Privacy and personal data

Effective from 6 October 2026

This is a translation. In case of any discrepancy, the Ukrainian version prevails.

Nyshporka Online collects only the data needed for signing in, contributions to Supriaha, subscriptions, security and understanding demand for archival files. We don't sell data, don't show adverts and don't use advertising trackers. We use Google Analytics for site traffic.

What we store and why

• Account: email, chosen name and contact, Google identifier and a one-way Argon2id hash of the password — for signing in and contacting you. The password itself isn't stored.
• Security: token hashes, short-lived sessions, the session's IP and browser — to protect sign-in and revoke access.
• Supriaha: manifests, contributions, licences and stated authorship — to publish and check the shared corpus. The top members table shows aggregated figures for your contributions and your public name, if you have set it in My account; without it, the row is signed “Anonymous”.
• Subscriptions: chosen places, fonds and surnames. Once a week they bring an email about new books; every email has an “Unsubscribe” link.
• Update emails: occasionally, when something important for researchers appears in Nyshporka, we send an email to your account's address. Every email has an “Unsubscribe” link; unsubscribing doesn't affect sign-in, subscriptions or service emails. We can see whether an email was opened and which links in it were followed: the email contains an invisible image and links tagged with your account. We record the time, the IP address and the name of the email program or browser; after you arrive on our site, also whether the page was scrolled (this is how a person's visit is told apart from a mail service checking the links). Why: to know whether the emails arrive and what in them is of interest, and not to send anything unnecessary. Only the administrator sees this data. The “Don't count mine” link at the bottom of every email turns this off for your account: emails will keep coming, but without tags.
• Events: searches, downloads and technical details of the client; the IP is stored there only as a one-way hash. If you download a file while signed in, or through the app with a key, the download is recorded against your account. Only the administrator sees who exactly downloaded a file; the file's author sees only aggregated figures — how many times, from which countries and with which app.
• Traffic: Google Analytics collects anonymised page-view statistics — which pages and sections are visited, where visitors come from and what they search for in Supriaha.
• Stories: the submitted text, byline and re-encoded images — only after explicit consent in the form.
• Reading orders: the email, name and Telegram you provided, the file description, links, re-encoded sample scans and a one-way hash of the IP — to assess the request, contact you and hold back spam. Only the person assessing the request sees the samples. A request can be submitted without an account.
• File notebook: the entries you have added to a file (description, errors in the archive's inventory, copies, lines checked by eye) and the list of folios looked through — without your comments. The text of the entries is visible to everyone on the book's page, with your public name. For a checked line, Nyshporka sends a clipping of that line from the scan (greyscale JPEG). By sharing checked lines, you agree that the owner of Nyshporka may use them, together with the clippings, to train handwriting recognition models. The clippings are not published and are not given to other users.

Retention

Sessions disappear when they expire, sign-in records after 48 hours, service notifications after 90 days, the event log after 180 days. Email opens and clicks are kept for a year; after that we erase the IP address and program name, and only the “opened / clicked” mark remains. Account data is kept for as long as the account exists. Public contributions and stories are kept as part of the published corpus and its provenance. Order requests are kept for as long as they are needed for fulfilment and settlement; before that, we delete them on request. File notebook entries and clippings of checked lines are kept as part of the corpus; an entry you withdraw disappears from the book's page, and its clipping is deleted. After an account is deleted, its entries remain without a name.

Who data is shared with

Infrastructure and traffic protection are provided by Cloudflare, Supriaha's files are stored in Cloudflare R2, and the server and email are run by Hostinger. Google receives sign-in data only if you yourself choose to sign in with Google, and traffic statistics through Google Analytics (in EU countries, only with your consent). A short summary of each new order request (including the contact) is sent to the administrator on Telegram. These providers process data only as far as is needed for the relevant service.

Cookies

Necessary cookies — sessions, form protection and unfinished sign-in. Your choice of light or dark theme is stored locally in the browser. Google Analytics sets its own analytics cookies to count visits (in the EU, only with your consent). There are no marketing cookies. The chosen site language is stored in a cookie so that links without a language in the address open in your language. So that one person on different networks (for example, home and mobile) is not counted twice, the site sets a cookie with a random visitor number (supriaha_vid) and remembers your answer to the consent request (supriaha_zghoda). In EU countries, and also when the country cannot be determined, both analytics items — this cookie and Google Analytics — are switched on only after you click “Accept”; “Decline” switches them off and removes a visitor cookie that has already been issued. In other countries the visitor cookie is set without asking. In the database the number is stored only as a one-way hash and is not linked to your account, except when you are signed in.

Your rights

In My account you can download all related data and delete your account. After deletion, private records are removed, while public contributions remain under their licence without a name or contact. Published stories become anonymous. Order requests not yet taken into work are deleted; those in progress or completed are detached from the account and kept for settlement. To remove an individual publication completely, write to [email protected].

Questions about data: [email protected]. The operator is the “Nyshporka Online” project.