Privacy Policy - Display Lab

1. Controller and scope

Display Lab is operated by Traian Anghel as an independent web service. This policy applies when you visit Display Lab, use its visual tools, purchase or restore PRO access, or contact us. For privacy questions or requests, email traian_an@yahoo.com. If a third-party website is linked from Display Lab, that website applies its own privacy policy.

2. Images and tool processing

Image optimization, safe-zone previews, contrast image sampling, color-vision simulations, display calculations, and generated previews are processed locally in your browser. Selecting an image does not upload it to Display Lab or create a server copy. The browser reads the file only to render the requested result, and closing or refreshing the page normally removes that temporary in-memory state.

When you download an optimized image, social-variant ZIP, clean image, analysis preview, batch ZIP, color-vision simulation, PNG card, or branded PDF report, the browser creates the output locally and downloads it directly to your device. Display Lab does not receive the original image, generated output, filename, sampled colors, or display specifications. A shareable Display Specs URL contains only the numeric settings deliberately placed in that URL. As with any local file or copied link, you control where it is stored and with whom it is shared.

3. PRO access data

For PRO payment confirmation and cross-device restoration, our Turso database stores a generated record identifier, Stripe customer identifier, checkout email address, API key, creation time, and active status. This limited record exists to confirm entitlement and restore access. We do not ask for a password, postal address, profile photo, date of birth, or unnecessary account biography.

PRO recognition uses a secure, HttpOnly session cookie after checkout or API-key restoration. The API key is not stored in browser local storage. Free-tier usage is enforced server-side using a one-way keyed hash of the network address, the usage date, feature name, and count; the raw address is not stored in the usage table. Local browser storage remains in use for non-sensitive preferences such as theme and cookie-consent choices. PRO access can be restored using the private API key.

4. Payments and Stripe

Payments are processed by Stripe. Display Lab does not receive or store full card numbers, security codes, or bank credentials. Stripe may process billing details, fraud signals, device information, and transaction records under its own privacy terms and legal obligations. We receive payment status, a session or customer identifier, and checkout contact information needed to deliver PRO access and handle support.

5. Contact messages

When you use the contact form, Display Lab stores your name, email address, selected topic, optional relevant page URL, message, and submission time in isolated Supabase tables. A one-way hash derived from the network address is stored separately for abuse prevention; the raw address is not stored in that rate-limit table. Only the Display Lab administrator can access and manage these records. Replies are sent separately through Zoho Mail.

Contact messages are retained only while reasonably useful for responding, maintaining an appropriate support record, resolving a dispute, or preventing abuse, after which they may be archived or deleted. Do not submit passwords, full payment-card data, complete API keys, confidential client files, or information you do not have permission to share.

6. Cookies, advertising, and technical logs

Display Lab uses necessary browser storage for preferences and user-requested features. Before advertising is enabled, optional Vercel Analytics is loaded only when Analytics consent is granted. If Google AdSense is activated, Display Lab uses Google's certified consent management platform for advertising disclosures and choices and disables its separate Vercel Analytics integration to avoid overlapping consent flows. You can later reopen the active system from the persistent Privacy Choices control or the footer. Read the Cookie Policy for categories, purposes, duration, third parties, and browser controls.

Clearly labeled affiliate recommendations may link to third-party merchants. Display Lab does not load merchant scripts, tracking pixels, or embedded checkout content inside these modules. A connection to the merchant occurs only after you choose the external link, at which point that merchant's privacy and cookie terms apply. Display Lab may receive an aggregate commission attribution from an affiliate partner without increasing your purchase price.

Hosting and security providers may generate limited technical logs such as IP address, request time, browser type, requested route, response status, and error diagnostics. Such logs are used for security, reliability, abuse prevention, and troubleshooting rather than to build a private image profile.

7. Legal bases and retention

Under GDPR, processing may rely on performance of a contract when delivering purchased PRO access, legitimate interests when securing and improving the service, consent where specifically requested, and legal obligations for financial or compliance records. PRO entitlement records are retained while needed to provide the contracted access period, support cross-device restoration, and resolve disputes. Support correspondence is kept only as long as reasonably useful. Images and generated previews are not retained by Display Lab. Technical logs are retained according to hosting-provider and security needs.

8. Sharing and international processing

Information may be processed by infrastructure providers required to operate the service, including hosting, Turso and Supabase database services, Zoho Mail, and Stripe payment services. We do not sell personal data. Providers receive only the information needed for their role and may process data in other countries using their published safeguards. Information may also be disclosed when legally required, to protect users and the service, or during a legitimate business reorganization subject to appropriate protections.

9. Your rights

Depending on your location, you may request access, correction, deletion, restriction, portability, or objection regarding your personal data. You may withdraw consent where consent is the legal basis and complain to your local data-protection authority. To request deletion, email traian_an@yahoo.com from the checkout address and describe the relevant record. We may request reasonable verification before exposing or deleting entitlement information. Deleting the only PRO record can make future restoration impossible, so we will explain that consequence before completing the request.

10. Security, children, and changes

We use reasonable technical and organizational measures, including restricted service credentials and encrypted network connections, but no internet service can guarantee absolute security. Display Lab is not directed to children under 16, and we do not knowingly create profiles for children. We may update this policy when features, providers, or laws change. Material changes will be reflected by a revised date and, where appropriate, an in-product notice.