PRIVACY POLICY

1. Who we are

Fragment Zero ("we", "us", "our") operates the website https://fragmentzero.net and the YouTube channel Fragment Zero | The Digital Archive. This Privacy Policy explains what personal data we collect when you visit our site, how we use it, who we share it with, and your rights regarding it.

If you have questions about this policy, contact us at contact@fragmentzero.net.

2. Data we collect

We collect data only when you interact with the site. The categories are:

• Server logs. Our hosting provider records standard request metadata: your IP address, browser user-agent, the page you requested, and the timestamp. Logs are kept for 30 days and are used only for security and performance diagnostics.
• Cookies and local storage. We use a small number of first-party cookies and local-storage entries to remember your selected language and to throttle abusive traffic. We do not set behavioural-tracking cookies of our own. See our Cookie Policy for full details.
• Voluntary submissions. If you submit a witness report, sign the cipher wall, subscribe to the newsletter, or use the dead-drop form, we store the data you provide (typically a handle, an optional email, and a free-text message). We use this data only for the purpose you submitted it for.
• Newsletter subscribers. If you subscribe to email transmissions, we store your email address and the date of subscription. You can unsubscribe at any time via the link in every email.

We do not knowingly collect data from children under 13. If you believe we have, contact us and we will delete it.

3. Third-party services

We use the following third-party services. Each has its own privacy policy that we encourage you to review:

• YouTube — when an episode page embeds a YouTube player, YouTube may set its own cookies and process your data per Google's privacy policy.
• Google Search Console — used for search-console verification only; does not track visitors.
• Cloudflare (if active) — provides DDoS protection and CDN caching. Cloudflare may log request metadata for fraud and abuse prevention per its privacy policy.
• Email service provider — newsletter delivery is handled by a transactional email provider (currently Beehiiv). They process your email address only for the purpose of delivering the messages you subscribed to.

If, in the future, we activate display advertising on this site (e.g. Google AdSense), this section will be updated to disclose the cookies and identifiers those services use, and a banner will be added to obtain your consent where required by law.

4. How we use your data

We process the data we collect for the following purposes only:

• To serve the page you requested and route traffic correctly.
• To remember your language preference across sessions.
• To respond to witness reports, dead-drop submissions, or messages you send us.
• To send the newsletter if you subscribed.
• To detect and prevent abuse, spam, or unauthorised access.

We do not sell, rent, or trade your personal data to third parties. We do not use your data to build behavioural profiles for advertising.

5. Legal basis (GDPR)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Consent. When you subscribe to the newsletter or submit voluntary forms.
• Legitimate interest. For server logs and security diagnostics, in proportion to the security need and balanced against your rights.
• Legal obligation. Where retention is required by applicable law (e.g. accounting records, court orders).

6. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data ("right to be forgotten").
• Restrict or object to certain processing.
• Receive a copy of your data in a portable format.
• Withdraw consent at any time (e.g. unsubscribe from newsletter).
• Lodge a complaint with your local data protection authority. In Bulgaria, this is the Commission for Personal Data Protection.

To exercise any of these rights, email us at privacy@fragmentzero.net. We will respond within 30 days.

7. California residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, including the right to know what personal information we collect, the right to delete it, and the right to opt out of any "sale" of personal information. We do not sell personal information as that term is defined under the CCPA.

8. Data retention

We retain personal data only as long as necessary for the purpose it was collected for:

• Server logs: 30 days.
• Newsletter subscriptions: until you unsubscribe.
• Witness reports and dead-drop submissions: indefinitely, unless you request deletion.
• Cipher-wall handles: indefinitely (these are intended to be a permanent public record).

9. Security

We protect your data with TLS encryption in transit, restricted access to backend systems, regular security updates, and offsite encrypted backups. No system is impenetrable; if a breach affecting your data occurs, we will notify you and the relevant authority within 72 hours of discovery, as required by GDPR.

10. International transfers

Our servers are located in Europe. If our third-party providers process data outside the EEA, they do so under standard contractual clauses or equivalent safeguards approved by the European Commission.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent change. Material changes will be announced on the site for at least 30 days before taking effect.

12. Contact

For privacy questions, data subject requests, or anything else: privacy@fragmentzero.net.