Privacy Policy
Last updated:
This is an English translation provided for convenience. If there is any difference between this version and the Portuguese version, the Portuguese version prevails.
This Privacy Policy describes how Kalkazu.org ("we", "our") collects, uses, stores and protects the personal data of the users ("you", "user") who access this website, in compliance with Brazil's General Data Protection Law (Law No. 13,709/2018 — LGPD).
1. Who we are (Data Controller)
- Name: Dário Henrique Pinheiro
- Contact e-mail: [email protected]
- Data Protection Officer (DPO): same contact as above
2. What data we collect
2.1 Data you give us directly
- Sign-up/account: name, e-mail and password. The password is never stored in plain text — we keep only a bcrypt hash (cost 12), in a table separate from the users table, so that an accidental query on the users table cannot expose credentials.
- Sign-in with Google (optional): if you choose to sign in with your Google account, we receive your name, e-mail and profile picture from Google. We have no access to your Google password.
- Profile photo (optional): you may upload a profile photo. It is shown next to your comments and is stored with the image service Cloudinary, outside Brazil. The photo is deleted when you remove it, replace it with one of the site's avatars or delete your account.
- Comments: the content you publish, linked to your account. Your comments and replies are public: they are shown with your name and your profile photo. When you like a comment, its author sees your name in the like notification. We keep the reports you make, without showing your name to anyone, the date you accepted the community guidelines and, if your account is stopped from commenting, the date of that block. All of this is deleted when you delete your account.
- Likes and favorites: the record of which articles you liked or saved.
2.2 Data collected automatically
-
Audience telemetry: we record the path of the page visited, a truncated version of your user agent, a generic device classification, and the date and time.
We do not record your IP address in this telemetry, and we use no cookie or any cross-site tracking identifier to measure it. The IP is used only in memory, to limit abuse, and is discarded right after.
-
Security records: administrative actions and authentication events are recorded in an audit trail. When an IP address is relevant to that trail, we keep only a salted cryptographic hash of it, never the address itself.
-
Protecting your account: we count failed sign-in attempts and record the date of the last access, in order to temporarily lock the account when there are repeated attempts to guess the password.
2.3 What we do NOT do
To avoid doubt, and because many content websites do the opposite:
- We do not run a newsletter and do not collect e-mails for marketing.
- We do not sell, rent or hand over your personal data to third parties.
- We do not make automated decisions about you.
We do not intentionally collect sensitive data (LGPD, art. 5, II).
3. Purpose and legal basis for processing
| Purpose | Data involved | Legal basis (LGPD, art. 7) |
|---|---|---|
| Create and maintain your account | Name, e-mail, password hash | Performance of a contract (item V) |
| Publish your comments | Content, link to the account | Performance of a contract (item V) |
| Likes and favorites | Link between account and article | Performance of a contract (item V) |
| Measure the website's audience | Path, truncated user agent, device | Legitimate interest (item IX) |
| Measure audience with Google Analytics | Google cookies and identifiers, pages visited | Consent (item I) |
| Show ads with Google AdSense | Google cookies and identifiers, browsing | Consent (item I) |
| Protect against abuse and intrusion | IP hash, user agent, sign-in attempts | Legitimate interest (item IX) |
| Comply with legal obligations | Account data, audit trail | Compliance with a legal obligation (item II) |
4. Who we share data with
The list is short and complete:
- Supabase — provider of the PostgreSQL database where the data is stored,
in the
sa-east-1region (São Paulo, Brazil). - Cloudinary — hosting of the articles' cover images and of your profile photo, if you upload one. It receives no other personal data from readers.
- Google — to authenticate sign-in, if you choose to sign in with your Google account; and, if you accept cookies, to measure audience (Google Analytics) and show ads (Google AdSense). This data may be processed outside Brazil.
- Public authorities, when required by law or court order.
International transfer: the database is hosted in Brazil, so your account data, comments and our own telemetry are not transferred out of the country in the normal course of operation. Data collected by Google Analytics and Google AdSense is processed by Google, which may store it outside Brazil. A profile photo you upload is stored by Cloudinary, outside Brazil.
5. Cookies
The only essential cookie is the session cookie, created when you sign in.
- It exists only to keep you signed in;
- It is
httpOnly, which means no JavaScript on the page can read it; - It is
sameSite=lax, which prevents it from travelling with requests coming from other websites; - It expires in 8 hours.
Besides it, we use Google analytics and advertising cookies:
- Google Analytics — measures how many people visit the website and which pages they read;
- Google AdSense — shows ads and may personalize them based on your browsing.
These cookies are not essential and are only set after you accept them in the cookie notice. You can decline, and the website keeps working normally. Learn how Google uses this data at https://policies.google.com/technologies/partner-sites.
6. Security
- Passwords protected with bcrypt at cost 12, stored outside the users table;
- All communication with the website travels over HTTPS;
- Temporary account lock after repeated failed sign-in attempts;
- Request rate limiting against automated abuse;
- Audit trail of privileged actions, without sensitive values;
- Database access separated by roles: the code that serves requests has no permission to change the database structure or to erase the audit trail.
No system is completely secure. In the event of a relevant incident, we will notify the affected users and Brazil's National Data Protection Authority (ANPD), as required by the LGPD.
7. How long we keep data
| Data | Period |
|---|---|
| Audience telemetry | 90 days, deleted automatically |
| Audit trail | 365 days, deleted automatically |
| Account, comments, likes and favorites | While the account exists |
When you delete your account, the data linked to it — comments, likes and favorites — is deleted with it.
8. Your rights (LGPD, art. 18)
You have the right to:
- Confirm that your data is being processed;
- Access your data;
- Correct incomplete, inaccurate or outdated data;
- Request anonymization, blocking or deletion of unnecessary data;
- Request data portability;
- Request deletion of data processed on the basis of consent;
- Withdraw consent at any time;
- Be informed about who your data has been shared with;
- Object to processing carried out in breach of the LGPD.
You do not need to ask in order to exercise the main ones. In your profile area you can edit your account data and delete your account and the associated data directly, at any time.
For other requests, write to [email protected]. We reply within 15 days.
9. Minors
The content is aimed at the general public interested in technology. We do not intentionally collect data from children. If you are responsible for a child and believe they have given us data, contact us so it can be removed.
10. Changes to this Policy
We may update this Policy. The date of the last update is always at the top of the document, and significant changes will be communicated visibly on the website.