Last updated: August 23, 2026
This policy explains what inkmeascii.com does with your data. It covers the ASCII art generator, which anyone can use without an account, and ASCII Hub, our community area where people can publish the art they make. This site is inkmeascii.com. In this policy, "we" and "us" mean inkmeascii.com.
Your Source Images Stay in Your Browser
The image you pick is never uploaded. Conversion runs entirely in your browser using JavaScript and the Canvas API. The picture on your disk or camera roll is read by the page, turned into characters on your screen, and that is where it ends. We have no image upload endpoint and no image storage. You can check this yourself: open your browser's network inspector while you generate art and you will see no outbound image request.
This has not changed with ASCII Hub. When you share a piece to the Hub, what leaves your browser is the finished ASCII art, not the photo it came from.
What We Store When You Share to ASCII Hub
Nothing is published unless you deliberately press Share to Hub. When you do, we store:
- the ASCII art itself, as text
- the title, description and tags you type
- the generator settings used to make it, such as character set, contrast and gamma, so the piece can be reproduced or remixed
- whether you marked the piece public or unlisted, and the time you posted it
Unlisted means the piece is not listed in the gallery or in search, but anyone who has the link can open it. Treat unlisted as private-ish, not secret.
Account Information
You only need an account to post, vote or comment. To create one we collect your email address and a public handle. The handle is permanent and visible to everyone. You can optionally add a display name and a short bio, which are also public. Your email address is not shown publicly.
Passwords
We never receive or store your password. Your browser stretches it with 600,000 rounds of PBKDF2 and sends only the derived key. Our server stores an HMAC of that key, computed with a secret key held server side, so the stored value is useless to anyone who obtains a copy of the database without also obtaining that secret.
Abuse Prevention and IP Addresses
We do not store raw IP addresses for Hub activity. When you sign up, log in, post or vote, we take the /24 network prefix of your address together with your network operator's ASN, run that through a keyed HMAC, and store only the resulting hash. That hash lets us notice when fifty accounts voting for the same piece all come from one network, or when signups are being farmed, without letting us or anyone reading the database work out where you are or reverse it back to your address.
Cloudflare Turnstile is used on signup and other sensitive actions to check that a request comes from a person rather than a script.
Automated Moderation
Moderation on ASCII Hub is automated. Every submission's title, description and tags, plus your handle and bio, are sent to a classification model running on Cloudflare Workers AI, inside the same infrastructure that serves this site. Based on the result, content can be held for review before it appears or removed automatically, and accounts can be restricted. This is automated decision-making, and we do it because we cannot review every submission by hand and still keep the Hub usable.
Every automated hold or removal can be reviewed by a person. Flagged items go into a human review queue, and if your content is removed you can ask us to look at it again by emailing [email protected]. We will tell you the outcome. The rules that content is judged against are set out in our Content Policy.
We send email through Resend, which receives your email address in order to deliver the message. We use it to confirm your address, to reset your password when you ask, and to send account and moderation notices.
Cookies
There are two kinds of cookie here and they are not the same thing.
Strictly necessary. When you log in we set a session cookie holding a signed token. It is HttpOnly, Secure and SameSite=Strict, which means scripts cannot read it and it is not sent to other sites. Without it you cannot stay logged in, so it is set on the basis of necessity rather than consent. Cloudflare Turnstile may also set a short-lived cookie as part of its bot check.
Analytics and advertising. Google Analytics and Google AdSense set their own cookies to measure traffic and to serve and measure ads. These are not needed for the site to work. Ads do not run on ASCII Hub pages.
You can clear or block cookies in your browser settings. Blocking the session cookie will log you out.
Log Files and Analytics
Our hosting and network providers keep standard server logs, which include IP address, browser type, timestamp, and the pages requested. We use Google Analytics 4 to understand which pages people use. Google Analytics collects device and browser information, approximate location derived from IP address, and pages viewed.
Previous versions of this policy said log data was not linked to anything identifying. That is no longer accurate in every case: if you are logged in, actions you take on the Hub are recorded against your account, and the network hash described above is stored alongside account and voting records specifically so that abuse can be traced. We are telling you this rather than repeating a claim that has stopped being true.
Who Receives Your Data
We do not sell your data and we do not share it for other companies' marketing. We use these processors, all based in the United States:
- Cloudflare for the application (Workers), the database (D1), automated content moderation (Workers AI), bot checks (Turnstile) and content delivery
- Resend for sending email. It receives your email address
- Google for Analytics, AdSense advertising on non-Hub pages, and Firebase Hosting for the static parts of the site
We may also disclose data where we are legally required to, or where it is necessary to investigate abuse, fraud or a threat to someone's safety.
International Transfers
If you are in the European Economic Area or the United Kingdom, your data is transferred to and processed in the United States by the providers listed above. Those transfers rely on the European Commission's Standard Contractual Clauses, or on the provider's certification under the EU-US Data Privacy Framework where they hold one. You can ask us for details of the safeguards that apply.
Legal Bases for Processing
If the GDPR applies to you, these are the bases we rely on. Running your account, storing what you post and showing it to other people is done to perform our contract with you, which is the Terms of Service you agree to when you sign up. Security, moderation, spam and vote-ring detection, and keeping the site working are done in our legitimate interests, and in the interests of everyone else using the Hub, in having a service that is not overrun. Analytics and advertising cookies are set only after you agree if you are visiting from the EU, the EEA or the UK, where consent is required. Elsewhere they are set on arrival, and you can block them with your browser or an extension.
How Long We Keep Things
- Your account and profile: until you delete the account.
- Art you post: until you delete the piece. See the section on account deletion below, which explains what happens to art when the account behind it goes away.
- Email confirmation and password reset tokens: these expire within 24 hours and are deleted once used or expired.
- Abuse prevention hashes and moderation records: up to 12 months from the event, longer only where an investigation or a ban is still active.
- Server logs: short-term, as retained by our hosting providers, typically days rather than months.
- Google Analytics data: retained according to the retention setting on the property, currently 14 months.
Your Rights
Wherever you live, you can ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, object to processing based on legitimate interests, ask us to restrict processing, or withdraw a consent you gave. If the GDPR or UK GDPR applies to you, you also have the right to complain to your national data protection authority.
We are building account deletion and data export directly into the account settings page, so you will be able to do both yourself without asking anyone. Until that ships, email [email protected] from the address on your account and we will handle it. We aim to respond within 30 days.
What Deleting Your Account Does
Deleting your account removes your email address, your password credential, your display name and your bio, and it releases nothing about you to anyone. It does not pull down the art you already published. Those pieces stay on the Hub with authorship anonymised, shown as posted by a removed user. We do it this way because other people bookmark, embed, remix and build on Hub posts, and silently deleting a chunk of the gallery breaks their work too.
If you want a piece gone, delete the piece first and then delete the account. Individual pieces can be deleted at any time and are removed from the Hub, including the stored PNG rendering. Copies that other people already downloaded or reposted are outside our reach.
Security
Traffic is encrypted with TLS. Passwords are handled as described above and are never stored. Session tokens are signed, HttpOnly and Secure. IP data is hashed under a secret key before it is written down. Access to production data is limited to people who need it to run the service. No system is perfectly secure, and we are not going to pretend otherwise, but we are not storing the things that would hurt most to lose.
Data Breaches
If a breach affects your personal data and is likely to put you at risk, we will notify you by email without undue delay, and we will notify the relevant supervisory authority within 72 hours where the law requires it. The notice will say what happened, what data was involved, and what you should do.
Children
You must be at least 13 to create an account. In some countries, including parts of the European Economic Area, the minimum age for consenting to online services on your own is 16, and where that applies to you it is the age that governs. We do not knowingly collect personal data from children below the applicable age. If you believe a child has created an account, tell us at [email protected] and we will remove it.
Advertising
The generator, blog and gallery pages carry Google AdSense advertising. ASCII Hub pages do not. Google and its partners may use cookies to serve ads based on your visits to this and other sites. You can opt out of personalised advertising at Google Ads Settings, at aboutads.info, or through the Network Advertising Initiative opt-out page. You can also opt out of Google's DART cookie through the Google ad and content network privacy policy. We have no access to or control over cookies set by third-party advertisers, and this policy does not cover their practices.
California Privacy Rights
If you are a California resident, you have the right to know what personal information we collect and who we disclose it to, the right to delete it, the right to correct it, and the right not to be discriminated against for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioural advertising as those terms are defined by the CCPA, other than through the advertising cookies described above, which you can opt out of using the links in that section. To make a request, email [email protected].
Changes to This Policy
We will update this page when what we do changes, and we will move the "Last updated" date at the top. If a change materially affects how we use your data, we will tell account holders by email before it takes effect.
Contact Us
Questions about this policy, or about your data, go to [email protected].