Privacy Policy
This policy explains which personal data the Cassandra service (the “Service”), available at https://kassandra.today, collects, what it is used for, and what rights you have.
1. Data controller
The data controller is Dmitriy Filyushin (the “Operator”). For any personal data matters contact the Operator via [email protected].
The Operator processes personal data in accordance with applicable data protection law, including Federal Law of the Russian Federation No. 152-FZ “On Personal Data” of 27 July 2006.
2. What data we process
| Data | Source | Purpose |
|---|---|---|
| Email address | entered at sign-up | account identification, login, address verification, access recovery |
| Username (handle) | entered at sign-up | public author name shown on the profile and next to published predictions |
| Password | entered at sign-up | stored only as an irreversible bcrypt hash; the Operator has no access to the password itself |
| Prediction content: statement, details, tags, source, probability, deadline, outcome and resolution comment | entered by you | operation of the Service: keeping predictions, accuracy and calibration statistics |
| Subscriptions to authors and notifications | created by your actions | the feed of watched predictions, in-app notifications |
| Timestamps of registration, email verification, record creation and changes | generated automatically | operation of the Service, abuse protection |
| Technical data: IP address, browser type, requested pages, request time | server logs | security and troubleshooting; kept for a limited time and not deliberately linked to a user profile |
We do not collect payment card details, identity documents or geolocation, and we use no advertising or analytics trackers.
Prediction statements are free text. Please do not include personal data of third parties: a published prediction becomes public and cannot be edited.
3. Legal bases and purposes
- Consent, which you give at sign-up by ticking the corresponding box (or by passing the privacy_consent field when registering via the API), for processing your email address, username and prediction content.
- Performance of the agreement on using the Service, for maintaining the account and sending verification and service emails.
- The Operator's legitimate interest in the security and availability of the Service, for technical logs.
We do not use personal data for advertising and make no decisions based solely on automated processing that would have legal effects for you.
4. Cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
| cassandra_token | login session (signed token); httpOnly | 30 days |
| cassandra_theme | selected colour theme | 1 year |
| cassandra_lang | selected interface language | 1 year |
All cookies are strictly necessary for the Service; there are no third-party or advertising cookies. Interface fonts are loaded from Google Fonts servers, so your browser sends its IP address to Google when a page loads; see the Google privacy policy.
5. Public data
Your username, registration date, public accuracy statistics and the predictions you explicitly published “for everyone” are visible to any visitor without login, including in the Explore catalogue and via direct links. Publishing a prediction is irreversible; that is part of the point of the Service. Your email address is never published or shown to other users.
Predictions you have not published are visible only to you.
6. Sharing with third parties
Data is processed on servers of the Operator and its hosting provider. The email address is passed to the email provider (SMTP server) solely to deliver verification emails. We do not sell or share personal data for marketing. Disclosure is possible only upon a lawful request from competent authorities.
7. Retention and deletion
Personal data is kept for as long as your account exists. You can delete the account yourself at any time on the Account page (or via DELETE /api/v1/me), confirming the action with your password. Deletion is immediate and irreversible: the email address, password hash, subscriptions, notifications and all predictions — including published ones — are removed, and links to them stop working. If self-service deletion is unavailable, contact the Operator as described in section 1; requests are fulfilled within 30 days.
Technical logs are kept for no longer than 90 days.
8. Your rights
You have the right to obtain information about the processing of your data, to request its correction, blocking or deletion, to withdraw consent, and to lodge a complaint with the supervisory authority for personal data protection. Withdrawing consent results in deletion of the account, since the Service cannot operate without an email address. To exercise your rights, contact the Operator as described in section 1.
9. Security
Passwords are stored only as bcrypt hashes; the session is a signed token in an httpOnly cookie; the connection to the Service is protected by HTTPS; database access is restricted to the application. No protection is absolute, so we recommend using a unique password.
10. Age
The Service is not intended for persons under 18. If you become aware that an account was created by a minor, inform the Operator and the account will be deleted.
11. Changes to this policy
The current version is always available on this page; the revision date is shown at the top. We will notify you of material changes at the email address of your account.