Privacy Policy

1. Data controller

The operator identified below is the controller of personal data processed through NightTales, except where a third party acts as an independent controller for its own services. NightTales and Saboreq are public-facing brands.

2. Data we collect

Depending on how you use NightTales, we may process your email address, username, display name, profile information, authentication records, published stories and images, comments, likes, bookmarks, follows, reports, support messages, account preferences, security records, device and request information, and billing identifiers or entitlement status supplied by our payment provider.

Payment-card details are handled by the payment provider and are not stored by NightTales.

3. Why we process data

We process account and service data to create and secure accounts, verify email ownership, authenticate users, publish and deliver content, provide community functions, store user preferences, prevent fraud and abuse, investigate reports, provide support, maintain service reliability, comply with legal obligations, and administer paid entitlements where offered.

Our legal bases may include performance of a contract, steps taken at your request before entering a contract, our legitimate interests in operating and securing the service, compliance with legal obligations, and consent where consent is required by law.

4. Public information

Your public username, display name, bio, published stories, story images, comments, visible reactions, follower information, and other content you intentionally publish may be available to anyone and may be indexed by search engines. Your account email address is not displayed as part of your public profile.

5. Authentication and email

Passwords are processed by our authentication system using password hashing; NightTales does not store readable account passwords. Email ownership is verified with time-limited one-time codes. Transactional messages such as verification and account-recovery emails are delivered through Resend.

6. Service providers

We use service providers to operate NightTales. These may include Convex for backend services, database functions and file storage; Vercel for website hosting and web analytics; Resend for transactional email; and Paddle as Merchant of Record where paid features are available. Providers process data according to their roles, contracts, and applicable law.

7. Analytics and advertising

We use Vercel Web Analytics to understand aggregate website usage and improve the service. If advertising is enabled, eligible pages may use Google AdSense or another disclosed advertising provider. Advertising technologies may process device, usage, or consent information as described in the provider's notices and any consent interface shown to you.

8. International data transfers

Some providers may process data outside Poland or the European Economic Area. Where required, transfers are protected using an applicable legal mechanism such as an adequacy decision, Standard Contractual Clauses, or another mechanism recognised by data-protection law.

9. Retention

We keep personal data only for as long as reasonably necessary for the purposes described in this policy. Account and published-content data is generally retained while your account or content remains active. Security, moderation, billing, fraud-prevention, tax, and legal records may be retained longer where necessary to establish, exercise, or defend legal claims or comply with law. Backups may take additional time to expire after deletion.

10. Your rights

Subject to applicable law, you may have rights to access, correct, erase, restrict, or object to processing of your personal data, and rights to data portability and to withdraw consent where processing is based on consent. You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), or another competent supervisory authority.

We may need to verify your identity before completing a request. Certain data may be retained where an exemption or legal obligation applies.

11. Children

NightTales is not intended for children under 16. If we learn that an account was created in violation of this requirement, we may take reasonable steps to restrict the account and delete data where appropriate.

12. Security

We use technical and organisational measures intended to protect accounts and service data, including authenticated access controls, password hashing, time-limited verification codes, server-side entitlement checks, and restricted handling of secrets. No online service can guarantee absolute security.

13. Changes to this policy

We may update this Privacy Policy when our service, providers, or legal obligations change. Material changes will be communicated in a reasonable manner. The effective date at the top identifies the current version.

14. Contact

For privacy questions or data-subject requests, use the details on our Contact page.