Privacy & Cookie Policy

1. Data controller

The controller of the personal data collected through this site is the operator of the PolyVeritas editorial project. For any privacy matter and to exercise your rights, the contact channel is [email protected].

2. Data processed, purposes and legal bases

• Account data (name, username, email, password stored exclusively as a bcrypt hash): registration and authentication; legal basis: performance of a contract (art. 6(1)(b) GDPR).
• User-generated content (comments, saved articles, profile picture): provision of the service features; basis: performance of a contract (art. 6(1)(b)).
• IP address and technical request data, kept temporarily in memory for rate limiting and in infrastructure logs: security and abuse prevention; basis: legitimate interest in the security of the service (art. 6(1)(f)).
• Contact emails sent to the editorial team: replying to requests; basis: legitimate interest / pre-contractual measures.

We do not sell personal data, we do not run advertising profiling, and we make no automated decisions with legal effects on individuals.

3. Recipients and providers

Data is processed through the following providers (processors or independent controllers), which may involve transfers outside the EU (United States), covered by the safeguards of arts. 44 ff. GDPR (standard contractual clauses and/or EU-US Data Privacy Framework certification, as stated in their respective terms):

• Railway Corp. (USA) — application and database hosting.
• Cloudflare Inc. (USA/EU) — DNS and, when active, security proxy/CDN.
• OpenRouter Inc. (USA) — AI processing of editorial content (receives no registered-user data).
• Tavily (USA) — source research for editorial content (receives no registered-user data).
• cron-job.org (Germany) — scheduling of automated generation (no personal data).

4. Retention

• Account data and associated content: for the lifetime of the account; upon account deletion, identifying data is removed.
• Comments of deleted accounts: removed together with the account.
• IP addresses for rate limiting: kept in volatile memory for the control window only (minutes/hours), never archived.
• Technical logs of the hosting infrastructure: per the provider's retention (order of days/weeks).

5. Your rights

You can exercise at any time your rights of access, rectification, erasure, restriction, portability and objection (arts. 15-22 GDPR) by writing to [email protected]. You also have the right to lodge a complaint with the data protection authority of your country of residence. If you are outside the EEA, you may have equivalent rights under your local privacy laws (e.g. CCPA/CPRA, UK GDPR, LGPD, PIPEDA): requests through the same contact channel are honoured wherever applicable.

6. Minimum age

The service is restricted to people aged 18 or over, given the nature of the content (analysis of real-money prediction markets). Registration requires a declaration of majority age.

7. Cookies and similar tools

This site uses technical cookies only, which do not require consent:

• next-auth.session-token (and related cookies) — session cookie for authenticating registered users; duration: session/30 days.
• next-auth.csrf-token — anti-CSRF protection for forms; duration: session.
• locale — stores the preferred language; duration: 12 months.

We use no profiling, advertising or third-party tracking cookies. Should any be introduced in the future, this notice will be updated and consent will be requested through a banner.

8. Security and breaches

We adopt appropriate technical measures: TLS encryption, passwords stored with bcrypt hashing, signed sessions, input validation and sanitisation, server-side access control and request rate limiting. In the event of a personal data breach posing a risk to individuals, the controller will carry out the notifications required by arts. 33-34 GDPR.

9. Changes

Material changes to this notice will be announced on the site and, for registered users, by notice to the email address associated with the account.