Privacy Policy

1. Introduction

Dracarium ("we," "us," "our") is a personal, independently-run book-tracking and reading-community site for dragon and fantasy fiction, based in the United States. This policy describes what information we collect through the service, how we use it, who we share it with, and the choices you have. It applies to everything collected through Dracarium itself — it doesn't cover any other site you might reach by following a link from here.

This policy is written to reflect what Dracarium actually does today. As the site grows or changes — new features, new service providers, a change in how it's operated — this document will be updated to match, with the effective date above reflecting the latest version.

2. Definitions

• Dracarium ("we," "us," "our") — the site, reachable at dracarium.com, and its operator.
• Reader ("you") — anyone who creates an account and uses Dracarium.
• Service — the Dracarium website and everything it does: book tracking, reviews, social features, and everything described in these policies.
• Personal Data — any information that, alone or combined with other information, could identify you as a specific person.
• Local Storage — a small amount of data your browser keeps on your own device (not sent to us as a separate tracking signal) to remember things like your theme or login session. See Section 3.5.
• Third-Party Service Provider — an outside company Dracarium relies on to operate — hosting, authentication, book data, and similar — never an advertiser or marketing partner. Dracarium has none of those.

3. Information we collect

3.1 Account information. Your email address and password when you sign up. Authentication runs through Supabase; we never see or store your password in plain text; it's hashed before it ever reaches our database. We do not collect your legal name, phone number, or mailing address for any reason.

3.2 Profile information (optional, provided by you). A display name, avatar image, and bio, if you choose to add them.

3.3 Content you create. Ratings, reviews, quotes, diary entries, reading status and progress, reading goals, ownership notes, tags, custom lists, buddy-read invitations, direct messages, and who you follow, mute, or block.

3.4 Account security. If you enable two-factor authentication, Supabase's authentication service stores the state needed to verify your enrolled authenticator(s) — we don't separately store your TOTP secret ourselves.

3.5 Usage data. Your IP address and basic browser/device information via standard hosting logs, plus anonymized page-performance metrics (Vercel Speed Insights).

3.6 Local storage — not tracking cookies. Dracarium doesn't use advertising cookies, tracking pixels, or third-party ad tech. Your browser's own local storage holds two things, kept on your device: your site preferences (theme, font size, spoiler settings), and your login session, so you stay signed in between visits. Neither is shared with us as a separate data point or used to track you across other sites.

4. How we use it

• Operate the core features of the site — tracking books, writing reviews, following other readers, messaging other readers, and so on.
• Generate recommendations based on books you've rated or tagged yourself.
• Let you participate in the community — reviews, comments, direct messages, buddy reads, and other interactive features you choose to use.
• Provide support if you reach out with a question or problem.
• Detect and slow down spam or abuse, such as rate limits on rapid-fire posting.
• Meet legal obligations where they apply.

We don't send marketing email or promotional offers — Dracarium doesn't have an outbound email-sending system at all today.

5. Data retention

Your content stays as long as your account exists. If you request deletion from Edit Profile → Danger Zone, there's a 30-day grace period during which you can cancel; after that, your account and everything tied to it — reviews, ratings, quotes, diary entries, direct messages, lists, and follows — is permanently deleted. We may retain minimal information where required to comply with a legal obligation or resolve a dispute.

6. Transfer of your data

Your information is stored and processed on Supabase's and Vercel's hosting infrastructure, which may be located outside your own country. If you're located outside the United States, using Dracarium means your data is transferred to and processed in the United States. We take reasonable steps to keep your data secure regardless of where it's processed.

7. Disclosure of your data

Business transitions. If Dracarium is ever transferred to a new operator, your account data may be transferred as part of that change. We'll post notice on the site before that happens.

Legal requirements. We may disclose information if required by law, in response to a valid request from a court or government authority, or if we believe in good faith it's necessary to protect the rights, property, or safety of Dracarium, our readers, or the public.

8. Third-party service providers

We don't sell your personal information, and we don't work with advertisers or marketing partners. The following outside services process data as part of actually running the site:

• Supabase — our database and authentication provider. Stores your account and content data, and enforces who can see what.
• Vercel — hosts the site, and provides anonymized page-performance analytics (Speed Insights) — not personal tracking or advertising.
• Google Books API — when you search for or import a book, that search is sent to Google's book database.
• Open Library / Internet Archive — an alternate source for book metadata.
• Google Fonts — this site's typography loads from Google's font service, which sends your IP address to Google as part of serving the font files.
• hCaptcha — verifies you're not a bot during sign-up, sign-in, and password reset.
• Discord — when the site itself hits an error, a short diagnostic message (the error text and the page URL — never your account data, message content, or anything you typed) is relayed to a private Discord channel we monitor, so problems get noticed and fixed quickly.

Each provider only receives what it needs to do its job and is bound by its own privacy terms. If Dracarium adds a new provider in the future — for payments, email, or anything else — it will be added to this list.

9. Security

9.1 Our safeguards. We rely on Supabase's row-level security to control who can see what data at the database level, and the site is served entirely over HTTPS. You can add an extra layer of protection to your own account by enabling two-factor authentication from Edit Profile → Account Security. No online service can guarantee perfect security, but we've made reasonable efforts appropriate for a project of this size.

9.2 Breach notification. If we discover a security incident that compromises your personal data, we'll notify affected readers without undue delay, consistent with applicable law — including, where the GDPR applies, notifying the relevant supervisory authority within 72 hours of becoming aware of a qualifying breach.

10. Children's privacy

Dracarium isn't directed at children, and we don't knowingly collect information from anyone under 13. If we learn that we've collected information from a child under 13, we'll delete it.

11. Your data protection rights

11.1 Access, export & deletion. You can download a full export of your ratings, diary entries, reviews, custom lists, quotes, reading goals, and direct messages anytime from Edit Profile → Your Data — no need to ask us first. You can request account deletion anytime from Edit Profile → Danger Zone, with a 30-day grace period to change your mind. For anything not covered by those self-service tools, use Support (Help & Contact, category "Privacy request") and we'll respond within 30 days.

11.2 Visibility controls. From Edit Profile, you can set your Favorites, Activity, and Lists to Public, Friends, or Private independently, and hide yourself from certain discovery features — this controls what other readers can see, separately from what we can see.

11.3 California residents. Regardless of whether Dracarium meets the specific thresholds that make the California Consumer Privacy Act (CCPA) mandatory, we extend the same core rights to every reader: the right to know what personal information we hold about you, the right to delete it, and confirmation that we never sell it. If you're a California resident and want to exercise these rights formally, reach us through Support as described in 11.1.

11.4 European Economic Area, UK, and Swiss residents. If you're in the EEA, UK, or Switzerland, the General Data Protection Regulation (GDPR) gives you additional rights over your personal data — access, rectification, erasure, restriction, portability, and objection to processing. The self-service tools in 11.1 already cover most of these directly (export, deletion); for anything else, reach us through Support as described there. Our legal basis for processing your data is primarily performance of the contract formed when you create an account (providing the service you signed up for), plus our own legitimate interest in keeping the site secure and functioning. We don't use tracking cookies or ad technology (see 3.6), so no cookie-consent banner is required under current EU/UK rules. Where our hosting providers (Supabase, Vercel) process data outside the EEA, that transfer is governed by their own data processing agreements and standard contractual clauses.

12. Links to other sites

Dracarium links out to other sites — book detail pages, Google Books, Open Library, and similar. We don't control those sites and aren't responsible for their content or privacy practices. Check their own policies before sharing information with them.

13. Changes to this policy

We'll update the effective date above whenever this policy changes, and post the current version on this page. For a material change — a new category of data collected, a new third party, a change in how long we keep something — we'll also note it prominently on the site around the time it takes effect. Dracarium doesn't currently have an outbound email system, so we can't promise a direct email notice; the version on this page is always the current one.

14. Governing law

This policy is governed by the laws of the State of Utah, without regard to its conflict-of-law principles.

15. Contact

The fastest way to reach us is Support, on the Help & Contact page — the form there requires being signed in. If you're locked out, try Forgot password first. If you can't sign in at all, that same page lists an email address as a fallback.