Privacy policy

1. Who we are

ComicAtlas (“we”, “us”) provides a comic library and reading-tracker product. This policy describes how we process personal data when you use our marketing site, join the waitlist, or use the application.

Many privacy choices are available in the product—see Your rights & in-app controls below.

2. Data we collect

ComicAtlas stores personal and usage data in our database (hosted with Supabase, PostgreSQL). Below is a practical summary of categories tied to this codebase; the shared comic catalog is largely non-personal reference data.

• Waitlist: if you join the waitlist, we store your email address, signup time, and a generic source label (for example, “marketing”). Inserts go through our API using a server-side key so the table is not exposed directly from the browser.
• Account (authentication): when you sign up, Supabase Auth processes your email and password (stored as a secure hash and managed by Supabase), session tokens, and related account metadata needed to sign you in and keep the session secure.
• Library & reading activity: we store the books you add or track, ratings and notes you choose to save, reading progress and history, custom lists, reading orders, and similar collection data. These records are associated with your user id so the product can show your library across sessions and devices.
• Preferences: for example appearance settings such as color palette and font scale, synced to your account when you are signed in.
• Collector Assistant: when you use the in-app assistant, we store conversation threads and messages under your account so the feature can load history and continue chats. To generate replies, prompts and relevant context may be sent to our AI provider (see processors below). Where available, we configure AI providers not to use this data for model training.
• Derived signals: we may store derived signals (for example recommendations or completion indicators) based on how you use the app.
• Catalog & enrichment: shared metadata about comics (titles, series, contributors, external ids) lives in catalog tables; it is not “your” personal data in the same sense as an email, though your library rows link your account to those records. Our servers may call third-party book or metadata APIs when you import or enrich titles.
• Technical data: hosting, authentication, and edge infrastructure may log IP addresses, device and browser hints, timestamps, and errors for security, rate limiting, and reliability—as is standard for web apps.

3. Why we use your data (legal bases)

Depending on your region, we rely on:

• Consent — when you join the waitlist or agree to optional communications.
• Contract — to provide ComicAtlas when you have an account.
• Legitimate interests — to secure our services, fix bugs, and understand aggregate product usage, balanced against your rights.
• Legal obligation — where the law requires us to retain or disclose information.

4. Storage, processors, and transfers

We use Supabase (database and authentication) and our application hosting provider to run ComicAtlas. When you use the Collector Assistant, messages and context may be processed by OpenAI or another model provider we configure server-side—those providers act as subprocessors for that feature. We may also call external book or metadata APIs (for example Google Books or Comic Vine) from our backend when resolving or importing catalog information; those requests are initiated by our systems on behalf of the product, not by selling your contact details to those services.

We do not sell your personal data.

Data may be processed in the United States or other regions where our subprocessors operate. If we transfer personal data from the UK, EEA, or Switzerland, we use appropriate safeguards (such as standard contractual clauses) where required.

5. How long we keep data

Waitlist emails are kept until you ask us to delete them or until we no longer need the list, after which we delete or anonymize them in line with this policy.

Account and app data are kept while your account is active and for a limited period afterward for backups, legal compliance, or dispute resolution.

6. Your rights & in-app controls

In Settings, you can clear your library, lists, reading orders, assistant conversations, and other collection-related records while keeping your login, or delete your entire account. The library-only delete does not remove your Supabase Auth profile or stored appearance preferences; full account deletion removes your auth user (preferences tied to that user id are removed with it). Waitlist signups are stored separately—if you need one removed and we have not added self-service yet, use the contact details on this page when listed.

Your library data belongs to you, and you can delete it at any time through the in-app controls described above.

Where GDPR, the UK GDPR, or similar laws apply, you may have the right to access, correct, delete, or restrict processing of your personal data, to data portability, and to object to certain processing. You may withdraw consent at any time where processing is based on consent. You may lodge a complaint with your local data protection authority.

For rights that are not covered by the self-service options above, use the contact details on this page when we publish them, or check back after this policy is updated.

7. Cookies and similar technologies

We use cookies and local storage as needed for authentication, preferences (such as theme), and core site functionality. We currently do not use analytics or marketing cookies. If that changes, we will update this policy and, where required, ask for consent before non-essential cookies run.

8. Children

ComicAtlas is not directed at children under 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children.

9. Changes

We may update this policy from time to time. We will post the new version here and, where appropriate, notify waitlist subscribers or account holders of material changes.