Privacy Review

Privacy Review

Facts for a data-protection reviewer assessing palaestra.thrivetech.ai. The live policy is at palaestra.thrivetech.ai/privacy-policy; its source is published.

Controller

Operated by an individual, noncommercial. Contact support@palaestra.thrivetech.ai. Erasure requests GDPR-request@palaestra.thrivetech.ai.

Personal data held

Data	Source	Purpose	Retention
Name	LinkedIn OIDC claim	Attribution on boards and scores	Until erasure
Email address	LinkedIn OIDC claim	Account identity; notifications only if opted in	Until erasure, or removable separately (below)
LinkedIn subject identifier	LinkedIn OIDC claim	Stable primary key	Until erasure
Episode data: turns, actions, scores	Generated by play	The scored record; replay	Until erasure
Sign-in time	Generated at sign-in	Audit of account access	90 days, then deleted
Problem report: message, page, engine version	Submitted by the user	Support	Until erasure
Problem-report trace, if attached	Submitted by the user	Support	30 days after the report is closed

Nothing else is stored.

What is refused

Profile photo	LinkedIn returns a photo URL whether it is requested or not. It is discarded on receipt. Not stored, not displayed, not logged.
IP address	Not stored.
Location	Not stored.
Device or browser details	Not stored at sign-in.

A sign-in record has three fields: a record id, a player id, and a timestamp. There is no column for anything else.

Both are readable in inspect/worker/auth.ts: the claims the worker reads, and the ones it drops.

The problem-report trace

Attached only if the user leaves the checkbox ticked, and the user can download and read the exact contents before sending. It holds recent in-app errors with their request reference ids, the results of any connection check run, the page the trace was captured on, and the browser user-agent string.

This is the one place a user-agent string is transmitted, and it is disclosed in the policy.

The trace has a shorter life than the message it arrived with. It is the part describing a device rather than a problem, so a scheduled sweep deletes it thirty days after the report is closed, while the message stays until erasure. Reopening a report restarts that clock. The sweep runs daily and is the same one that removes sign-in records at ninety days.

Consent and lawful basis

Sign-in is required to play; there is no guest access. The account fields above are necessary to provide the service.

Notifications are separate and off by default. notify_enabled defaults to disabled. No email is sent unless the user turns it on.

The address obtained from LinkedIn is stored only when the provider asserts it is verified. An unverified claim is kept as identity and earns no sending rights.

Sub-processors

Processor	Role	Location
Cloudflare	Hosting, D1 database, R2 object storage, request logging	Configured region WNAM (western North America)
LinkedIn	Identity provider at sign-in only	Per LinkedIn

No data is sold, shared with advertisers, or passed to data brokers. There is no analytics processor, because there is no analytics.

Cookies

Cookie	Purpose	Lifetime
Session	Signed player identifier	30 days
Return path	Preserves the destination across the OAuth redirect	10 minutes

Both are first-party, HttpOnly, Secure, SameSite=Lax. There is no tracking cookie and no third-party cookie.

Rights, and how they are exercised

Right	Mechanism	Timing
Access and portability	"Export my data" on the profile, self-service	Immediate
Erasure	Email GDPR-request@	Within 30 days
Remove email address only	"Remove my address" on the profile	Immediate
Withdraw notification consent	Profile, or a one-click link in any notification	Immediate

Erasure does not depend on jurisdiction. The address names the regulation that named the right, not the set of people entitled to it. Requests are honored the same way wherever the person lives.

Erasure removes the player record, episodes, turns, and sign-in records.

Removing the email address separately sets a marker that also nulls the address on every subsequent sign-in, so the identity provider cannot silently restore it.

Verify

• inspect/web/privacy-policy.tsx — the published policy, as source
• inspect/worker/auth.ts — which claims are read, and the address-removal marker
• inspect/worker/support.ts — what a problem report stores
• inspect/web/connection-check.tsx — the diagnostic, which measures only the user's own browser

See also Security Review.