Privacy policy

[TO BE COMPLETED — the controller's name or registered company name, tax ID and legal address in Paraguay. The law requires the controller to be identified; an email address alone is not enough.]

Contact for anything to do with personal data: info@ficteca.com.

What you give us when you sign up:

• Your email address. It is how you sign in, and the only thing we require besides what follows.
• Your display name. You choose it and other people see it next to your reviews. It does not have to be your real name.
• Your date of birth. We use it to check that you are at least 16. It is shown to nobody, and it cannot even be read from the application: it is protected at the database level.
• Your preferred language.

What you give us if you want to:

• A short profile description.
• The fandoms you picked when signing up, to give recommendations a starting point.
• Your adult-content preference.

What is generated as you use Ficteca:

• Your reviews and ratings, which are public.
• Your reading record: which works you marked as read, reading or planned, and any private notes on them. This is private and nobody but you sees it.
• Accounts you blocked, and reports you filed.
• The recommendations we compute for you.

What we keep because the law requires it:

• When you accepted the terms and the privacy policy, which version you accepted, an irreversible hash of your IP address, and your browser identifier. The law places the burden of proving consent on us, and this is that proof. We store a hash rather than the IP itself, so that the record cannot be used to track you.

What we do not hold: passwords — we use none; card details — we charge nothing; your location, your contacts, or anything the law classifies as sensitive data.

• So you can sign in and have an account: your email and display name. Legal basis: your consent, given when you signed up.
• To check the minimum age: your date of birth. Legal basis: compliance with a legal obligation.
• To display your reviews and compute each work's average: what you post. Legal basis: your consent.
• To recommend works to you: your declared fandoms and your reading record. Legal basis: your consent.
• To prevent abuse — rate limits, detecting rating manipulation: minimal technical records. Legal basis: our legitimate interest in keeping the service usable.
• To prove your consent: the consent records. Legal basis: compliance with a legal obligation.

We do not use your data for advertising, we do not sell it, and we do not pass it to third parties for commercial purposes. We take no automated decisions producing legal effects on you: recommendations only change the order in which you see works.

We use only technical cookies, necessary for the site to work: the ones that keep you signed in and the one that remembers your language. Without them you could not stay signed in.

Because they are strictly necessary, the law does not require us to ask your consent for them, which is why you will not see a cookie banner.

We use no advertising cookies, no cross-site tracking and no third-party analytics. If we ever add analytics, this policy changes first and we tell you.

Ficteca runs no servers of its own. We use providers that process data on our behalf, following our instructions:

• Supabase, on Amazon Web Services infrastructure in São Paulo, Brazil: the database and authentication.
• Vercel, in the United States: hosting for the application.
• Resend: delivery of the emails carrying your sign-in code.
• Sentry: error monitoring, so we find out when something breaks.

None of them may use your data for their own purposes.

Your data leaves Paraguay, and you should know that.

The database is in São Paulo, Brazil. We chose that region on purpose: Brazil has the LGPD, a general data protection law in force and equivalent in standard to the European Regulation, and latency from Asunción is far lower than from any United States region.

The application is served from Vercel, on infrastructure in the United States.

The law permits these transfers to countries with an adequate level of protection or under appropriate contractual safeguards. We have the corresponding data processing agreements in place with our providers.

• Your account and profile: for as long as the account exists. Delete it and they go.
• Your reading record and private notes: deleted along with your account.
• Your reviews and ratings: kept, but anonymised. They are irreversibly unlinked from you. Section 4 of the terms of use explains why.
• The record of your consent: deleted along with your account. Keeping it as proof might seem sensible, and we considered it: but a consent record unlinked from the person does not prove that you consented, which is the only thing that record has to prove, and keeping it linked would mean holding data about somebody who asked to be erased. Since no personal data of yours remains under processing, there is nothing left to justify.
• The only thing that survives is your reviews, without your name and with no link back to you. Once unlinked they stop being personal data: they are a text and a rating about a work.

The law gives you these rights over your data, and Ficteca is built so that you can exercise most of them without asking anyone:

• Access: see what we hold about you. It is all in your profile.
• Rectification: correct what is wrong. Editable from your profile, instantly.
• Erasure: delete your account and your data. A button in your profile, with no email to write and no reply to wait for.
• Objection and restriction: ask us to stop using your data for a specific purpose.
• Portability: take your data in a format another service can read.
• Withdraw consent: as easily as you gave it, which is by deleting your account.

For anything not self-service, write to info@ficteca.com. We have 30 calendar days to answer.

If you believe we have not complied, you may complain to the authority responsible for enforcing Act No. 7,593/2025.

Everything travels encrypted and is stored encrypted.

The database enforces row level security: every query is limited to what that person may see, and the limit is imposed by the database rather than by the application. Even with a bug in the code, one person could not read another's private data.

The most sensitive profile fields — your date of birth among them — additionally have their read privilege revoked at column level, for everyone.

No measure is infallible. Should a breach occur that could affect you, we notify the authority within 72 hours and tell you.

Ficteca does not accept registrations from people under 16, and we do not knowingly collect data from anyone below that age.

If we find an account belonging to someone under 16, we close it and delete their data. If you are a parent or guardian and believe a minor in your care created an account, write to info@ficteca.com.

Each version carries a date and a number. If we change something substantial we will tell you and ask you to accept it again.

Earlier versions are kept on record, so it is always possible to know what the one you accepted said.

info@ficteca.com, for any question about your personal data.