Policies
Privacy
This notice explains what the site holds about you, why, who else processes it, and what you can do about it. Reading the archive requires no account and no non-essential cookies.
Last updated 11 August 2026
Who is responsible
Masab Farooque runs this site and decides how personal data is handled, which makes him the data controller. Reach him at hello@bluelockarchive.com for anything on this page.
What is held, and why
| Purpose | Data | Lawful basis | Kept for |
|---|---|---|---|
| Running an account | Email address, password hash, username, display name, bio, sign-in timestamps | Contract. You cannot have an account without them. | Until you close the account, then deleted immediately. |
| Ratings and comments | The score or text you submit, and which page it belongs to | Contract. This is the feature you signed up for. | Until you delete the item or close the account. |
| Keeping the site online and stopping abuse | Server logs: IP address, page requested, browser type, timestamp | Legitimate interests, namely keeping the service available and investigating abuse. | Held by the host on a rolling short-term basis, not linked to your account. |
| Rate limiting sign-in and registration | The email address entered, IP address, browser type, whether the attempt worked, timestamp | Legitimate interests, namely protecting accounts from password guessing and stopping bulk registration. | Thirty days, then deleted automatically. |
| Understanding how the site is used | Pages visited, approximate location from IP, device and browser, and a recording of how you moved and clicked on the page | Consent. Nothing runs unless you agree, and you can withdraw at any time. | Set by Google and Microsoft under their own policies. |
| Advertising | Cookies and device identifiers set by the ad provider | Consent. Nothing runs unless you agree, and you can withdraw at any time. | Set by the ad provider under their own policy. |
No special category data is collected, and nothing here is used for automated decision-making or profiling that produces legal effects.
Who else processes it
| Processor | Role | Where |
|---|---|---|
| Supabase | Database and authentication | Data is stored in the ap-south-1 region (Mumbai, India). |
| Hosting provider | Serving the site and writing request logs | Location depends on the deployment region. |
| Google (AdSense) | Display advertising, only after you consent | Transfers outside the UK and EEA under Google’s own safeguards. |
| Google Analytics | Counts visits and pages, only after you consent | Transfers outside the UK and EEA under Google’s own safeguards. |
| Microsoft Clarity | Records how pages are used, only after you consent | Transfers outside the UK and EEA under Microsoft’s own safeguards. |
| Fandom and AniList | Serve images your browser requests directly | They see the request, including your IP address, as any image host would. |
Your data is never sold, and it is never shared for anyone else's marketing.
Session recording
If you agree to analytics, Microsoft Clarity records how pages are used: scrolling, clicks, and movement around the page. It is used to find what is confusing or broken, not to identify anyone. Text you type into a field is masked before it leaves your browser, so passwords and email addresses are not captured. Nothing is recorded unless you have agreed, and declining costs you no functionality.
What is public
Your username, display name, bio, approved comments and ratings are visible to anyone. Your email address never is. Treat the bio as a public field and keep anything private out of it.
Your rights
You can see your data, correct it, take it elsewhere, or have it erased. Two of those are self-service and take effect immediately.
- Access and portability. Download everything held about you as JSON from your account page.
- Rectification. Edit your display name and bio on the same page.
- Erasure. Closing your account deletes your profile, ratings and comments in one step, with no waiting period.
- Objection and restriction. Withdraw advertising consent from the footer at any time. Email for anything else.
If you are unhappy with the response
You can complain to your local data protection authority. In the UK that is the Information Commissioner's Office; in the EU it is the supervisory authority where you live. Raising it here first is usually faster.
Cookies
Only the sign-in session is set without asking, because an account cannot work without it. Advertising and analytics wait for your consent and can be withdrawn whenever you like. The cookie page lists each one.
Children
Accounts are not intended for children under 13, and no age data is collected. If you believe a child has registered, email and the account will be removed.
Security
Passwords are hashed by the authentication provider and never visible to the site. Database access is governed by row-level policies, so one account cannot read another's private data even if the interface were bypassed.
Sign-in and registration attempts are recorded so repeated failures can be slowed down. Each record holds the email address that was typed, the IP address it came from, the browser type and whether it worked. Only an administrator can read them, they are never used for advertising or analytics, and everything older than thirty days is deleted automatically. Note that the email address in a failed attempt is whatever was entered, which is not necessarily an address belonging to anyone with an account here.
Changes
The date at the top changes whenever this notice does. There is no mailing list, so that date is the reliable way to tell.