Privacy Policy

Effective date: 6 September 2026 Last updated: 6 September 2026

1. Who is responsible for your data

War in World is operated by:

Pavel Novák K Točné 938, Dolní Břežany 25241, Czechia contact@warinworld.app

The operator is the data controller for the personal data described in this policy, within the meaning of the EU General Data Protection Regulation (GDPR). The operator is an individual established in the Czech Republic, not a company, and there is no separate privacy team: the person named above is the person who reads and answers requests about your data.

No data protection officer has been appointed. One is required under Art. 37 only for public authorities, for controllers whose core activity is large-scale regular and systematic monitoring of people, or for large-scale processing of special-category data. This service is none of those: it is one person running a subscription reader with a few tables of account data. If that changes, this paragraph changes with it.

2. What this policy covers

This policy covers the War in World service, read in a browser at warinworld.app and app.warinworld.app. It explains what personal data is collected, why, who it is shared with, how long it is kept, and what rights you have.

War in World is a conflict-reporting service. Most of what it shows you — the conflict dossiers, events, statements and maps — is editorial content compiled from published news sources. That content is not about you and is not covered by this policy except where it is noted below (§10).

3. What is collected, why, and on what legal basis

3.1 Account data

Data	Why	Legal basis
Email address	To create your account, sign you in, send you a one-time sign-in code, and let you reset your password. Those emails are sent through Resend (§6)	Performance of a contract (Art. 6(1)(b)) — you cannot have an account without it
Password	Stored only as a cryptographic hash. The plain password is never stored and cannot be recovered by anyone, including the operator	Performance of a contract
Username	Shown on any post or comment you write. Chosen by you at sign-up	Performance of a contract
Account creation date	Account administration	Performance of a contract
Subscription status and current period end date	To know whether your subscription is active and therefore what the service should show you	Performance of a contract

Your username is public within the service. Anyone who can see a post or comment you write can see the username attached to it. Please do not choose a username you would not want associated with what you write. Your username cannot be changed after you choose it.

Data	Why	Legal basis
IP address	Recorded against each active session by the authentication service, for session management and to detect abuse	Legitimate interests (Art. 6(1)(f)) — keeping accounts secure
Browser user-agent string	Same	Legitimate interests
Sign-in timestamps	Same	Legitimate interests

This data is collected by the authentication service the app uses (see §6), not by the service’s own code, but the operator is responsible for it all the same.

3.3 Content you create

Data	Why	Legal basis
Posts and comments (title, body, timestamp)	To publish them to other subscribers, which is what you asked us to do	Performance of a contract
Votes on posts and comments	To order the community feed. Your individual votes are visible only to you	Performance of a contract
Accounts you have blocked	To hide that person’s content from you	Performance of a contract
Reports you file about content	To review and act on reports, and to prevent repeat abuse of the reporting system	Legitimate interests — running a moderated community

Reports are linked to the account that filed them. Reports are not shown to the person being reported, and are not visible to you after you have filed one.

3.4 Records of how you use the service

Data	Why	Legal basis
Which conflicts you have chosen to follow	To assemble your home feed	Performance of a contract
Feed items you have dismissed	So dismissed items stay dismissed	Performance of a contract
Which weekly briefs you have opened, with timestamps	To mark them as read	Performance of a contract
The date your current subscription began	To show how long you have been a subscriber, beside your username	Performance of a contract

We keep no record of which days you opened the service, which cards you expanded, or how much of it you have read. A points ledger that would have recorded all three was removed from the database before it was ever used.

No advertising, analytics, attribution or crash-reporting software of any kind is included. The operator does not build a profile of you, does not track you across other sites, and does not sell or share personal data for advertising. There are no third-party cookies, and no cookie banner, because there is nothing to consent to.

3.5 Location

If you open the map, your browser asks for permission to use your location. If you grant it, your coordinates are used in your browser only, to calculate how far you are from a conflict area.

Your location is never transmitted to the operator, to the service’s servers, or to any third party. It is held in memory while the page is open, is not written to storage, and is discarded when you close the tab. Refusing the permission simply means no distance figure is shown; nothing else changes.

3.6 Data stored in your browser

The following is kept in your own browser’s storage, is not transmitted anywhere, and is removed if you clear your browsing data:

your sign-in session, so you do not have to sign in every time
which conflicts you follow, and your notification preferences
a cached copy of your subscription entitlement, so the service knows what to show you before the network answers

3.7 What is not collected

We do not collect your name, date of birth, postal address, phone number, contacts, photos, calendar, microphone or camera data. There is no advertising identifier, no push notification token, and no analytics identifier of any kind.

4. Payments

Subscriptions are sold directly by the operator and payment is processed by Stripe Payments Europe, Ltd. and its group companies.

Card details never reach the operator. Payment is taken in Stripe’s own hosted checkout, in Stripe’s own page. The operator’s systems never receive, and never store, your card number, expiry date or security code.

What is recorded against your account here is only: whether your subscription is active, which of the two plans it is on, when the current period ends, the Stripe customer and subscription identifiers needed to manage it, and the fact and time of the consent you gave at checkout regarding immediate performance and the right of withdrawal (Terms §5).

Stripe processes your payment data as a controller in its own right for some purposes — fraud prevention and its own legal obligations — under its own privacy policy, at https://stripe.com/privacy.

5. How long data is kept

Your data is kept for as long as your account exists, and is deleted when you delete your account. There is no other schedule and nothing expires on its own.

This is stated the way it is because it is what the service actually does. There is no dormancy rule: an account that is never signed into again is not deleted after a period of inactivity, and no warning email is sent. Describing one here would be a promise with nothing behind it. Deleting your account, which you can do yourself at any time from your account screen, is what ends the retention — see §7 for exactly what that removes.

Account data, your content, and your usage records are kept for as long as your account exists.
Session records, including IP addresses, are held by the authentication service for as long as the session is valid. A session ends when you sign out, or when its refresh token expires after a period of inactivity. The authentication service also keeps an audit log of sign-ins and account changes; it is held for the life of the project and is removed along with the rest of your account data when you delete your account.
Payment records are kept by Stripe under its own retention rules, and by the operator for as long as tax and accounting law requires a record of a sale to be kept — in Czechia, ten years for VAT-relevant records. A deleted account does not delete an invoice, because the law does not permit it to.
Editorial content — the conflict dossiers, events and statements — is kept indefinitely, because it is a historical record. It is not personal data about you.
Draft editorial items that were never published are deleted automatically after 7 days, and rejected ones after 30 days.

6. Who your data is shared with

Personal data is not sold, and is not shared for advertising. It is processed by the following service providers (“processors”), each acting on the operator’s instructions:

Provider	What it receives	Where
Supabase, Inc. — database, user accounts, server functions	All account data, your content, your usage records, your IP address and user agent	Data is stored in Amazon Web Services’ Europe (Ireland) region. Supabase, Inc. is a company incorporated in the United States.
Stripe — taking and managing payments	Your email address, your card details (which the operator never sees), and your billing history	Ireland, with group companies in the United States
Resend, Inc. — sending authentication emails	Your email address, and the one-time sign-in and password-reset codes sent to it	United States
Cloudflare, Inc. — serving the site, and routing mail sent to our contact address	Anything you send to contact@warinworld.app, including a request about your data	United States, on a global network
Google LLC (Gmail) — the mailbox the contact address forwards to	The same	United States
Anthropic PBC — automated classification of news articles and drafting of the weekly brief	No user data. Only news articles from public sources, and editorial items already published	United States

About the contact address. Mail sent to contact@warinworld.app is routed by Cloudflare Email Routing and delivered to a Gmail mailbox. Both Cloudflare and Google therefore process whatever you write to us, including a request about your own data, and both are listed above for that reason. If you would rather a rights request did not pass through them, say so in your message and we will agree another way to correspond.

The service also fetches news from publishers and from the UN’s ReliefWeb service. This happens on the server, not in your browser — those publishers never see your IP address or learn what you read.

The map is served from the operator’s own infrastructure, so no map provider learns which places you look at.

The operator may also disclose personal data where legally required to do so, for example in response to a valid order from a competent authority.

7. Deleting your account

You can delete your account yourself, from your account screen.

What is deleted. Your email address and password, your username, your subscription record, your votes, the accounts you had blocked and any blocks against you, the reports you filed, your reading records, and your record of dismissed items. All of it is removed from the database outright.

What remains. Posts and comments you wrote stay in the community — otherwise replies other people wrote to them would stop making sense. But they no longer belong to you in any way the system can trace: the link to your account is severed, and the username shown on them is overwritten. They appear as written by “Deleted account”.

After deletion there is no record anywhere in the service that connects that content, or anything else, to you: not your account identifier, not your email address, and not your username.

Two things are worth knowing. Deleting your account cancels your subscription in the same action, immediately, so you are not charged again for something you can no longer sign in to — see Terms §5, which also says what that costs you. And the payment record itself survives, at Stripe and in the operator’s accounts, for as long as tax law requires (§5): a deleted account does not delete an invoice, because the law does not permit it to.

If you would rather have specific posts or comments removed as well, delete them yourself before deleting your account, or contact the operator (§9) and they will be removed.

8. Your rights

If you are in the EU or the European Economic Area, you have the right to:

access the personal data held about you, and receive a copy
rectify data that is inaccurate or incomplete
erase your data (“right to be forgotten”)
restrict processing in certain circumstances
object to processing carried out on the basis of legitimate interests
data portability — receive the data you provided in a structured, machine-readable format, and have it transmitted to another controller where technically feasible
withdraw consent at any time where processing is based on consent. Withdrawing consent does not affect processing carried out before you withdrew it.

You can exercise the most common of these yourself: your content can be deleted from within the service, and your account can be deleted from your account screen.

For anything else, contact the operator using the details in §9.

Complaints. If you believe your data has been handled unlawfully, you can complain to a supervisory authority. The Czech authority is:

Úřad pro ochranu osobních údajů (Office for Personal Data Protection) Pplk. Sochora 27, 170 00 Praha 7, Czech Republic https://www.uoou.cz

You may also complain to the supervisory authority in the EU country where you live.

9. How to make a request, and how it is handled

Send requests about your data to contact@warinworld.app.

That address is read by Pavel Novák, the operator named in §1. There is no support department and no team: one person receives the request and one person answers it.

Some rights you do not need to ask for. Your posts and comments can be deleted from within the service, and your whole account can be deleted from your account screen, without contacting anyone (§7).

How your identity is checked. Send your request from the email address your account is registered to. That address is how the request is matched to the account, and it is the only check made. A request that arrives from any other address cannot be acted on, and you will be told so rather than ignored — acting on it would mean handing over, or destroying, someone’s account on a stranger’s say-so.

This is one rule and it applies to every kind of request: access, a copy of your data, correction, restriction, objection, and deletion. It is the same rule stated on the account-deletion page at warinworld.app/delete-account.

If you have lost access to the registered address and so cannot write from it, say so. There is no automated way around this, and what can be done will depend on what you can show; but it will be looked at rather than refused out of hand.

How long it takes. You will get a response within 30 days of the request arriving.

That is the statutory maximum under the GDPR rather than a shorter promise, and it is stated honestly: one person reads this mailbox, and a commitment that cannot be kept in a bad week is worse than a longer one that always is. Most requests are answered well inside it. If a request is genuinely complex, the GDPR allows the period to be extended by up to two further months — if that ever happens you will be told within the first 30 days, with the reason.

If you ask for a copy of your data, you will get your account record, your posts and comments, your votes, your reading and dismissal records, and your subscription history. Two things are given in a reduced form, because they are also information about other people: the accounts you have blocked, and the reports you have filed, are returned as counts and dates rather than as the other person’s username. If you need one of those identified for a specific reason, say which and why, and it will be considered.

10. Information about people in the news

War in World reports on armed conflicts. Its dossiers, event records and quoted statements name public figures — heads of state, ministers, military spokespeople and similar — and describe their public actions and public statements.

This is journalistic processing of information already published by news organisations and official sources, in the public interest. Every item carries its source.

If you are named and believe something about you is inaccurate, contact the operator (§9). Terms of Use §4 sets out what happens then: the item is checked against the source, and is corrected, annotated, or answered with your response recorded alongside it.

11. Content posted by other users

Posts and comments are written by users, not by the operator. The operator does not control what people write, and users are asked not to post other people’s personal information.

If a post or comment contains your personal data and you want it removed, contact the operator (§9). Content can also be reported from within the service, and reported content is reviewed.

12. Children

War in World is not intended for children. You must be at least 16 years old to create an account or use it.

Sixteen is above the age the Czech Republic sets for consent to information-society services, which is 15 (GDPR Art. 8 allows any age from 13 to 16, and Czech law adopted 15). The higher age is deliberate: the service reports on armed conflict, and its subject matter is not suitable for younger readers.

We do not verify your age at sign-up. We ask for an email address, a password and a username, and nothing else. The age limit above is a condition of use, not something that is checked. If you become aware that someone under 16 has created an account, contact the operator (§9) and it will be deleted.

13. International transfers

The database that holds your account and your content is in the European Union (Ireland), and payments are taken by Stripe’s Irish entity. However, several of the providers in §6 are United States companies or have US group companies, and personal data may be accessible to them from the United States.

Where that happens, the transfer is made under the European Commission’s standard contractual clauses, incorporated into each provider’s data processing agreement, and — for those providers that are certified — under the EU–US Data Privacy Framework. No personal data is transferred to any country outside the EEA except through one of those two mechanisms.

Ranked by what each actually holds, the transfers that matter are: Supabase, which holds everything; Resend, which receives every user’s email address together with live one-time sign-in and password-reset codes; Stripe, which holds billing data; and Cloudflare and Google, which between them route and store anything you send to the contact address — including a request about your own data, which is often more revealing than the account it concerns. Anthropic receives no user data at all.

You can ask for details of the mechanism relied on for any particular provider by writing to the address in §9.

14. Security

Access to your data is restricted at the database level: the database enforces, for every table, that a user can read only their own rows. Passwords are stored as hashes and cannot be read by anyone, including the operator. Connections between your browser and the server are encrypted.

The operator can access user data through the service provider’s administration console — this is unavoidable for running and supporting the service.

If there is a data breach. The operator is the only person who administers this service, so the operator is who notices, and there is no internal escalation to describe. What happens is this: on becoming aware of a breach, the operator assesses what data was involved and who is affected. If it poses a risk to people’s rights, it is reported to the Úřad pro ochranu osobních údajů within 72 hours of becoming aware of it, as GDPR Art. 33 requires — including where the assessment is still incomplete, in which case the remainder follows. If it poses a high risk, affected users are told directly, by email to the address on their account, without undue delay, in plain language: what happened, what data was involved, what is being done, and what they should do. A record of every breach is kept whether or not it is reportable.

15. Changes to this policy

If this policy changes materially, the operator will update the “last updated” date above and show you a notice the next time you open the service, so that you find out by using it rather than by having been told to check this page periodically. Where a change concerns something you are asked to agree to, you will be asked again.

16. Contact

For anything in this policy, including a request about your own data: