Privacy Policy

Last updated: October 1, 2026

1. Who we are

This Privacy Policy explains how POE Hideout Art Tool ("we", "us", "our") collects, uses and protects personal information when you use our website and services (the "Service"). It should be read together with our Terms and Conditions.

We collect only what we need to run the Service, and we do not sell your personal information.

2. Information we collect

Information you give us

  • Account details: username, email address, and optionally your first and last name. Your password is stored only as a secure one-way hash; we cannot see it.
  • Profile picture: if you upload one, we store a resized copy (256 x 256 pixels). The image is re-encoded, which removes embedded metadata such as location data. You can also choose one of our built-in avatars instead.
  • Images you convert: the images you upload to generate hideout art, and the previews and .hideout files we generate from them.
  • Messages to us: when you use the Contact page, the email address you enter, your message, the request type and any screenshots you attach. These are delivered to our support inbox by email.

Information collected automatically

  • Usage and account activity: your remaining conversions and credits, subscription status, account creation date and last login time.
  • Previews and results: the images you upload and the previews and .hideout files generated from them. You can unlock or re-download your results for 7 days. We keep uploads and results after that to review the quality of the Service and prevent misuse, and delete them periodically or when you ask us to. If you use Share, the original image and preview are published on a public page until you ask us to remove it.
  • Site analytics (first-party only): we record simple events such as "visited the site", "generated a preview", "signed up" and "purchased" to understand where people get stuck. These events are linked to a random visitor ID stored in a cookie, not to your name, and are never shared with advertisers.
  • IP address and browser information: used to keep you logged in, to apply rate limits that protect the Service from abuse, to limit free previews per person, to count each like and page view only once, and to create a one-way hashed device identifier (derived from your browser's user agent and IP address) that helps prevent misuse of conversions. When you generate a preview we also store your IP address, your approximate country (looked up on our own server from a local IP database, never sent to a third party), your browser's user agent and the uploaded file name with that generation, so we can apply the free-preview limit per IP address and stop abuse.
  • Server logs: technical logs such as errors and request information that help us keep the Service running and secure.

We do not use advertising trackers, and we do not build advertising profiles.

3. How we use information

  • to create and manage your account and authenticate you;
  • to provide the Service: generating hideout art, previews and files from your images;
  • to manage subscriptions, conversions and billing;
  • to answer your messages, support requests and bug reports;
  • to protect the Service and its users, including rate limiting, fraud and abuse prevention;
  • to maintain, troubleshoot and improve the Service;
  • to send you essential service messages, such as billing notices or changes to our terms;
  • to comply with legal obligations and enforce our Terms.

4. Legal bases

Where data protection laws require a legal basis, we rely on: performance of a contract (providing the Service you signed up for); legitimate interests (keeping the Service secure, preventing abuse and improving it); legal obligation (for example tax and accounting records); and consent where we ask for it, which you can withdraw at any time.

5. Payments

Subscription payments are processed by our third-party payment provider. When you subscribe, you provide your payment details directly to that provider. We do not receive or store your full card number. We receive limited information needed to manage your subscription, such as your subscription status, plan, billing country, the last digits of your card where provided, and transaction identifiers. The payment provider processes your information under its own privacy policy.

6. Sharing and service providers

We share personal information only as needed to run the Service, with:

  • Payment provider: to process subscriptions and payments.
  • Email provider (Google Gmail): used to deliver Contact page messages to our support inbox and to send replies.
  • Hosting and infrastructure providers: that store and run the Service on our behalf.
  • Content delivery services: the website loads fonts from Google Fonts and a scrolling library from jsDelivr. Your browser connects to these services directly, which means they receive your IP address and browser information when a page loads.
  • Authorities: where required by law, or to protect our rights, users or the public.
  • Successors: if the Service is reorganised, sold or transferred, information may transfer as part of that transaction under this policy.

Service providers may only use your information to provide their services to us. We do not sell or rent your personal information, and we do not share it for advertising.

7. Cookies and local storage

We use only what is necessary for the Service to work:

  • Session cookie: keeps you logged in and protects forms against cross-site request forgery.
  • Visitor ID cookie ("vid"): a random identifier that lets you open the previews you generated while logged out, applies the free preview limit, and powers our first-party analytics. It contains no personal information and expires after about a year.
  • "Remember me" cookie: only if you choose it at login, to keep you signed in on that device.
  • Local storage: remembers small preferences in your own browser, such as the hideout you last selected. It never leaves your device.

We do not use advertising or cross-site tracking cookies. You can clear cookies and local storage in your browser at any time; you may then need to log in again.

8. Data retention

  • Account data: kept while your account is active and deleted when you ask us to delete your account, except where we must keep limited records for legal, tax, accounting or fraud-prevention reasons.
  • Uploaded images and generated files: kept with the generation record (including the IP address and country stored with it) until we delete it, which we do periodically and on request. Download your .hideout file to keep it; your own access to a result lasts 7 days.
  • Profile pictures: kept until you change or remove them, or delete your account.
  • Contact messages: kept in our support inbox for as long as needed to handle your request and any follow-up.
  • Rate-limit data: IP-based counters are held only in temporary server memory for short periods and are not written to our database.
  • Billing records: kept for as long as required by applicable tax and accounting laws.

9. Security

We use reasonable technical and organisational measures to protect your information, including hashed passwords, protection against cross-site request forgery, rate limiting, validation and re-encoding of uploaded images, and restricted access to our systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password.

10. Your rights

Depending on where you live, you may have the right to:

  • access the personal information we hold about you;
  • correct inaccurate information (you can edit most details yourself on your profile);
  • delete your account and personal information;
  • receive a copy of your information in a portable format;
  • object to or restrict certain processing;
  • withdraw consent where processing is based on consent;
  • lodge a complaint with your local data protection authority.

To exercise these rights, contact us through our Contact page. We may need to verify your identity before responding, and we will respond within the time required by applicable law. We do not discriminate against you for exercising your rights.

11. International transfers

The Service is available worldwide, and our service providers may process information in countries other than your own. Where required, we rely on appropriate safeguards for such transfers, such as the contractual protections offered by our providers.

12. Children

The Service is not directed to children under 13 (or the minimum age required in your country to consent to online services), and we do not knowingly collect their personal information. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will change the "Last updated" date above and, for material changes, notify you by email or on the website before they take effect.

14. Contact

For privacy questions or requests, reach us through our Contact page. We reply by email.

POE Hideout Art Tool is an independent fan-made tool and is not affiliated with or endorsed by Grinding Gear Games.