Controller
The controller responsible for processing personal data is Andreas Cadosch, Zürich. Privacy enquiries can be sent to us through the contact form.
What data we process
Account data (email address, username, display name, password stored only as a cryptographic hash), optional profile details (location, website, short bio, avatar), the content you publish (forum posts, comments, gallery images, news, topic pages), your direct messages, and technical server logs (including IP address, kept briefly, for abuse defence and troubleshooting).
Legal bases
Processing is carried out to perform the usage relationship (Art. 6(1)(b) GDPR / contract performance under the Swiss revDSG) for account and services, and on the basis of legitimate interests (lit. f) for security, spam protection, abuse prevention and server logs.
Cookies and browser storage
We set strictly necessary cookies only: «__Secure-better-auth.session_token» (your login session, only while you are signed in), «NEXT_LOCALE» (your language choice) and «acta_pw_notice_dismissed» (remembers for 180 days that you dismissed the notice about setting a new password). Moderators who open the preview of a draft additionally receive «__prerender_bypass», which expires when the browser is closed. A few items stay only in your browser's storage (localStorage or sessionStorage) and are never sent to us: «acta-theme» (light or dark appearance), for the current browser session a note of which conversations you have already marked as read, and in the administration area unsaved form drafts (at most 7 days) and sidebar widths. There are no analytics, tracking or advertising cookies, and the spam protection (see below) sets no cookies on this website either. A cookie consent banner is therefore not required.
Fonts
All fonts are served from our own server (self-hosted). No requests are made to Google Fonts or other external font services, so no IP address is transmitted to third parties.
Embedded videos (YouTube / Vimeo)
Videos are embedded using click-to-load. Before you click, nothing is transmitted to YouTube or Vimeo — no cookie, no IP address, no request. Only when you click «Load video» is the player loaded (in privacy-friendly mode: youtube-nocookie.com or Vimeo with «Do Not Track»), and from that point data is transmitted to the respective provider.
Images in forum posts
Images in forum posts are served from our own server, including those that older posts originally embedded from other websites. If a new post points to an image on a third-party server, it is embedded using click-to-load: before you click, nothing is transmitted to that server — no cookie, no IP address, no request. Only when you load the image does your browser fetch it directly from the third-party server, which then receives your IP address and technical details about your browser. Our server never fetches such addresses itself.
Spam protection (Cloudflare Turnstile)
When you register, when you use the contact form without being signed in, and when you start a new conversation within 24 hours of registering, we use Cloudflare Turnstile to check that a human is submitting the form. As soon as you open one of these forms, your browser loads a script and a verification frame from challenges.cloudflare.com. Cloudflare receives your IP address, technical details about your browser and connection (user agent, TLS characteristics) and the domain of this website. On this website Turnstile sets no cookies and stores nothing in your browser's storage; what Cloudflare processes inside its own verification frame is described at cloudflare.com/turnstile-privacy-policy. The provider is Cloudflare, Inc. (USA); the transfer relies on the EU-U.S. and Swiss-U.S. Data Privacy Framework, under which Cloudflare is certified. Cloudflare processes the data on our behalf to fend off bots and, by its own account, also as an independent controller to improve its bot detection. The legal basis is our legitimate interest in protecting against spam and abusively created accounts (Art. 6(1)(f) GDPR).
Email delivery
Transactional emails (verification, password reset, notifications) are sent via Brevo (Brevo SAS, EU). You can unsubscribe from individual notifications at any time under Notifications.
Hosting
The application runs on a server at Netcup (Germany, EU); all content is stored in a PostgreSQL database on the same server. Encrypted backups are created regularly.
Direct messages
Direct messages are stored on the server in plain text (not end-to-end encrypted) and protected by our access, backup and audit measures. You can export your messages or have them removed via account deletion at any time.
Retention
We store account and content data for as long as your account exists. The email send log (outbox) is deleted automatically after 90 days; server logs are kept only briefly.
Your rights
You have the right to access and data portability (self-export under Data & account), to rectification (via profile editing), to erasure of your account (in the same place), and to object to or restrict processing. Requests without an account can be sent to us through the contact form.
Right to complain
If you believe your data is being processed unlawfully, you can lodge a complaint with the competent supervisory authority (in Switzerland the Federal Data Protection and Information Commissioner FDPIC, in the EU the respective data protection authority).
Changes to this policy
We may update this privacy policy, for example when services or the legal situation change. The version published here is always the authoritative one.
