Privacy Policy — Humanity

This Privacy Policy explains what information Humanity ("we," "us," or "our") collects, how we use it, and the rights you have over your personal data.

We designed Humanity to collect the minimum amount of information necessary to run the Service. We do not sell your personal information. We do not run advertising. We do not use third-party analytics or tracking scripts.

1. Information We Collect

1.1 Information you provide

• Account information — Your username, email address, and password. Passwords are hashed with bcrypt before storage; we never see or store your password in plain text.
• Profile information — Optional details you add to your profile, including a bio, location, website URL, and avatar image.
• Content you submit — Any posts, comments, images, reactions, or shares you publish or perform on the Service.
• Consent record — The date, time, IP address, and browser user-agent at the moment you accept our Terms and Privacy Policy (required for compliance with the Philippine Data Privacy Act).

1.2 Information collected automatically

• Session data — A single essential cookie that identifies your session so you remain signed in. It contains no personal information — only an opaque session ID.
• Security and abuse-prevention data — Your IP address, browser user-agent, and timestamps of security-relevant actions (sign-in attempts, password resets, comment submissions). Used for rate limiting and abuse prevention.
• Server logs — Standard web server access logs (IP address, request path, timestamp) generated by our hosting provider. Retained for security and diagnostic purposes.

1.3 Information we do not collect

• Your real name (unless you choose a username containing it).
• Your phone number, address, or payment information (the Service does not process payments).
• Any data from third-party advertising, analytics, or tracking services.

2. How We Use Your Information

We use the information we collect to:

• Create your account and authenticate your access.
• Display your posts, comments, and profile to other users.
• Deliver in-app notifications (e.g., when someone reacts to your post or comments on it).
• Verify your email address and recover access if you lose your password.
• Detect, prevent, and respond to abuse, spam, and unauthorized access.
• Comply with legal obligations and enforce our Terms of Service.

We do not use your information for behavioral advertising. We do not sell or rent your data to any third party.

3. Cookies and Similar Technologies

Humanity uses a single, essential cookie: a session cookie that keeps you signed in. It is set with the HttpOnly, SameSite=Lax, and (in production) Secure flags.

We do not use any third-party cookies, tracking pixels, or advertising identifiers. You can clear or block this cookie at any time through your browser settings, though doing so will sign you out.

4. Sharing and Disclosure

4.1 Service providers

We use a small number of third-party services to operate Humanity. These providers process data on our behalf under their own terms and only for the purposes we specify:

• Resend — For delivering transactional emails (verification links, password resets, security notifications). Your email address is transmitted to Resend only when an email is being sent to you.
• Hosting provider — Our servers and database are hosted by a cloud infrastructure provider. Server logs are retained by that provider subject to their own retention policies.

4.2 Legal requirements

We may disclose information if required by law, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Humanity, our users, or the public.

4.3 No sale of personal data

We do not sell, rent, or trade your personal information to any third party for any purpose. Ever.

5. Data Retention

• Account data — Retained until you delete your account. After deletion, personal identifiers are removed immediately and backups are purged within 30 days.
• Content (Posts, Comments) — If you delete a post or comment, it is "soft-deleted" (hidden from all users) and permanently purged from our database during our regular cleanup cycle.
• Notifications — Retained while your account is active and purged if the associated post is deleted.
• Security event logs (rate limits, sign-in records) — Retained for 24 hours unless preserved as part of an active security investigation.
• Email verification and password reset tokens — Retained for their stated TTL (24 hours and 1 hour respectively), then marked used and purged.

6. Data Security

We protect your data with industry-standard technical and organizational measures, including:

• Encrypted transport (HTTPS/TLS) for all traffic.
• Bcrypt password hashing with per-user salts.
• CSRF protection and SameSite cookies.
• Rate limiting on authentication, commenting, and abuse-prone endpoints.
• Session-version invalidation when your password changes.
• Image upload processing that strips EXIF metadata and prevents malicious file execution.
• Access controls on our servers and databases.

7. Your Rights Under the Data Privacy Act

As a data subject under RA 10173, you have the following rights:

• Right to be informed — you have the right to know how your personal data is being processed.
• Right to object — you may object to the processing of your personal data.
• Right to access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may request correction of inaccurate personal data (e.g., via profile settings).
• Right to erasure or blocking — you may request deletion or blocking of your personal data, subject to legal retention requirements.
• Right to damages — you may claim damages if your rights have been violated.
• Right to data portability — you may request a copy of your data in a structured, machine-readable format.
• Right to file a complaint — you may file a complaint with the National Privacy Commission.

To exercise any of these rights, contact us at the email provided in the footer. We will respond within fifteen (15) working days.

8. Children's Privacy

Humanity is not intended for users under 13. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal data, please contact us.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or through the Service before they take effect. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.