Privacy Policy

1. Introduction

Welcome to Prismarium (“we,” “our,” or “us”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our digital library platform (the “Service”).

By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide Directly

Account Information:

• Email address (required for account creation)
• Username (optional)
• Display name (optional)
• Profile image/avatar (optional)
• Password (stored securely, hashed - we cannot see your password)

User-Generated Content:

• Documents you upload (PDFs, images, text files)
• Annotations and highlights you create
• Notes and journal entries
• Collections and bookmarks
• Reading progress and bookmarks
• Feedback submissions (bug reports, feature requests)

2.2 Information Collected Automatically

Usage Data:

• Document uploads, views, and interactions
• Search queries (to improve search functionality)
• Annotations and bookmarks created
• Reading progress and time spent
• API usage (for cost tracking and service optimization)

Technical Data:

• IP address (collected by hosting provider for security)
• Browser type and version
• Device information (for responsive design)
• Session cookies (required for authentication)

Guest Course Ballots:

• A random browser token lets us remember and update one current choice while a ballot is open
• Our database stores only a poll-specific cryptographic identifier derived from that token, never the token itself
• Short-lived rate limits use a separate poll-specific cryptographic network identifier
• We do not attach ballot records to an email address or account, and we do not store a raw IP address or user agent in ballot tables

Analytics:

• Page views and navigation patterns (via Vercel Analytics)
• Performance metrics (via Vercel Speed Insights)
• Error logs (for debugging and improvement)

3. How We Use Your Information

We use the information we collect to:

• Provide and Improve the Service: Authenticate your account, store documents, process OCR, generate AI metadata, enable search, track reading progress
• Service Operations: Monitor API usage and costs, track errors, analyze usage patterns, ensure security
• Communication: Send verification emails, respond to feedback, send service updates (if you opt in)
• Legal Compliance: Comply with applicable laws, respond to legal requests, protect our rights

4. Third-Party Services and Data Sharing

4.1 Service Providers

We use the following third-party services to operate the platform:

4.2 AI Service Data Processing

4.3 Data Sharing Policy

We do NOT:

• Sell your personal information to third parties
• Share your data with advertisers
• Use your content for marketing purposes without consent

We may share data:

• With service providers necessary to operate the platform (listed above)
• If required by law or legal process
• To protect our rights or prevent harm
• With your explicit consent

5. Cookies and Tracking Technologies

5.1 Essential Cookies

Authentication Cookies:

• Purpose: Maintain your login session
• Duration: Session-based (expires when you log out)
• Provider: Supabase
• Required: Yes (cannot disable - required for service)

Guest Ballot Cookie:

• Purpose: Remember your current course-ballot choice, allow changes while voting is open, and reveal live results after you vote
• Set only after a vote is successfully recorded
• Protected from JavaScript access and sent only in same-site requests
• Duration: Up to one year, or until you delete it

5.2 Analytics Cookies

Vercel Analytics:

• Purpose: Understand how users interact with the service
• Data: Page views, navigation patterns (anonymized)
• Duration: Varies
• Required: No (can be disabled via browser settings)

5.3 Local Storage

We use browser local storage for read-aloud preferences, wiki link activation history, and reading position bookmarks. Local storage is stored on your device and can be cleared via browser settings.

6. Data Storage and Security

6.1 Where Your Data is Stored

• Account Data & User Content: Supabase (PostgreSQL database)
• Uploaded Documents: Cloudflare R2 (object storage)
• Analytics Data: Vercel (hosting provider)

6.2 Security Measures

We implement security measures to protect your data:

• Encryption: Data in transit (HTTPS/TLS)
• Authentication: Secure password hashing (bcrypt)
• Access Controls: Row-level security policies in database
• Regular Updates: Security patches and updates
• Monitoring: Error tracking and security monitoring

However: No method of electronic transfer over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6.3 Data Retention

• Account Data: Retained until you delete your account
• User Content: Retained until you delete it or your account
• Usage Analytics: Aggregated data retained for up to 2 years
• Error Logs: Retained for up to 90 days

Account Deletion: When you delete your account, we will delete your personal information and user-generated content within 30 days, except where we are required to retain it by law.

7. Your Rights and Choices

7.1 Access and Control

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct your account information
• Deletion: Delete your account and associated data
• Export: Export your data (annotations, collections, etc.)
• Opt-Out: Disable analytics cookies via browser settings

7.2 How to Exercise Your Rights

To access, update, or delete your data:

1. Log into your account
2. Go to your profile settings
3. Navigate to Privacy Settings, or
4. Contact us at: privacy@prismarium.xyz

7.3 GDPR Rights (EU Users)

If you are in the European Union, you have additional rights: right to data portability, right to object to processing, right to restrict processing, and right to lodge a complaint with a supervisory authority.

7.4 CCPA Rights (California Users)

If you are a California resident, you have the right to know what personal information is collected, know if personal information is sold or disclosed (we do not sell data), opt-out of the sale of personal information, and non-discrimination for exercising your rights.

8. Children’s Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@prismarium.xyz.

If we discover we have collected information from a child under 13, we will delete that information promptly.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your country.

By using our Service, you consent to the transfer of your information to these countries. We ensure appropriate safeguards are in place when transferring data internationally, including standard contractual clauses, adequacy decisions, and vendor privacy certifications.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the “Last Updated” date
• Sending an email notification (for material changes)
• Displaying a notice in the application (for significant changes)

Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

12. Additional Information

12.1 Data Controller

12.2 Supervisory Authority (EU Users)

If you are in the EU and have concerns about our data practices, you can contact your local data protection authority.

13. Affiliate Link Disclosure

Prismarium participates in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com.

As an Amazon Associate, we earn from qualifying purchases. This means that when you click on certain links to products on Amazon and make a purchase, we may receive a small commission at no additional cost to you. This helps support the maintenance and development of the Prismarium platform.