Privacy policy

Who is responsible

The controller of your data is Deep Journey. For any question or request about your data, write to .

What we collect

Account: name, email address, username, password (stored only as a bcrypt hash), and, if you add them, a bio, a birth date and a profile picture.

Google sign-in: name, email address, profile picture and the identifier Google gives your account.

What you write: articles, the images you upload to them, and your tags and newsletter settings.

Reading: the articles you save to your reading list and mark as read.

Article reads: when an article is opened we record the browser's user agent, the referring page, the preferred language and the device type, plus your account if you are signed in. We do not record your IP address for reads.

Security: each sign-in records your IP address and user agent.

Newsletters: if you subscribe to an author, your email address, language and subscription status.

Why, and on what legal basis

To provide the service you signed up for: your account, publishing, reading list and newsletters (performance of a contract, LGPD art. 7, V).

To protect accounts against abuse and unauthorized access: sign-in records and rate limits (legitimate interest, art. 7, IX).

To send an author's newsletter: only after you confirm the subscription from the email we send (consent, art. 7, I). You can withdraw it at any time through the link in every email.

To show authors aggregate reading figures for their own articles (legitimate interest, art. 7, IX).

Who else processes it

We use providers that process data on our behalf: Amazon Web Services (servers and database, in São Paulo), Vercel (web hosting), ImageKit (image storage and delivery), an email delivery provider, and Google, if you sign in with it. Some of them are based outside Brazil, so data may be transferred internationally under the safeguards of LGPD art. 33.

We do not sell your data and do not use advertising or tracking cookies.

Cookies

We use only the cookies the service needs to work: the session cookie that keeps you signed in, and one that remembers the light or dark theme you chose.

How long we keep it

Account data and content: while your account is active.

After you delete your account: it is deactivated at once and hidden from everyone. The records and your articles stay in our database, hidden rather than deleted, and are not erased automatically.

Sign-in records: kept with the account.

Newsletter subscriptions: until you unsubscribe or the author deletes their account.

Your rights

Under LGPD art. 18 you may ask to confirm and access your data, correct it, have it anonymized or erased, port it, learn who it is shared with, and withdraw consent. You can edit your profile and delete your account in Settings; for anything else, write to . We answer within 15 days.

Security

Connections are encrypted with TLS, passwords are stored only as hashes, and access to the servers and database is restricted. No system is risk-free: if an incident may affect you, we will tell you and the ANPD as LGPD requires.

Changes

When this policy changes in a way that matters, we will say so in the product before the change takes effect. The date at the top shows the current version.