Privacy Policy

This notice explains what personal data YumeDB processes when you create an account and use the service, on what legal basis, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Spanish LOPDGDD.

Who is responsible

The controller of your personal data is the operator of YumeDB, a personal, non-commercial project run from España. For any privacy question or to exercise your rights, write to contact@vkoshtovnyi.com — this mailbox is actively monitored and is the effective contact point with the controller.

What data we process

• Account: your email address and a password, stored only as a scrypt hash — we never keep or see it in clear text.
• Public profile: username and display name, plus anything you choose to add — avatar, banner, short bio, accent colour.
• Preferences: timezone, scoring system, title/name language and profile visibility.
• Session & security data: a session identifier kept in a cookie; technical connection data such as IP address and browser user-agent may be processed to keep your account secure and prevent abuse.
• Transactional email: your address is used to send account emails only — the mandatory verification code when you sign up, password-reset codes, and confirmations for email changes or account deletion.
• Consent record: the moment you accepted the Terms and this policy when creating the account.
• Newsletter (opt-in only): if you subscribe to product news in Settings → Account we store the moment you opted in; every issue includes a one-click unsubscribe and you can also switch it off in settings. Account emails (codes, security) are separate and always work.

We do not process special categories of data, and we do not run advertising or analytics trackers.

Why we process it (legal bases)

• To provide your account and its features — performance of a contract (art. 6.1.b).
• To keep the service secure and prevent fraud or abuse — our legitimate interest (art. 6.1.f).
• To send optional communications, should we ever add them — your consent (art. 6.1.a), which you can withdraw at any time.
• To comply with legal obligations where they apply (art. 6.1.c).

Cookies and local storage

We use a single strictly-necessary session cookie for authentication and keep some non-personal interface state (recently viewed items, theme) in your browser. See the Cookie Policy for details. We do not use consent-requiring cookies.

Who we share it with

We rely on service providers that process data on our behalf under contract (data processors, GDPR art. 28). We do not sell your data or share it with advertisers.

• Amazon Web Services EMEA SARL — hosting and infrastructure (server and database) (EU — eu-west-3 region (Paris)).
• Hostinger International Ltd. — transactional email delivery (verification codes, resets) (EU).

If you choose to sign in with Google, GitHub or Discord, that provider acts as an independent controller for its own service; we only receive your name, email address and avatar from it.

International transfers

Where a provider processes data outside the European Economic Area, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses.

How long we keep it

We keep account data while your account exists. When you delete your account — from Settings → Account, or by writing to us — your profile, library, lists and favorites are removed from the live database immediately; where infrastructure backups exist, they rotate out shortly afterwards. Session records and verification codes expire automatically.

Your rights

You may request access, rectification, erasure, restriction and portability, object to processing, or withdraw consent, by writing to contact@vkoshtovnyi.com. We respond within one month. You can also exercise the two most common ones directly from the app: download everything from Settings → Account → Export your data, and erase everything with Settings → Account → Delete your account. You may also lodge a complaint with the Agencia Española de Protección de Datos (AEPD).

Minors

You must be at least 14 years old (Spain, LOPDGDD art. 7) to create an account. We do not knowingly process data of children below that age.

Changes

We may update this notice; the effective date is shown below.

Última actualización: 2026-08-07. Contacto: contact@vkoshtovnyi.com.