Privacy Policy

1. Who is responsible for your data

saturn.faith is an independently operated, invite-only personal profile hosting service. The operator of saturn.faith is the data controller for the personal data described in this policy. You can reach us at saturnfaithlegal@gmail.com for any privacy request or question, including the requests described in sections 8 and 9.

2. Data you give us directly

• Account data. Your email address, username, and a password hash. We never store your password in a readable form; it is hashed with Argon2 and cannot be recovered by us or by anyone who obtains the database.
• Invite data. The invite code you redeemed and which member issued it, so invite trees and abuse can be traced.
• Profile content. Everything you choose to publish: display name, biography, location text, links, colors and layout settings, badges, diary entries, comments you post, and the friend relationships you accept.
• Uploads. Avatars, background images, video, audio, cursors, and click sounds you upload, along with their file metadata.
• Linked identifiers. Optional third-party identifiers you enter, such as a Discord user ID or a Minecraft username, used only to render the widgets you enabled.
• Consent records. The date and policy version you accepted at registration, which we are required to be able to demonstrate.

3. Data collected automatically

• Session cookies. A signed authentication cookie that keeps you logged in. It is strictly necessary for the service and is not used for advertising or cross-site tracking.
• Profile view counts. When a profile is viewed we store a one-way hash derived from the visitor's IP address and browser user-agent, together with a timestamp. The hash lets us de-duplicate views without retaining the IP address itself in the view record.
• Server and security logs. Our web server and reverse proxy record request metadata, including IP address, requested URL, status code, and user-agent, for security, abuse prevention, and debugging.

We do not run advertising networks, third-party analytics suites, behavioural profiling, or cross-site tracking pixels, and we do not attempt to identify you across other websites.

4. Why we use your data, and our legal bases

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to create and authenticate your account, host your profile, and deliver the features you enable.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse and spam, enforce our Terms, understand aggregate load, and maintain the invite system. We balance these interests against your rights and use the least identifying data that works.
• Consent (Art. 6(1)(a)) — for optional features you switch on, such as third-party widgets, and for accepting these policies at registration. You may withdraw consent at any time by disabling the feature or deleting your account.
• Legal obligation (Art. 6(1)(c)) — to respond to valid legal process and to retain records where the law requires it.

Publishing a profile is inherently public. Anything you place on your profile, diary, or comments is visible to anyone who can reach the page, and may be cached, indexed, or copied by third parties outside our control.

5. Third parties and embedded services

Some features load resources from, or send requests to, third parties. When that happens your browser or our server contacts them directly and they may receive your IP address and request metadata under their own privacy policies. We do not sell your data to them.

• Hosting and network. Our server host and our DNS/CDN provider process traffic on our behalf as processors.
• Spotify and SoundCloud. Used to fetch public track titles and album artwork for the media player when you paste a track link.
• Discord presence. If you enable the Discord widget, your Discord user ID is sent to a public presence API to display your status.
• Minecraft profile services. If you link a Minecraft username, we query Mojang's public API to render your skin.
• Object storage. Uploaded media may be stored with a third-party object storage provider acting as our processor.

We may also disclose data where we are legally required to, to protect the rights, property, or safety of saturn.faith, our members, or the public, or in connection with a transfer of the service, in which case this policy will continue to apply to data transferred.

6. How long we keep data

• Account and profile data: for as long as your account exists.
• Uploads: until you remove them or your account is deleted. Copies may persist briefly in caches and backups.
• View-count hashes: retained in aggregate; individual view records are pruned over time.
• Server and security logs: retained for a short rolling period, then rotated out.
• Consent records: retained for as long as needed to demonstrate that consent was given, even after account deletion where required for legal defence.

When you delete your account, your profile, uploads, diary entries, comments, and friend relationships are deleted from the live database. Content that other members have quoted or reposted, and third-party caches or search engine indexes, are outside our control.

7. Security

Traffic is served over HTTPS. Passwords are hashed with Argon2. Database access is restricted to the application host and is not exposed publicly. Uploads are validated and served from a restricted media path. No system is perfectly secure, so we cannot guarantee absolute security, and you are responsible for keeping your password confidential and for the security of the devices you use. If a breach affecting your personal data occurs, we will notify affected members and any competent supervisory authority where the law requires it.

8. Your rights in the EEA and UK

If the GDPR or UK GDPR applies to you, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• restrict or object to processing based on legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, without affecting processing already carried out; and
• lodge a complaint with your national data protection authority.

Contact saturnfaithlegal@gmail.com to exercise any of these rights. We respond within one month and may ask you to verify control of your account before acting. Exercising your rights is free and will not result in worse service.

9. Your rights in California and other US states

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and how it is used, to request deletion, to request correction, to opt out of the sale or sharing of personal information, and not to be discriminated against for exercising those rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not knowingly process sensitive personal information for the purpose of inferring characteristics. Members in other US states with comparable privacy laws may exercise equivalent rights through the same contact address.

10. International transfers

saturn.faith is operated from, and hosted on, infrastructure that may be located outside your country, including in the United States. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses with the providers involved.

11. Children under 13

saturn.faith is not directed to children and you must be at least 13 years old to register. We do not knowingly collect personal data from children under 13. If you believe a child under that age has created an account, contact us and we will delete the account and its data promptly.

12. Changes to this policy

We may update this policy as the service changes. The effective date at the top of this page always reflects the current version. Material changes will be announced on the site, and where the law requires it we will ask you to accept the new version before continuing to use saturn.faith.

13. Contact

Privacy questions, data requests, and complaints: saturnfaithlegal@gmail.com.