Privacy policy

1. Controller and contact

• Controller: the operator of this site (“the operator”)
• Privacy officer: the operator
• Contact for privacy questions and complaints: metaaccountbanhelp@proton.me

Questions, complaints and requests about personal information can be sent to the contact above.

2. Information we process

The site has no member accounts. We do not ask visitors for an account or an email address.

• Posts and comments: title, text, language, nickname, password, and when it was written or edited. The password is stored only as a one-way hash (bcrypt).
• Abuse prevention (IP hash): when you post, comment, report, try a password to edit or delete, open a post or like it, your IP address (for IPv6, its first 64 bits) is combined with a secret value and turned into a SHA-256 hash. The site’s database never stores the IP address itself.
• Reports: the reason, optional details, when it was made, and the IP hash and network hash of where it came from (the network hash is a salted SHA-256 hash of the IP address range: the first 24 bits of an IPv4 address, the first 48 bits of an IPv6 address)
• Wrong-password records: when a wrong password was tried, on which post or comment, and the IP hash
• View and like records: so that views and likes are not counted twice from the same place, the day a post was opened or the time it was liked, with the IP hash
• Generated automatically: access logs (IP address, pages requested, time of access, browser details and similar). These are recorded and kept by our hosting and database providers as part of providing their service.
• Anti-bot check: the information Cloudflare Turnstile uses for its check when you post, comment or report (IP address, browser details and similar)
• Automatic title translation: when you write a post or change its title, only the title is sent to Google Cloud Translation to be translated into the site’s other languages, and the translated titles are stored with the post. The text, comments, nickname and anything else about the writer, such as the IP address, are not sent to Google. To cap the amount translated per day, the writer’s IP hash and the number of characters are recorded each time.
• Admin sign-in: the email address and sign-in records of the admin account (the site admin only)

If you only read the site, we receive no personal information other than the access logs above.

3. Purposes

• Providing the boards (showing posts and comments, checking passwords for edits and deletions, automatic translation of post titles)
• Preventing flooding and abuse (limiting posts, comments and reports from one connection, allowing one report per connection, making sure reports from a single network cannot hide content automatically, blocking password guessing, stopping automated submissions, capping the amount translated per day)
• Handling reports and enforcing the rules
• Answering questions and handling requests to exercise your rights
• Keeping the service secure and fixing faults

4. Retention

• Posts and comments (title, text, nickname): when the author deletes one with the password, or the admin removes it, it disappears from public pages at once. The title, text and nickname of deleted posts are still kept in the database to deal with reports and disputes; there is currently no automatic deletion period for them (they are kept until the operator deletes them).
• Password hashes: until the post or comment is deleted. Its password hash and IP hash are erased at the moment of deletion.
• IP hashes (posts, comments, reports) and network hashes (reports): 30 days. A job that runs once a day clears hashes older than 30 days, so each is gone within a day after its 30 days. The IP hash of a post or comment deleted before then is erased at deletion.
• Wrong-password records: 1 day. The same job clears records older than a day, so each is gone within a day after that.
• View records: until the next day (cleared by the same job). Like records: 30 days (cleared by the same job; the post keeps its like count).
• Translated titles: while the post is published. Changing the title or deleting the post deletes them at once. Translation records (IP hash and number of characters): 1 day (cleared by the same job).
• Reports (reason and details): kept as a moderation record after they are handled (their IP and network hashes are cleared after 30 days, as above).
• Access logs and IP addresses: kept by the hosting and database providers for the period they set for security and operations (the exact periods will be added before this policy takes effect)
• Admin account information: until the admin account is deleted

Unless the law requires us to keep it, we do not keep personal information after its retention period ends.

5. Deletion

Personal information is destroyed without delay once its retention period ends or its purpose has been achieved. Electronic files are deleted in a way that cannot be recovered. We do not process personal information on paper.

6. Disclosure to third parties

We do not provide personal information to third parties, except where a law specifically requires it or it is unavoidable to meet a legal obligation (for example, a warrant from an investigative authority).

7. Processors and international transfers

We use the following providers to run the site. All four are US companies, so personal information is transferred abroad. The details below are disclosed as required by Article 28-8(1)(3) and (2) of PIPA.

How to refuse, and what happens if you do: if you do not want your information transferred abroad, do not post, comment or report. You can still read the site. Access logs are created whenever the site is visited and are needed to deliver it, so the only way to avoid them is not to use the site. When you write a post or change its title, the title is transferred to Google to be translated. If you do not want that, do not put personal information in the title, or do not post. Deleting a post also deletes its translated titles.

8. Your rights

You can ask at any time to access, correct or delete your personal information or to stop its processing.

• You can edit or delete your own posts, and delete your own comments, with the password you chose.
• For anything else, write to the contact email (metaaccountbanhelp@proton.me). We will act without delay; requests for access are answered within 10 days. As there are no accounts, a request may be limited if we cannot tell whether you wrote the content concerned.
• A legal representative or someone you authorise can make a request for you, with a letter of authorisation.
• Where another law limits a request, we will tell you why.

9. Children under 14

Children under 14 must not post, comment or report. The site has no way to obtain a parent’s or guardian’s consent. If we learn that we have processed personal information of a child under 14, we will delete it without delay.

10. Public information and sensitive data

Posts, comments, nicknames and posting times, and the automatically translated titles, are visible to everyone. Password hashes, IP hashes and network hashes are never public and are not shown on the site’s admin pages either.

Do not write real names, contact details, login information, ID documents or sensitive information such as health or criminal records — yours or anyone else’s. If you do not want something to be public, do not post it; you can delete your own posts with your password.

11. Security measures

• Encryption in transit (HTTPS)
• Passwords stored only as bcrypt hashes, IP addresses and address ranges only as salted SHA-256 hashes
• Writes to the database only through the site’s server (checked with a key only the server knows); password, IP and network hashes cannot be read from outside, by column-level permissions
• Row-level security in the database, so that only published content is visible from outside
• Administrative functions limited to the signed-in admin
• Security features provided by our processors

12. Cookies and similar technologies

We do not use cookies for visitors. Only when the admin signs in is a session cookie used to keep the admin signed in. We do not use advertising or analytics cookies or trackers.

If you dismiss the language suggestion banner, that choice is saved in your browser’s local storage. It is not sent to our servers and is removed when you clear the site’s data in your browser.

When you open an address without a language prefix (such as the home page), the site picks the language from your browser’s language setting and the country our host (Vercel) infers from your IP address. Neither is stored.

The anti-bot check on the post, comment and report forms (Cloudflare Turnstile) processes browser information while it runs. See the Cloudflare Turnstile privacy addendum (abre em uma nova guia) for details.

13. Where to get help in Korea

For advice on or to report a privacy infringement, you can contact:

• Personal Information Infringement Report Center (KISA): 118 (in Korea), privacy.kisa.or.kr (abre em uma nova guia)
• Personal Information Dispute Mediation Committee: 1833-6972 (in Korea), www.kopico.go.kr (abre em uma nova guia)
• Supreme Prosecutors’ Office: 1301 (in Korea)
• Korean National Police Agency: 182 (in Korea)

14. Users in the EU and UK (GDPR and UK GDPR)

• Legal bases: we provide the boards (including the automatic translation of post titles) on the basis of contract — the terms of use (Article 6(1)(b) GDPR) — and process IP and network hashes to prevent flooding and abuse and to handle reports on the basis of our legitimate interests (Article 6(1)(f)).
• Your rights: you can ask for access, rectification, erasure, restriction of processing and data portability, and you can object to processing based on legitimate interests. You also have the right to complain to a supervisory authority, for example where you live or work or where the infringement took place (in the UK, the ICO).
• Transfers: the operator is based in the Republic of Korea, which is covered by an EU adequacy decision; the UK also recognises Korea as providing adequate protection. Transfers to our US providers rely on the EU-US Data Privacy Framework where the provider is certified, or on other appropriate safeguards such as standard contractual clauses.

15. Changes to this policy

We will announce changes on the site at least 7 days before they take effect, or 30 days before for changes that significantly affect your rights.

Effective date: to be set (draft)