Privacy Policy

This page explains what The Boy and the Rainbow collects when you comment or subscribe to the newsletter, why, for how long it's kept, and how you can act on your own data.

1. What's collected, and why

When commenting: the name you type in (or "Anonymous"), your email (if you choose to provide it), the comment text, the article and language, the date and time, your browser's timezone and language, a summary of your device (e.g. "iPhone/Safari", never the full browser string), the site you came from (if any), how long you stayed on the page before sending, and a hash of your IP.

When subscribing to the newsletter: just the email, plus the same technical context set above (timezone, language, device, referrer, IP hash), never the name.

Each of these serves a function: the technical context helps distinguish a real person from an automated bot (anti-spam signal), the IP hash makes rate limiting possible, and the rest is what shows up during moderation to give context to the comment.

2. Legal basis

To publish a comment: your explicit consent, given in the form through the Publication Consent (versioned and dated).

For the newsletter: your consent, confirmed by email before anything is sent (double opt-in).

For anti-spam and security context (IP hash, device summary, etc.): legitimate interest, to prevent abuse of the form and database.

3. How long data is kept

The IP is encrypted (never stored in plain text) and is automatically deleted after 180 days.

The comment itself stays as long as it's published on the site. If removed at your request, it's deleted from the database.

The newsletter email stays until you unsubscribe, which can be done at any time, in one click, with no explanation needed.

4. Who the data is shared with

No one, with a single named exception: the service used to actually deliver emails (currently intended to be Resend or an equivalent provider). That service acts as a mail carrier: it only receives the address at send time, and the subscriber list continues living in the author's own database, not the provider's.

There's no selling, renting, or passing on of data to third parties, advertising, or any other purpose.

5. What this site does NOT do

No third-party trackers, no external analytics (like Google Analytics), no advertising cookies, and no precise GPS location collection or browser fingerprinting. And, technically, it's impossible for this site to read any other site's cookies. No site can do that; it's a security limitation built into the browser itself.

6. Your rights

You can ask, at any time, for: access to the data that exists about you, correction of anything incorrect, full deletion, or the withdrawal of consent given (which, for a published comment, means removing it from the site).

To exercise any of these rights, write to oi@theboyandtherainbow.com. Newsletter unsubscription can also be done directly via the link in every email sent, with no need to write to anyone.

7. Security applied

All communication with the form happens over HTTPS. Every database access uses parameterized queries (never string concatenation, which prevents SQL injection). The IP is encrypted with a strong algorithm (AES-256-GCM) before being stored. Moderation happens only through Telegram, protected by a secret and identity validation. There's no web admin panel exposed on the internet, which reduces the attack surface.

8. Newsletter: specific section

Subscribing asks only for the email, never the name. It works through double opt-in: after subscribing, a confirmation email arrives, and only after that click does the subscription become active. Every email sent carries a one-click unsubscribe link, no questions asked. The commitment: this list is never sold or passed on to anyone, for any reason.

9. Data controller and contact

The controller of the data processed on this site is the author of The Boy and the Rainbow. Contact: oi@theboyandtherainbow.com. This policy carries version date 2026-07-25 and may be updated. Relevant changes will be flagged on this same page.