PoemShip Privacy Policy
1. General
This Privacy Policy describes what personal data PoemShip (the "Service") collects, how that data is used, stored, and shared. By using the Service you agree to the terms of this Policy.
Current version: v1.6, effective 28 October 2026. Version history is in section 14.
2. Who processes your data
The data controller is:
- Kiryl Anokhin, sole proprietorship (JDG), Poland
- NIP: 8982272619
- REGON: 521004109
- Address: Wrocław, Poland
- Privacy contact: [email protected]
We do not appoint a Data Protection Officer (DPO) — the scale and nature of our processing do not trigger the requirement under Art. 37 GDPR.
3. Scope and definitions
- Personal data — any information relating to an identified or identifiable natural person.
- Processing — any operation performed on personal data: collection, storage, modification, use, deletion.
- User — a natural person who visits the Service or holds an account.
4. What we collect
Account data (on registration): email, username, password hash, full name, short "about" text, social links, avatar; the time you confirmed your email address. While a confirmation link is unused we keep only a hash of its token and its expiry.
Sign in with Google (only if you choose it): of what Google sends when you sign in, we use only your Google account ID, your email address, whether Google has verified that address, and your name; anything else Google includes (such as your profile picture or language) we ignore and do not store. We use them only to create your account or sign you in, and to connect Google sign-in to an existing account with the same email address; for a new account, your name becomes its display name. We do not receive your Google password, and we do not ask for any other data in your Google account (such as contacts, Gmail or Drive). We do not use data received from Google for advertising and do not sell it; beyond the processors that run the Service (section 7), we share it with no one. PoemShip's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Author profiles (if you post poems): for each author name you post under (you can have several, for example one per language), the name, the language it is written in, and the short bio, link and country you enter, shown on that name's public author page; the time you confirmed that the poems you post are your own, written by you, and the same confirmation for each poem.
User content: poems (including poems anyone with the link can read and poems only you can see), comments, other material you publish.
Reports: when you report a poem, your account, the poem, the reason you chose and the note you add, if any. We do not tell the poem's author who reported it.
Library submissions: when you submit a poem to the library, the time you submitted it, our decision, when we made it, the note we add to it, if any, and, if we decline the poem, any notes on it we leave for you; if you send the poem again after a decline, the note you add for us, if any. Only we read your note. Automated checks help us review a submitted poem and draft those notes; a person decides and chooses what we send you. The results of those checks are kept with the poem. Author claims: when you ask to publish under the name of an author in our library, your account, that author, the message and the link (if you add one) you send us to show it is you, the time you sent the request, our decision and when we made it. Only we see the message and the link; they are not published. If we approve, that author becomes one of your author profiles; its page and its library poems stay as they are.
Smart Search: query text (do not enter personal data; the text is not tied to an account); the pbm_vid identifier and a salted hash of your IP address for search allowance enforcement.
Technical data: IP address, User-Agent, cookies, session identifier, interface language, region.
Derived data: moderation flags, action counters.
We do not collect special categories of data (health, beliefs, biometrics, etc.) and we do not ask for them.
5. Purposes and legal bases
| Purpose | Legal basis (GDPR) | Parallel under 152-ФЗ / BY PD |
|---|---|---|
| Account creation and operation (including email confirmation and sign-in with Google), your author profiles, publishing your poems | Art. 6(1)(b) — performance of contract | Performance of contract / data subject consent |
| Abuse prevention, security, Bugsnag | Art. 6(1)(f) — legitimate interests | Legitimate interests of the operator |
| Handling poem reports, keeping out poems copied from others or written by AI | Art. 6(1)(f) — legitimate interests | Legitimate interests of the operator |
| Reviewing poems submitted to the library and, if we decline one, preparing our notes on it for you, where automated checks help and a person decides | Art. 6(1)(f) — legitimate interests (keeping the library free of copied and unsuitable poems; helping you see why) | Legitimate interests of the operator |
| Checking a request to publish under the name of an author in our library | Art. 6(1)(b) — performance of contract | Performance of contract |
| Analytics (GA/GTM, Yandex.Metrica) | Art. 6(1)(a) — consent | Data subject consent |
| Contextual advertising (AdSense) | Art. 6(1)(a) — consent | Data subject consent |
| Responses to email inquiries | Art. 6(1)(f) — legitimate interests | Legitimate interests of the operator |
| Providing Smart Search, enforcing search allowance | Art. 6(1)(b) — performance of contract / Art. 6(1)(f) — legitimate interests | Performance of contract / legitimate interests of the operator |
| Crisis detection to show a support note | Art. 6(1)(f) — legitimate interests | Legitimate interests of the operator |
For users in Russia and Belarus, the equivalent bases apply: performance of contract, legitimate interests of the operator, data subject consent (Art. 6, 9 of 152-ФЗ; corresponding articles of the Republic of Belarus Law "On Personal Data Protection").
6. Cookies
We use strictly necessary cookies (authentication, language, region, remembering your consent choice) and — only with your consent — analytics and advertising cookies. See the Cookie Policy for details.
7. Who receives your data (processors)
- Google (GA/GTM/AdSense) — analytics and ad serving subject to consent
- Google (Sign in with Google, only if you use it) — confirms who you are and sends us the data listed in section 4; for the sign-in itself Google acts under its own Privacy Policy
- Yandex LLC (RU/Finland) — Yandex.Metrica subject to consent
- Bugsnag / SmartBear — error reporting (legitimate interests)
- Cloudflare — CDN, DDoS protection, delivery of transactional email
- Hosting provider — server infrastructure in the EU
- Voyage AI, Inc. (USA) — turns the query into a vector embedding and reranks candidate poems (query text only; no account data, no IP)
- DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) (China) — reads the query to understand the request (query text only; no account data, no IP)
- TypeSafe (USA) — query classification, reading the request and crisis detection (Jev model) to show a support note with help lines (query text only; no account data, no IP); it also reads poems submitted to the library to help us review them (the poem's title and text only; no account data, no IP)
- Anthropic, PBC (USA) — reads the Smart Search query to understand the request (query text only; no account data, no IP); also reads poems submitted to the library to help us review them (the poem's title, epigraph, text and language only; no account data, no IP); Anthropic processes this data only on our instructions and does not use it to train its models
We do not sell personal data and do not share it with third parties for their own purposes.
8. International transfers
Some processors are located outside the EEA. For transfers to the US (including Cloudflare, Voyage AI, TypeSafe and Anthropic) we rely on Standard Contractual Clauses (SCCs) approved by the European Commission; for Cloudflare and Anthropic a copy of the clauses is available on request at [email protected]. Members can avoid the transfer of their poems to Anthropic and TypeSafe by not submitting poems to the library, and visitors can avoid the transfer of their queries to Voyage AI, TypeSafe and Anthropic by not using Smart Search. DeepSeek processes data in China. China does not have an adequacy decision from the European Commission; this transfer relies on Standard Contractual Clauses (SCCs). Visitors can avoid this transfer by not using Smart Search. Yandex.Metrica processes data in Russia and Finland — if this matters to you, you can decline analytics cookies in the consent settings.
For users in Russia and Belarus (Art. 12 of 152-ФЗ, corresponding article of the Belarus Law): your data may be stored and processed on servers outside Russia / Belarus. By continuing to use the Service you consent to cross-border transfer.
9. Retention
- Account data — until deletion by the user plus a 30-day backup tail
- Author profiles — with the account; if a poem of yours is in the library when you delete the account, only the author name stays, as that poem's credit
- Google account ID — with the account, until it is deleted
- Email confirmation links — valid for 48 hours; the token hash is removed once you confirm the address
- Poem reports — until the reported poem or the account that filed it is deleted
- Library submissions and the results of the checks of a submitted poem — until the poem or your account is deleted; only an anonymous count of check results and decisions stays, with no text and no identifiers
- Author claims — approved ones until the account that sent them is deleted; declined ones 12 months after the decision
- Bugsnag events — 30 days
- Access logs — 90 days
After these periods, data is deleted or anonymised.
10. Your rights
GDPR (users in the EU/EEA): access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right to lodge a complaint with a supervisory authority — UODO (Polish Personal Data Protection Office), uodo.gov.pl.
152-ФЗ (users in Russia): access, rectification, blocking, erasure of personal data, withdrawal of consent, complaint to Roskomnadzor.
Belarus Personal Data Protection Law (users in Belarus): equivalent rights, complaint to the National Personal Data Protection Center of the Republic of Belarus.
CCPA (California residents): right to know, delete, and opt out of "sale". We do not sell personal information.
11. How to exercise your rights
- Email: [email protected]
- Self-serve deletion: Settings → Delete account. This removes your account, your author profiles, all of your poems (with their library submissions and the results of their checks), all of your comments, the reports you filed and your author claims, with no recovery path.
- Sign in with Google: you can disconnect PoemShip at any time in your Google Account under Third-party apps & services. This stops sign-in with Google but does not delete your account here; to sign in another way, set a password with "Forgot password?".
We respond to requests within 30 days.
12. Children
The Service is not intended for persons under 13. We do not knowingly collect data from children under 13. If you learn that a child has submitted data without parental consent, contact us and we will remove it.
13. Security
Passwords are stored as bcrypt hashes. Data is transferred over TLS. Database access is restricted. No system is perfectly secure, but we apply commonly accepted protective measures.
14. Changes
We may update this Policy. For material changes we will give at least 14 days' notice via email or a site notice. Version history is kept in our repository.
15. Contact
Questions and requests: [email protected].