Privacy Notice
Last updated 23 August 2026
What personal data Joy of Mags collects, why we use it, how long we keep it and the rights you have over it.
1. Controller and contact
Joy of Mags is the controller for the personal data described in this notice. For any privacy question, or to exercise your rights, contact privacy@joyofmags.com.
2. What we collect and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Email address, password hash | Creating and securing your account | Contract |
| Date of birth | Age eligibility (16+) and mature-content gating (18+) | Legal obligation / legitimate interests |
| Display name, handle, bio, avatar | Your public profile and creator credit | Contract |
| Publication and issue metadata, uploaded PDFs and covers | Hosting and displaying your magazines | Contract |
| Purchase and subscription records | Granting access, receipts, accounting | Contract / legal obligation |
| Stripe account identifiers and capability flags | Creator payouts through Stripe Connect | Contract |
| Page-view events with a browser session identifier | Creator reading analytics | Legitimate interests |
| Bookmarks, reading progress, follows | Your library and resume-reading features | Contract |
3. What we do not collect
- We never see or store card numbers. Payments are handled on Stripe's hosted checkout.
- We do not use advertising or cross-site tracking cookies.
- We do not sell personal data.
4. Who we share data with
- Lovable Cloud — application hosting, database, authentication and file storage.
- Stripe — payment processing, creator onboarding and payouts (Stripe is an independent controller for its own compliance purposes).
- Email delivery provider — account and transactional email.
- Law enforcement or regulators where we are legally required to disclose.
5. International transfers
Our processors may process data outside the UK/EEA. Where they do, transfers are covered by UK International Data Transfer Agreements, the EU Standard Contractual Clauses or an adequacy decision.
6. How long we keep it
Account and profile data is kept for as long as the account exists and deleted within 30 days of closure. Purchase records are kept for seven years for tax and accounting purposes. Analytics events are retained in identifiable form for 24 months. Full detail is in our Data Retention Schedule.
7. Your rights
We respond to requests within one month. Send them to privacy@joyofmags.com.
- Access a copy of your data, and have inaccurate data corrected.
- Erasure, subject to records we must keep (for example purchase history) and to other readers' purchased access.
- Restriction of and objection to processing based on legitimate interests, including analytics.
- Portability of the data you provided to us.
- Complain to the Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
8. Security
Data is encrypted in transit and at rest. Database access is constrained by row-level security so users can only read their own records. PDFs are served through short-lived signed URLs, and paid issues are gated server-side rather than only in the interface. Access to production data is limited to those who need it.
9. Children
Joy of Mags is not intended for under-16s. If we learn that an account belongs to someone under 16, we close it and delete the associated data.