Privacy policy

Who is responsible

Terra Lecta is run by Edgar Barrantes, who is the data controller for the personal data described here. Write to edgar@barrantes.dev with any question or request about your data.

What we collect

• Your account: your email address and password. The password is stored only as a secure hash by our authentication provider; we never see it.
• Your profile: your username, an optional display name, and whether your map is public.
• Your reading: the books you mark as read, with the date and rating if you add them.
• Imports: when you upload a Goodreads or StoryGraph export, we read only the books marked as read (title, author, date read, rating) and keep that summary so you can review the matches. The file itself is not stored.
• Your consent: the date you accepted these terms and this policy, and which version you accepted.
• Technical data: our hosting and authentication providers keep short-lived logs, including IP addresses, to run the service and protect it from abuse.

Why we use it, and on what legal basis

• To provide the service you signed up for: your account, your reading list and your map. This is necessary to perform our agreement with you (GDPR article 6(1)(b)).
• To keep the service secure and prevent abuse, using technical logs. This is our legitimate interest (article 6(1)(f)).
• To show your map publicly, only if you switch that on. You can switch it off at any time on your map page.

We do not use your data for advertising or profiling, and we do not make automated decisions about you.

Cookies

We use only the cookies needed to keep you signed in, set by our authentication provider. They are strictly necessary for the service, so we do not ask for cookie consent. We use no analytics or advertising cookies.

Who else is involved

These providers process data on our behalf, under data processing agreements:

• Supabase stores the database and runs sign-in and account emails, in the European Union (Ireland).
• Vercel hosts the website; pages are served from the European Union (Dublin). Vercel is a US company, and any transfer outside the EU relies on the European Commission’s standard contractual clauses.

Your browser also loads content directly from these services, which see your IP address when it does:

• OpenFreeMap for the map tiles.
• Wikimedia Commons for portraits, book pictures and photographs of places.

If Google sign-in is offered and you use it, Google confirms your identity and shares your name and email address with us. Google’s own privacy policy applies to that sign-in.

How long we keep it

We keep your data for as long as you have an account. When you delete your account, your profile, reading list, ratings and imports are deleted immediately. Encrypted backups kept by our database provider are overwritten within a few days. Technical logs are kept by our providers for a short period, usually days to weeks.

Your rights

Under the GDPR you can:

• See and take your data: use “Download my data” on your map page to get everything we hold about you as a file.
• Correct it: edit your profile and readings at any time.
• Delete it: use “Delete my account” on your map page, or write to us.
• Object to or restrict how we use your data, and withdraw consent at any time.
• Complain to your local data protection authority.

We answer requests within one month.

Children

Terra Lecta is for people aged 16 and over. If you are younger, please do not create an account.

Changes

If we change this policy in a way that matters, we will update the date at the top and tell signed-in users before the change takes effect.