Privacy Policy
Last updated: 29 September 2026
This Privacy Policy explains what personal data Apologea ("we", "us", "our") collects when you use the Apologea website, applications and services (together, the "Service"), why we collect it, and what rights you have over it.
It should be read together with our Terms and Conditions. By using the Service you acknowledge this Privacy Policy.
In short: we collect what is needed to run your account, publish your writing and keep the platform safe. We do not sell your personal data, and we do not use the content you publish to train our own machine-learning models.
Table of contents
- Data we collect
- How we collect it
- Why we use it and our legal bases
- Cookies and local storage
- Who we share data with
- How long we keep data
- Security
- International transfers
- Your rights
- Children
- Changes to this policy
1. Data we collect
We collect the following categories of personal data.
1.1 Data you give us
- Account data: your username, email address and password. Passwords are stored only as a salted hash; we never store your password in readable form.
- Profile data: your display name, bio, avatar and the social links you choose to add.
- Content you publish: articles, debate turns, resources, uploaded images and any information you include in them. Your content is published under your username and is visible to other users of the Service.
- Communications: the content of messages you send us, such as a support request or a copyright notice, and our replies.
1.2 Data we collect automatically
- Usage data: what you read, like, respond to and vote on; the debates you take part in; who you follow; and which notifications you open. This is what makes features such as your article feed and your quota balance work.
- Technical data: your IP address, browser type and version, device and operating system information, the pages you request and the times at which you request them, and error and diagnostic logs.
- Security data: records of failed sign-in attempts, rate-limit counters, session identifiers and verification tokens, kept to detect abuse and to keep your account safe.
1.3 Payment data
If you buy apologia credit, our payment provider Stripe processes the transaction. We receive a payment reference, the amount, the currency, the status of the purchase and the credits granted, together with the email address you supply at checkout. We do not receive or store your full card number or your card's security code.
We do not intentionally collect special category data, and we ask you not to include it in your profile or your content.
2. How we collect it
- Directly from you, when you register, edit your profile, publish content, buy credit or contact us.
- Automatically, as you navigate the Service, through our servers and logs.
- From your browser storage, because the Service stores a small amount of data locally in your browser, as described in section 4.
- From our payment provider, which tells us whether a purchase was completed and for how much.
We do not buy personal data from data brokers, and we do not add data from third-party advertising networks.
3. Why we use it and our legal bases
Where the EU GDPR applies, we rely on the legal bases set out below.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and securing your account, signing you in and delivering the Service | Account, profile, technical and security data | Performance of a contract |
| Publishing your content and showing it to other users | Profile and content data | Performance of a contract |
| Metering the apologia quota, processing credit purchases and preventing double-crediting | Usage, account and payment data | Performance of a contract |
| Keeping the Service available, diagnosing faults and improving features | Technical and usage data | Legitimate interests |
| Preventing fraud, abuse, spam and attacks, and enforcing our Terms | Security, technical and usage data | Legitimate interests |
| Sending transactional email, such as address verification, password reset and notifications you have enabled | Account and usage data | Performance of a contract |
| Responding to your requests, notices and complaints | Communications data | Legitimate interests and legal obligation |
| Meeting accounting, tax and other legal obligations | Account and payment data | Legal obligation |
You can object to processing based on legitimate interests at any time by writing to us. We will stop unless we have compelling grounds that override your interests, or a legal obligation to continue.
4. Cookies and local storage
We use a small number of strictly necessary cookies and browser storage entries:
- a session cookie, which keeps you signed in;
- a colour-scheme and mode preference, stored in your browser so the Service remembers whether you chose light or dark, and whether the article editor has unsaved drafts;
- draft data, which may be kept in your browser so that work in the editor is not lost.
These are required for the Service to function, so we do not ask for consent for them and we do not use them for advertising. If we ever introduce optional analytics or marketing cookies, we will ask for your consent first and update this section.
Most browsers let you block or delete cookies and site data. Blocking the session cookie will prevent you from signing in.
5. Who we share data with
We do not sell your personal data. We share it only with service providers that help us run the Service, and only as far as needed:
- Hosting and infrastructure providers, which run the servers and databases that hold the Service and its data;
- Stripe, which processes payments and handles card data under its own privacy terms;
- Email delivery providers, which send verification, password-reset and notification messages; and
- Logging and monitoring providers, which help us detect faults and attacks.
We may also disclose personal data:
- where the law requires it, or in response to a valid legal request;
- to protect the rights, property or safety of our users or the public;
- to professional advisers under a duty of confidence; and
- as part of a reorganisation, merger or sale of all or part of our business, in which case we will tell you and the recipient remains bound by this policy.
Some data you publish is public by design. Your username, profile, published content and debate record are visible to other users, and you should assume anything you publish can be copied by anyone who can see it.
6. How long we keep data
| Data | Retention |
|---|---|
| Account and profile data | While your account is open, then deleted or anonymised within 30 days of closure |
| Published content | While your account is open, and afterwards for as long as it is needed for the integrity of answered articles and completed debates, or until you ask us to delete it |
| Payment and quota records | Kept for the period required by tax and accounting law |
| Security and rate-limit records | Kept for a short period, normally up to 90 days |
| Server logs and diagnostic data | Kept for a limited period, normally up to 30 days |
| Backups | Overwritten on a rolling cycle, normally within 90 days |
Where we cannot delete data immediately, we restrict access to it and keep it only for the purpose that requires it.
7. Security
We take the security of your account seriously. Measures include hashing your password with a modern salted algorithm, signing session tokens, transport encryption, rate limiting on authentication endpoints, restricted database access and the principle of least privilege across our systems.
No online service can promise perfect security. You can help by choosing a unique password, keeping it confidential, and telling us if you notice anything suspicious.
8. International transfers
We may store and process your data in countries outside the one you live in, including the United States and the European Economic Area. Where personal data is transferred out of the UK or the EEA, we rely on an appropriate safeguard, such as the UK or EU Standard Contractual Clauses or an adequacy decision.
9. Your rights
Subject to applicable law, you have the right to:
- access the personal data we hold about you;
- correct data that is inaccurate or incomplete, most of which you can edit yourself in your profile;
- erase your data, subject to the retention rules in section 6;
- restrict or object to our processing, including processing based on legitimate interests;
- port the data you gave us in a structured, machine-readable format;
- withdraw consent where processing is based on consent; and
- complain to your local data protection authority. In the UK, that is the Information Commissioner's Office.
To exercise any of these rights, write to us. We will respond within one month, and we may ask you to confirm your identity first. You can also delete much of your own data directly: you can edit your profile, remove your content, and close your account.
If you are a California resident, you also have the right to know what categories of personal data we collect and to whom we disclose it, to request deletion, and to be free from discrimination for exercising your rights. We do not sell or share your personal data as those terms are defined by the CCPA.
10. Children
The Service is not intended for children. You must be at least 16 years old, or older where your country requires a higher age of digital consent, to use it. If we learn that we hold personal data of a child below that age, we will delete it and close the account.
11. Changes to this policy
We may update this Privacy Policy to reflect changes to the Service or to the law. If a change is material we will give reasonable notice, for example by email or by a prominent notice in the Service, before it takes effect. The date at the top of this page always shows the current version.