Secondhang is a prototype of a site for finding and downloading public-domain art. You can use all of it without an account. There are no ads, and the site doesn’t ask for your name or e-mail address. This page explains what data the site does handle, who handles it, and why.
Who is responsible
Mashplan AB is responsible for the personal data described here (the controller, in the words of the GDPR). Questions and requests go to info@mashplan.com.
Loading the site
When you open a page, your browser sends your IP address and the usual details of a web request (the address of the page, your browser’s name and version) to the services that deliver it:
- Vercel serves the pages and runs the site’s server code, in Dublin.
- Convex holds the collection’s database, in Ireland. Pages are built from it on the server, and your browser also connects to it directly while you browse.
- Bunny.net delivers the images, downloads included, from the server nearest you. The files are stored in Stockholm.
They need your IP address to answer, and may record requests in their own logs. Vercel and Bunny.net answer through servers around the world, so a request from outside Europe may first reach a server outside the EU. None of the site’s own records contain your IP address; the one place a scrambled form of it is kept is described under Rate limiting.
Links to museums, Wikimedia Commons and other sites take you to them, and their own privacy policies apply there.
Searching
When you search, the site’s server sends the words you typed and the filters you chose to Convex, which finds the matching works. Two things are kept there:
- A search log: the search text (up to 200 characters), the filters, the kind of search, how many works were found and the first ten of them, how long the search took, and which server turned the text into a vector (see below). It holds no IP address, account or anything else that says who searched. We use it to see how well search works, and to prepare searches people have made before so they run faster.
- A cache of vectors: the search text, in lower case, with the vector made from it, so the same search needn’t be worked out again.
Browsing with filters alone, without search words, isn’t logged.
To match words to pictures, Convex sends the text of a new search to our embedding server, which turns it into a vector (a list of numbers). It runs on Fly.io in London, with a backup on Vercel in Dublin. They get the text from Convex, never your IP address. The text travels in the request’s address, so it may appear in those services’ request logs.
Neither the log nor the cache is deleted automatically at present. Since they don’t say who searched, please don’t type personal information, such as a private person’s name, into the search box.
Rate limiting
To keep the site from being overloaded, the start page, search and browse pages, and the “Visually similar” works on artwork pages are limited per visitor (60 text searches a minute, for example). For this the site’s server turns your IP address into a key: a SHA-256 hash of the address together with a secret, cut to 32 characters. Without the secret the key can’t practically be traced back to an address, and the address itself is never stored.
Convex keeps the key with a counter and the time of your latest request for each kind of limit (text searches, browsing, similar works). Each request overwrites them. These records aren’t deleted automatically at present.
Visitor statistics
We count visits with Umami Cloud, on secondhang.art only. For each page you view, its script sends the page’s address (for a search, that includes the search words) and title, the address of the page that linked to it, and your screen size and browser language. Umami works out your browser, operating system and type of device from the request, and an approximate location (country, region, city) from your IP address. It also uses the IP address, your browser’s user agent and a value that changes every month to make an anonymous visitor ID, so visits in the same month can be counted once. It doesn’t store the IP address in its statistics, and it doesn’t use cookies. Umami and its providers may record IP addresses in their own operational and security logs.
Our Umami account keeps its data in the EU (Frankfurt), for six months. To stop Umami counting your visits in a browser, run localStorage.setItem('umami.disabled', '1') in its developer console on secondhang.art: the script then sends nothing from that browser. Content blockers that block Umami work too.
Cookies and storage in your browser
The site sets one cookie, __vdpl, when you open a page. Vercel uses it for “skew protection”: it holds the identifier of the version of the site you loaded, so that the rest of your visit is served by that version even if we publish a new one meanwhile. It contains nothing about you, the page’s scripts can’t read it, and it has no expiry date, so your browser deletes it when the browsing session ends. It is strictly necessary to deliver the site, which is why there is no cookie banner.
Apart from that cookie the site stores nothing in your browser: no other cookies, no local storage, no session storage. Umami’s script only reads the one local-storage entry described above.
The editor and “View on a wall”
The editor (Edit on an artwork page) and “View on a wall” run in your browser. They load the artwork’s image from Bunny.net and the room photos from this site. What you make stays on your device: Copy, Download and Share hand the finished file to your clipboard, your downloads or your device’s share menu. Nothing is uploaded, and nothing is saved between visits.
E-mail addresses
The site doesn’t collect e-mail addresses. Artwork pages used to have “Order as print” and “Print-ready file” buttons that asked for an address, to tell you when prints or print-ready files became available. If you left yours, it is stored in Convex with which of the two you chose and the artwork you were looking at, along with a sign-up counter for the address that limits repeated sign-ups. It was given for that notice only, and we delete it if you ask.
Who processes data for us
Legal basis
We handle this data on the basis of our legitimate interests (GDPR article 6(1)(f)): delivering the site and keeping it secure and available, making search work and improving it, and knowing roughly how many people visit and what they look at. E-mail addresses from the earlier waitlist were given so that we could send the notice you asked for (your consent, article 6(1)(a)).
Your rights
Under the GDPR you can ask for a copy of the personal data we hold about you, have it corrected or erased, restrict or object to how we use it, and receive it in a portable form where that applies. Write to info@mashplan.com. The search log, the vector cache and the rate-limit keys don’t say who you are, so we usually can’t tell which entries are yours unless you give us something that lets us find them, such as the IP address you used (GDPR article 11).
You can also complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), or to the data protection authority where you live or work.
Changes
When the site starts handling data differently, we update this page and the date at the top.