hashavatar.app
Help Docs Terms Privacy Repository Rust Crate
Privacy Notice

Privacy

The service is intentionally simple, but a public avatar API still receives some request data in order to function. This page describes that practical baseline.

What The Service Receives

  • the opaque identifier you put in the request, such as an internal id, username, or one-way hash
  • request parameters such as avatar type, style options, size, format, and background
  • standard HTTP metadata handled by the server, reverse proxy, and CDN, such as IP address, user agent, referrer, and request timing

What The App Itself Stores

The application does not require user accounts and does not set application cookies by default. In the basic request flow it generates the avatar on demand and returns it directly.

If object storage support is enabled and a signed-link or persistence route is used, the generated avatar file and its object key may be stored in the configured S3-compatible bucket.

Privacy-Preserving Telemetry

If telemetry is enabled by the operator, the app emits aggregate OpenTelemetry metrics for page views, visible page time, repository and crate clicks, demo actions, and avatar generation counts grouped by bounded style choices such as kind, background, accessory, colour, expression, shape, and size bucket.

Telemetry does not include raw identifiers, tenant or style namespace values, IP addresses, user agents, referrers, full URLs, cookies, or free-form text. The telemetry endpoints accept only allow-listed aggregate labels.

Logging And Infrastructure

Depending on deployment, infrastructure components such as nginx, Caddy, Cloudflare, hosting providers, or S3-compatible storage may keep access logs and operational metadata. Those logs are part of running a public service and may contain the identifier you requested if it appears in the URL.

What To Avoid Sending

Email-shaped identifiers are accepted for compatibility, but URLs can appear in infrastructure logs. Send an internal stable id or a one-way application hash when you want to avoid putting personal data in the request URL.

Repository And Crate

You can inspect the implementation in the public API repository and the reusable avatar renderer in the Rust crate. Repository · Rust Crate

Translation Notice

Website translations are AI-assisted and best effort. If you see wording that should be improved, contributions are welcome on GitHub. Improve translations