Privacy Policy
1. Who we are
This policy explains how The Infinite Archive (“we”, “us”), operated by Epic Sky, LLC, a Delaware limited liability company, handles personal information at theinfinitearchive.com (the “Service”). Questions or requests: privacy@theinfinitearchive.com.
2. What we collect
| Information | When | Why |
|---|---|---|
| Email address and password (stored only as a one-way hash) | You create an account | To sign you in, secure your account, and send account and billing emails |
| Account activity: sign-up and sign-in times, and the IP address and browser details recorded in security logs | You sign up or sign in | Security, fraud prevention and troubleshooting |
| Saved dossiers and expedition progress | You save a dossier or answer checkpoints while signed in | To sync them across your devices |
| Membership details: plan, status, renewal date, and Stripe customer and subscription IDs | You buy or manage a membership | To grant members-only access and manage billing |
| Payment details (card number, billing address) | You check out | Collected and stored by Stripe, not by us. We see only limited details such as the card brand and last four digits |
| Reader poll votes | You vote in a poll | Stored with a random browser ID, not linked to your account, to count one vote per browser |
| Questions sent to the editors | You use “Ask the archive” | To research and answer them. Not linked to your account. Please do not include personal information |
| Basic request data (IP address, browser, pages requested) | Any visit | Recorded in our hosting provider’s server logs to deliver and secure the site |
Stored on your device. The site uses your browser’s local storage, not advertising cookies, to keep you signed in (an authentication token), remember your saves, expedition progress and poll votes, and hold the random browser ID used for polls. You can clear these at any time in your browser settings. We do not use advertising cookies, cross-site tracking, or third-party analytics. Google Fonts requests are described in Section 4.
For California residents, the categories of personal information we may collect include identifiers (such as email address, IP address, and browser or device identifiers); internet or other electronic network activity (such as sign-in times, pages requested, saves, progress, poll votes, and questions); commercial information (such as membership plan, status, renewal date, and transaction-related identifiers); and account credentials (such as an email address and hashed password). We collect these categories directly from you, automatically from your browser or device, and from providers involved in payment, hosting, database, authentication, and email delivery. We use them for the business and commercial purposes described in this Policy, including providing and securing the Service, processing memberships, communications, support, improvement, and legal compliance. We do not collect every category of personal information identified in California law.
3. How we use it
We use personal information only to provide and secure the Service, process memberships and payments, send transactional emails (such as confirmations, password resets, receipts, renewal reminders and important notices), respond to you, improve the archive, and comply with law. We do not send marketing emails without your consent, and we do not use your information for profiling or automated decisions that have legal or similar effects on you.
4. Service providers
We disclose personal information to service providers that process it for us under contract. Google Fonts is described separately because the browser requests font files directly from Google’s servers, which may receive request data as described below:
- Supabase: database and authentication (accounts, saves, progress, membership records).
- Vercel: website hosting and delivery, including server logs.
- Stripe: payment processing, subscriptions and the billing portal.
- Google Fonts: web fonts loaded from Google’s servers. When your browser requests a font file, Google receives the requesting IP address and browser details contained in the request, such as user-agent information. This request is not used by us as an advertising or analytics tracker.
- Resend: sends account, billing and other transactional emails on our behalf.
Information may be processed in the United States and other countries where these providers operate. If you access the Service from outside the United States, your personal information may be transferred to, stored in, and processed in the United States and other countries whose privacy laws may differ from those where you live. We will handle that information as described in this Policy and use any transfer safeguards required by applicable law.
5. No sale or sharing
We do not currently sell your personal information, and we do not currently “share” it for cross-context behavioral advertising, as those terms are defined under California law. We have not engaged in those activities during the preceding 12 months. These statements do not prevent disclosures to service providers, Google Fonts, Stripe, or others described in this Policy. We may disclose information if required by law or to protect rights and safety. In a merger, acquisition, reorganization, or sale of assets, a successor may receive personal information, and the successor will be bound by this Policy with respect to that information.
6. How long we keep it
We keep account data while your account is open. When you delete your account, we delete your account, saves, progress and membership record from active systems within 35 days. Deleted account data is purged from backups within 35 days, subject to any shorter or longer period required by law or documented technical limitations. Billing, payment and transaction records are kept for 7 years for tax and accounting purposes, or longer if required by law. We retain privacy request records for 24 months and support and correspondence emails for 3 years. Anonymous poll votes and questions are not linked to your account and may be retained indefinitely while they remain unlinked to your identity. Our current retention periods are: security logs, 12 months; server/request logs, 90 days, or as retained by our hosting provider, but not longer than 90 days where we control the retention; and deleted account data in backups, 35 days after removal from active systems, unless a longer period is required for security, legal or disaster-recovery purposes.
7. Your choices and rights
From your Account page you can download a copy of your data, change your password, manage or cancel your membership, and delete your account. Depending on where you live, including California and other U.S. states with privacy laws, you may also have the right to know what personal information we hold, to access, correct or delete it, to receive a portable copy, and to opt out of sale, sharing or targeted advertising (which we do not currently do). To make a request, email privacy@theinfinitearchive.com. We may verify your identity by matching information to our records, including your account email, and we will not discriminate against you for exercising your rights. We will generally respond to a verifiable request within 45 days, or within the period required by applicable law; where permitted, we may extend the response period once by up to 45 additional days and will notify you of the extension. If we deny a request and applicable law provides an appeal right, you may appeal by replying to our decision or emailing us within the period required by that law. We will explain the basis for the decision and respond to an appeal within the period required by applicable law. For a request submitted by an authorized agent, we may require proof of the agent’s authority and may separately verify your identity as permitted by law. California residents may also have rights under California’s Shine the Light law. Based on our current practices, we do not disclose personal information to third parties for their own direct marketing, so no separate Shine the Light request is currently necessary. Because we do not currently sell or share personal information for cross-context behavioral advertising, there is no such activity for which a sale or sharing opt-out is needed. We honor Global Privacy Control signals as required by applicable law. We do not currently respond to Do Not Track signals because there is no consistent industry standard and we do not use cross-site advertising or analytics tracking.
8. Security
We use encrypted connections (HTTPS), hashed passwords, and database access controls that limit each account to its own records. No system is perfectly secure; please use a unique password.
9. Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact privacy@theinfinitearchive.com. A parent or guardian may request access to or deletion of the child’s personal information, and we may verify the parent’s or guardian’s identity and authority before responding. Users aged 13 to 17 may use the Service only with a parent’s or guardian’s consent, consistent with the Terms of Service.
10. Changes
We will post any changes here with a new effective date. For material changes, we will provide notice to account holders by email or through the Service before the changes take effect, where practicable, and will identify the effective date. Your continued use of the Service after the effective date is subject to the revised Policy.
11. Contact
The Infinite Archive · privacy@theinfinitearchive.com