Privacy Policy

What we collect

We collect as little as the site needs to work:

• If you only read: nothing that identifies you. Our host (Cloudflare) processes your IP address to deliver pages and block abuse. We count page views with Cloudflare Web Analytics, which sets no cookies and does not track you across sites. On story pages we count reads, how far through the text readers get and roughly how long they read, stored per device as keyed hashes with no cookie needed, so writers and editors can see which stories hold readers.
• If you like or vote: a random device identifier stored in a cookie, so one device counts once. We store a keyed hash of it and of your IP address, never the raw values. Hashes help us exclude automated or duplicate votes.
• If you create an account: your email address and name (from Google or the email you enter), and the stories you save, your reading progress, your likes and votes, and your email preferences.
• If you submit a story: the story, the details you add (place, rough date, an optional image), how you want to be credited, the permissions you give and when you gave them, and messages between you and our editors. Your email is used to contact you about the submission and is never published. If you send a story without signing in, we keep it in an account for the email you give (created for you if needed, with no password); you choose whether we email you about it, and you can sign in with that email to see it.
• If you send an advertising enquiry: your name, company, email and message.
• If you comment: the comment, when you posted it, and any reports you make about other comments. If you follow an author: who you follow.
• If you apply to become an author: your legal name, the public name you choose, your phone number, your writing sample, our decision and note, and which version of the author agreement you accepted and when. Your legal name and phone number are seen only by our editors and are never published; your public name is shown on your stories and author page. Deleting your account deletes your application.
• If you are a named author: the profile you give us (photo, short bio, links to your public social accounts).

Google user data

If you choose "Continue with Google", we request only your basic profile: your name, email address and profile picture (the "openid", "email" and "profile" scopes). We use them only to create and sign in to your account, show your name on your shelf, and contact you about your submissions and any emails you opt in to. We do not request access to your Gmail, Drive, contacts or any other Google data.

We do not sell Google user data, use it for advertising, or share it with third parties except our infrastructure providers listed below, which process it on our behalf to run the service.

Enigma Archives' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use it

We use your information to:

• run your account, shelf and reading history;
• count votes and likes fairly and stop spam and fraud;
• review, edit, translate, publish and, if you allow it, adapt submitted stories, within the permissions you gave;
• send emails you asked for (a reminder when a part comes out, video alerts, collection updates, the monthly letter, new stories from authors you follow). These are off until you choose them;
• tell you about your own activity: replies to your comments, comments on stories you wrote, and when a story you submitted is published or becomes a video. These are on by default because they concern things you did, and you can turn them off in your account. Every email has a one-click unsubscribe link;
• review comments before they appear, act on reports, and stop people who break the rules from commenting;
• count clicks on sponsor links as a daily total per sponsor, for the sponsor's report. Sponsors never receive anything that identifies you;
• reply to advertising enquiries;
• keep the service secure and meet legal obligations.

Cookies and local storage

We use a small number of first-party cookies and browser storage, all needed for features you use: the device cookie for votes and likes, a marker that you have interacted (so we only ask for your vote state when needed), your sign-in session, and preferences such as day/night mode, text size and recent searches. Cloudflare Turnstile, which protects our forms from bots, may set its own cookie.

Stories that became videos show a picture of the video. TikTok's player loads only if you press play; TikTok then receives your IP address and may set its own cookies, under TikTok's privacy policy. Until you press play, nothing is sent to TikTok.

We do not use advertising or cross-site tracking cookies today. If we add display advertising, we will update this policy and ask for consent where the law requires it before any such cookie is set.

Who processes data for us

We share data only with providers that run the service for us, under their data-processing terms:

• Cloudflare (hosting, security, bot protection);
• Supabase (database, sign-in and file storage);
• Google, only if you choose to sign in with it;
• Resend, our email provider, only to send emails you asked for.

What is public

Published stories show only the credit you chose: full name, first name, a pseudonym, or Anonymous. Your contact details, account and any private messages are never public. Vote and like totals are public; who voted is not.

Comments are public once an editor approves them, shown with the display name on your account (you can change it) and never with your email. Author profiles show what the author chose to share. Follower counts are public; who follows whom is not.

How long we keep it

• Account data: until you delete your account.
• Comments: until you delete them, an editor removes them, or you delete your account. Reports are kept while the comment exists.
• Vote and like records: kept without any link to you once your account is deleted, so public totals stay accurate.
• Submissions: while under review and, if published, for as long as the story is published under the permissions you gave. Rejected submissions are deleted within 12 months.
• Advertising enquiries: up to 12 months.
• Security logs at our providers: as set by their policies, typically up to 30 days.

Your choices and rights

You can change email preferences and delete your account at any time from "You" → your shelf. Deleting your account erases your profile, saved stories, reading history, reminders and submissions. A story already published from your submission stays under the permission you gave unless you ask us to remove it; we will then unpublish it. Videos already published on TikTok may not be fully retractable.

You can ask us for a copy of your data, to correct it, or to delete it by emailing hello@enigmaarchive.com. We reply within 30 days. Step-by-step deletion: https://enigmaarchive.com/en/data-deletion.

Children

The site is not directed at children under 13, and we do not knowingly create accounts for them. If you believe a child has given us personal data, contact us and we will delete it.

Security

Data is encrypted in transit. Access to stored data is limited by database rules, and staff can sign in only through their Google accounts. No system is perfectly secure; if a breach affects you, we will tell you and the relevant authorities as the law requires.

Changes and contact

We will post any change here and update the date above. For significant changes we will tell signed-in readers by email or on the site.

Questions: hello@enigmaarchive.com. Enigma Archives, Maldives.