Privacy Policy

1. Introduction

Welcome to Beyond Why ("we", "us", or "our"), accessible from beyondwhy.org. Beyond Why is an independent reading platform dedicated to serialized intellectual deep dives, insight cards, and builder logs.

This Privacy Policy explains how we collect, use, store, and protect your information when you visit our platform or use our authentication services. We are committed to protecting your privacy and handling your data with transparency.

2. Information We Collect

We collect minimal personal information necessary to provide and secure your account:

• Account Registration Data: When you register directly with an email and password, we collect your full name, email address, and username. Your password is hashed and managed securely through Supabase Authentication; we never view or store raw passwords.
• Google Account Data (OAuth): If you choose to sign in using Google Sign-In, we receive basic profile information provided by Google OAuth, specifically your full name, email address, and profile picture URL. We use this data strictly to populate your profile and authenticate your sessions.
• User-Generated Content & Interaction Data: We store information you create within the platform, such as saved bookmarks, reading preferences, poll votes, and public comments.

3. Google User Data Handling

Beyond Why adheres strictly to Google's API Services User Data Policy regarding data received via Google OAuth:

• Requested Scopes: We request only basic identity scopes (openid, email, and profile). We do not request access to Google Drive, Gmail, Google Contacts, or any other sensitive APIs.
• Use of Google Data: Google user data is used exclusively to verify your identity, sign you in to your Beyond Why account, and display your avatar and name on your user profile.
• No Data Transfer or Sale: We do not sell, rent, or transfer Google user data to third parties, data brokers, or advertising networks under any circumstances.
• No Advertising or Tracking: Google user data is never used for targeting advertisements or user profiling.

4. How We Use Your Information

We use the collected information solely to:

• Authenticate your identity and maintain signed-in sessions.
• Manage your user profile, bookmarks, and platform interactions.
• Send essential transactional authentication emails (such as account verification links and password reset emails).
• Maintain platform security and prevent unauthorized access or abuse.

5. Cookies & Local Storage

• Essential Session Cookies: We use HTTP session cookies issued by @supabase/ssr to keep you signed in securely as you navigate the site.
• Local Storage: We use client-side localStorage (such as beyondwhy_auth_tagline) to store local visual presentation preferences for up to one hour.
• No Tracking Cookies: We do not use third-party tracking cookies, advertising pixels, or cross-site tracking scripts.

6. Third-Party Service Providers

We share data only with infrastructure providers required to operate the application:

• Supabase: Our database and authentication host. User profiles and account records are stored in PostgreSQL database tables protected by Row Level Security (RLS).
• Resend: Our transactional email dispatch service used to deliver account verification and password recovery emails from auth@beyondwhy.org.

7. Data Retention & Account Deletion

Your personal data is retained for as long as your account remains active. You may update your profile display name, username, and password at any time via your account settings.

If you wish to permanently delete your account and remove your personal information from our systems, please contact us at privacy@beyondwhy.org. Upon verification, your user profile and account records will be purged.

8. Security

We employ industry-standard technical measures to protect your data, including HTTPS/TLS encryption for all web traffic, secure password hashing, and encrypted database connections. However, no method of electronic transmission is 100% secure, and we recommend using a strong, unique password.

9. Children's Privacy

Beyond Why is designed for a general audience and does not knowingly collect personal data from children under the age of 13. If you believe a child has provided us with personal information, please contact us for immediate deletion.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be published directly on this page with a revised effective date.

11. Contact Us

If you have questions or privacy concerns regarding this policy, please reach out to us:

Email: privacy@beyondwhy.org
Website: beyondwhy.org