Privacy Policy
The short version
- We collect what the site needs to run: your account, what you upload, what you do on the site, and records of money that moves.
- We do not sell personal information, we show no ads, and we have no advertising or analytics trackers.
- Stripe handles card numbers. We never see them.
- Your profile, uploads, comments, and public boards are public. Your email, downloads, votes, and private boards are not.
- You can download a copy of your data and delete your account from settings.
This summary is here to help you read the page. The full text below is what applies.
1. Who we are
Misfit Mindset LLC, a Georgia limited liability company operates Negative Space and is responsible for your information. Questions and requests go to [email protected].
2. What we collect
- Account. Email, username, display name, a password hash (never the password itself), when you accepted the terms, and who invited you if you joined through an invite link.
- Google sign-in. If you use it: your Google account id, verified email, and the name Google sends. We use them to open or link your account.
- Profile. Bio, location, avatar, banner, links to your website and social accounts, interests, screens, and your NSFW choice.
- Uploads. The file, the sizes and loops we make from it, and its title, tags, credit, license, palette, and settings.
- Moderation. If you apply to moderate, your answers and the decision. If you're on the team, a log of each moderation action you take: what it was, which wallpaper, comment, or account it was on, and why. Reports you file, and reports about you.
- The automatic check. For each upload: nudity scores, what the picture seems to show, its brightness and colors, and what the check decided. Moderators can see this. It is deleted with the wallpaper.
- Activity. Likes, saves and boards, follows, comments and mentions, challenge entries and votes, reports you file, and your notifications.
- Downloads. Which wallpaper, format, and size, and when. We link a download to your account if you are logged in.
- Money. For tips and contributions: the amount, who it was for, your note and whether it is public, Stripe's payment ids, the fee split, and when you agreed it was final. For creators: the Stripe Connect account id, whether Stripe has enabled payouts, and payout records. Card numbers go only to Stripe.
- Technical. Your IP address is used in memory to rate-limit abuse. Our web server's access logs record IP addresses and the pages requested. Cloudflare sees each connection before it reaches us.
3. What is public
Anyone can see your username, display name, avatar, banner, bio, location, links, follower count, founding member number, and Supporter badge. They can also see your published wallpapers and their counts, your comments, and your public boards. If you choose, anyone can see your public tip notes, and your name and note on the supporters wall.
If you're a moderator or admin, that's public too: the team is listed on /moderators and your page shows a badge.
Your email, password, downloads, votes, private boards, notifications, reports, moderator applications, and payout details are not public. The owner and admins can see reports and applications. Moderators see reports about content and ordinary accounts, but never reports about the team, and never your email or payments.
4. How we use it
We use your information to run the archive. That means showing and delivering wallpapers, keeping you logged in, and sending notifications. It also means charging the tips and contributions you ask for, paying creators, counting invites, moderating reports, and stopping abuse.
Every upload goes through an automatic check that suggests tags and titles, marks nudity NSFW, and holds possibly explicit work for a moderator. It uses image-recognition models that run on our own server. Your images are not sent to another company for it, and we don't train models on them. A person makes the final call on anything held.
We do not sell or rent personal information. We do not share it for advertising, including cross-context behavioural advertising. We do not use it to train an AI model.
5. Email we send
We send email only when something happens that you would expect to hear about:
- a welcome note when you join;
- a password reset link when you ask for one;
- a "you got a tip" email when someone tips your work.
We do not send newsletters or marketing email. Mail comes from [email protected] through Resend.
6. Cookies
We use only the cookies below. They are all first-party and all needed for the feature they serve. We use no analytics, advertising, or tracking cookies, and no browser storage beyond these.
| Cookie | What it does | Kept for |
|---|---|---|
ns_session | Keeps you logged in. The server stores only a hash of it. | 30 days |
ns_flash | Carries a one-time message such as "Published." to the next page. | 20 seconds |
ns_next | Remembers the page to return to after you log in. | 1 hour |
ns_ref | Remembers whose invite link brought you, so they get credit when you join. | 30 days |
ns_google_state, ns_google_verifier | Protect the Google sign-in handshake. | 30 minutes |
ns_terms | Remembers that you agreed to the terms while Google signs you in. | 30 minutes |
Cloudflare, which sits in front of the site, can set its own security cookies, for example when it asks a browser to prove it is not a bot.
7. Who else handles it
- Stripe processes card payments and holds and pays out creator balances.
- Google confirms your login when you choose Google.
- Resend delivers the email listed above.
- Cloudflare fronts the domain and protects the site from attacks.
Each one gets only what its job needs. The site itself, its database, and all uploads run on a server we operate in the United States. If you use the Pin button, Pinterest receives what you send it. The Facebook button sends that page address to Facebook. The Instagram button hands the picture to the app you pick on your phone.
We will disclose information if the law requires it, or to protect people or the site from harm.
8. How long we keep it
We keep your account until you delete it. The owner account cannot be deleted from settings. When you delete your account, we delete your profile, your uploads and every size and loop made from them, your comments, likes, follows, boards, votes, and notifications.
Some records stay with your name taken off them, because they are the books or they keep the site safe. These are tips and contributions, payouts, download counts, reports you filed, and moderation actions, including the audit log of anything you did as a moderator. Moderator applications are deleted with the account.
Server logs rotate on their own. A deleted wallpaper leaves the archive. A copy someone already downloaded is outside our reach.
9. Your choices and rights
- See and take your data. Settings has an export. It downloads your profile, uploads (with their automatic check results), boards, comments, likes, follows, tips, contributions, payouts, downloads, challenge activity, reports, notifications, and moderator applications as a JSON file.
- Correct it. Edit your profile and your wallpapers at any time.
- Delete it. Delete a single wallpaper from its page, or your whole account from settings.
- Choose what shows. Keep NSFW off, keep tip notes private, and keep your name off the supporters wall.
Depending on where you live, for example California, the EU, or the UK, the law may give you more rights. These can include access, correction, deletion, portability, and objecting to how we use your data. We honour those requests for everyone. Email us for anything the site has no button for. We answer within 30 days. You can also complain to your local data protection authority.
10. Security
Passwords are stored as scrypt hashes. Login sessions and reset links are stored as hashes too. The site is served over HTTPS. Only the owner, admins, and moderators can reach moderation tools. No system is perfect. If we learn of a breach that affects your information, we will tell you.
11. Children
Negative Space is for adults. We do not knowingly collect information from anyone under 18. If we learn that we have, we delete the account.
Changes to this page
- September 25, 2026. First version.
- September 28, 2026. Reorganised with a summary and section links. Now covers profile links, invites, notifications, mentions, supporter contributions, public tip notes, download history, and server logs. Adds what is public, every cookie by name, the email we send, what deleting an account keeps, and the fuller data export.
- September 28, 2026. Added the automatic image check: what it records, that it runs on our own server, and that a person decides on anything held.
- September 28, 2026. Added moderator applications, the moderation audit log, the public team list, and who on the team can see reports.
- September 28, 2026. Mail now comes from [email protected].
- September 28, 2026. The Facebook and Instagram buttons are named. Facebook receives the page address. Instagram receives the picture only if you send it from your phone.
Questions about this page go to [email protected].