Last updated: 1 November 2026
This policy explains what personal data SVG Variants collects, why, who receives it, how long we keep it and how you can control it. It covers the website svgvariants.com and the app app.svgvariants.com.
In short:
- We collect what we need to run your account, your projects and your purchases.
- We do not sell your data.
- Our website and app use no analytics, no advertising and no tracking pixels.
- Packs are paid in cryptocurrency through our payment processor. We have no access to your wallet.
Who is responsible for your data
SVG Variants is responsible for your personal data (the "controller"): it decides why and how your data is used.
For any question or request about your data, write to contact@svgvariants.com.
What we collect
Your account
When you sign up, we store:
- your e-mail address;
- your first and last name only if you gave them when you signed up (the sign-up form no longer asks for them);
- your username;
- your password, stored only as a hash (PBKDF2), so we cannot read it;
- your credit balance;
- one sign-in token, valid 7 days, so that you stay signed in;
- the date and the version of the terms you accepted;
- whether your e-mail address is verified, and the date it was verified;
- the dates your account was created and last changed;
- if we unlock paid features for you as a tester: your e-mail address, in our server settings.
E-mail codes
To check that your e-mail address is yours, we send a 6-digit code to it when you sign up. We send a new one if you ask for it, or if you sign in before you have entered it. When you forget your password, we send a code to change it. We also send two short notices: when someone tries to sign up with the address of an existing account, and after your password is changed.
- We store each code only as a hash, never in readable form.
- A code expires after 30 minutes and stops working after 5 wrong attempts.
- To stop code guessing, we count wrong codes for each account. After 10 wrong codes in 24 hours, no new code is sent or accepted for that account until the 24 hours are over. This count is stored with the code and deleted with it.
- A new code replaces the previous one. A code that has been used is deleted. A code that is never used is deleted automatically about one day after it expires.
- Our account e-mails contain no images and no links from us. Brevo, which sends them, records delivery events (for example delivered or bounced) and, depending on its settings, whether an e-mail was opened. We do not use this information for marketing.
If you sign up but never enter your code, a new sign-up with the same e-mail address or the same username replaces that unverified account.
When you sign up, we also check the part of your address after the @. We refuse temporary (disposable) e-mail addresses, using a public list, and domains that cannot receive e-mail. For this check, our server looks up that domain in the public DNS. Your full address is not sent.
Your projects and files
- the SVG files you upload, exactly as you uploaded them;
- the recipe you build: colour palettes, variant sets, background and other settings;
- the files we generate for you: SVG, PNG and JSON files, and thumbnails;
- the collection name and description you type;
- your generation history.
An SVG file can contain information written by your design tool, for example an author name or file paths from your computer. We keep the file as you uploaded it. If you do not want us to store this information, remove it from the file before you upload it.
Your purchases and credits
- for each purchase: the pack, the credits, how long the credits are valid, the amount in euros, the cryptocurrency you chose and the amount in that cryptocurrency, the status, the dates and a payment reference;
- the date and the version of the terms you accepted when you ticked the box before paying;
- your credit history: credits added, spent and returned;
- your download rights for the files you generated;
- if you ask for a refund: your e-mails about it and the cryptocurrency address you give us to receive it.
Packs are paid in cryptocurrency. The payments are processed by our payment processor, currently NOWPayments. To open a payment, we send it the price of the pack in euros, the cryptocurrency you chose, an internal payment reference that contains your internal account id, the pack name and the number of credits. We do not send it your e-mail address or your name. NOWPayments gives us the payment address, the amount to pay and then the status of the payment. It also receives the details of your payment transaction (for example the amount, the addresses used and the date) and uses them under its own privacy policy.
A cryptocurrency payment is recorded on a public blockchain: anyone can see the amount, the addresses used and the date. This is how these networks work; such a record cannot be deleted, by us or by anyone else.
Notify me when packs go on sale
You can ask to be notified when packs go on sale, with the form on svgvariants.com or, when you are signed in, in the app. We store your e-mail address (in the app, the e-mail address of your account) and, with the form, your message if you write one. We do not keep your IP address with your request (it only appears for a short time in the technical logs described below). We use your e-mail address only to tell you when packs go on sale.
Requests for studio access sent with the form on svgenic.com before 27 October 2026 are kept only to answer them.
Technical logs
Our web servers keep logs of the requests they receive: IP address, date and time, the address requested, the page you came from (referrer) and your browser's user agent. We use them for security and to fix problems. They are deleted automatically by log rotation.
To stop password guessing and spam, we count failed sign-in attempts, access-code attempts, requests for e-mail codes and code attempts (per account and per IP address) and requests sent with the form on svgvariants.com. These counters are kept in memory only. They are not written to disk and disappear when the server restarts. The only exception is the count of wrong e-mail codes for each account (see E-mail codes), which is stored with the code.
We also count, for each paid feature, the generations refused because they need it. A feature is counted at most once per account and per day: to do this, the server keeps the account id in memory for the day only, never writes it, and forgets it at the end of the day or on restart. The saved counts contain no account id, no e-mail address and no other personal data.
What we do not collect
- No analytics, no advertising, no tracking pixels on our website or in the app.
- No card data, and no access to your wallet.
- The notifications we receive about new sign-ups and payments contain no personal data.
- Fonts are hosted on our own server: browsing our pages sends no request to Google or any other third party.
What we keep in your browser is described in Cookies and browser storage.
Why we use it, and for how long
| Data | What we use it for | Legal basis | How long |
|---|---|---|---|
| Account data | Create your account, sign you in, keep your credit balance, answer your requests, record the terms you accepted, unlock paid features for testers | Contract | While your account is open, then deleted without undue delay after it is closed |
| E-mail address and e-mail codes | Check that your e-mail address is yours before your account is activated, and let you change a forgotten password | Contract | A code expires after 30 minutes; it is deleted once used or replaced, and an unused code about one day after it expires; the verification date is kept as the account data |
| Account data and credit history | Prevent abuse, for example several accounts used to collect free credits | Legitimate interest: security and abuse prevention | As for the account data |
| Projects and files | Import, preview, generate, store and deliver your files | Contract | At most while your account is open, then deleted without undue delay after it is closed |
| Projects and files | Improve the service, for example fix import or rendering problems | Legitimate interest: a service that works well | As for the projects and files |
| Purchases, credit history, download rights and refund requests | Add your credits, handle refunds, keep invoices and accounting records, record the box you ticked before paying, decide whether your account can generate paid features and receive the bonus credits | Contract and legal obligation | As long as the law requires, up to 10 years |
| E-mail and message of a request to be notified | Tell you when packs go on sale; for earlier requests for studio access, answer them | Consent | Until we have told you that packs are on sale or answered your request, or sooner if you ask |
| Technical logs | Security and troubleshooting | Legitimate interest: security | Deleted automatically by log rotation |
| Attempt counters | Block password guessing, code guessing and spam | Legitimate interest: security | In memory only, lost when the server restarts; the count of wrong e-mail codes is stored with the code and deleted with it |
| Browser storage and the access-code cookie | Keep you signed in, remember your settings and, when the app asks for one, the access code | Strictly necessary for the service you ask for | See Cookies and browser storage |
Who receives your data
- Hetzner Online GmbH (Germany) hosts our servers, and the data stored on them, in the European Union.
- NOWPayments, our payment processor, processes your cryptocurrency payments. It receives the payment data described in Your purchases and credits.
- Brevo (Sendinblue SAS, France) sends our account e-mails: e-mail verification codes, password codes and the two account notices. It receives your e-mail address and the content of the e-mail (with the code), and processes them on our behalf, as our processor. Brevo keeps a log of the e-mails it sends (address, subject, date) for a limited time under its own retention rules; a code stops working after 30 minutes.
- Our e-mail provider carries your messages when you write to us, and our replies.
We do not sell or rent your data, and we do not share it with advertisers.
Transfers outside the European Union
Your data is stored on Hetzner servers in the European Union.
When you buy a pack, the data needed for the payment goes to NOWPayments, which may process it outside the European Union. This transfer is needed to carry out the purchase you ask for. A payment recorded on a public blockchain can be seen from anywhere.
How long we keep your data
- Account data: while your account is open, then deleted without undue delay after it is closed.
- Projects and generated files: at most while your account is open. They may be deleted earlier, for example when an account is inactive. Keep your own copy of your files.
- Payment and credit records: as long as the law requires, up to 10 years, even after your account is closed.
- E-mail and message of a request to be notified: until we have told you that packs are on sale (or, for an earlier request for studio access, answered it), or sooner if you ask us to delete them.
- E-mail codes: a used or replaced code is deleted at once; an unused code is deleted automatically about one day after it expires.
- Technical logs: deleted automatically by log rotation.
You can close your account at any time by writing to contact@svgvariants.com. There is no button for this in the app yet.
How we protect your data
- Passwords are stored only as salted hashes (PBKDF2), not in readable form.
- All traffic to svgvariants.com and app.svgvariants.com is encrypted with HTTPS.
- Access to the servers is restricted, and the database cannot be reached from the internet.
- Every imported file is cleaned automatically: scripts, external links and embedded HTML are removed, and unsafe or oversized files are rejected.
- Verification and password codes are stored only as hashes, expire after 30 minutes and stop working after 5 wrong attempts; after 10 wrong codes in 24 hours, codes are paused for that account.
- To activate an account, you need both the code sent to its e-mail address and its password.
- Sign-in attempts, access-code attempts, code attempts and requests for e-mail codes are limited.
Cookies and browser storage
svgvariants.com sets no cookies and stores nothing in your browser.
The app at app.svgvariants.com keeps the items below in your browser. All of them are strictly necessary for the service you ask for, so no consent is needed. None of them is used for analytics, advertising or tracking.
| Name | Type | What it does | How long |
|---|---|---|---|
auth_token | Local storage | Keeps you signed in | Valid 7 days, removed when you sign out |
theme | Local storage | Remembers the light, dark or system theme | Until you change it or clear your browser data |
svgenic.… | Local storage | Remembers display preferences for each project (stage background, preview size, colours shown in the layer view, last pixel art setting) and the reserve of generated colours of each project | Until you clear your browser data |
svgenic_gate | Cookie | Set only when the app asks for an access code: remembers that you entered it. It has the same value for everyone and identifies no one. | 30 days |
You can delete these items at any time in your browser settings. You will then need to sign in again, and to enter the access code again if the app asks for one.
Your rights
You can ask us to:
- give you a copy of your data (access);
- correct it (rectification);
- delete it (erasure);
- stop a use based on our legitimate interest (objection);
- pause a use while a question is settled (restriction);
- send you the data you gave us in a common, machine-readable format (portability).
You can also withdraw your consent to a request to be notified at any time: we then delete your e-mail address and message.
To use your rights, write to contact@svgvariants.com from the e-mail address of your account, so we know the request comes from you. We answer within the time limits set by law.
Payment and credit records that the law requires us to keep cannot be deleted before the end of that period.
Complaints
If you think we do not respect your rights, please write to us first. You can also complain to the data protection authority of your country of residence.
Automated decisions
We make no automated decisions about you that have a legal effect. The only automatic checks are the check of your e-mail address at sign-up (temporary addresses and domains that cannot receive e-mail are refused), the file check at upload (a file that is unsafe or too large is rejected), the check that a generation uses only the features of your account (a generation that needs a paid feature your account does not have is refused before any credit is taken) and the limits on sign-in attempts, access-code attempts, requests for e-mail codes and requests sent with the form on svgvariants.com.
Children
SVG Variants is not for people under 18, or under the age of majority in their country. If you think a child has given us personal data, write to us.
Changes to this policy
We may update this policy, for example when the service or the law changes. The date at the top shows the last update.