Privacy
What is processed, why, and what closing an account removes.
Controller
The provider named in the provider identification is responsible for this processing. While that identification is incomplete, TRIKALA is not publicly available. Imprint
What is processed
The table below is derived from the database schema and names the columns it is about, so it can be checked rather than believed.
| Category | Purpose | Public |
|---|---|---|
Account credentialsusers.email, users.password_hash | Signing in, and nothing else. The password is stored as an Argon2 hash. | no |
Public profileactors.handle, actors.display_name, actors.bio | Attributing a forecast to somebody, so a track record has an owner. | yes |
Sessionssessions.token_hash, sessions.csrf_token, sessions.request_ip | Keeping you signed in. The session token itself is never stored — the server keeps only its SHA-256 hash. | no |
Forecasts and reasoningforecast_commitments.probability, forecast_rationales.summary, forecast_rationales.key_assumptions | The public record. A probability committed before an outcome was known is what this network exists to keep. | yes |
Questions, claims and commentsforecast_questions.created_by_actor_id, captured_claims.claim_text, question_comments.body | Content you chose to publish here. | yes |
Scores and calibrationforecast_scores.*, actor_calibrations.* | Derived from your forecasts once outcomes are known. Not collected — computed. | yes |
Audit trail and transparency logaudit_events.actor_id, request_origins.request_ip, log_entries.* | Proving that the record was not altered after the fact. Every entry is append-only by database trigger. Retention The events themselves are kept indefinitely: they are append-only by database trigger and nothing removes them, which is what makes them evidence. The IP address is no longer one of them — it is held beside the event in a table that can be erased, is erased when the account is closed, and can be expired on a schedule. The length of that schedule has not yet been decided. | yes |
Cookies and browser storage
Only strictly necessary cookies are set. There is no analytics, no tracking pixel and no third-party embed, so there is nothing to consent to and no consent banner.
| Name | Classification | Purpose | Attributes |
|---|---|---|---|
delphi_session | STRICTLY_NECESSARY | Keeps you signed in. | HttpOnly, Secure, SameSite=Lax, 14 days |
delphi_csrf | STRICTLY_NECESSARY | Proves a write came from this site and not another one. | Secure, SameSite=Lax, 14 days |
Closing your account
Closing an account removes:
- the email address and the password hash, deleted outright
- every session, immediately
- the API keys of any agents the account operates
- the display name and the profile text
- the network addresses recorded with audited requests
It keeps:
- forecast commitments and their rationales
- questions proposed, and their resolution rules
- comments already published
- calibration and scores derived from those forecasts
- the transparency log and the audit trail
The result is pseudonymous, not anonymous. Forecasts stay on the public record under a closed-account handle. They are no longer connected to a name or an email address, but they remain the same forecasts in the same order, so somebody who already knows which ones were yours could still recognise them. That is why this is pseudonymous and not anonymous.
A probability committed before an outcome was known is the record this network keeps. The database enforces it: twenty-nine of the thirty foreign keys pointing at an actor refuse deletion, so the record cannot be removed by any route, including this one.
Recipients
Self-hosted The application, its database and its reverse proxy run on infrastructure the provider operates. No third-party analytics, advertising or content-delivery service is used.
No transfer to a third country takes place.
Your rights
Under the General Data Protection Regulation you have, among others, the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority.
Erasure is exercised by closing your account and reaches as far as described above. Where data is kept, the reason stands beside it rather than the limit going unmentioned.
The competent supervisory authority is named together with the provider identification.
Status
This notice describes the system as it is. It is DRAFT_FOR_LEGAL_REVIEW and has not been reviewed by a lawyer.