Privacy

What is stored

• Paint Box: a scrambled form (SHA-256) of the box key, when it was made and last opened, and the palettes in it (name, colours, note). No name, email or account.
• Rate limits: a salted, one-way hash of your connection's address with a daily counter, deleted after two days.
• Server logs: the web server keeps standard access logs (address, page, time, browser) for security, rotated by the host.

Cookies

Two, both strictly necessary: __Host-rp_box holds your Paint Box key on this browser (only after you save a palette or open a box), and __Host-rp_csrf protects forms. No advertising or tracking cookies, no analytics services (on pages with the banner, the ad tag adds one to a daily page-view total), no outside fonts. The only outside service the pages load is the adengine.us banner described under Advertising.

Advertising

The home page, the tools (Pad, Contrast, Colour vision, Ramps, Export), Pricing and About show one banner ad below the page, labelled “Advertisement”. It comes from AdEngine (adengine.us), the small ad network run by WeldonPC, the company behind RiotPad. For now the ads are for WeldonPC’s own services. Your Paint Box, the swatch card, the terms, this page and error pages show no ad.

To show an ad, your browser loads a script from adengine.us, asks it for one banner, loads the banner image, and reports once that the page was viewed and once that the banner was shown. Like any website, adengine.us receives your connection’s address (IP address), your browser type and the address of this site with those requests. It never gets your palette: the requests name only this site and the banner size, and your browser tells adengine.us only that you came from riotpad.com, not the page address with your colours in it.

• No cookies, no profile. AdEngine sets no cookies, gives you no ID and does not track you from site to site.
• How your address is used. adengine.us looks up the approximate city for your IP address in a location database kept on its own server (nothing is sent to anyone else), so that ads meant for one area are shown only there. It also uses the address to count each ad view or click only once and to leave out robots and WeldonPC’s own office traffic. The address is not stored with the counts; the temporary entries made from it expire within six hours and are cleared from the server within two days.
• What is kept. Daily totals only: page views for RiotPad, and views and clicks for each ad. The adengine.us web server also keeps a standard access log (IP address, time, address requested, referring site, browser) for security; it is deleted on a rolling schedule.
• Clicking an ad passes through adengine.us, which counts the click, and then opens the advertiser’s site, which has its own privacy policy.
• Nothing about you is sold or shared.

Deleting

Delete a palette or the whole Paint Box from the box itself. Boxes not opened for two years (with no Riot Pass running) are deleted automatically.

Payments

When checkout opens, PayPal handles payment details; RiotPad will store only the subscription reference, plan and end date.

Questions

Questions about privacy, your Paint Box or the ads go to WeldonPC, the company behind RiotPad: Contact WeldonPC. Please do not send a Paint Box link: anyone with it can open the box.