Privacy Policy

This policy explains what information Fiction Realm keeps about you, why, who can see it, and what you can do about it. We've tried to write it in plain words.

1. Who we are

Fiction Realm (fictionrealm.net and the Fiction Realm app) is run by Radostin Petkov and Stratimir Petkov, two private individuals in Bulgaria. We are responsible for your personal data (the "controller" under the EU's General Data Protection Regulation, GDPR).

Contact: admin@fictionrealm.net

2. What we keep, and why

• Your username, display name and email address: to run your account. Your email is used to log in (if you choose), to confirm it's yours, and for password resets and important account messages. It is never shown on your profile.
• Your password: to log you in. It is stored only in a scrambled form that can't be turned back into the password.
• Your birthday: to check you're old enough to use Fiction Realm, to show stories rated for adults only to people who are 18 or older, and to let your friends (people who follow each other with you) know on your birthday. It is never shown on your profile.
• What you post (stories, chapters, pictures, characters, timelines, comments, reviews, wall posts, questions and answers, reading lists, Workshop and Bookshop posts): to show it on the site, as you choose (public, private, or only for your followers).
• Private messages and group chats: to deliver them. Only the people in the conversation can read them. We don't read them; if someone reports a message, an admin can see that message to decide on the report.
• Your profile (picture, background, bio, links, and your privacy settings): to show your profile the way you set it up.
• Who you follow, block or mute; your bookshelf, bookmarks and reading progress: to make those features work.
• Which stories you open, save, review or comment on: to count story hits for writers, keep your reading history, and recommend stories you may like. Recommendations are worked out on our own server, only from activity on Fiction Realm.
• If you log in with Google, Apple or Facebook (their account ID for you, and the name and email they share): to log you in with that account. We never get your Google, Apple or Facebook password.
• Two-factor authentication (if you turn it on): the secret key for your authenticator app, stored encrypted, to check your 6-digit codes.
• A one-way code made from the internet address (IP address) you signed up from: to limit how many accounts can be made from one connection, against spam. The address itself is not stored and can't be read back from the code.
• Reports you send, and moderation decisions: to keep the site safe and handle problems. The emails of banned accounts are kept on a list so they can't sign up again.
• A history of changes to your account (when it was made and with which email, email and username changes, password changes and resets, two-factor authentication and Google, Apple or Facebook logins turned on or off, deactivation, suspensions and bans): to keep accounts secure and to help you get yours back if someone else takes it over. It never includes your password or your internet address. Only admins can see it, and it's included when you download your data.

For a short time, the server also keeps some technical information in its memory, such as the internet address of failed login attempts (to slow down password guessing). This is forgotten within minutes to hours.

3. Our legal reasons (GDPR)

• To provide the service you signed up for (contract): your account, your posts, messages and the site's features.
• Our legitimate interests: keeping the site secure and free of spam and abuse, moderating content, keeping backups, counting hits and recommending stories. You can object to these at any time (see section 8).
• Your consent: when you choose to log in with Google, Apple or Facebook, and when you start a chapter's music player. You can stop at any time.
• Legal obligations: when the law requires us to keep or hand over information.

4. Who can see your information

• Other users see what you make public, or what you share with your followers or a conversation, according to your settings. A private profile is visible only to followers you approve.
• The two of us, as admins, can see what's needed to run and moderate the site. We don't browse private messages.
• Companies that help us run the site, only as needed:
  • our hosting provider, which stores the website and its data;
  • our email provider, which sends account emails;
  • Google, Apple and Facebook, only if you choose to log in with them;
  • YouTube, only if you start a chapter's music player. The player loads from YouTube's privacy-enhanced address (youtube-nocookie.com) and only when you press play.

We don't sell your data, we don't show ads, and we don't use outside tracking or advertising tools.

Google, Apple, Facebook and YouTube are based in the United States. When you use them, your information may go there under their own policies and the EU's rules for such transfers (such as the EU-US Data Privacy Framework).

5. Cookies and storage in your browser

• One login cookie keeps you logged in. It is needed for the site to work and lasts 30 days after your last visit.
• Your browser's own storage remembers a few settings on your device, such as your autoscroll speed and the choices you made in interactive stories. This never leaves your device.
• The YouTube player (when you press play) may set its own cookies.

We don't use advertising or analytics cookies.

6. How long we keep it

• Your account and posts: until you delete them or your account.
• When you delete your account: your profile, stories, wall posts, lists, follows and the rest are deleted. Your comments, private messages, group messages and reviews stay where they are, shown as "Deleted user", so other people's conversations still make sense. If you want any of those removed too, email us.
• Co-written stories: if you own a story with co-authors and delete your account (or are away for six months), it passes to a co-author instead of being deleted.
• The history of changes to your account is kept as long as the account, and deleted with it.
• Deactivated accounts are hidden and kept until you log in again or delete them.
• Notifications are removed 3 days after you've seen them, and at most after 30 days.
• Password reset links work for 1 hour; email confirmation links for 2 days.
• Backups of the whole site are made every day and kept for about a week, then deleted. Something deleted from the site disappears from the backups within that time.

7. Age

You must be 16 or older to use Fiction Realm. If we learn that someone younger has signed up, we'll delete the account. Stories rated for adults are shown only to people who are 18 or older.

8. Your rights

Under the GDPR you can:

• get a copy of your data: Settings, Security & Account Management, Download my data gives you a file with your account details and everything you've posted;
• correct it: most of it you can change yourself in Settings;
• delete it: Settings, Security & Account Management, Delete account, or email us;
• limit how we use it, or object to uses based on our legitimate interests;
• withdraw consent you gave (for example, remove a linked Google, Apple or Facebook login in Settings).

Email admin@fictionrealm.net for anything you can't do yourself. We'll answer within one month.

You can also complain to the Bulgarian data protection authority, the Commission for Personal Data Protection (www.cpdp.bg), or the authority in your own EU country.

9. Security

We protect your data with scrambled passwords, encrypted two-factor keys, secure connections (https), limits on login attempts, and optional two-factor authentication. No website can be perfectly secure. If a problem ever puts your data at risk, we'll tell you and the authorities as the law requires.

10. Changes

If we change this policy, we'll update the date at the top. If the change is important, we'll tell you on the site before it takes effect.

Terms of Service