Privacy notice — No-Extinction Forum

1. Data controller

The data controller is Pietro Mugnaini, responsible for the No-Extinction project.

Contact for privacy requests and for exercising your rights: mail@no-extinction.org.

2. Who this notice applies to

This notice covers the processing of the personal data of users of the No-Extinction Forum, reachable from the no-extinction.org website.

The Forum can be read without registering. To publish discussions or replies, use the “Useful” function, follow discussions or send reports, you must create an account and verify your email address.

3. Minimum age

Creating an account on your own is allowed from the age of 14.

During registration users must declare that they are at least 14 years old. The full date of birth is not requested.

Users under 14 cannot create a Forum account on their own.

Information also addressed to minors is written in the clearest and most understandable language possible.

4. Data processed

For registration and authentication we process: email address, password stored in hashed form by the authentication service, user identifier, nickname, email confirmation date, creation/update and last sign-in dates, as well as technical metadata needed for authentication.

In the Forum profile we process: public nickname, an optional short biography, profile status (active/suspended/blocked), any suspension duration, the date the rules were accepted and the date of the declaration about the minimum age.

While using the Forum we may also process: published discussions and messages, source URLs, “Useful” reactions, followed discussions, internal notifications, reports, optional notes in reports, moderation actions and Forum roles.

The email address is never shown publicly. The Forum does not allow files, images or attachments to be uploaded.

5. Public data

Normally visible to other users and to Forum visitors: nickname, any bio, discussions, messages and other content the user decides to publish.

Before publishing, users are asked not to include personal data — their own or other people's — that is not necessary to the discussion.

6. Purposes and legal bases

Data is processed in order to:

• create and manage the account and allow the use of the requested Forum features;
• verify the email address and manage sign-in and password recovery;
• publish and organize discussions, replies, reactions, follows and notifications;
• apply the Forum rules and manage reports and moderation;
• prevent spam, abuse and unauthorized access, and keep the service secure;
• comply with legal obligations and defend rights in case of disputes.

Managing the account and the features requested by the user is based on the performance of the requested service. Security, abuse prevention and the moderation needed for the Forum to work properly are based on the controller's legitimate interest in protecting the service, its users and the community, with due regard for the rights and freedoms of the data subjects. Where a processing operation specifically requires consent, that consent is requested separately.

7. Email verification and security

Verifying the email address is mandatory. Before confirmation users can read the Forum but cannot publish, reply, react, follow discussions or send reports.

Security and anti-abuse controls are in place, including rate limiting, duplicate blocking, limits on links, restrictions for newly created accounts, content sanitization and server-side authorization checks.

The IP address may be read temporarily at runtime for some anti-abuse and rate-limiting functions; the application does not store it in the Forum tables. Further technical data may appear in the logs of the infrastructure and of the authentication service, according to the rules of the respective providers.

8. Moderation and reports

Registered and verified users can report content. Reports contain the identifier of the reporter, the content involved, the reason, the priority and an optional note.

High-priority reports may trigger an immediate email notification to the administrator containing the reason, the type of content, any note, a preview of the reported content and a link to the moderation queue. The reporter's email address is not included in that notification.

Moderation actions are recorded in an audit log. Moderators and administrators do not edit the text written by users: they can hide or remove content and take the other actions foreseen by the Forum rules.

9. Retention periods

The following retention criteria apply:

• account and profile: for as long as the account exists, save for further retention required by law, security or the handling of disputes;
• discussions and messages: kept so that conversations remain understandable; if an account is deleted, where technically and legally appropriate, content may be dissociated from or anonymized with respect to its author instead of being automatically deleted;
• Forum notifications: 12 months;
• resolved reports: 24 months;
• moderation action log: 36 months;
• newsletter data: until unsubscription; afterwards only the data strictly needed to document consent and its withdrawal may be kept;
• technical and authentication logs managed by providers: for the periods set by those providers.

Before the public launch, mechanisms consistent with these retention periods must be configured where technically necessary.

10. Providers and recipients

The following services are used to run the website and the Forum:

Lovable / Lovable Cloud — hosting, server functions, PostgreSQL database and authentication service. Forum and authentication data is hosted in the AWS eu-west-1 region (Ireland, EU), while the edge network and some technical infrastructure logs may involve further nodes according to the provider's architecture.

Resend (Plus Five Five, Inc.) — delivery of some transactional emails, including moderation notifications and other project communications. The service may process data in the United States.

Cloudflare Web Analytics — aggregate usage statistics without profiling cookies and without persistent individual identifiers.

Data is not sold to third parties.

11. Transfers outside the European Economic Area

The database and the main Forum data are hosted in the European Union, in Ireland.

Some processing may involve transfers to or access from countries outside the European Economic Area, in particular for the Resend service and for components of the hosting provider's global network.

For Resend, the provider states that it uses the safeguards required by applicable law, including the European Union Standard Contractual Clauses and, where applicable, the Data Privacy Framework.

For the other providers, the safeguards and data processing agreements made available by those services apply.

12. Cookies, local storage and statistics

The Forum does not use advertising or profiling cookies.

For registered users the authentication session token is stored in the browser's localStorage and is necessary to keep the session active.

Cloudflare Web Analytics is used for aggregate statistics, without cookies and without individual profiling.

If technologies that are not strictly necessary are introduced in the future, this notice and any consent management will be updated before they are used.

13. Rights of the data subject

In the cases provided for by the GDPR, users may request access to their data, its rectification or erasure, the restriction of processing, object to processing and, where applicable, obtain data portability or withdraw consent previously given.

Requests can be sent to: mail@no-extinction.org.

Users also have the right to lodge a complaint with the Italian Data Protection Authority or with the competent supervisory authority.

14. Account deletion

Users can request the deletion of their account by writing to mail@no-extinction.org, unless an automatic function is later made available in the profile.

Deleting an account does not necessarily mean the automatic deletion of all public contributions when that would make discussions incomprehensible: in such cases content may be kept in dissociated or anonymized form, without prejudice to the requests and rights recognized by applicable law.

15. Changes to this notice

This notice may be updated when the Forum features, the providers used or the applicable law change. Relevant changes will be made available on the website in an easily accessible way.