Shadow of Reality Privacy Policy

Last updated: 19 September 2026

This policy explains what data the Shadow of Reality app and the shadowofreality.fun website collect, why we need it, where it’s stored, who can see it and how to delete it.

In short

No ads.
No analytics or tracking in the app, and no third-party SDKs for that.
No cookies on the website.
We don’t sell your data or share it for marketing.
You can delete your account and all your data right in the app.

Who we are

Shadow of Reality is a project run by its developer in Ukraine. For any question about your data, email support@shadowofreality.fun.

We follow the Law of Ukraine “On Personal Data Protection” and, for users in the EU, the principles of the EU General Data Protection Regulation (GDPR).

The only way to sign in is with Google. From Google we receive:

your Google account ID;
your email address;
your account name, used only as your initial display name. You can change it.

We never see your Google password and get no access to your Google services: the app asks only for your basic profile and email address.

You can also sign in without Google — with a code sent to your email. We then get only the address you typed and send a one-time 6-digit code to it from noreply@shadowofreality.fun. We never store the code itself — only its hash, which lives for 10 minutes. If an account with that address already exists (including one created with Google), you sign in to that account.

What data we store

Account: your Google account ID, email address, display name and unique nickname, plus an optional bio and an optional avatar that you upload yourself. We also store when you registered and when you confirmed you are 18+ and accepted the Terms.
Sign-in codes: for email sign-in — the address, the code’s hash and when it was created and used. These records become useless after 10 minutes.
Your content: the images you generate or upload, their descriptions, prompts and style, the 18+ mark and the “Hide the prompt from others” setting. We don’t keep uploaded files as they are: the image is re-encoded and its metadata (including EXIF and location) is dropped. We only read the generator’s prompt from it, if there is one.
Activity: likes, comments, follows, blocks, reports, “Not interested” marks, in-app notifications, and which art you have already viewed. We use the last one to build your feed and avoid showing you the same thing twice.
Settings: “Show 18+ content”, “Public likes” and your remaining daily generation attempts.
Technical data: our web server (nginx) keeps access logs with IP addresses and request details. We need them for security and troubleshooting. They are kept for up to 14 days and then deleted automatically.
Device language: the app sends it in the Accept-Language header so that we can show messages in your language.

Why we use your data, and on what legal basis

To run the service (performance of a contract). Sign-in, your profile, generating and publishing art, the feed, comments, follows, notifications, generation limits and message language. We use your viewing history to pick art for your feed and avoid repeats.
Your consent. Showing 18+ art and making your likes public. Both settings stay off until you turn them on, and you can turn them off at any time.
Legitimate interest. Security, preventing abuse and moderation: server logs, the safety filter for prompts, reports and blocks.

Where your data is processed

Servers: Hetzner Online GmbH, in a data center in Helsinki, Finland (EU). The database and all images are stored there.
Image generation: on our own hardware in Ukraine. Prompts and generated images are processed there and are not sent to third-party AI services.
Sign-in: Google (Google Sign-In).
Email: if you write to us at support@shadowofreality.fun, your message is stored on the mail server of our hosting provider (ukraine.com.ua).

For users in the EU: the prompt and the generated image are transferred to Ukraine, where our hardware runs. This is necessary to carry out your generation request (Art. 49(1)(b) GDPR). All other data stays in the EU.

Who can see what

Everyone in the app can see your published art, nickname, name, bio, avatar and follower and following counts.
Website visitors and search engines. Published art without the 18+ mark and public profile pages may also appear on the website, for example through shared links like shadowofreality.fun/a/… or shadowofreality.fun/@nickname, and may be indexed by search engines.
Our social media. Published art without the 18+ mark may appear on Shadow of Reality’s official social media accounts, credited with the creator’s nickname. How to opt out is explained in the Terms.
18+ art never appears on the website or on our social media. In the app, only people who have turned on “Show 18+ content” can see it.
Private art is visible only to you.
Your “Liked” list stays private unless you turn on “Public likes”.
The prompt of anything you publish can be hidden from others with the “Hide the prompt from others” setting.

How long we keep data

We keep your data for as long as your account exists.
You can delete individual art or comments at any time.
When you delete your account in the app (Settings → Delete account), the account and everything linked to it are deleted immediately: your art and its files, avatar, comments, likes, follows, blocks, reports, notifications and generation history.
We back up the database every night and keep each backup for 14 days, so your data is gone from backups within 14 days of deletion.
Web server logs are kept for up to 14 days.
Search engines may show cached copies of public pages for a while after deletion. That’s outside our control, but those copies disappear once the search engine sees the page is gone.
If you can’t get into the app, email us from the address linked to your account. We’ll delete your account within 30 days (usually much sooner) and confirm by email.

Step-by-step instructions are on the account and data deletion page.

Security

All connections use HTTPS.
In the app, images are served through signed links that expire after a limited time. Published art without the 18+ mark also has a permanent address on the website — that’s how it gets shared.
Access to our servers is restricted.

To be honest, though, no system is completely secure, so nobody can guarantee absolute security, and neither can we.

Your rights

You have the right to:

find out what data we hold about you and get a copy;
have inaccurate data corrected;
have your data deleted;
restrict or object to how we process it;
receive your data in a form you can take to another service (data portability);
withdraw your consent. To withdraw it completely, delete your account. For 18+ content and public likes, just turn the setting off.

You can do a lot of this right in the app: edit your profile, or delete art, comments or your whole account. To get a copy of your data, correct it or ask anything else, email support@shadowofreality.fun. It’s best to write from the address linked to your account, so we can be sure it’s really you. We reply within 30 days. A copy of your data comes as JSON together with your image files.

If you believe we are violating your rights, you can complain to the Ukrainian Parliament Commissioner for Human Rights. If you live in the EU, you can contact your local data protection authority. We’d appreciate it if you wrote to us first, as we may be able to sort it out faster.

Age

Shadow of Reality is only for people aged 18 and over, and you confirm this when you sign up. If you know that someone under 18 is using the app, please let us know.

Changes to this policy

When this policy changes, we update the date at the top of this page. We’ll let you know about material changes in the app.

Contact

Send any questions about your data and privacy to support@shadowofreality.fun. The rules for using the service are in our Terms of Use.