Privacy Policy

This Privacy Policy explains how Zack Jordan ("we," "us," or "our") collects, uses, and shares information about you when you use A Crowded Galaxy at acrowdedgalaxy.com — including the comic and novel reader, membership and store, community features, and the in-browser Airlock game (together, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

Information We Collect

Information you give us

Account information. When you create an account we collect your email address, a username or display name, and a password. Passwords are stored in encrypted form; we do not keep them in plain text.
Payment information. Subscriptions and purchases are processed by our payment provider, Stripe. Stripe collects and stores your card details directly; we do not receive or store full payment card numbers. We do receive limited billing information such as your name, the last four digits of your card, your subscription status, and transaction history.
Shipping information. If you order a physical item, Stripe's checkout collects your name and shipping address so the order can be delivered. We store that address alongside your order record and use it only to fulfill, ship, and support that purchase.
Communications and content. If you contact us, submit fan art, post in community features, or create content within the game, we collect the information you provide.

Information we collect automatically

Usage and device data. We use PostHog for product analytics. This may include the pages you view, links and buttons you interact with, referring URLs, your approximate location (derived from your IP address), and details about your browser, device, and operating system, along with performance metrics.
Session recordings. If you allow analytics, PostHog also records a replay of your visit — the pages as they appeared, and your clicks, scrolling, and navigation through them — so we can see where the site confuses people rather than only that it did. What you type is masked: text you enter into any field, including passwords, email addresses, comments, and search boxes, is recorded as a blocked-out shape and never as text. If you decline analytics, nothing is recorded at all. See Cookies and Analytics below.
Cookies and similar technologies. We use cookies and local storage to keep you signed in, remember your preferences, and measure usage. See Cookies and Analytics below.
Reading activity. We record which pages you open in the comic and novel reader and where you left off, so we can restore your place, show you what you have read, and understand which chapters hold attention.
Game activity. When you play the Airlock game, we record in-game actions and session events so the game works and so we can improve it.
Link and QR-code scans. When you follow one of our tracked links or scan a QR code printed in a book, we log the scan so we can tell whether printed codes are pointing where they should. We record the type of browser, the country reported by our network provider, and a salted daily hash of the request that lets us recognize repeat scans within a single day. We do not store the IP address itself, and because the hash changes every day it cannot be used to follow you across days.

Information from third parties

Third-party sign-in and linking. If you sign in or link your account through Discord, Patreon, or Imgur, we receive basic profile information from those services as you authorize — for example your user ID, username, and email address. We use this to create or connect your account and to confirm your membership benefits.
Public community activity. So that we can recognize long-time supporters, we keep an internal record of publicly posted community activity connected to this project — for example public comments left on the webcomic on third-party platforms. This is information those platforms already publish. If you would prefer we did not keep a record of yours, contact us and we will remove it.

Cookies and Analytics

We use two broad categories of cookies and similar technologies:

Strictly necessary. Required to sign you in, keep your session secure, and remember essential settings — including the small cookie that records your analytics choice below. The Service does not function without these.
Analytics. Used by PostHog to understand how the Service is used so we can improve it. These are not required for the Service to function.

Your choice. The first time you visit, we show a notice asking whether analytics is okay. If you are in the EEA or the UK, analytics stays off until you accept it. Elsewhere, analytics is on unless you decline. Either way you can change your mind at any time from the Cookies link in the site footer, or under Privacy in your account settings. Declining takes effect immediately: we stop collecting, and we clear what the analytics provider stored on your device.

Browser privacy signals. We honor Global Privacy Control (GPC) and "Do Not Track". If your browser sends either signal, analytics is switched off automatically and we do not show you a consent notice — you do not have to do anything.

Record of your choice. Your choice is stored on your device, and that device copy is what actually controls whether analytics runs. If you have an account, we additionally keep a record of the decision on your account so we can demonstrate what you chose — the decision itself, the date, whether your browser was sending a privacy signal at the time, and which version of this notice you were shown. We do not record your IP address, your device, or your location alongside it. If you do not have an account, nothing about your choice is stored on our servers at all. You can see your own record under Privacy in your account settings.

Most browsers also let you refuse or delete cookies through their settings. Disabling non-essential cookies will not prevent you from using the Service.

How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain the Service, and authenticate you;
Deliver the memberships, chapters, and other content you are entitled to;
Process payments, manage subscriptions and purchases, and prevent fraud;
Understand and improve the Service, and measure performance and reliability;
Communicate with you, including sending transactional messages (such as receipts, security alerts, and password resets) and, where you have opted in, updates and marketing;
Maintain the security and integrity of the Service; and
Comply with legal obligations and enforce our terms.

Legal Bases for Processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases: performance of a contract with you (to provide the Service you request); our legitimate interests (such as securing and improving the Service), where not overridden by your rights; your consent (for example, optional analytics or marketing, where consent is required); and compliance with a legal obligation.

We do not sell your personal information. We share information only as described here:

Service providers. We share information with vendors who process data on our behalf, including: Stripe (payments, subscriptions, and checkout — including shipping addresses for physical orders), Vercel (website hosting), Neon (our main database), Google Cloud (hosting for the Airlock game server and its database), Cloudflare R2 (storage for uploaded images, audio, and other files), Resend (transactional and member email), PostHog (product analytics), Sentry (error and performance monitoring), OpenAI (site search — when you search, your search text alone is sent to generate a semantic match; we do not send your name, email, or account with it), and Discord, Patreon, and Imgur (account linking and membership). These providers are permitted to use your information only to provide services to us.
Legal and safety. We may disclose information if required by law, or if we believe in good faith that disclosure is necessary to comply with a legal obligation, protect our rights or property, protect the safety of any person, or investigate fraud or abuse.
Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.

Data Retention

We keep your personal information for as long as your account is active or as needed to provide the Service. We also retain information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or anonymize it.

Your Rights and Choices

Depending on where you live, you may have some or all of the following rights regarding your personal information:

Access — request a copy of the information we hold about you;
Correction — ask us to correct inaccurate information;
Deletion — ask us to delete your information;
Portability — request a copy in a portable format;
Objection / restriction — object to or ask us to restrict certain processing;
Withdraw consent — where we rely on consent, withdraw it at any time.

California residents (CCPA/CPRA): you have the right to know what personal information we collect and how we use and share it, to request deletion, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information. We do not sell your personal information. We will not discriminate against you for exercising these rights.

EEA/UK residents (GDPR): in addition to the rights above, you have the right to lodge a complaint with your local data protection authority.

You can update some information directly in your account settings, and manage your subscription through the Stripe customer portal. To exercise any of these rights, contact us at privacy@acrowdedgalaxy.com. We may need to verify your identity before acting on your request.

Children's Privacy

The Service is not directed to children under 13 (or under 16 where a higher age of consent applies), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will delete it.

International Data Transfers

We operate from, and use service providers located in, the United States and other countries. If you access the Service from outside those regions, your information may be transferred to, stored, and processed in a country whose data protection laws differ from those in your country. Where required, we use appropriate safeguards for such transfers.

Security

We use reasonable technical and organizational measures designed to protect your information, including encryption of stored passwords. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Third-Party Links and Services

The Service may link to or integrate with third-party websites and services (such as Discord, Stripe, Patreon, and Imgur). This Privacy Policy does not apply to those third parties, and we are not responsible for their practices. We encourage you to review their privacy policies.

Our internal staff documentation — the administrative tools our own team uses, which are not part of the site you read — embeds some instructional video hosted on YouTube. No page of this website loads anything from YouTube, and nothing about your reading is sent there. We name it here because our policy is to disclose every outside service a browser can reach, including on our own staff's screens. Even there nothing is requested until a person presses play: until then only a placeholder is shown, and no request, cookie, or identifier reaches Google.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If we make material changes, we will provide additional notice as required by law. Your continued use of the Service after an update means you accept the revised policy.

Contact Us

If you have questions about this Privacy Policy or how we handle your information, contact us:

Zack Jordan
Email: privacy@acrowdedgalaxy.com
Postal address: to be listed here shortly. In the meantime, email us and we will provide it on request.