Privacy policy

Who is responsible

Broadside is a personal project run by one person, who is responsible (the “controller”) for the personal data described here. The exception is what publishers collect from their readers, such as form answers and private comments: for that, the publisher is responsible and we store it for them (see the terms).

Write to privacy@broadside.page about anything in this policy. We answer within one month.

What we collect

If you have an account

• Your email address, your username, your name or your organisation's name, and your password, which we keep only as a strong one-way scramble (a hash).
• What you tell us when you start: who you share for and, if you choose, your town and country. We never read your location from your device.
• Your profile picture and the name you show on your profile, if you add them, and the language you use Broadside in.
• Passkeys, if you add them: only the public half is kept; the private half never leaves your device.
• The codes we email you to confirm your address, kept scrambled for 10 minutes.
• For each log-in, the session, with the internet address and browser it was opened from, so that you stay logged in and we can spot misuse.
• What you ask us for, such as more places for pieces, and our answers.

What you publish

Your files, the page images and text we make from them, captions, settings and forms, and the results of our checks: scores for each page, the links and QR codes found, and decisions made by a person. Your original files are never shown to readers.

If you read or respond

• A visit, each time you open a piece: which piece, which pages you saw and for how long, whether you came from its QR code, a link or the board, the kind of device (phone, tablet or computer), your browser's language, the website that sent you, and your country (two letters, from our network provider; nothing finer). A post seen on the board for about a second counts as a visit too.
• To count each reader once without a cookie, we scramble your internet address and browser with a secret that changes every day and keep only the result. The secret is deleted at the end of its day; after that, the result cannot be linked to you or to your other visits. Your internet address itself is never stored.
• If you say yes to being remembered (“May we remember this device?”), your browser keeps a random device code, so coming back to a piece does not count you as a new reader. If you are logged in, your account is used for this instead. Either way we keep only a scrambled key per piece, and the publisher sees only totals, never who you are.
• Reactions and likes: when you are not logged in, your browser keeps a random code for each one, so you can take it back. We keep only a scrambled copy, and nothing that ties one reaction to another.
• Comments, which need an account: what you write, the page it is about, and your account. Your username and picture appear beside your public comments.
• Who you follow and who follows you, and when, kept until either account is deleted. Anyone can see how many people follow you and how many you follow, but not who.
• Form answers: what you type and when, with the day's scrambled visitor code or your account, used only to limit how often one person can answer. The publisher does not see your account.
• Reports: the reason, any details you add (read only by us), and a scrambled code so that one person cannot report the same piece twice.

When you write to us

Your email address and what you write.

To keep Broadside running

Our network provider sees your internet address in order to deliver Broadside and protect it from attacks. To slow down anyone guessing passwords, we count log-in attempts under a scrambled copy of the internet address, for one day at most. Our server's technical logs are deleted after 14 days.

Why we use it

We use your data only for these purposes, each on the legal basis named in brackets (articles of the EU's General Data Protection Regulation, GDPR):

To run your account and your pieces

and show them to readers as your settings say (our agreement with you, the terms: Art. 6(1)(b)).

To keep Broadside safe

checking uploads, stopping spam and abuse, handling reports, protecting accounts and enforcing bans (our legitimate interest, and our users', in a safe service: Art. 6(1)(f)).

To tell publishers how their pieces are read

in totals that never identify a reader (legitimate interest: Art. 6(1)(f)).

To remember a device

only if you said yes, so that you are counted once (your consent: Art. 6(1)(a)). You can take it back at any time, below, without affecting what was counted before.

To meet legal duties

such as answering lawful requests from authorities and reporting child sexual abuse (Art. 6(1)(c)).

We do not sell personal data. Today we do not use it for advertising, build profiles of you, or use your pieces or responses to train AI models. That may change as Broadside grows; if it does, we update this policy first, tell you before it applies, and ask for your consent where the law requires it.

No decision with legal or similarly serious effects on you is made by automatic means alone. Automatic checks can hold a piece back for a person, or block a link known to be dangerous; a person decides every ban.

Who else sees it

Readers

see what you publish. Next to pieces you list on the board, they see your username, your picture, and your town and country if you gave them. Your profile shows the same, with the pieces you list on the board and how many people follow you and you follow; your town and country appear there only once you have listed a piece. If you add a name to your profile in your settings, your profile shows it under your username, and nowhere else. Profiles are kept out of search engines. Never the name on your account or your email address.

Publishers

see the comments and form answers sent to their pieces, and totals of how they were read. They do not see who read them.

Our hosting provider

in the European Union runs our server and database.

Cloudflare

delivers Broadside, protects it from attacks, stores our files in its EU storage, sends our emails (such as your confirmation code), and forwards email sent to our addresses. Cloudflare, Inc. is based in the United States.

Google (Web Risk)

receives the web addresses found in published pages, never who published or read them, to check them against lists of dangerous sites.

Authorities

when the law requires it, and when we report child sexual abuse or a threat to someone's life.

Our service providers work under contracts that bind them to our instructions. If Broadside is ever handed to someone else to run, your data goes with it only under this policy, and we tell you first.

Where it is stored

Our server, database and files are in the European Union. Cloudflare's network delivers Broadside from the place nearest to you, so your internet address may be handled outside the EU. Cloudflare and Google are certified under the EU–US Data Privacy Framework and also use the EU's standard contractual clauses.

How long we keep it

Your account

until you delete it.

A piece you delete

is erased shortly after, with its files, responses and counts. When you replace a piece, the old version's page images are deleted 24 hours later, so readers who opened it can finish.

Sessions

30 days after your last visit, or until you log out.

Visits

90 days. After that only daily totals remain, which say nothing about any reader.

The daily secret

deleted at the end of its day.

Counters that limit how often something can be done

one day at most.

Your answer to “May we remember this device?” and the device code

13 months, or until you take your yes back.

Comments and form answers

until you or the publisher delete them, or the piece or the account is deleted.

Follows

until you unfollow, or either account is deleted.

Reports and moderation records

12 months after the decision; longer only while an appeal, a dispute or a legal duty needs them.

Bans

see below.

Email you send us

as long as we need it to deal with your request, and two years at most.

Backups

encrypted, and gone within 30 days.

If an account is banned

To stop a banned person coming back, we keep:

• a scrambled copy of the account's email address, so it cannot be used to sign up again;
• a ban code in each browser the account is still logged in on, given the next time that browser opens Broadside. The code is random and says nothing about the person; we keep only a scrambled copy. A browser with a ban code cannot open or use an account.

These are kept as long as the ban lasts. The removed content and our notes on the decision are kept for 12 months, longer only while an appeal or a legal case needs them.

We do not fingerprint devices, and we do not ban internet addresses, because schools, libraries and offices share them. We do this because of our legitimate interest, and our users', in keeping out people who scammed, exploited or endangered others (Art. 6(1)(f)). You can appeal a ban (see the terms).

Cookies and your browser

Broadside uses no advertising or tracking cookies and no outside analytics service. This is everything it keeps in your browser:

Log-in cookie

keeps you logged in; 30 days after your last visit, or until you log out.

Language

the language you picked, set only when you pick one; one year.

Theme

light or dark, on wide screens, if you chose one; until you change it.

Logged-in hint

a “1” that lets the menu take its shape before your session loads. It says nothing about who you are.

Reaction and like codes

one random code per reaction or like, saved only when you tap, removed when you take it back.

Device memory

your answer to “May we remember this device?” (asked only on a piece, only if you are not logged in) and, only after a yes, a random device code; 13 months.

Ban code

only in browsers of banned accounts (see above).

All of these are needed for something you asked for, so they need no consent, except the device code, which is set only after you say yes. To take your yes back on this browser:

Your rights

Wherever you live, you can ask us to:

• show you the personal data we hold about you, and give you a copy in a common format;
• correct it (you can change your username, name, town and picture yourself in Settings);
• delete it;
• limit how we use it while something is being checked;
• stop using it where we rely on our legitimate interest, unless we have strong reasons to go on, such as a ban;
• take back a consent you gave, at any time.

Write to privacy@broadside.page, from your account's email address if you have one. We may ask you to show that the data is yours; we answer within one month, and it is free.

As a reader, we usually cannot find your visits, because we never knew who you were; that is the point. For form answers and private comments, ask the publisher first; we help them answer you.

You can also complain to a data protection authority, in particular in the EU country where you live or work, or where you think the problem happened.

Children

Accounts are for people aged 13 and over, and under 18 with a parent's or guardian's agreement. Reading needs no account. Today there are no adverts and no profiling, for anyone. If we learn that someone under 13 has an account, we delete it. Parents can write to privacy@broadside.page.

Security

Passwords are hashed with Argon2id, connections are encrypted, uploads are checked for what they really are, original files stay in private storage, and readers only ever receive page images we made. No system is perfect: if your data is ever exposed in a way that puts you at risk, we tell you, and the authorities, as the law requires.

Changes to this policy

When this policy changes, the date at the top changes too. If a change matters to you, such as a new service provider or a new use of your data, we tell you before it applies.