Privacy Policy

WHO THIS COVERS

This policy describes The Archive at redactedorclassified.com (the "site"). It applies to visitors, people who create an account, and people who post, comment, vote, or play the clearance game. The site operator is the controller of the personal information described here. Supabase and Vercel process that information on the operator's behalf.

ACCOUNTS

You can create an account with an email address and password, or with:

• GitHub (GitHub OAuth)
• Google (Google OAuth)

Those providers share with us the account details their consent screen lists, typically an email address, a display name, and an avatar URL. We store a username and display name you choose, and a profile row tied to your login. Authentication, session tokens, and password hashes are handled by Supabase Auth. We do not receive or store your GitHub or Google password.

Signup and password-reset messages are sent by Supabase Auth. The repository does not include a separate email product (no Resend, SendGrid, Postmark, or similar). Delivery uses whatever mail transport is configured on the Supabase project.

WHAT YOU POST

Theories, edits, evidence, comments, votes, follows, reports, and investigation-board pins are stored so the site can show them. Your username and role are visible to other visitors because profiles are readable by the public. Treat anything you post as public.

Posts and comments are opinions and allegations contributed by users. They are not verified fact. See the Terms of Service.

POINTS, STREAKS, AND CLEARANCE

If you take part in the game, we store activity used to compute a clearance score: files opened, votes, comments, approved theories, bonus points, and a daily streak. Some of that activity is shown on your public dossier, including division progress. Points and streaks have no cash value.

COOKIES AND ANALYTICS

The site uses essential cookies set by Supabase Auth to keep you signed in (session access and refresh tokens). Those cookies are required for login. We do not use them for advertising.

The site is hosted on Vercel and uses Vercel Analytics. Vercel Analytics is cookieless: it does not set an analytics cookie and does not use the data for advertising. It receives technical request data such as pages visited, referrer, and browser type so the operator can see aggregate traffic.

WHERE DATA IS PROCESSED

• Supabase provides the Postgres database, authentication, and file storage.
• Vercel hosts the application and provides Vercel Analytics.
• GitHub and Google process the OAuth sign-in when you choose those providers.
• If the operator turns on Cloudflare Turnstile, Cloudflare processes the captcha challenge used on signup and login. That check runs only when both Turnstile keys are configured.

These companies may process information in the United States or other countries where they operate. Their own privacy notices describe those transfers.

HOW LONG WE KEEP IT

Account and profile data are kept while your account exists. Posts, comments, and votes stay on the site until you delete them, a moderator removes them, or you ask us to delete or anonymize them. When an account is deleted, we remove or anonymize the profile. Copies in operator backups may remain until those backups rotate. Security logs are kept only as long as needed to investigate abuse.

SELLING AND SHARING

We do not sell personal information. We do not share it for cross-context behavioral advertising. We share it with the processors above so they can run the site, and when the law requires disclosure.

YOUR RIGHTS

Depending on where you live, you can ask to access, correct, delete, or export your personal information, and to object to or restrict certain processing. You may also complain to a regulator. We will not discriminate against you for making a request.

GDPR (EEA and UK). You have rights of access, rectification, erasure, restriction, portability, and objection, and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. This site does not make that kind of decision. You may lodge a complaint with your supervisory authority. Where we rely on consent, you can withdraw it at any time.

CCPA / CPRA (California). You have the right to know the categories of personal information we collect (identifiers such as email and username, account credentials held by our auth provider, and user content), the right to delete, the right to correct, and the right to opt out of sale or sharing. We do not sell or share personal information as those terms are defined. You may use an authorized agent. We will verify the request using your account email.

PIPEDA (Canada). You may ask for access to the personal information we hold, ask for a correction, and challenge our compliance with the Office of the Privacy Commissioner of Canada.

Quebec Law 25. You may ask for access, rectification, and information about the categories of people who receive your information. The contact address below is the place to reach the person responsible for the protection of personal information. You may also file a complaint with the Commission d'accès à l'information du Québec. If a confidentiality incident presents a risk of serious injury, we will notify affected people and the Commission as the statute requires.

DELETION REQUESTS

Email the contact address below from the address on your account and ask us to delete it. Include your username. We may need to confirm you control the account. Deletion removes the login and profile. Public posts may be removed or left up with the author replaced by a deleted-user label when removing them would break a thread. Moderators can also suspend an account; a suspended user is told that on the suspension page.

CHILDREN

The site is not directed at children under 16. We do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

CHANGES AND CONTACT

We will post changes on this page and update the date above. Continued use of the site after a change means you have seen the new policy.

Contact: info@nebula500.com.