Privacy policy

1. Controller

The data controller is [UZUPEŁNIJ: nazwa / imię i nazwisko administratora, adres]. Contact for data matters: [UZUPEŁNIJ: e-mail kontaktowy].

2. Data we process

Account: email address, username, password hash (bcrypt — we never know your password), language, optionally country and a short bio.

Content: comments, questions, analyses, cited sources, reactions, reports, followed events, notifications.

Technical data: IP addresses are used only in server memory to limit abuse (login and registration limits) and are not stored in the database. The web server may keep standard access logs for a short time.

We never reveal users' locations. A country is shown next to comments only if you provide it.

3. Purposes and legal bases

Running your account and enabling discussion — Art. 6(1)(b) GDPR (performance of the service).

Security, moderation, spam and abuse prevention, moderation log — Art. 6(1)(f) GDPR (legitimate interest).

Emails (address confirmation, password reset, notifications) are sent only in connection with your account; no advertising.

4. Cookies

We use only essential cookies: the login session (httpOnly) and your language choice. No analytics or advertising cookies.

5. Recipients

The server (VPS hosting) and outgoing email (SMTP) providers act as processors. [FILL IN: provider names]

Comments are public.

6. Retention

Account data is kept until the account is deleted. Database backups are rotated after 14 days.

When an account is deleted, comment text is erased; threads with other people's replies keep a 'deleted' marker.

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection.

You can download your data (JSON) and delete your account yourself in your profile. For anything else, write to the contact address.

You may lodge a complaint with your data protection authority (in Poland: UODO, uodo.gov.pl).