1. Who is responsible
The data controller is the operator of rect360, reachable at support@rect360.com. Identification details are provided on request to anyone exercising the rights in section 9, and to any supervisory authority that asks.
2. What is collected
If you buy a plot: your email address, a bcrypt hash of the generated password, the IP address the purchase came from, and the payment reference returned by Creem. Card details are never collected — they are handled by Creem and never reach rect360. A checkout you start and never finish leaves the same order record — address, plot, amount, IP — simply marked as expired.
About your account: the date the plot became yours, the time you last signed in, and the IP address that sign-in came from. Only the most recent sign-in is kept; no history of your sign-ins is derived or stored.
What you put on your plot: the image, the message, the outbound link, the music selection and any reward you configure.
If you write in the chat: the message text and the IP address it came from. While you are signed in, the name published beside the message is your email address; with the anonymous switch on it is a nickname derived from that address instead, and the address itself is not shown.
If you win a reward: which plot it came from, what it was, the claim code, and who won it — your email address if you were signed in, otherwise the temporary nickname the chat gave you. When you claim it, the address you claim with is stored alongside and shown to that plot's owner, who needs it to deliver the reward.
If you simply visit: your IP address is held in the clear only briefly, for rate limiting, and is deleted within a day. For the visitor counter neither your address nor your browser details are ever recorded in the clear: what is stored is a one-way hash of them, made with a secret key and not reversible. That hash is kept indefinitely, because the wall's all-time visitor total is simply the number of those records — deleting them would corrupt the counter retroactively. A separate one-way hash is kept so the site can remember which country an address is in and pick a language; that one is deleted automatically after 30 days.
No analytics, advertising or tracking service is used. There is no third-party tracker on the site.
3. Why, and on what basis
To perform the contract — creating your account, assigning the plot, emailing your password, showing your content on the wall, sending reward claim codes.
Legitimate interests — rate limiting and abuse prevention, keeping the service running, and moderating content that breaks the Terms. These uses are kept to what is necessary and never used to profile you.
Legal obligation — keeping the records a tax or consumer authority may require.
Your data is never sold, rented or shared for advertising. Nobody buys a list from us because there is none to buy.
4. Cookies and browser storage
The PHP session cookie keeps you signed in and carries the anti-forgery token. It is strictly necessary for the site to work, is not used for tracking, and is removed when you sign out.
Two more cookies are set, holding one word each: that you have finished the guided tour of the wall, and that you have finished the tour of the dashboard. They exist so the tour does not start over on your next visit. They last a year, are read only by this site, and identify nobody.
Your preferences are kept in your own browser and never sent anywhere: light or dark theme, whether interface sounds are on, where you dragged the chat tab, whether you post in the chat anonymously, which chat message you last read, and which one-off notices you have already been shown. Clearing your browser data removes them.
There is no advertising or analytics cookie, which is why there is no cookie banner asking for consent.
5. Who else processes your data
Creem — payment processing, as merchant of record. Receives your email address and payment details. Their privacy policy.
Resend — sends the account and reward emails. Receives your email address and the message content.
Railway — hosting. The application and database run on their infrastructure.
ip-api.com — used once per unfamiliar address to learn which country it is in, so the site can choose a language. It receives the IP address and nothing else.
Giphy — only if you search for a GIF in the chat. The search itself goes through our own server so Giphy does not see who is searching; the GIF image is then loaded by your browser from Giphy.
YouTube (Google) — plot music is played through YouTube. The empty player is prepared as soon as you first touch the wall, so that a plot with music starts playing straight away rather than in silence; from that moment your browser is in contact with YouTube directly, and their terms and cookies apply. No video is ever shown and nothing plays until you open a plot that carries music.
Google Fonts and cdnjs — the typeface and the icon set are loaded from these addresses, which means your browser reveals its IP address to them when a page loads.
Two things of yours can also be seen by people rather than by companies, and both are described in section 2: a chat message you send while signed in carries your email address as its name, and a reward you claim hands your address to that plot's owner. Nothing else you give us is shown to anyone.
6. Where your data goes
The processors listed above operate outside Türkiye, including in the United States and the European Union, so your data is transferred abroad when they process it. Each is a professional provider with its own published data-protection terms and standard contractual safeguards.
7. How long it is kept
Your account and plot content — for as long as you own the plot. If you ask for deletion, the content is removed and the plot is returned to the wall.
Your join date, last sign-in time and last sign-in address — with your account, that is, for as long as you own the plot. They are deleted when the account is.
Chat messages — the chat holds the last 2,000 messages; as new ones arrive, older ones are deleted automatically. A message also goes earlier than that if it breaks the Terms or if you ask for it to be removed.
Reward wins and claims — for as long as the wall runs. They are the plot owner's delivery list and the only record of who won what if a claim is ever disputed.
Order records on our side — the address, plot, amount and IP behind a purchase, and behind a checkout that was never completed, for as long as tax and consumer law requires them.
Rate-limit records — a day at most, then discarded automatically. The same for failed sign-in attempts.
Country-lookup hashes — 30 days, then deleted automatically.
Visitor-counter hashes — indefinitely; the all-time visitor total is nothing more than the number of them, so deleting one would rewrite it (section 2).
Payment and invoice records — kept by Creem for the period their own obligations require.
8. How it is protected
Traffic is served over HTTPS. Passwords are stored only as bcrypt hashes. Chat messages are encrypted at rest with AES-256-GCM. Uploaded images are re-encoded server-side, which strips anything hidden inside the file. Every write endpoint is protected against cross-site request forgery and rate-limited by address.
No system is perfect and this one is run by a single person. If you find a security problem, report it to support@rect360.com and it will be taken seriously.
9. Your rights
You may ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, object to processing based on legitimate interests, or ask for a machine-readable export. Write to support@rect360.com; requests are answered within 30 days.
If you are in Türkiye you may complain to the Personal Data Protection Authority (KVKK). If you are in the EU or the UK you may complain to your local supervisory authority.
10. Children
rect360 is not for children. Buying a plot requires you to be 18 or older, and the service is not directed at children. If you believe a child has given us personal data, write to support@rect360.com and it will be deleted.
11. Changes to this policy
This page is the current version, and its date is at the top. A change that materially affects how your data is used will be announced by email to plot owners.
12. Contact
support@rect360.com — for any question about this policy or any request concerning your data.