Privacy Policy
Last updated: 5 October 2026
This policy explains what personal data ALMA (books.synaptiq.academy) collects, why, who it goes to, how long it is kept, and what you can do about it. It describes how the site actually works today.
1. Who runs ALMA
ALMA is the public name of this website. It is operated by Synaptiq Academy, which decides why and how the personal data described here is used. In data protection law, that makes it the controller.
For anything about your personal data, write to admin@synaptiq.academy. No data protection officer has been appointed.
2. What we collect
You can read ALMA without giving us anything. What we collect depends on what you do.
If you create an account
- Email address and password (stored only as a one-way hash, never in readable form).
- Profile details you choose to add: display name, username, picture, cover image, short bio, country, favourite book, character or quote, reading status.
- Account records: when the account was created and verified, last sign-in, and your settings (for example whether your profile is public, which is the default).
- When you register, we also record the IP address and browser details used, as a security record.
If you take part in the community
- What you post: comments on articles and pages, Keeper Theories, forum topics and replies, wiki edits, book club posts, and any files you attach.
- What you do with other posts: likes and reactions, votes, bookmarks, follows, and reports you send to moderators.
- Notifications we generate for you inside the site (for example when someone replies to you).
- Moderation records, if a moderator hides content or restricts an account.
Your username, display name, profile picture and anything you post are visible to other visitors. Your email address is never shown publicly.
If you subscribe to an email list
- Your email address, which list you joined (for example Shadow Choice Insider or ALMA's picks), where on the site you signed up, and when.
- Your confirmation: every subscription must be confirmed through a link we email you before anything else is sent.
- If you unsubscribe, the date you did.
If you send us a request or an email
- The name, email address and details you put in a data request form or an email to us.
Collected automatically when you use the site
- Server and hosting logs. Like any website, the servers that deliver ALMA receive your IP address, browser and device details, the address you requested and when. These are kept by our hosting providers for a limited period.
- Page view counts. When a page loads, our server records the page, the referring website and a pseudonymous code made from your IP address, browser details and the date. The code changes every day and your IP address itself is not stored. No cookie is used for this.
- Clicks to bookshops. When you click a link to a bookshop, we record which book, which shop, where on ALMA you clicked, the referring website and any campaign tags in the link that brought you here. No IP address or account is attached to these records.
- Searches. What you type in the search box is sent to our server to find matching articles. It is not linked to you or stored in our database.
- Abuse protection. To stop automated abuse, our server briefly counts requests per IP address for some actions (creating an account, signing in, password resets, subscribing to an email list, sending data requests). These counts are held in memory for at most an hour.
- Find My Next Read and Which Keeper Are You? Your answers are worked out in your own browser and are not sent to us. Only an email address you choose to give at the end is sent, to subscribe you.
3. What stays in your browser
Some things are saved only in your own browser: your cookie choice, sign-in tokens if you have an account, articles you save, reading settings, and progress in the Keeper games. These aren't sent to us except where needed to keep you signed in. The Cookie Policy lists each one by name.
Google Ads cookies are used only if you accept Marketing cookies. You can change that at any time in .
4. Why we use it, and on what legal basis
| What for | Data | Legal basis (GDPR) |
|---|---|---|
| Running your account and the community features you use | Account, profile and community data | Contract: needed to provide the service you asked for (Art. 6(1)(b)) |
| Sending account emails (verify your address, reset your password) | Email address | Contract (Art. 6(1)(b)) |
| Sending newsletters you subscribed to | Email address, list, signup details | Your consent, given when you subscribe and confirm (Art. 6(1)(a)) |
| Moderating content and protecting the site from abuse and fraud | Community content, reports, moderation and security records, IP-based request counts | Legitimate interests: keeping the site and its community safe (Art. 6(1)(f)) |
| Understanding which pages and book recommendations are useful | Page view counts and bookshop click records | Legitimate interests: improving ALMA, using pseudonymous or non-identifying data only (Art. 6(1)(f)) |
| Measuring whether ads lead to clicks through to the author's books | Google Ads cookies and the data Google receives | Your consent (Marketing cookies) (Art. 6(1)(a)) |
| Answering your requests and keeping a record of how we handled them | Request details | Legal obligation (Art. 6(1)(c)) and legitimate interests |
| Delivering the website at all | Server and hosting logs | Legitimate interests: operating and securing the website (Art. 6(1)(f)) |
Where we rely on legitimate interests, you can object (see Your data rights). Where we rely on consent, you can withdraw it at any time; this doesn't affect anything done before you withdrew.
We don't sell personal data, and we don't use it to build advertising profiles.
5. Who receives it
We use these service providers, which process data on our behalf:
| Provider | What they do | Data involved | Location |
|---|---|---|---|
| Vercel Inc. | Hosts and delivers the ALMA website. | Your IP address and browser details in request logs when you load a page. | United States (global delivery network) |
| Railway | Runs ALMA's server and its database. | Everything ALMA stores about accounts, subscriptions, posts and requests; IP address and request details in server logs. | United States (servers in the US West region) |
| Resend | Sends ALMA's emails (account emails, newsletter confirmations and newsletters). | Your email address and the content of the email. | United States |
| Google Ireland Ltd / Google LLC | Google Ads conversion measurement. Only if you accept Marketing cookies. | Cookie identifiers, the pages you visit on ALMA, your IP address and browser details, and clicks through to the author's books on Amazon. | Ireland and the United States |
Google uses the data from Google Ads cookies partly for its own purposes, under its own privacy policy, as an independent controller. Besides these providers, your public profile and posts are visible to anyone visiting the site, and we may disclose data where the law requires it, for example to a court or authority.
6. Links to Amazon and other bookshops
Some links to bookshops are affiliate links (see the Affiliate disclosure). When you click one, you leave ALMA. The bookshop handles your visit and any purchase under its own privacy policy and may set its own cookies. ALMA doesn't receive your name or payment details from the bookshop.
7. Transfers outside Europe
Vercel, Railway, Resend and Google are based in the United States, and ALMA's server and database run in the United States. Your data is therefore transferred outside the European Economic Area. These transfers rely on the safeguards in each provider's data processing terms: the European Commission's Standard Contractual Clauses, and the EU-US Data Privacy Framework where the provider is certified under it. You can ask us for more information about these safeguards.
8. How long we keep it
- Your account is kept while it's open. When an account is deleted, the profile (name, username, picture, bio, settings) is deleted, the email address is replaced, and the password and any pending tokens are cleared. Posts and comments you wrote are not removed automatically; they stay without your profile attached. You can ask us to remove them.
- Newsletter subscriptions are kept until you unsubscribe. After that we keep your address marked as unsubscribed, so we don't email you again by mistake. Ask us if you want it removed completely. Subscriptions that were never confirmed are not currently deleted automatically.
- Page view counts and bookshop click records are kept as statistics. They contain no IP address and no account.
- Security records (the IP address and browser recorded when an account is created, and the log of account actions) are kept as a security record. We don't currently delete them automatically; you can ask us to.
- Data requests are kept as a record that we handled them as the law requires.
- Hosting and server logs are kept only for the limited period our hosting providers keep them.
- IP-based request counts for abuse protection are kept in memory for at most an hour.
9. Security
Connections to ALMA are encrypted (HTTPS). Passwords are stored as one-way hashes. The sign-in cookie can't be read by scripts on the page and is sent only over secure connections. Access to the admin area is limited to ALMA's editors and controlled by permissions. No system is perfectly secure, but we work to protect your data and will act promptly if something goes wrong, including notifying you and the authorities where the law requires.
10. Your rights
You can ask to access, correct, delete, restrict or receive a copy of your personal data, object to some uses, and withdraw consent. You can also complain to a data protection authority. How to do each of these, and how we respond, is on Your data rights.
In Romania the authority is Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) (dataprotection.ro). If you live elsewhere in the EU, you can also contact the authority in your own country.
11. Children
ALMA is a general-audience site. Some of its books are written for young adults, but accounts, community features and newsletters are not designed for children to use on their own, and ALMA doesn't ask for anyone's age. If you are under the age at which you can agree to online services yourself where you live (16 under the GDPR unless your country has set a lower age, which can't be below 13), please ask a parent or guardian before creating an account or subscribing. If we learn that we hold a child's data without valid consent, we will delete it. Parents can contact us at admin@synaptiq.academy.
12. Automated decisions
We don't make decisions about you by automated means that have legal or similarly significant effects. Find My Next Read simply matches your answers to books in your own browser.
13. Other websites
ALMA links to other websites, including bookshops and social networks. Their privacy practices are their own. When you use a share button, you go to that network's site and its policy applies.
14. Changes to this policy
If we change how we use personal data, we'll update this page and the date at the top. If a change needs your consent, for example a new type of optional cookie, we'll ask again before it applies.
15. Contact
Questions or requests: admin@synaptiq.academy. You can also use the data request form or the deletion request form.