Privacy

What NoZLan stores about you, why, and for how long. In plain words.

Who we are

NoZLan is a cosplay and convention photography website from the Netherlands and Belgium. It is run by Sven van de Walle (Lokeren, Belgium), who is responsible for your data. For privacy questions and requests, use Contact us.

If you just visit

• Visitor statistics, only if you say yes. When you first visit, we ask whether we may use Google Analytics to count visitors and see which pages are read. Only if you choose Accept does your browser load it. It then sets cookies from Google (_ga, _ga_…) and sends Google the page you view, roughly where you are (country or city, not your exact address), your device and browser, and where you came from. We only send the page itself, never the part of the address after a ?, so private links and sign-in codes never reach Google. We use this only for statistics, not for advertising, and we don't let Google use it for ads. If you choose No thanks, nothing is loaded and no cookies are set. You can change your mind any time with Cookie settings at the bottom of every page.
• We use no advertising and no other tracking.
• Your choice about statistics is remembered in your own browser, so we don't ask again on every page.
• If you open an age-restricted gallery, a cookie remembers that choice for 30 days.
• Our server keeps standard technical logs (IP address, page, time) to keep the site running and secure.

If you have an account

• Account: your username, email address, password (stored only as a one-way hash that nobody can read back), your role, and when you signed up, agreed to the rules and last signed in.
• Sign-in security: for sign-in attempts we store the IP address and the name that was used, for 30 days, to stop people guessing passwords.
• A session cookie keeps you signed in. It is needed for the site to work.
• Your page: what you choose to fill in — display name, bio, links, pronouns, country, tags, profile picture, header image, cover photo, page style and watermark. Changes others can see are checked by a moderator before they go online.
• Reports: if you report someone, moderators can see that it was you, so they can spot misuse. The person you report never can.

Your photos

• What we keep: the photos you upload in three sizes (and a blurred version), your album titles, descriptions and captions, and — only if you choose it when uploading — your original file. We remove location data (GPS) and camera details from every photo.
• Who can see them: nobody but you and NoZLan moderators until a moderator has approved them. After that, who can see them depends on the album: everyone on NoZLan, only people with your private link, or only you. All member photos are delivered through links that stop working after a while, so a private photo can't be passed around by copying its address.
• Automatic check: before a moderator looks, our own server runs an open-source program that estimates whether a photo may contain nudity. It only decides the order in which moderators see photos; a person always makes the decision. Your photos never leave NoZLan's own server and storage for this.
• Photos that are rejected are deleted from storage right away. A note that a photo was rejected, and why, is kept for 30 days so you can see the reason.
• Butterflies, credits and "this is me": we store which photos you gave a butterfly (only the uploader sees how many a photo has, never from whom), credits you added or accepted, and archive photos you linked to your page.
• Staff picks: NoZLan staff may show a photo from a public album on the homepage. You can take it off at any time in your album.
• Storage: we count how much space your photos use, to apply your storage limit. Getting the newsletter gives you extra space; we check that by looking up your confirmed email address on the newsletter list.

Emails

• We only send emails that belong to your account (confirming your address, resetting your password, telling you why a photo or change couldn't go online) and, if you signed up for it, the newsletter.
• The content of an email is deleted from our database once it is sent. A record that it was sent (address, subject, time) is kept for 30 days.
• Every newsletter has an unsubscribe link. If you unsubscribe, we keep only a scrambled (hashed) version of your address, so we don't accidentally add you again.

Who helps us

• Hetzner (Germany) — the server and database.
• bunny.net (Slovenia) — storing and delivering images.
• Google Workspace — sending our emails.
• Google Analytics (Google Ireland) — visitor statistics, only if you accept them. Google keeps this data for at most 14 months.

We don't sell your data and don't share it with anyone else, unless the law requires it.

How long

• Accounts that are never confirmed are deleted after 7 days.
• Everything else stays until you delete it yourself, or delete your account.
• Pausing your account hides your page. We keep everything as it is until you sign in again or delete your account.
• Deleting your account (on your account page) hides your page right away. For 30 days you can still change your mind by signing in. After those 30 days we permanently delete your account, profile, photos, originals, images and watermark, and your butterflies, credits and archive links. Moderation records keep what was decided, but no longer your name. If you told us why you're leaving, that answer is kept without your name or email address.
• Backups: every night we make an encrypted backup of the website, and every week of member photos. They are kept on our own storage in Belgium, not with another company. Something you deleted can stay in those backups for up to 10 weeks, after which it is gone for good. We only use backups to restore the site after a failure, never to bring back something you deleted.

Photos of you in the NoZLan archive

NoZLan has photographed conventions since 2009. If you are in one of those photos and want it removed, contact us and we will take care of it. Linking an archive photo to your own page ("this is me") is optional and you can undo it at any time.

Your rights

You can ask us what we store about you, correct it, have it deleted, or object to how we use it. Most of this you can do yourself on your account page and in your albums; for the rest, contact us. You must be 16 or older to have an account. If you think we handle your data wrongly, please tell us first. You can also complain to the Belgian data protection authority, the Gegevensbeschermingsautoriteit, or to the authority in your own country — in the Netherlands the Autoriteit Persoonsgegevens.