What The Neverending Painting is
The Neverending Painting is one shared, ever-deepening artwork. You can explore it without an account. Signing in exists for one reason: to credit you when you discover a place no one has seen before.
What we collect, and why
- Account basics. When you sign in with Google we receive your email address and a Google account identifier. We use them to sign you in and to tell your account apart from others. We never post with your email or show it to other visitors.
- Your explorer name. A public pseudonym shown on your discoveries. It is generated for you and you can change it; it does not need to be your real name.
- Discovery history. Which areas of the painting you revealed and when. This is the product: discoveries are credited to your explorer name and remain part of the painting's history.
- Abuse-prevention signals. At signup we record your IP address and a hash of a random device identifier. They are used only to slow down bulk account creation that would drain the painting's shared daily budget. They are kept while your account exists and are removed when your account is deleted.
Cookies & Analytics
We use functional session cookies and privacy-preserving, aggregated analytics:
tnp_access and tnp_refresh — keep you signed in. HttpOnly session cookies.tnp_oauth_state — protects the Google sign-in round trip; deleted as soon as sign-in completes.tnp_device — a random identifier used as an abuse-prevention signal (see above). Not used for tracking.
We use aggregated analytics to understand general visitor volume and feature popularity. No personal advertising profiles are created, and we never sell browsing data to third parties.
What we share
- Payment processor (Xsolla). When you make a purchase, our online reseller and Merchant of Record, Xsolla (xsolla.com), processes billing and transaction information in accordance with Xsolla's privacy policy. We do not receive or store your credit card or payment instrument numbers on our servers.
- Image-generation providers. When new detail is painted, the providers receive image data (pixels, masks, and art direction) — never your name, email, IP address, or any other personal information.
- Google. Sign-in uses Google OAuth under Google's own privacy policy. We receive only the fields listed above.
- We do not sell personal data or share it with advertisers.
Deleting your account
You can delete your account yourself at any time from your profile page. The pixels and places you discovered stay in the shared painting — removing them would punch holes in an artwork other people also explored — but they are anonymized: your discoveries are re-attributed to “a former explorer”, and your email, explorer name, sign-in identities, IP address, and device identifier are removed. Deletion also signs you out everywhere immediately.
Operator information and contact
The Neverending Painting is operated by Ran Shaltiel. If this policy changes, the effective date above changes with it. For privacy questions, data requests, or inquiries, contact us at support@neverendingpainting.art.