Responsibility and contact
Alaa Nfissi operates Fact vs Hype and is the privacy contact. Use Contact & corrections to request access, correction, deletion, or an explanation. Requests enter a protected queue available to you and authorized moderators. No separate support inbox is advertised.
Information we use
Sign-in is handled by Supabase and the configured identity provider. The application keeps a separate pseudonymous public profile, submitted contributions, private drafts and evidence, saved products, review requests, notifications, and narrowly scoped moderation records. Provider account identifiers and sessions are not public profile fields.
Public and private material
Public profiles, published product claims, active experiences, approved report revisions, public approved evidence copies, requests, and disclosed vendor replies may be read without signing in. Private drafts and original files are accessible to their contributor and authorized moderators. Public content can be copied by other people; withdrawal cannot recall copies already downloaded.
Purpose and service providers
We use information to authenticate accounts, maintain contributions, review evidence, respond to requests, limit abuse, and operate the service. Hosting, authentication, database, and storage providers process data on our behalf and may process it outside your jurisdiction. The release runbook records the actual hosting regions and backup coverage before activation.
Cookies and measurement
Authentication uses essential session cookies. Your comparison selection stays in this tab’s session storage. When operational measurement is enabled, we count searches with results, evidence engagement, completed contributions, contact requests and return visits using event names and dates only. A last-visit date can be kept in your browser; no visitor identifier, query text, page URL, email or evidence is included in measurement events. Do Not Track and Global Privacy Control disable these events. The application does not install advertising trackers or send private writing to AI providers. Hosting and identity providers may retain their own security logs under their terms.
Retention and removal
You can retract experiences, withdraw reports and files, or delete your account. Deletion immediately hides contributions and revokes application sessions. A daily cleanup removes withdrawn or rejected files and deletes the provider account identity. Abandoned uploads expire after one hour. Rate counters expire after two days; read notifications after 90 days; closed contact content after 90 days. Audit reasons are cleared after 90 days and audit identifiers after one year. Published content and private drafts remain until withdrawn or deleted. Backup copies follow the separately verified provider retention schedule.
Access and export
Your fieldbook exports your profile, submissions, report revisions, evidence metadata, saved products, requests, and review correspondence as JSON. Download evidence originals separately from their report while your account is active. Ask for a correction or additional access through the contact queue.
Safeguards and incidents
Access checks run on the server and database, including current sessions and roles. Original files are private. Public file copies require explicit approval and are served through a route that checks withdrawal status. If an incident occurs, the operator assesses impact and applicable notification requirements. No system is presented as perfectly secure.