T-Short Privacy Policy

Festival accounts and Google / X / Facebook sign-in · Effective 8 November 2026

This policy explains how T-Short, the animation film festival website at t-short.art, accesses, uses, stores, shares and deletes account information, including information received through Google Sign-In, X sign-in and Facebook Login. It applies to the festival account service at t-short.art/festival/. Other processing on the festival's information website, such as contact forms, embedded content and website cookies, is described in the general website privacy notice.

1. Information we access and collect

Google: choosing Google Sign-In requests the permissions openid, email and profile. We access your Google account identifier, name, email address and its verification status to authenticate you. Google's identity token can contain additional standard profile claims, such as a profile picture URL. The integration does not import or store your Google profile picture. We do not request access to Gmail messages, Google Drive files, contacts or calendars.

X: choosing X sign-in requests tweet.read, users.read and users.email. We request your own account profile: account identifier, name, username and confirmed email address when X supplies it. X requires read permissions for this flow; our sign-in integration does not retrieve your posts. None of these sign-in integrations requests permission to publish posts or send messages. We never receive your Google, X or Facebook password.

Facebook Login: we request the email permission and the public profile information Facebook provides for sign-in. This includes your app-scoped Facebook identifier, first and last name, profile picture and email address, where Facebook supplies them and you allow access. When creating a new account, the integration may save a local copy of your Facebook profile picture as your festival avatar. The profile request also asks for website, locale, profile description, hometown and birthday; Facebook does not supply these without the necessary permissions. These additional details are not saved to create the festival account. We do not request permissions for friends lists, posts or messages, and do not publish on your behalf.

Your festival account: we also process the username, profile information and content you submit to T-Short, and account or security correspondence you send us. Technical records can include login/session identifiers, time of access, IP address, browser information, requested URLs and error information used to operate and protect the service.

2. What we use Google, X and Facebook information for

We use sign-in information to authenticate you, create or recognise your T-Short account, associate future sign-ins with the same account, and avoid duplicate accounts. For Google and X, a verified provider email may link sign-in to an existing account where the provider is authoritative for that email address. Facebook sign-ins are matched using the email supplied by Facebook or, when none is supplied, an internal account address derived from the Facebook identifier. Your name may appear on your festival profile according to the website's profile settings.

Google, X and Facebook sign-in are optional. You may use the website's registration and password sign-in instead. Signing in does not itself subscribe you to a newsletter. Provider sign-in information is used to provide and secure the account service; it is not sold, provided to data brokers, used for advertising targeting or used to train general-purpose AI models.

Our handling of Google information follows the Google API Services User Data Policy, including its applicable restrictions on use and disclosure. Separate analytics, advertising or embedded-content processing described in the general website notice does not authorise using Google sign-in information for those purposes.

3. Storage and security

The account database stores your provider account identifier, its association with your T-Short account, and the account details described above. Google and X access tokens are used temporarily during sign-in and are not stored in the account database. T-Short creates its own website session after successful authentication.

The Facebook access token is held by the login library in server-side PHP session storage, rather than in the account database. Facebook-related festival account data includes the imported profile details, avatar where available, sign-in source and a value derived from the Facebook profile address. These details follow the same access, retention and deletion rules as other account records.

Website and provider sign-in connections use HTTPS. The Google/X sign-in integration validates provider identity and authorisation responses and protects against forged or replayed login requests. Its HTTPS login cookies use Secure, HttpOnly and SameSite protections. Access to account records, the server and backups is restricted to authorised operators and service providers who need access to operate, maintain or secure the service.

4. Who processes or receives information

• Website operators: authorised people administering the festival may access information where necessary for account support, service operation, security or handling your request.
• Hosting: the website operates on infrastructure supplied by dogado GmbH, Germany. Its account database, local mail service and scheduled local backups are hosted on this server. Infrastructure providers process information as needed to supply and protect the hosting service.
• Email: messages to the domain contact address are received by the domain's local mail service. Account and security email is sent through the website's local mail system. Email delivery also involves the mail providers chosen by the sender and recipient.
• Google, X or Facebook (Meta): when you choose a provider, your browser is redirected to it with an authorisation request identifying T-Short and the requested permissions. The provider independently processes that interaction under its own privacy policy: Google, X or Meta. Those providers may process information internationally under their published arrangements.

We do not disclose Google sign-in information for sale, advertising targeting or unrelated purposes. Disclosure is limited to providing the account service and necessary infrastructure, protecting security, handling your request, or meeting an applicable legal obligation. The Google/X integration does not send your festival account records back to either provider.

5. How long information is retained

• Account records and provider links: retained while your T-Short account exists and removed from the live account database when the account is deleted. We may retain information separately where a specific legal obligation or unresolved security matter requires it, for that purpose only.
• Scheduled website backups: created locally each day, with a full backup weekly. The configured rotation keeps up to four full backup sets and their associated daily incremental backups. Deletions from the live database therefore reach older scheduled copies as those sets are replaced; deletion does not immediately rewrite existing backup archives. Backups are for recovery and are not used as the live account service.
• Website access/error logs: configured to rotate at 10 MB, keeping ten rotated archives for each log. Their retention is determined by that rotation and traffic volume, rather than a fixed number of days.
• System and mail logs: rotated weekly, retaining four rotated archives in addition to the current log.
• Sign-in cookies: the website uses session cookies and may keep a persistent login cookie for up to ten years, unless you log out or remove it earlier. You can clear these cookies in your browser. Cookie lifetime is not a separate permission to use Google information for other purposes.

Account/privacy correspondence is used to resolve the request and retain records necessary for related follow-up or applicable legal duties. Contact us if you need deletion of correspondence or information that may remain in recovery copies; we will explain the applicable retention and handling for your request.

6. Revoking access and deleting your information

You can revoke T-Short access in your Google connected-app settings, X connected-app settings, or Facebook Apps and Websites settings. Revocation stops future use of that authorisation; it does not itself delete your T-Short account, previously stored account details or an existing T-Short session. You may log out separately.

Account deletion is enabled on the festival website under Settings → Delete account and requires the account password. If you signed in socially and do not have a usable festival password, or cannot access your account, request deletion at mail@t-short.art. We may ask for information necessary to verify that the request relates to your account. Deleting the account removes its Google/X identity link, Facebook-related account details and account sessions from the live database. A profile picture imported from Facebook is deleted with the festival profile. Recovery copies and logs follow the retention rules above.

7. Your rights and policy updates

You may request access, correction, deletion, restriction or portability of your personal information, or object to processing where applicable. You may withdraw a consent where processing relies on it. The general website privacy notice describes the controller, further rights and how to contact a supervisory authority. Send account-related requests to mail@t-short.art; we handle them within the applicable legal requirements.

We will update this policy if our processing changes. A material new use of Google information will be disclosed before that use begins, and any required new consent will be requested. The effective date above identifies this version.