Privacy Policy

Privacy Policy

This covers Adama Platform, the community at adama-platform.com, and what happens to information about you here.

The short version: everything is on one machine, nothing is sold, nothing is shared with advertisers, and no page on this site loads anything from anybody else's server.

Who is responsible

The administrators of this community. Under the UK GDPR and the EU GDPR we are the data controller. Reply to any email from this community to reach us.

The authors of the software this runs on have no access to any of it, and neither does anybody else who is not an administrator here.

What we hold

Because you gave it to us

• Your email address. It is how you sign in and how we reach you.
• Anything you wrote: your profile, your answers to the community's questions, posts, comments, replies to events.
• Whether you said you are coming to something, and how many people you are bringing.
• Your address, if you chose to give one. This is the one thing here that nobody else can read — not other members, not administrators, not anything automated. It sits in a field of its own, and what the software does with it is work out how far you are from a proposed venue. Only the distances are ever shown, and only as a chart of how many people are within so many miles, with no names on it. You can clear it at any time on your own page, and clearing it removes the coordinates worked out from it. If you never give one, the town on your profile is used instead, which places you at its centre; if you give neither, you are simply not counted.

Because the software records it

• When your account was created, when you last signed in, and whether an administrator has approved you.
• The IP address you signed up from, and a count of how much your browser interacted with the sign-up form. Both exist for one reason: to make sense of a burst of accounts arriving from one place. The address is erased automatically after ninety days, because a question nobody is still asking is not a reason to keep somebody's location.
• Your sessions: when each began, roughly when it was last used, and the browser it belongs to. The sign-in token itself is stored only as a one-way hash — a copy of the database is not a list of logins.
• A short-lived record of recent requests, held in memory only and lost when the server restarts: the page asked for, the time, the response, your IP address and your browser's user agent string.
• If somebody invited you: that the invitation was sent, whether the image in it was fetched, and whether you joined.

What we do not hold

• Passwords in readable form. If this community uses passwords at all, they are stored scrambled in a way that cannot be reversed.
• Payment details. No money moves through this site.
• Anything from an advertising network, a data broker, or a social network. There are none here.
• Your live location. Nothing here ever asks your browser or your phone where you are. The address described above is one you typed, once, on purpose.
• Your contacts, or anything from your device beyond what your browser sends with an ordinary request.

Cookies

This site uses cookies. There are two, both strictly necessary, and neither of them tracks you.

Both are set by this site and read only by this site. There are no analytics cookies, no advertising cookies, and no third-party cookies of any kind — so there is nothing here to consent to or opt out of, which is why this site does not ask you to click through a banner before reading anything.

Under the ePrivacy rules, cookies that are strictly necessary for a service you asked for do not require consent. These are those, and there are no others.

If your browser blocks them, you can read whatever is public and will not be able to sign in.

The app version of this site may also use your browser's local storage to remember that you have dismissed a notice. That never leaves your device.

Email

We send email for things you asked for: a sign-in code, a notification you turned on, a summary you chose, an invitation.

Every notification and every digest carries the address of the page that turns it off, and turning it off changes nothing else — your inbox on the site still fills up, so nothing is lost by choosing to be left alone.

If this community sends mail through a provider, your address and the message pass through that provider's systems in order to be delivered. Nothing else about you is sent to them.

Invitations contain a small image that tells us the message was opened. It is a poor signal in both directions — most email clients block it, and some fetch it automatically before anybody has read anything — and we treat it as such. Blocking images stops it entirely.

Notification emails and digests contain no tracking of any kind.

Notifications on your device

If you turn on push notifications, your browser gives this site a key that lets it send a message to that browser. That key belongs to the session you turned it on in: signing out deletes it, and the notification stops working.

A notification says who did something and where, never what they said. It travels across your browser vendor's push service to reach your device, so we deliberately do not put the contents of anything in it.

Why we are allowed to hold it (GDPR)

• To run the community you asked to join. Your account, your posts, your sessions. Legal basis: performance of a contract, and our legitimate interest in operating a members' community.
• To keep it working and safe. The request log, failed sign-in counts, bans. Legal basis: legitimate interests — a community that cannot keep out somebody who has been removed cannot protect its members.
• To send you things you turned on. Notifications and digests. Legal basis: consent, which you withdraw by changing the setting.

Who else sees it

Other members see what you post and what is on your profile. Administrators see that plus your email address and your answers to the joining questions.

If this community has connected an AI assistant, an administrator can ask it to help with the site and the board. When they do, what it is asked to look at is sent to whoever runs that model. It is never given your email address, it cannot see anything an administrator has marked human-only, and it is off unless this community turned it on. Ask an administrator whether it is on here.

To turn an address into a point on a map, the software sends it to a geocoding service — by default OpenStreetMap's, which is run by a charitable foundation and which this software identifies itself to. That is the only thing an address is ever sent to, it is sent once, and what comes back is two numbers that are kept here. Whoever runs this community can see which service is in use, and turn it off, in the server's settings.

Beyond that: the hosting provider, who has the machine; the email provider, if this community uses one; and nobody else. Nothing here is sold, rented, or handed over for advertising. We would hand something over if the law actually required it, and we would tell you unless we were forbidden to.

Where it lives

On the machine that serves this site, in a single database file, held by whoever provides that machine. If that machine is outside the UK or the EEA, the transfer is a necessary part of providing the service you asked for.

How long it is kept

• Your account and profile: while you are a member.
• Posts and comments: conversations on the board may expire after a period this community sets, and expire with their notifications.
• Sessions: until they expire or you sign out. Signing out deletes the session, rather than marking it dead.
• The request log: in memory, a few thousand requests, gone on restart.
• The IP address you signed up from: ninety days, then it is erased on its own.
• If an administrator rejects an application: everything is deleted, exactly as described under Your rights below. There is no reason to keep the data of somebody who is not joining.

If you leave, you do not have to ask. Your own page has a Your data tab with a button that deletes your account: your profile, your answers, your sessions, your notifications, the invitations sent to you and your answers to events all go with it.

What stays is what you wrote on the board, with your name taken off it. A conversation other people replied to is theirs as well as yours, and cutting your words out would leave holes in their thread. If you want those gone too, ask an administrator — they can do both at once.

A ban on your address, if there is one, also stays. A community that cannot keep out somebody it removed cannot protect anybody, and that is the legitimate interest we are relying on to keep it.

Your rights

You can:

• see what we hold about you — the Your data tab on your own page has a button that downloads the lot as one file: your account, your profile, your answers, everything you have written, what you said to each event, and the invitations you sent. It is built the moment you ask and is never kept as a file on the server;
• take it somewhere else — that same file is the portable copy;
• correct anything that is wrong — most of it you can edit yourself;
• delete your account and what is attached to it, from that same tab, without asking anybody;
• stop us using it in a particular way, or object to us using it at all.

For the first four there is a button, so there is nothing to wait for. For anything else, ask: there is no charge and no form, and we answer within a month.

If you think we have got this wrong, you can complain to your data protection authority — in the UK that is the Information Commissioner's Office at ico.org.uk, and in the EU it is the supervisory authority where you live.

Children

This community is not intended for children, and accounts are for adults unless this community has said otherwise.

Changes

If this changes, the new version appears here. If a change matters, we will say so where members will see it.