ArtAttack is a personal project, not a company. It’s run by the Mabray family and a small volunteer team. Nobody here is making money off your data, and there is no plan to sell it, rent it, or hand it to advertisers. If that ever changes, you'll get notice before it happens, not after.
This policy covers the artattack.art website and the ArtAttack Discord server. It's written in plain English on purpose. If something here is unclear, email piko@artattack.art and ask.
You have to be 13 or older
ArtAttack is not for kids under 13. Don't make an account if you're under 13, and don't let a younger sibling use yours.
If we find out someone under 13 has an account, we delete the account and everything on it. If you're a parent and you think your under-13 kid has an account here, email piko@artattack.art
and we'll remove it, usually within a few days.
If you're 13 to 17, you can use ArtAttack, but you should tell a parent or guardian you're here. Some of the people on this platform are adults.
What we collect
When you make an account:
- A username you pick
- An email address
- A password (stored scrambled, we can't read it)
- Anything optional you choose to add, like a bio, avatar, or links
When you use the site:
- Art, comments, posts, and messages you submit
- Basic technical logs: IP address, browser type, timestamps. These come with running any website and are used for security and abuse investigation.
If you link Discord:
- Your Discord username and user ID, so your account and your Discord identity connect
When you report someone or get reported:
- The report, what was reported, and what the moderators did about it. We keep these.
What we don't collect
We don't ask for your real name, home address, phone number, school, or workplace. Don't send those to us. Don't put them in your profile either.
There are no ads on ArtAttack and no advertising trackers. No Facebook pixel, no ad networks, no data brokers.
We don't take payments, so we never see card or bank information.
What's public
Assume anything you post is public. Your username, profile, art, comments, and activity are visible to anyone who can reach the site or the server, including people who aren't logged in and search engines.
Your email address is not public. Moderators don't get to see it. Only @pmabray and any admin who needs it for a security or safety issue can.
Direct messages on Discord are between you and the other person. We can't read them. That means if something bad is happening in a DM, we can't see it, and we need you to report it with screenshots.
Who else touches your data
We use a few outside services to run this thing. They see some of your data because they have to.
- Vercel & Supabase hosts the website and database
- Cloudflare handles traffic, DNS, and blocks attacks
- Discord runs the server and everything on it, under their own privacy policy
- Supabase sends account emails like password resets
We don't send your data anywhere else. If we add a service, this list gets updated.
How long we keep things
Your account and posts stay up until you delete them or delete your account.
Technical logs get cleared after about 90 days.
Moderation records stick around longer, including after a ban. That's on purpose. If someone gets banned for harassing a minor, we need to remember that when they return under a new username.
Deleting your stuff
You can edit or delete your own posts anytime.
To delete your whole account, use the delete option in your settings or email piko@artattack.art from the address on the account. We'll remove your account, profile, and posts within 30 days.
Two honest caveats. Comments other people made on your work may stay up with your name removed, so their conversations don't get shredded. And if someone screenshotted or reposted your art elsewhere, we can't reach it.
If you were banned, deleting your account doesn't erase the ban record.
Your rights
Depending on where you live, you may have a legal right to see what data we hold about you, correct it, delete it, or get a copy. That includes people in California, the EU, and the UK.
You don't need to cite a law. Email piko@artattack.art and ask. We'll do it. We're a small project, so give us a couple of weeks.
We will never charge you or make you jump through hoops for this, and we won't treat you differently for asking.
Security, honestly
We use standard protections: encrypted connections, hashed passwords, limited access to the admin side.
But this is a volunteer-run project, not a bank. We can't promise your data will never be exposed. Don't reuse a password here that you use anywhere important. If we ever have a breach, we'll tell you what happened and what to do about it, in public, quickly.
Changes
If we change this policy in a way that matters, we'll post a notice on the site and in the Discord before it takes effect. The date at the top always tells you the current version.
Contact
That inbox is monitored by ArtAttack. For safety issues that can't wait, use the report system in Discord.