Privacy policy

This policy applies to VersalSpace websites, APIs, accounts, newsletters, community areas, and contact forms that link to it. Sahastranshu Sharma is responsible for deciding why and how personal data is processed.

• Account data: full name, username, email, password hash, verification status, role, subscription tier, and account timestamps.
• Optional profile data: avatar, biography, location, website, social handles, interests, expertise, favorite rocket, badges, and reputation.
• Authentication and security data: session identifiers, hashed refresh tokens, one-time verification records, IP address, device type, user-agent, login times, and security events.
• Activity data: bookmarks, follows, reactions, comments, posts, notifications, searches, downloads, shares, and newsletter preferences.
• Usage data: pages viewed, referrer, campaign parameters, device category, approximate country, scroll depth, time on page, and performance information.
• Communications and content: contact details, support messages, newsletter records, profile images, community media, comments, and posts.

Plain-text passwords are not stored; passwords are processed into a one-way hash. Do not submit sensitive financial, health, identity, confidential, or other unnecessary personal information.

• Create accounts, verify email addresses, authenticate sessions, and recover access.
• Provide profiles, bookmarks, personalization, community features, notifications, and requested services.
• Send transactional email and newsletters you request.
• Respond to questions, complaints, corrections, privacy requests, and security reports.
• Prevent abuse, enforce the Terms, investigate incidents, and maintain security and audit records.
• Measure reliability and usage, diagnose errors, improve features, and understand aggregate trends.
• Comply with law, lawful orders, and the establishment, exercise, or defense of legal claims.

Processing is based, as applicable, on consent, providing a requested service, legitimate uses permitted by law, legal obligations, and protection of users and the service. Consent may be withdrawn for optional processing without affecting earlier lawful processing.

A strictly necessary HttpOnly refresh-token cookie keeps users signed in. In production it is configured with Secure and SameSite protections. A short-lived access token, account summary, and session identifier may be stored in browser local storage. These tools support authentication and are not used by us for cross-site advertising. Clearing storage or signing out may end the session. The standard refresh session is designed to expire after approximately 30 days.

We do not sell personal data and do not give advertisers account passwords or authentication tokens. Limited data may be processed by providers needed to operate the service:

• Hosting, database, cache, storage, content delivery, backup, and infrastructure providers.
• Email delivery providers for verification codes, password recovery, security notices, and newsletters.
• Sentry, when configured, for errors, performance, and security diagnostics. Credentials are configured to be redacted before events are sent.
• Google or GitHub when you choose their sign-in option. Their own terms apply, and VersalSpace receives account identifiers and basic profile or email information needed for sign-in.
• Advisers, authorities, courts, or other recipients when legally required or reasonably necessary to protect rights, safety, and service integrity.

Providers may process data in other countries. Available contractual, technical, and access safeguards are used for cross-border processing.

Usernames, display names, avatars, biographies, selected profile fields, posts, comments, reactions, and contribution statistics may be public and may be indexed or copied by others. Deletion may not remove copies already made by third parties, search engines, archives, or lawful records.

• Account and profile data is generally kept while an account is active and for a reasonable period afterward for deletion processing, disputes, fraud prevention, backups, and law.
• Authentication sessions expire or are revoked; the standard refresh-session lifetime is approximately 30 days.
• Verification and password-reset data is kept only as needed for expiry, abuse prevention, and security records.
• Contact, moderation, audit, and security records are retained as reasonably needed. Technical logs may be retained for at least 180 days where applicable law requires it.
• Newsletter records are kept until unsubscribe or deletion, with a limited suppression record where needed to honor an unsubscribe.
• Public contributions may be retained, removed, or anonymized for discussion integrity, law, abuse prevention, and rights claims.

Data no longer required will be deleted, anonymized, or isolated from normal use, subject to backup cycles and legal duties.

Application safeguards include password hashing, email one-time codes, HttpOnly refresh cookies, short-lived access tokens, role-based controls, rate limiting, input validation, security headers, restricted CORS, monitoring redaction, and server-side session records.

Subject to applicable law, you may request access, correction, erasure, information about processing, withdrawal of consent, or grievance resolution. You may edit many profile fields directly and use the available newsletter unsubscribe process.

For deletion or another privacy request, use the contact form and write "Privacy request" in the subject. Identity verification may be required. Information may be retained where law permits or requires it.

Accounts and community features are intended only for people at least 18 years old. If we learn that a child supplied personal data without legally valid authorization, the account may be suspended and the data deleted as required.

This policy may change for product, provider, security, or legal reasons. The updated version will show a new date, and material changes may also be communicated through the site or account email.

Submit privacy questions, grievances, and security reports through the contact page. The responsible person is Sahastranshu Sharma. His public professional profile is on LinkedIn.