Privacy Policy

Last updated 14 October 2026

ClickForArt renders everything in your browser, so your photos and videos stay on your device unless you save a project to your account. The site sets no cookies, shows no ads and has no analytics that tell one visitor from another.

Who is responsible

World Wyss Web, Mitteldorf 5e, 5637 Beinwil, Switzerland, is responsible for the processing described here, as the controller under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). Send questions and requests to [email protected].

What stays on your device

Files you open are read into the page and processed on your device, and your browser writes the export. Your sessions, saved sequences, track library and settings are kept in your browser's storage (IndexedDB and local storage), where we cannot see them. The site also keeps a copy of itself in your browser so it works offline. You can delete stored projects and media from the storage panel on the start page, or clear everything by deleting the site's data in your browser.

Visiting the site

The site runs on a server we rent from Hostinger International Ltd. (Cyprus), in a data centre in Phoenix, United States. To send you a page, the server receives your IP address and the usual details of the request, such as the address of the page and your browser's name. We use these only to deliver the site and keep it secure.

The app also tells our server when a tool page is opened and when a file is exported, with the tool and the file type and nothing else. The server adds these to daily totals per tool. It stores no IP address or other identifier, and nothing about your media. We use the totals to see which tools people use.

Your account

The studio needs an account. You sign up with your email address and a password, or sign in with a link we email you. With your account we keep your email address, your password in hashed form, your plan and its status, when the paid period ends, your customer number at Stripe, how many exports you made this month, and any projects you choose to save to the server, including the media in them. Supabase also records when you sign in and from which IP address, to keep accounts secure. When you are signed in, your browser keeps a sign-in token in local storage so you stay signed in.

Supabase Inc. (United States) hosts this data for us in its Zurich, Switzerland region, and sends the sign-in emails. We use the data to provide the account and plan you signed up for (GDPR Art. 6(1)(b)). We keep it until you ask us to delete your account. Write to [email protected] from the account's email address and we delete the account and its stored projects within 30 days. Payment records are kept longer, as described below.

Payment

Payments go through Stripe. You enter your card details on Stripe's own checkout page, and they never reach our server. We give Stripe your email address and your account's ID so it can create a customer record, and Stripe tells us your plan, the subscription's status and when the paid period ends. Stripe Payments Europe, Ltd. (Ireland) processes the payment, together with Stripe, Inc. in the United States. Stripe is responsible on its own for some of its processing, such as fraud prevention, and its checkout page uses its own cookies. See Stripe's privacy policy.

We use this data to take payment for your plan (GDPR Art. 6(1)(b)) and to keep the business records Swiss law requires (GDPR Art. 6(1)(c)). Those records, including invoices, are kept for 10 years.

Feedback

The feedback form sends your message, your email address if you give one, the screen you were on, your browser and screen size, and the effects you had on. A report sent from the crash screen also carries the error and where in the code it happened, which can include a file name. The form goes through Web3Forms, a form service that emails it to us. We use it to answer you and fix problems (GDPR Art. 6(1)(f)), and delete it once we no longer need it for that.

Who else receives data

Only the providers named above: Hostinger for hosting, Supabase for accounts and stored projects, Stripe for payments and Web3Forms for feedback. We do not sell personal data, share it for advertising or make automated decisions about you. We disclose data to authorities only where the law requires it.

Data outside Switzerland and the EU

Some of these providers process data in other countries, in particular the United States, where our server also runs. Where a country does not have data protection that Switzerland and the EU recognise as adequate, we rely on the provider's certification under the Swiss-US and EU-US Data Privacy Framework or on the EU standard contractual clauses, with the changes Swiss law requires.

Your rights

You can ask what data we have about you and get a copy of it. You can have it corrected or deleted, limit or object to how we use it, and withdraw any consent you gave. Write to [email protected]. We may ask you to confirm it is you. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the EU, to the data protection authority where you live.

Changes

We update this page when what we do with data changes. The date at the top shows the last change.