PRIVACY POLICY
1. DATA CONTROLLER
CASEFILES ("we", "us", "our") operates the website casefiles.space. We are the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR).
2. DATA WE COLLECT
We collect the following categories of personal data:
Account Data
- Email address (for authentication and notifications)
- Username / callsign (publicly visible)
- Password (hashed, stored by Supabase Auth)
- Avatar configuration preferences
Usage Data
- Comments and discussion contributions
- Sighting reports you submit
- Case favorites and reading progress
- Case collection data
Technical Data
- IP address (server logs, retained for security)
- Browser type and version
- Cookie consent preferences (stored locally)
3. LEGAL BASIS FOR PROCESSING
We process your data under the following legal bases (GDPR Article 6):
- Consent -- for email notifications and optional analytics cookies
- Contract performance -- to provide the Service and maintain your account
- Legitimate interests -- for security, fraud prevention, and Service improvement
- Legal obligations -- to comply with applicable laws
4. HOW WE USE YOUR DATA
- Provide, maintain, and improve the Service
- Authenticate and manage user accounts
- Send transactional emails (welcome, new case notifications)
- Moderate user-generated content
- Analyze usage patterns to improve the Service
- Prevent abuse, fraud, and security threats
- Comply with legal obligations
5. THIRD-PARTY SERVICES
We share data with the following third-party processors, all of which maintain appropriate data protection agreements:
We do not sell your personal data to third parties.
6. DATA RETENTION
- Account data -- retained while your account is active, deleted within 30 days of account deletion request
- User content -- retained while the account exists; anonymized upon account deletion
- Server logs -- retained for up to 90 days for security purposes
- Cookie consent -- stored locally in your browser; cleared when you clear browser data
7. INTERNATIONAL DATA TRANSFERS
Your data may be transferred to and processed in countries outside the EEA, including the United States. When this occurs, we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions where applicable
- Data Processing Agreements with all processors
8. YOUR RIGHTS
Under GDPR, you have the following rights:
- Access -- request a copy of your personal data
- Rectification -- correct inaccurate or incomplete data
- Erasure -- request deletion of your data ("right to be forgotten")
- Restriction -- request that we limit processing
- Portability -- receive your data in a machine-readable format
- Objection -- object to processing based on legitimate interests
- Withdraw consent -- withdraw consent at any time without affecting prior processing
- Lodge a complaint -- file a complaint with your local data protection authority
To exercise any of these rights, contact us at privacy@casefiles.space. We will respond within 30 days.
9. AUTOMATED DECISION-MAKING
The Service uses AI (Anthropic Claude, OpenAI) for:
- Generating case dossier analyses from raw data
- Creating content summaries and narrations
- Processing sighting reports
These AI systems process publicly available incident data, not your personal data. No automated decisions with legal or significant effects are made about users based solely on automated processing.
10. COOKIES
We use the following types of cookies:
Essential Cookies
Required for the Service to function. These include authentication session cookies and cookie consent preferences. These cannot be disabled.
Analytics Cookies (optional)
Used to understand how visitors interact with the Service. Only set with your explicit consent. You can manage your cookie preferences at any time via the cookie consent banner or by clearing your browser data.
For more details on our cookie usage, see the cookie consent options available at the bottom of any page.
11. CHILDREN'S PRIVACY
The Service is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly. If you believe we have collected data from a child, please contact us immediately.
12. SECURITY
We implement appropriate technical and organizational measures to protect your data, including:
- Encrypted data transmission (TLS/HTTPS)
- Hashed password storage (via Supabase Auth)
- Role-based access controls
- Regular security monitoring and logging
No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
13. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date above. For material changes, we will notify you via the Service or email. Your continued use after changes take effect constitutes acceptance.
14. CONTACT
For privacy-related inquiries or to exercise your data rights: