Privacy Notice

1. Who is responsible

Olga Malenovic, operating Scribinx from Serbia as an individual, is the controller responsible for the personal data described here. For privacy questions or requests, email [email protected].

This notice covers Scribinx accounts, profiles, publications, messages and browser features for an international audience.

2. Information we handle

You provide your email address, password, interface language, acceptance of the Terms and declaration that you are at least 18 when creating an account. We store a password hash, account and verification status, acceptance and age-declaration timestamps, and account/profile relationships. We do not ask for a birth date or identity document as part of registration.

Depending on the features you use, we handle profile names, handles, biographies and avatars; manuscripts, Notes, covers, drafts and publication settings; comments, likes, follows, collections, blocks, notifications and messages; promotion requests and campaign information; and reports, support correspondence and moderation records.

Technical data includes session and recovery-token records, timestamps, session user-agent information and application activity. Hosting, email and network providers may process IP addresses, browser information and delivery or security logs. Internal view/share and sponsored-placement records use event identifiers and may include an authenticated profile association where the feature records it.

3. Why we use information

Account, authentication, draft storage, publication and messaging processing supports the service you request and the steps needed to provide it. Where applicable, its legal basis is performance of our agreement with you. Email verification and password recovery are service communications, not permission for marketing email.

We use proportionate information to protect accounts, prevent abuse, moderate content, answer support requests and understand the operation of our own features and contextual sponsored placements. Where applicable, we rely on legitimate interests in a safe, functioning service, subject to your rights and a documented balancing assessment. Mandatory legal disclosures and records rely on the relevant legal obligation. Optional Google Analytics relies on consent.

Required registration fields are necessary to create an account; optional biography, avatar and promotion information are not required for public reading. Ask [email protected] about the basis for a particular use of your data.

4. Public content and private information

Publishing makes your selected profile and work information available to visitors, search engines and people who share or download it. Public comments and other public interactions may identify your profile. Do not publish someone else's personal data without a lawful basis. Private drafts and messages are not intended for public display; authorized service personnel may access them when necessary for support, safety or legal obligations.

Messages are available to their participants and are not end-to-end encrypted. Recipients can save or share what you send. Unpublishing or deleting from Scribinx cannot recall downloaded copies, screenshots or search-engine caches. Public profile information is distinct from your account login email; do not place private contact details in public content unless you intend to share them.

5. Recipients and service providers

Information is available to the audiences or message recipients you choose and to authorized administrators for the purposes above. Current infrastructure includes the operator's NAS for application/data hosting, Cloudflare for the public network route, security and private R2 file storage, and Brevo for transactional email. These providers receive information needed for their role, such as network requests or email recipient and delivery information. Clicking an external author or sponsor link also takes you to a separate site's privacy practices.

Google receives optional analytics information only if analytics is available and you consent. We may disclose information when legally required or necessary to address a lawful rights or safety request. For details about a provider, its role or processing locations, contact [email protected].

6. Cookies and storage on your device

The first-party scribinx_session cookie supports login and is not readable by page scripts. The scribinx_csrf cookie helps protect authenticated actions. Both have a 30-day lifetime; logout and password reset invalidate the relevant login session. These functional controls are separate from optional analytics.

The editor saves recovery copies and cover-design preferences in your browser's local storage. They may contain unpublished text or images, have no automatic time expiry, and are not all cleared by logout. Matching recovery content is removed after a successful save and supported deletion flows clean up relevant entries. On a shared device, clear Scribinx site storage when finished; doing so can remove unsaved work and sign you out.

An analytics-choice cookie remembers a deliberate choice for 90 days without extending it on visits. A local denial record can keep analytics off when the server is unavailable. Optional GA cookies are configured for the browser session only; a browser may restore a session. See Analytics details and the Privacy settings control for your current choice.

7. Optional Google Analytics

The live status is shown below and on Analytics details. If available, GA4 starts only after you actively accept and declare that you are at least 18. Rejecting or withdrawing does not limit reading, registration or publishing. Accepting the Terms or reading this notice does not consent to analytics.

The integration measures public page types and successful sign-ups, publication transitions and recorded content views using generic labels, interface language and content type. It does not send account or publication identifiers, email, titles, handles, searches, messages, private drafts, form text, actual page URLs or URL tokens in its event payloads. Google may also generate session/engagement events and receive pseudonymous browser identifiers, device information and network data, including your IP address during transmission. This is not anonymous processing.

The design excludes advertising features, Google signals and account-linked tracking. The intended GA4 user/event retention is two months without activity reset; it does not govern standard aggregate reports. The live property retention setting cannot be confirmed from the application. Ask [email protected] for the current provider setting. Use Turn off analytics to stop future collection and clear this integration's GA cookies. Withdrawal cannot recall requests already sent or automatically delete earlier Google records. Contact the operator separately about deletion; we may be unable to attribute old pseudonymous records without an existing browser identifier.

8. Retention and deletion

Login sessions expire after 30 days; verification links are valid for 24 hours and password-reset links for one hour. Token validity is not a promise that all associated database or email-provider records are immediately deleted. Analytics choices expire after 90 days. Minimal choice receipts contain a token hash, policy version, decision, timestamps and language/source labels, without an account, IP address or content; automated cleanup removes receipts at 180 days.

Deletion requests hide the affected content immediately. Account deletion revokes account sessions; profile deletion switches sessions to a remaining profile. Scheduled cleanup removes the deleted account/profile data and associated files after 30 days. Replaced and orphaned files also have a 30-day grace period. Backups may retain earlier copies until their configured expiry. A fixed live backup schedule has not been verified. Minimal recovery deletion receipts contain opaque target identifiers and request times for six months, so later deletion requests can be reapplied after restoration. Downloads and copies held by others cannot be recalled.

Support correspondence is kept while handling your request and related rights or legal obligations. Operational/provider logs and records outside account cleanup have separate lifecycles; contact [email protected] for the applicable period or deletion assistance. A restored backup must reapply deletion requests before public access resumes.

9. International processing

The operator is in Serbia and the service is intended for worldwide use. Provider processing and a recipient's location may involve countries outside your own, including the United States for Google services if activated. Do not assume all data stays in Serbia or the European Economic Area.

Processing locations and safeguards depend on the provider and applicable law. Contact [email protected] to ask about a particular transfer and the safeguards or agreements that apply. Analytics consent does not by itself replace any required transfer safeguards.

10. Your privacy rights

Depending on the law and processing basis that apply, you may request access and a copy, correction, erasure, restriction, portability, or object to processing, including processing based on legitimate interests. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Rights are not absolute; we will explain any applicable limitation.

Email [email protected] with your request and the account or information concerned. We may ask for proportionate identity confirmation, but do not send a password or unnecessary identity documents. Requests are normally free. Where GDPR applies, the normal response period is one month; a permitted extension of up to two further months must be explained within that first month. Other applicable legal deadlines also apply.

You may complain to Serbia's Commissioner for Information of Public Importance and Personal Data Protection, or another competent authority. Where GDPR applies, this can include the authority in your habitual residence, workplace or the place of the alleged infringement. You do not have to contact us before complaining.

Serbian data protection Commissioner · EEA data protection authorities

11. Children and age declarations

Accounts, publishing and messaging are restricted to people aged 18 or older. Public reading does not require an adult account, and optional analytics acceptance requires a separate adult declaration. A declaration is not independent identity or age verification.

If you believe an under-18 person has created an account or supplied personal data inappropriately, contact the operator so we can investigate and take appropriate action.

12. Security and automated features

We use access restrictions, password hashing and security controls to protect information. No online service can guarantee absolute security. Keep your credentials private and report suspected compromise promptly.

The service uses automated feature logic such as counts, ordering and rate limits. The service does not use a system making solely automated decisions with legal or similarly significant effects. If such processing is introduced, we will provide the required information and safeguards before it is used.

13. Changes and contact

The version and update date appear above. We update this notice when processing changes, with notice appropriate to the change and fresh consent where required. For privacy, rights, security or service questions, contact [email protected].