1. Controller

The controller for data processing on Anbloq is the provider named in the imprint, which lists name, postal address, and email address. Send privacy questions and requests about your rights to that email address.

2. Summary

• Anbloq uses no tracking, analytics, or advertising cookies and no ad networks.
• We only use cookies and local storage that are technically necessary to run the service.
• Blogs, comments, traces, reviews, and your public profile are visible to everyone and are kept permanently as part of the archive.
• Payments are handled by Stripe. We never receive your card details.

3. Hosting and server logs

Anbloq is hosted by Railway Corporation, 548 Market St PMB 68956, San Francisco, California 94104, USA. Anbloq uses servers in the European Union. Railway provides a Data Processing Addendum. Further information is available in Railway's privacy policy. For processing outside the EU, see section 13.

Every page request processes technically necessary data: IP address, date and time, requested address, status code, amount of data transferred, referrer, and browser and operating system (user agent). This data is used to deliver the page, analyse errors, and defend against attacks. Application and deployment log availability at Railway depends on the selected plan: Free: 3 days; Trial and Hobby: 7 days; Pro: 30 days; Enterprise: up to 90 days. These periods describe dashboard availability rather than guaranteed final deletion; Railway states that upgrading plans can restore older logs. See Railway's log documentation.

To prevent abuse (for example on login, registration, password reset, and reports) we count requests per IP address and account. Counters are shared across servers in the database, using keyed hashes instead of readable IP addresses, emails or usernames. Request windows last up to one hour; daily upload-byte budgets reset after 24 hours. Expired counters are removed as new counters are created.

The legal basis is our legitimate interest in a secure and stable service (Art. 6(1)(f) GDPR).

4. Account and profile

For an account we process your username, email address, and password, which we only store as a secure hash. You may optionally add a display name, bio, location, website, profile picture, banner, accent colour, theme, and further profile settings. Profile details, account age, and your activity (for example the number of blogs) are public. A real name is not required.

Your account also includes your settings (such as whether NSFW content is shown), follows, saved blogs, votes, the seen state of traces, and notifications.

If email confirmation is enabled, we send you a confirmation link. We also send password reset emails (see section 8).

The legal basis is the performance of the terms of use (Art. 6(1)(b) GDPR).

5. Public content and archive

Blogs, comments, traces, sources in public libraries, reviews, and reactions are public and are shown with your username, date, and edit status. Anbloq is meant to be a lasting archive: content stays findable, including through search engines. Exceptions are blogs marked NSFW and the +18 forum, which are only shown to signed-in people who enabled NSFW content and are excluded from indexing.

Removed or deleted content may remain visible as a placeholder (for example "[removed: spam]") so that discussions stay traceable. The content itself is no longer shown.

The legal basis is the performance of the terms of use (Art. 6(1)(b) GDPR) and our legitimate interest in a lasting, traceable discussion archive (Art. 6(1)(f) GDPR).

6. Private areas

Files and folders in the Anbloq Library, premium uploads, private notes, and private sources are stored for you only. They are not public unless you explicitly share them through a share link. We only access them when this is necessary for technical operation, to handle a report, or because of a legal obligation.

The legal basis is the performance of the terms of use (Art. 6(1)(b) GDPR).

7. Signing in with Google or GitHub

You may optionally sign in with Google or GitHub. We then receive a unique account ID and your email address from that provider, plus your GitHub username for GitHub, and link them to your Anbloq account.

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (privacy policy)
• GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA (privacy policy)

Google's sign-in script only loads after you click "Continue with Google". Only then are your IP address and technical browser data transmitted to Google.

The legal basis is the performance of the terms of use at your request (Art. 6(1)(b) GDPR). For transfers to the USA, see section 13.

8. Sending emails

System emails (email confirmation, password reset) are sent through Resend, Inc., USA (privacy policy). Your email address and the content of the message are transmitted to Resend. We do not send newsletters or marketing emails.

The legal basis is the performance of the terms of use (Art. 6(1)(b) GDPR).

9. Subscriptions and payments

Badge and Premium subscriptions are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (privacy policy). You enter payment details directly with Stripe; we do not receive them. We store the Stripe customer ID, the plan, status, billing period, cancellations, and refunds. Cancellations through the cancellation form in your settings are stored with name, email address, contract, type, and time, and you receive a confirmation by email. Stripe is partly a controller in its own right for payment processing and also processes data to prevent fraud.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and statutory retention duties (Art. 6(1)(c) GDPR in conjunction with section 147 of the German Fiscal Code and section 257 of the German Commercial Code).

10. Reports, moderation, and security

When you report content, we store the report, the reason, your explanation, the reported content, and your account or, without an account, your name and email address. We confirm receipt and tell you the decision by email. If your own content is removed, you receive a statement of reasons by email. For decisions about content or accounts we store the reason, time, and the person who acted. Spam filters automatically check new content for typical spam patterns.

The legal basis is our legitimate interest in protecting the platform (Art. 6(1)(f) GDPR) and the duties under the Digital Services Act (Art. 6(1)(c) GDPR).

11. Cookies and local storage

We only use technically necessary storage:

• sessionid: keeps you signed in (cookie, until you sign out, at most two weeks).
• csrftoken: protects forms against forgery (cookie, one year).
• django_language: stores your language if you switch it manually (cookie, until you close the browser).
• anbloq-theme: stores your colour scheme (browser local storage).
• anbloq-seen-traces: remembers which traces you have already seen (local storage).
• anbloq-post-scroll: restores your scroll position in the feed (session storage).
• anbloq-offline-…: the service worker's offline cache with a notice page, the stylesheet, and the logo, so Anbloq shows an offline page without a connection and can be installed as an app. No personal content is stored there.

This storage is strictly necessary for the functions you request (section 25(2) no. 2 of the German TDDDG), so no consent is required. You can delete it in your browser at any time.

12. External content

• Knowledge pages: our server downloads Wikipedia articles without transmitting any of your data. Images on these pages, however, load directly from servers of the Wikimedia Foundation, Inc. (USA). The Wikimedia Foundation receives your IP address. We serve the formula rendering (KaTeX) ourselves.
• Linked profile pictures: if someone sets a profile or banner image as an external address, your browser loads that image directly from the external server.
• Links: you open external links in blogs and sources yourself; the privacy policy of that website then applies.

The legal basis is our legitimate interest in displaying this content (Art. 6(1)(f) GDPR).

13. Transfers to third countries

Some of the providers above (in particular Railway, Resend, GitHub, Google, Stripe, and the Wikimedia Foundation) also process data in the USA. Transfers rely on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the provider is certified, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

14. Retention

• We keep account data until you have your account deleted.
• You can delete your account at any time in your settings or request deletion by email. We then delete your login details, profile data, connections, and private content. Public blogs and comments are deleted or anonymised so that they can no longer be linked to you.
• We keep billing records for up to ten years because of statutory obligations.
• We keep reports and moderation decisions as long as they are needed for handling and evidence.
• Request counters expire after at most one hour, upload-byte counters after 24 hours. Expired entries are periodically removed.

15. Your rights

Under the GDPR you have the right to

• access the data stored about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on our legitimate interest (Art. 21),
• lodge a complaint with a data protection supervisory authority (Art. 77), in particular in the member state where you live.

You can change many details directly in your settings, where you can also delete your account. For everything else, an email to the address in the imprint is enough.

16. Minors and the +18 forum

Anbloq is intended for people aged 16 and over. The +18 forum and blogs marked NSFW are for adults only; enabling NSFW content confirms that you are at least 18 years old.

17. Security and changes

Connections are encrypted with TLS, passwords are only stored as hashes, and access to administrative functions is restricted. We update this privacy policy when features or the law change. The version published here applies.