Privacy policy.
Your data. Clear principles.
01 / Migrated reader accounts
When existing TRUTH accounts are migrated from the previous service, we retain the display name and email needed to match sign-in, migration source and email subscription status. Migrated public profiles display the name and follow relationships, never the email, phone number, address or birth date. Existing subscription opt-outs are retained; migration does not send email or change marketing preferences. Access to a migrated account requires Google or LinkedIn to verify the same email address. You can change profile visibility, unfollow people and delete the account after signing in.
02 / Optional profile photo
You can upload, replace or remove a profile photo in your account. Before upload, the browser creates a square PNG copy without the original file metadata. The photo is stored in the site’s protected file storage. Only you can view a private profile photo; signed-in readers can view it when your profile is public. Removing the photo or deleting your account removes the stored photo. A photo is optional.
03 / Newsroom collaboration applications
The application form saves your name, email, personal LinkedIn profile URL, professional interests, message and optional portfolio URL in our private site database. We use these details to consider the collaboration you request and contact you about it. Providing a LinkedIn URL is required in place of an attached CV; we do not automatically copy your profile or receive LinkedIn access credentials through this form. Access is restricted to the site owner and authorised editorial handling. Applications expire after 90 days and are deleted during the next submission or owner review. Security controls use short-lived keyed network identifiers, not raw IP addresses in application records; these are removed after expiry during subsequent processing. A reader account is not required. To request deletion, contact support@truthmagazine.pl. Please do not include sensitive personal data or confidential source information.
04 / Data controller
The controller of personal data processed by TRUTH Magazine is Stowarzyszenie Centrum Wsparcia „Just Do It”, KRS 0000983480, the magazine’s publisher. Contact for privacy requests: support@truthmagazine.pl. Correspondence address: ul. Żubrza 16/2, 54-229 Wrocław, Poland.
05 / What data we use
We process information you provide in correspondence, including your name, email address and message. When you create a reader account, we store your site-specific sign-in identifier, sign-in email, chosen display name, account timestamps and the privacy notice version you acknowledged. We also store the article links you save, their save dates, your public/private setting, a random community profile identifier and follow relationships. We also store which authors and featured people you follow to display their articles in your account. These choices remain private regardless of your profile visibility. LinkedIn or Google sign-in information may include your name and, if shared, your email address. Technical infrastructure may process IP addresses, browser information and security logs.
06 / Purposes and legal bases
We process reader account and saved-article data to provide the service you request (Article 6(1)(b) GDPR). Correspondence and service security are based on our legitimate interests in responding to enquiries and protecting our services (Article 6(1)(f)). Where correspondence concerns entering into or performing a contract, Article 6(1)(b) applies. Records required by law, including donation accounting records, are processed under Article 6(1)(c). Any optional activity requiring consent has a separate consent request; consent can be withdrawn without affecting earlier lawful processing.
07 / Accounts and sign-in
Reader accounts use LinkedIn or Google OpenID Connect when that provider is configured. We verify the sign-in response and maintain a server-side TRUTH session using a Secure, HttpOnly cookie. We never receive LinkedIn or Google passwords and do not retain either provider’s access or ID tokens. A reader account is created at your request. Profiles are private by default. If you choose a public profile, signed-in readers can see your display name and follow relationships. We also store which authors and featured people you follow to display their articles in your account. These choices remain private regardless of your profile visibility. Switching to private removes you from the reader list and hides follow relationships. Your email and saved articles always remain private. Public articles do not require sign-in.
08 / Contact forms and newsletter enquiries
The current contact and newsletter forms prepare a message in your email application. It is sent to the newsroom only when you send that email. A newsletter enquiry does not automatically enrol you in a mailing list.
09 / Truth Ambassador 2027
Award submissions are sent by email only after the sender sends the draft. Candidate work, contact details, submission reasons and jury assessments are processed under Article 6(1)(f) GDPR to administer and document a credible distinction. Third-party candidates receive an information notice at first contact, within one month and before publication. Rejected submission files are normally kept for three months after the final decision, jury records for three years, and a minimal public recipient record for five years followed by a review. A separate optional consent is requested for additional promotion. Individual jury records are confidential; there is no public online jury assessment form. The full award-specific notice, including rights, recipients and retention exceptions, is in section 12 of the bilingual award rules at truthmagazine.eu/ambasadorzy-prawdy/. Privacy contact: support@truthmagazine.pl.
10 / Audience voting
To enforce the two-vote quota for different candidates, we process verified sign-in email information and an account identifier. Separate provider accounts are not merged. A keyed, pseudonymous ledger links account and verified-email identifiers to choices, times and rules version; the same verified email shares a quota across Google and LinkedIn. A verification hash is kept while the reader account exists; unused sign-up records are removed after 30 days during subsequent sign-in processing. Voting integrity and abuse controls rely on Article 6(1)(f) GDPR. Individual choices are private. Deleting a profile removes its verification proof but does not reset the vote quota; the pseudonymous voting ledger is retained until 15 April 2027 and thereafter removed, leaving only totals without voter identifiers. Separate complaint correspondence may be retained for justified handling. OAuth confirms control of a provider account and email, not a unique human identity. Google is a separate sign-in provider subject to policies.google.com/privacy.
11 / Donations
Stripe processes payments. We do not receive full payment card details. We may receive the donor and transaction information needed to administer and account for a donation, such as its amount, date and status. Stripe explains its own processing at stripe.com/privacy.
12 / External services and browser storage
The website uses external services, including Google Fonts, Google Translate links, Stripe and a LinkedIn feed widget from SociableKIT. Requests to external services may transmit technical data, including your IP address and browser information. Providers may use cookies or similar technologies. The site stores language preferences and news headline caches in browser storage. Settings for browser storage are available in your browser. Opening an external platform is subject to that platform’s privacy information. Adding this notice does not itself change how external scripts load.
13 / Recipients and international transfers
Authorised editorial staff and providers of hosting, email, technical infrastructure, payments and accounting may process data where needed for their tasks. Reader account records are stored in the site’s Cloudflare D1 database; LinkedIn or Google provides sign-in identity, while TRUTH stores hashed session identifiers. Profile visibility and follows are processed to provide the community features you request (Article 6(1)(b) GDPR). International services may process data outside the European Economic Area. Applicable transfer arrangements, including adequacy decisions or contractual safeguards where used, are described in the providers’ documentation. Contact us for information about transfers relating to data we control.
14 / How long data is kept
Your active reader profile and saved articles are kept while the account exists. Deleting the reader account removes those records from the active account database. It also removes follow relationships and TRUTH sign-in sessions. It does not delete your LinkedIn or Google account or separate correspondence and donation documentation. Sessions expire after seven days or 24 hours of inactivity; sign-in state is valid for ten minutes. Expired session and sign-in-state records are removed during subsequent sign-in operations. Correspondence is retained for handling the matter and, where necessary, legal obligations or protection of claims. Accounting documentation is retained for the period required by applicable law. Infrastructure logs and provider-held records follow the relevant provider’s retention arrangements.
15 / Your rights
Subject to the GDPR’s conditions, you may request access, rectification, erasure, restriction, portability or object to processing based on legitimate interests. Consent can be withdrawn at any time. Contact support@truthmagazine.pl to exercise your rights. You can also complain to Poland’s President of the Personal Data Protection Office (UODO), uodo.gov.pl. Providing account and contact information is voluntary; without the information needed for a feature we may not be able to provide it.
16 / Control and security
You can edit your display name, remove saved articles or delete your reader account in My account. Account access is checked on the server, and private responses are not intended for shared caching. We do not use reader account data to make automated decisions producing legal or similarly significant effects. Sign out when using a shared device.
17 / Updates
We update this notice when the service or its processing changes. Last updated: 28 October 2026.
Contact and provider information
OpenAI · Cloudflare · Stripe · SociableKIT · LinkedIn · Google · UODO