Privacy Policy

1. What we collect

Account data: email, password (stored as a salted scrypt hash — we never see it), membership status and expiry, source (signup / code / payment).

Mirrored order data: to grant access to the right account we store the Paddle customer ID, subscription status and period, order amount and currency, and which volume was bought. Payment instrument details stay with Paddle only.

What you send us: the name, email and text of letters to the Desk, plus the IP and its coarse region at submission time (for spam and abuse handling).

First-party traffic statistics: time, path, language and referring domain, plus a hash of the IP address (salted with a server secret and truncated, so it cannot be reversed) used for de-duplication and rate limiting. No advertising cookies, no third-party tracking pixels.

Browser storage: session cookies (sign-in state and CSRF protection; HttpOnly / SameSite=Lax) and one localStorage flag that only tells the header whether you are signed in.

2. What we do not do

No third-party ad networks, no cross-site behavioural tracking, no marketing profiles, and we never sell or rent your data.

Advertising in the paper, when present, is labelled by the Desk and kept physically apart from editorial; we do not use tracked ad delivery.

3. Who we share it with (processors)

Paddle.com Market Ltd (merchant of record): payments, invoices, tax, refunds and chargebacks. We exchange the customer ID and order status with Paddle to identify your subscription; Paddle's own privacy policy applies to its processing.

Cloudflare: CDN and security (WAF, DDoS mitigation). Its edge nodes process the visiting IP and may set security cookies such as __cf_bm.

Web fonts: the fonts we use (Noto Serif SC, Noto Sans SC, Playfair Display) are self-hosted by us under the SIL Open Font License 1.1 — nothing is requested from Google or any other third-party font service, so your IP is not disclosed to one.

Email service: transactional mail (email verification, password reset, order notices) is sent through the configured mail provider.

Otherwise we disclose personal data only where the law compels us to.

4. Why we process it (legal bases)

Contract: granting membership and single-volume access, delivering content, handling refunds and support.

Legitimate interests: site security and abuse prevention (rate limiting, spam handling, incident investigation) and anonymous traffic statistics.

Legal obligation: keeping transaction and invoice records for tax and accounting law.

Consent: sending you email you asked for, and processing letters you submit; you can withdraw at any time.

5. How long we keep it

Account and entitlement data: for as long as the account exists. After deletion we keep only what tax/accounting law requires for transactions, and delete or anonymise the rest.

Traffic statistics: kept in de-identified (hashed-IP) form for analytics, with detail pruned periodically.

Letters: kept for a reasonable period after handling (normally no more than 24 months).

6. Your rights

You can ask to see the personal data we hold, correct it, export a copy, delete your account and data, object to traffic statistics, or withdraw consent.

Write to hello@pawtimes.press from your account email; we normally answer within 30 days. If you are unhappy with our response you can complain to your local data protection authority.

7. Children

PawTimes is written for adult readers. If you are under 16, please use it with a parent or guardian's consent; we do not knowingly collect children's data.

8. International transfers

Paddle and Cloudflare may process data outside your country (including outside the EU/UK), relying on their compliance mechanisms such as standard contractual clauses.

9. Security

HTTPS site-wide; passwords stored as salted hashes; database and admin area reachable only locally and by controlled accounts; Paddle webhooks are signature-verified; admin sign-in has lockout and constant-time comparison.

10. Changes and contact

Updates appear on this page with a "last updated" note. Data requests and questions: hello@pawtimes.press.