Version: 1 November 2026. Effective when this version is published in the service.
1. Controller and contact
The controller of personal data is Mikołaj Bednarek, conducting business as Bearpoints Mikołaj Bednarek, Polish tax identification number (NIP) 5212136333, ul. Kościelna 28C, 05-254 Kuligów, Poland, operating the service under the brand The Dreamer’s Crossing. For privacy matters, contact gm@dreamerscrossing.pl.
2. Data categories, purposes and legal bases
| Feature | Data | Purpose and legal basis |
|---|---|---|
| Account, sign-in and password recovery | Email address, password hash, account identifier, role, email confirmation, session and MFA data, security events; unique nickname, optional first and last name, public signature and profile visibility | Provide the account, public identity where enabled and protect access; performance of a service contract under Article 6(1)(b) GDPR and legitimate interest in security under Article 6(1)(f). |
| Chronicles and drafts | Chronicle, adventure, encounter, encyclopedia, note and Spark text; change history | Store and present your work; performance of a contract under Article 6(1)(b). |
| Guest trial | One chronicle, random session and recovery identifiers, activity time; optional email and confirmation | Maintain the trial, allow private return, send the link and one expiry reminder; performance of a contract under Article 6(1)(b). |
| Sharing, copying and import | A published snapshot of the entire chronicle, visibility state, date, author identifiers and signatures; independent copies, imported credits and provenance declarations | Publish according to the author's choice, preserve attribution and enable reading, copying and import; performance of a contract under Article 6(1)(b). |
| Coauthor invitations | Recipient email, invitation state and expiry, account and chronicle identifiers, author attribution | Deliver and manage invitations and access to shared work; performance of a contract under Article 6(1)(b) for account holders and legitimate interest under Article 6(1)(f) in responding to an author's invitation for a recipient who has not yet joined. |
| Community and moderation | Public signature or identifier, comments, likes, historic ratings, reports and moderator decisions | Community features under Article 6(1)(b); protecting others, security and legal claims under legitimate interest, Article 6(1)(f); specific legal duties under Article 6(1)(c) where applicable. Ratings and rankings are currently disabled; previously stored ratings are retained. |
| Reports without an account and appeals | Reporter name and email (optional for child sexual exploitation reports), description of the identified content, good-faith statement, privacy notice version, private case token, decision and appeal reasons, technical request data needed to limit abuse | Handle reports and appeals, document decisions and protect the form; legal obligation under Article 6(1)(c) insofar as applicable digital services law requires it; legitimate interest in service protection and legal claims under Article 6(1)(f). |
| Contact messages and complaints | Name if provided, email, subject, message and correspondence | Respond and handle the matter under Article 6(1)(b), or legitimate interest in correspondence under Article 6(1)(f) for other inquiries. |
| News | Email, consent and its changes, address confirmation, delivery state | Send project updates only after separate, voluntary consent under Article 6(1)(a) GDPR and Article 398 of the Polish Electronic Communications Law. Withdrawing consent does not affect your account. |
| Diagnostics and statistics | Technical request data, time, limited information about the visited screen and device | Protect the service and measure its usefulness without identifying analytics; legitimate interest under Article 6(1)(f). |
An email address and password are needed to create an account. Email is optional for a guest trial, but without it we cannot send the link or reminder. We do not ask for special categories of data. You decide what to put in your chronicles and should not include other people’s data without a proper basis.
3. Who receives data
Authorized technical administrators have task-appropriate access; administrative roles may read accounts, chronicles and reports to maintain the service. Data is processed on a VPS in Poland, and IQHost handles email. Infrastructure providers process data as needed to provide their services. Umami analytics and local backups run on the VPS. The operator also manually keeps encrypted recovery copies on an operator-controlled laptop outside the VPS; the copy includes database and configuration data. Authorized public authorities may also receive data where required by law.
An author may deliberately share a complete chronicle snapshot by link or in the catalog. Anyone with the link may then read it, and a signed-in user may make an independent copy in their account. Unpublishing does not erase earlier copies. Comments are shown publicly with the user's selected signature, date and text; likes are shown in aggregate. Public author profiles and credits may display a nickname or a chosen signature containing the user's name. An administrator sees the information needed to handle a report.
A reporter receives a private case link and, if they provide an email address, may receive it by email. A person whose content was restricted receives reasons and can access the case after signing in. The link contains a confidential token and should be protected like a password. The reporting form uses a local time-limited token, a hidden field and an IP-based rate limit; it does not transfer data to an external CAPTCHA provider.
The external “Buy me a beer” link leaves the Scriptorium. Further processing follows that website operator’s rules. The Scriptorium does not store payment-card data.
4. Transfers outside the EEA
The current app configuration does not outsource storage of chronicles or backups to providers outside the European Economic Area. The app server and IQHost email infrastructure are located in Poland. An email sent to an address you provide also reaches your chosen mailbox provider, whose infrastructure may be outside the EEA. If the Operator later enables a service involving the Operator’s own transfer of data outside the EEA, this Policy will be updated before that processing begins and will identify the transfer basis and safeguards.
5. Retention periods
- An active guest record is kept for 30 days from the last activity. One reminder may be sent before expiry to a previously confirmed email address. Once expired, the record is removed from the active database.
- Account data and private chronicles are kept while the account exists. On a request to close an account, the Operator will assess what can be deleted and what is still necessary for a legal duty, resolution of a report or defense of claims. The Scriptorium currently has no self-service button to delete an entire account.
- Public snapshots remain accessible until they are unpublished or the chronicle is deleted. Independent copies made by other users belong to their accounts and are not automatically deleted when the original is unpublished.
- Comments, reactions and ratings remain with published material while it is shared. After deletion or unpublishing, they may be kept as needed to handle a report, appeal or claim. Reports, moderation decisions, appeals and related correspondence are kept for the duration of the case and the required period during which it can be challenged, and afterward only as long as needed for a legal obligation or defense of claims. Deletion requests are assessed individually, including related community entries.
- Local backups on the production server have a configured 14-day retention and are cleaned in the next daily cycle. Encrypted copies held on the operator's laptop are created and removed manually; their retention is reviewed against recovery needs and deletion obligations, rather than automatically limited to 14 days. Deleted data may remain in protected backups; emergency restoration should not reactivate it without reconsidering deletion requests.
6. Cookies and statistics
The Scriptorium uses essential cookies for accounts, guest mode and form protection. The guest cookie allows the browser to return to a record, and the private link enables recovery on another device. Authentication cookies are protected from JavaScript access. Deleting cookies may end a session; a guest without a saved link may lose access. Technical interface preferences may be saved locally in the browser.
The Scriptorium uses self-hosted Umami analytics without identifying cookies. Statistics receive generalized screen-type names, not email addresses, chronicle titles or note contents. Statistics are kept as long as needed to assess and develop the service; the Operator periodically reviews their continued usefulness. Technical app logs are stored locally for approximately 14 days.
7. Your rights
You may request access, rectification, erasure, restriction of processing and data portability to the extent provided by the GDPR. You may object to processing based on legitimate interest and withdraw your News consent at any time without affecting earlier lawful mailings. Send your request to gm@dreamerscrossing.pl. To protect an account, we may ask you to confirm your authority. We will respond within the GDPR time limits. You may also complain to the President of the Polish Personal Data Protection Office: uodo.gov.pl.
8. Automated decisions and policy changes
The Scriptorium does not make decisions about you that have legal or similarly significant effects solely by automated means. Moderation decisions are made by an administrator. We will announce material changes to this Policy in the service with a new date and version.