Privacy Policy

1. Controller and contact

Controller: Angelini Sebastiano, natural person, Italy. Website: realityerror.media.

Privacy requests: privacy@realityerror.media (alias to activate before public launch). DPO, if applicable: [TO BE CONFIRMED].

2. Data categories

• account: email, display name, verification, sign-in provider and session data;
• activity: saved Stories, reactions, Awards votes, comments, votes, reports, appeals and moderation data;
• email: address, content and technical status of OTPs, links and transactional notices;
• technical and security data received by browser, API and hosting within configured limits;
• first-party aggregate analytics: hour, event, Story/competition, language, category, surface and normalized channel/campaign.

Do not put credentials, health data or unnecessary personal data in comments or reports.

3. Purposes and legal bases

• provide reading, accounts, sessions, saves, reactions, comments, votes and reports: requested service and contract;
• send OTPs, links and operational notices: requested service and pre-contractual measures;
• prevent abuse, moderate, secure the service, audit and handle requests: legal obligation where applicable or legitimate interest;
• aggregate product statistics: legitimate interest, subject to balancing;
• comply with law and defend claims: legal obligation or legitimate interest.

4. Accounts, notices and comments

Better Auth manages sign-in and sessions. Public reading needs no account; Google and Apple are used only if enabled and selected.

Email may use Mailpit in development/test and Resend in production if enabled. Messages are transactional, not marketing newsletters.

Comments, reports and appeals may be retained for moderation, security, audit and disputes under the Participation Policy.

5. Recipients and processors

Configured in the repository: Better Auth 1.7.5 with Prisma/PostgreSQL; PostgreSQL and Mailpit through Docker Compose for development/test. Supported but not shown as active: Resend in production and Google/Apple OAuth when credentials are configured. No identifiable Production hosting, database, object storage or CDN/WAF provider is present in the verified files. Actual processors and sub-processors must be determined before launch. External source and media URLs may also cause requests to the domains embedded in content.

6. Transfers outside the EEA

No non-EEA transfer is verifiable from the repository: no Production hosting, storage or email provider is configured. If Resend, Google, Apple or another provider is activated, countries, roles, safeguards and documentation must be verified and added before launch.

7. Retention

Aggregate analytics have a default retention of 24 months and are periodically deleted by a worker; the value is configurable and not verified in Production. Account/session, OTP/link verification, comment, report, appeal, communication and audit tables have no automatic retention policy in the repository. Infrastructure logs and backups are not configured in the repository.

Proposal requiring approval and implementation:expired sessions after 30 days; expired OTP/link records after 30 days; closed communications and reports after 24 months; moderation audit after 5 years; application logs after 90 days; rolling backups for no more than 30 days. Comments and accounts require a separate erasure/anonymisation rule, with documented legal-claim exceptions. These are proposals, not current retention settings.

8. Security

The service uses server-side sessions and authorization, Better Auth protections, separated Development/Test environments and minimized analytics. Production examples require HTTPS and PostgreSQL SSL, but the real deployment is not present or verified. No measure removes every risk.

9. Your rights

Subject to GDPR Articles 15–22, you may request access, rectification, erasure, restriction, objection and portability, or withdraw consent. You may object to processing based on legitimate interests and may not be subject to a solely automated decision where Article 22 applies. You may complain to your supervisory authority. Contact: privacy@realityerror.media.

Email is required to create and maintain an account and receive OTPs/links; name and username are required only for features that use them. Without an email, sign-in is unavailable; public reading remains available without an account. Google or Apple provide the data supplied through the selected authentication flow.

10. Analytics and updates

The application analytics table does not persist account, email, IP, user-agent, full referrer, fingerprint, cross-site identifier, analytics cookie or identifying localStorage. Events are aggregated by hour. The Session database table may contain IP and user-agent received by Better Auth; infrastructure logs depend on the Production environment and must be verified. New tools or material changes require a new assessment and policy update.