Your data is yours, not ours. We collect only what running the sites needs, we never sell it, and we show no ads. Anyone who simply reads a site is not tracked at all: no cookie, no profile, nothing kept about them.
Who is responsible
- For Authors’ accounts, this website, and reports sent to us, we are responsible for your data (the “controller”), and you can reach us as below.
- For a site’s Members, the author whose site you joined is responsible for your data, and we keep it for them (as their “processor”). Questions about what an author does with their Members list go to that author; we will help them answer.
What we keep about Authors, and why
- Your account: your name, your email address, and your password, stored only as a scrambled hash we cannot read back. If you turn on two-factor authentication, its secret and recovery codes, encrypted. We use these to let you in and to send you the emails you need: confirming your address, password resets, your exports, and the Monday digest of your site’s week, which you can switch off.
- When you last signed in, and whether we have warned you about a quiet account, so that only abandoned accounts are ever deleted.
- Everything you put on your site: books, chapters, posts, pages, images, files, your profile and links. We keep it as long as your site exists, to show it to your readers.
- While you are signed in, your session is kept on our server with your IP address and your browser’s name, to keep you signed in and to spot misuse. It is removed after two hours without activity.
What a site keeps about its Members
When you join an author’s site, the site keeps:
- your email address, and the dates you joined and were last seen, which the author can see and download;
- which of the site’s chapters you opened and how often, which you marked as read, and which downloads you took. The author sees only totals, such as how many Members read each chapter, never who read what. After 90 days with no new reading of a chapter or download, your name is taken off the record and only the totals remain;
- the chapters you hearted, and any typo you reported, with the words you quoted and your note. The author sees the report, but not who sent it.
We use this only to run the site for its author, and look at who read what only to investigate abuse of the site. The author can remove you from their Members list at any time, which deletes all of it; or ask them, or us, to do it for you.
What we keep about anyone who reads a site
- A count. We count each day how many pages of each site were opened, as a plain number, with no IP address, no cookie and nothing that tells one reader from another. Search engines and other bots are left out.
- Server logs. Like every website, our server notes each request it answers: the address it came from, the page, the time and the browser’s name. We use these logs only to keep the service running and secure, and keep them for no more than 14 days.
- Short-lived counters. To stop floods of messages, sign-ups and sign-in links, we count how often each IP address uses those forms. The counts are forgotten within an hour, or a day for sign-ups.
Messages and reports
- An author’s contact form sends your name, email address and message to the author by email, and keeps them in the author’s panel until the author deletes them, or their site is deleted. Only a site’s latest 1,000 messages are kept there.
- A report about a site keeps its reason, your details and, if you give it, your email address, with a note of what we did about it. We never show the reported author who sent it.
- Email you send us is kept, so we have the history if you write again.
Who helps us run it
We use these companies, and they handle personal data for us only as far as their part of the service needs:
- the hosting provider hosts the server, its database and its logs.
- Postmark (ActiveCampaign) delivers every email we send: sign-in links for Members, account emails, exports, digests and contact-form messages.
- Cloudflare stores the images and files on every site (Cloudflare R2), and delivers them, so it sees the IP address of whoever loads them. Its Turnstile check runs on the signup form and on authors’ contact forms, to tell people from bots, and looks at your IP address and browser to do so.
Postmark and Cloudflare are US companies. Where your data leaves the European Union, it is covered by the safeguards EU law requires, such as the European Commission’s standard contractual clauses. Our fonts are served by us, and no page on Draft Margin loads anything from an advertising or analytics company.
When we look at your data
- To help you, when you ask us to and say we may.
- To investigate abuse reported to us or found by us, including a site’s content and its Members’ reading of the last 90 days. If we find a site used for a purpose the abuse policy rules out, we act, and tell the authorities where the law requires.
- When the law requires it, under a binding order. Unless we are forbidden to, we tell the person concerned first.
Our reasons, in the law’s terms, are the agreement you made with us when you created your account, and our legitimate interest in running a safe, working service. If Draft Margin ever passes to someone else, we will tell you well before your data does.
Your rights
Wherever you live, you can ask us to:
- tell you what we hold about you, and give you a copy;
- correct it;
- delete it, or limit what we do with it;
- stop using it for a purpose you object to;
- give it to you in a form you can take elsewhere.
Authors can do most of this themselves: change their details in their account settings, download everything with Export my site, and delete their account there. For anything else, write to [email protected]. We may need to check it is you before we act. You also have the right to complain to your data protection authority.
How we keep it safe
Every page is sent over an encrypted connection. Passwords are stored only as hashes, two-factor secrets are encrypted, sign-in links for Members work once and expire, and the files an author keeps for Members are held privately and handed out through links that expire.
How long we keep it
- An Author’s account and site: until the account is deleted, by them or for being quiet (see the terms).
- A Member: until the author removes them, or the site is deleted.
- Who read or downloaded what: 90 days, then totals only.
- Daily visit counts: as long as the site.
- Sessions: two hours without activity. Server logs: 14 days. Form counters: an hour, or a day for sign-ups.
- Exports: seven days.
Deleting an account deletes its site at once, with its content, files and Members. Any copy left in our backups is gone within 30 days.
Changes
We may update this policy as the service changes or the law requires. When we make a significant change, we refresh the date at the top and let Authors know by email.
Who runs it
Draft Margin is run by The operator, Postal address to be set, the operator’s country. Write to [email protected] about anything on this page.