Privacy Policy

Effective date: 28 August 2026 · Last revised: 14 October 2026 · Applies to dahakimlab.com and its subdomains

Who we are

Heritage Art Link (dahakimlab.com) is an online WebXR art exhibition operated by artist Daha Kim. Contact: artistdahakim@gmail.com.

What we collect and why

• Anonymous visitor identifier. The exhibition does not use accounts. To keep your archived sculptures and purchased unlocks working, our server gives your browser a random identifier in a first-party cookie (__Host-hal_vid, kept up to 400 days). It is signed by our server, cannot be read by scripts on the page, contains no personal details, and is removed when you clear this site's data.
• Archived sculptures. If you archive a coalesced sculpture in the finale, its shape data and your anonymous identifier are stored in our database so the share link works.
• Purchases. If you buy a premium unlock, payment is processed by Toss Payments (or by PayPal, through Toss Payments, when you choose the PayPal option); card and PayPal account details never reach our servers. We store the order identifier, the item, the amount, and your anonymous visitor identifier to grant and audit access. When you start a paid recording or download a purchased file, we also record the time it started, with the same identifier, to apply the refund policy.
• Purchase restore. After a purchase you get a restore key, and you can create short-lived 6-digit device codes. They let you use your purchase on another browser or device, or after clearing cookies. We store a one-way, keyed fingerprint of each key and code, never the key itself. For each restore attempt we record the time, the result, the anonymous identifiers involved, and a one-way-hashed network identifier. We use these records to stop guessing (repeated wrong attempts are blocked for a day) and to answer refund questions. They are kept for 13 months.
• Error reports. If the exhibition malfunctions in your browser, a technical report (error message, browser type, page URL, and a one-way-hashed, non-reversible network identifier) may be sent to us so we can fix the problem. No precise location or persistent personal profile is collected.

Cookies, local storage, and advertising

The exhibition itself uses one first-party cookie for the visitor identifier (see above; not used for tracking or advertising) and browser local storage for interface preferences. Pages on this domain may show advertising served by Google AdSense. Google and its partners may use advertising cookies to personalize ads based on your visits to this and other websites. You can opt out of personalized advertising at Google Ads Settings, and learn how Google uses data at policies.google.com.

Third-party services

• Cloudflare — website hosting and delivery
• Supabase — database for archives, captions, and purchase records
• Amazon Web Services (S3 / CloudFront) — delivery of 3D media assets
• Toss Payments — payment processing (subject to its own privacy policy)
• PayPal — payment processing for purchases made with the PayPal option (subject to its own privacy policy)
• Google Gemini API — translation of heritage caption text (only caption text is sent)
• Google AdSense — advertising (see above)

Retention and your choices

Archived sculptures and purchase records are kept for as long as the service operates, so links and unlocks continue to work. Error reports are kept only for debugging. Clearing your browser's site data removes your local identifier; to request deletion of an archive or records associated with your identifier, email us and include the share link or order details.

Children

The exhibition is a general-audience artwork and does not knowingly collect personal information from children.

Changes

If this policy changes, the new version will be posted at this address with an updated effective date.