Privacy Policy

DerinSpot.BLOG is run by Derin DeNio, who decides how and why your personal data is used (the “controller” under the GDPR). You can reach us at privacy@derinspot.blog.

Information you give us:

• Account details: your name, email address and a password (stored only as a one-way hash, never in plain text).
• Profile details you choose to add: a bio and topic tags, and a profile photo if you sign in with Google or GitHub.
• Content you create: blog posts and drafts (including cover images and any images, video, audio or files you add), comments and replies.
• Activity: claps, bookmarks, who you follow and who follows you, and the notifications generated by these actions.

Information from Google or GitHub if you choose to sign in with them: your name, email address and profile photo, plus an identifier for your account with them. We do not receive your Google or GitHub password.

Information collected automatically: like most websites, our servers and hosting provider process your IP address, browser type and the pages requested, to deliver the site, keep it secure and diagnose problems. We also briefly keep your IP address and the email address you type in memory to limit repeated login, sign-up and password-reset attempts. These counters clear themselves within an hour.

We don’t use advertising or analytics trackers, and we don’t build advertising profiles.

• Public: published posts (visible to anyone, with or without an account) and comments, shown together with your name and profile photo. Your profile page, bio, tags and follower lists are visible to people who are logged in.
• Private: your email address is never shown to other users. Drafts are visible only to you.

Anything you publish can be copied, shared or indexed by others, so please don’t post anything you want to keep private.

• To provide the service (creating your account, logging you in, publishing your posts, showing comments, sending notifications). Legal basis: performing our agreement with you (GDPR Art. 6(1)(b)).
• To send account emails such as email verification, email-change confirmations and password resets. We don’t send marketing emails. Legal basis: performing our agreement with you.
• To keep the site secure and prevent abuse (rate limiting, fraud and spam prevention, fixing bugs). Legal basis: our legitimate interests (Art. 6(1)(f)).
• To meet legal obligations, such as responding to lawful requests. Legal basis: legal obligation (Art. 6(1)(c)).

We don’t sell or rent your personal information, and we don’t “share” it for cross-context advertising. We use these service providers to run the site. They only process data on our behalf:

• Render: hosting and server logs.
• Neon: the database that stores accounts, posts and comments.
• Resend: sends our account emails (verification, password reset, email-change notices).
• Edge Store: stores images and other files you upload.
• Cloudflare: our DNS provider, which translates derinspot.blog into the server’s address.
• Google and GitHub: only if you choose to sign in with them. When your profile photo from Google or GitHub is displayed, your browser requests it from them directly, so they see your IP address.

We may also disclose information if the law requires it, or to protect the rights, safety or security of our users or the site.

We use only the cookies the site needs to work. Because they are strictly necessary for login and security, they don’t require your consent, and we don’t show a cookie banner. We don’t use advertising, analytics or tracking cookies.

On a secure connection these names may begin with __Secure- or __Host-. We also store your light/dark theme choice in your browser’s local storage so the site looks the way you left it. This stays on your device.

You can delete cookies in your browser settings, but you will then be logged out.

• Your account, posts, comments and activity are kept until you delete your account.
• When you delete your account (Edit Profile, then Delete Account), we delete your profile, posts, comments, claps, bookmarks, follows and notifications, and we remove the files you uploaded. Our database provider may keep backups for a limited time before they are overwritten, and server logs expire on the hosting provider’s schedule.
• Email verification and password-reset links expire after one hour.
• We keep your 100 most recent notifications.
• Comments and posts you delete yourself are removed from the live site straight away.

If you are in the European Economic Area, the UK or Switzerland, you have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent where we rely on it. You also have the right to complain to your local data protection authority.

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request a copy, to correct it, to delete it, and not to be discriminated against for using these rights. We do not sell your personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of.

How to use your rights: you can edit your name, bio, tags and email, and delete your account, yourself under Edit Profile. For anything else, such as a copy of your data, email privacy@derinspot.blog from the address on your account. We may need to confirm it’s really you, and we will respond within one month (or 45 days for California requests). An authorized agent may make a request for you with your written permission.

Our service providers are based in, or process data in, the United States. If you are in the EEA, the UK or Switzerland, your data is therefore transferred to the US. Where required, those transfers rely on legal safeguards such as the EU Standard Contractual Clauses or an adequacy framework that covers the provider.

We protect your information with measures including encrypted connections (HTTPS), hashed passwords, rate limiting on login and email actions, email confirmation for email changes, and restricted access to our systems. No system is perfectly secure, so we can’t guarantee absolute security. If a breach affecting your data occurs, we will notify you and any required authorities as the law requires.

DerinSpot.BLOG is not intended for anyone under 16. We don’t knowingly collect information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.

We may update this policy from time to time. When we do, we will change the “Last updated” date at the top, and for significant changes we will make a clearer announcement on the site.

Questions or requests about your privacy? Email privacy@derinspot.blog.