Privacy Policy

Lilac Drawer is run by Lilac Drawer (operated by Safa Laith). For the EU and UK GDPR, we are the "controller" of your personal data.

We can be contacted by email only. Questions or requests about your privacy: lilacdraweres@gmail.com.

When you create an account:

• your name, username, email address and password (the password is stored only as a secure hash);
• anything you add to your profile: bio, profile photo and cover photo.

When you use the community:

• posts, comments, photos and fashion collages you share, and products or articles you attach;
• likes, reactions, reposts, who you follow and who follows you;
• accounts you block and reports you send about posts, comments or profiles;
• notifications we create for you (for example when someone replies to you).

When you sign in:

• a session record with the date, your IP address and your browser's user agent, used to keep you signed in and to protect your account. Sessions expire after 30 days.

If you choose to:

• your email address when you subscribe to our newsletter;
• a push subscription (a technical address provided by your browser) when you turn on device notifications.

Automatically, for every visitor:

• the address of each page viewed and the time, to count visits. We do not store your IP address, browser or any identifier with these counts, and we don't use them to track you.
• clicks on links to stores: we count them as daily totals per product, store and type of page (for example "article" or "recommendation"), to learn which products and recommendations readers find useful. We don't store your IP address, account or any identifier with these counts. To ignore repeated clicks, your browser remembers recent clicks for the current session only, and our server briefly keeps a scrambled (hashed), non-reversible code in memory that is never saved.
• standard server logs kept for security and troubleshooting. They are kept for a limited time and then deleted.

We don't collect payment details: purchases happen on the retailers' own websites. We don't knowingly collect sensitive data (such as health or religious beliefs); please don't post it.

• To run your account and the community (show your posts, deliver notifications, let you follow and block people). Legal basis: performing our contract with you (the Terms of Service).
• To keep the site safe: preventing spam and abuse, reviewing reports, securing accounts. Legal basis: our legitimate interest in a safe service, and in some cases legal obligations.
• To send the newsletter and push notifications you asked for. Legal basis: your consent, which you can withdraw at any time.
• To understand which pages are popular (anonymous visit counts). Legal basis: our legitimate interest in improving the site.

We do not sell your personal data, and we don't use it for targeted advertising.

Your name, username, profile and cover photos, bio, posts, comments, reposts, likes on posts, collages and your followers/following lists can be seen by anyone, including people without an account and search engines. Your email address, password, blocks, reports and notifications are never shown to other users.

We only share personal data with service providers who help us run the site, under contracts that protect it:

• website, database and image hosting, and server backups: Hetzner Online GmbH (Germany);
• email delivery for the newsletter: Resend (resend.com);
• your browser's push service (Google, Apple or Mozilla) when you turn on device notifications.

We may also disclose data if the law requires it, to protect people's safety, or as part of a sale or transfer of the site (you would be told first).

Many product links on Lilac Drawer are affiliate links (see our Affiliate Disclosure). We don't pass your personal data to retailers. When you click a link and visit a retailer such as Amazon, that retailer may set its own cookies to record that you came from us. Their privacy policies apply on their websites.

We only use what's needed for the site to work:

• Sign-in cookies (set by our login system, Better Auth) that keep you signed in. They are strictly necessary and are removed when you sign out or your session expires.
• Browser storage (local storage) that remembers things you did on this device: that you subscribed to the newsletter (so we stop asking), your fashion collage drafts and uploaded collage photos, and, for the current browser session only, which store links you just clicked (so a repeated click isn't counted twice). It stays on your device and you can clear it in your browser settings.

We don't use analytics, advertising or tracking cookies, so we don't show a cookie banner. If that changes, we will ask for your consent first and update this policy.

• Account and community content: until you delete it or delete your account.
• Sign-in sessions: 30 days, or until you sign out.
• Newsletter: until you unsubscribe or delete your account.
• Reports about content: up to 2 years, so repeat abuse can be recognised. A report you sent is deleted with your account.
• Backups: deleted data can remain in backups for up to 30 days before it is overwritten.

You can delete your account at any time in Edit Profile → Account → Delete my account. This permanently deletes your profile and photos, posts, reposts, comments (and replies to them), likes, reactions, follows, blocks, notifications, reports you sent and your newsletter signup, and signs you out. If you can't sign in, email us at lilacdraweres@gmail.com from the address on your account.

Depending on where you live, you have the right to:

• access the personal data we hold about you and get a copy of it;
• correct it (you can edit most of it yourself in your profile settings);
• delete it;
• object to, or ask us to restrict, how we use it;
• receive it in a portable format;
• withdraw consent (for the newsletter or push notifications) at any time.

To use any of these rights, email lilacdraweres@gmail.com. We reply within one month (30 days), may ask you to confirm your identity, and never charge for reasonable requests.

Complaints. You can also complain to your data protection authority:

• EU: the supervisory authority in your country;
• UK: the Information Commissioner's Office (ico.org.uk);
• Canada: the Office of the Privacy Commissioner of Canada (priv.gc.ca);
• Australia: the Office of the Australian Information Commissioner (oaic.gov.au).

California and other US states. You have the right to know what we collect, to delete it, to correct it and not to be treated differently for using these rights. We do not sell or "share" personal information for cross-context behavioural advertising.

Our website, database, uploaded images and backups are hosted in Germany. Some of our other service providers, such as our email delivery provider and your browser's push service, may store data outside your country, including in the United States. Where data leaves the EU, UK or Canada, we rely on safeguards such as the European Commission's Standard Contractual Clauses or the provider's certification under the EU-US Data Privacy Framework.

We use HTTPS everywhere, store passwords only as secure hashes, limit login attempts and restrict who can access the database. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

Lilac Drawer is not meant for children. You must be at least 16 to create an account, wherever you live. If we learn we have data from someone under 16, we delete it. Parents can contact us at lilacdraweres@gmail.com.

We will update this page when our practices change and change the date at the top. If the changes are important, we will also tell members by email or on the site.

Email lilacdraweres@gmail.com with any question about this policy or your data.