Privacy Policy

Last updated: November 9, 2026

1. Who we are

MyForum and MyBlog are hosted community and blog services operated by an independent developer (“we”). For personal data processed to run the Service, we are the controller. Contact: [email protected].

2. What we collect

Account data: email address, display name, hashed password, session records, and the sites you create.
Content: posts, replies, pages, uploaded media and settings you or your members create.
Technical data: IP address, user agent, request logs, and security events (rate limits, failed logins) used to operate and protect the Service.
Billing data: handled by our Merchant of Record, Creem. We receive subscription status, plan, customer ID and invoices — never your full card number.

3. Why we use it

to provide and secure the Service (contract performance);
to process payments and meet tax obligations (contract and legal obligation);
to prevent abuse, spam and fraud (legitimate interests);
to send service emails you requested, such as replies and digests (consent or contract).

4. Cookies

We use a single essential cookie to keep you signed in. We do not use advertising or third-party tracking cookies. If we introduce analytics later, we will update this page and ask for consent where required.

5. Sharing and subprocessors

We share data only with providers needed to run the Service:

Cloudflare — DNS, CDN, TLS and abuse protection;
Creem — payments, tax calculation, invoices and subscription management;
Our hosting provider — servers and storage in the region where the Service runs;
Email provider — transactional email delivery (when enabled).

We do not sell personal data.

6. International transfers

Our providers may process data outside your country, including in the United States and the European Union. Where required, transfers rely on standard contractual clauses or an equivalent safeguard.

7. Retention

Account data: until you delete your account, then 30 days recovery, then deletion.
Content: same as above; backups expire within 90 days.
Server logs: up to 30 days, unless needed for a security investigation.
Billing records: as long as required by tax law, held by Creem.

8. Your rights

Depending on where you live, you may request access, correction, export, deletion, or restriction of your data, and object to processing. Email [email protected] and we will respond within 30 days. You can also export your content from your dashboard at any time.

9. Children

The Service is not directed at children under 16. If you believe a child has created an account, contact us and we will remove it.

10. Security

Passwords are hashed with scrypt, sessions are stored server-side, traffic is encrypted, and access to production systems is limited to key-based authentication. No system is perfectly secure; report issues to [email protected].

11. Changes

We may update this policy. Material changes will be announced on this page with a new date.