Privacy Notice
Last updated 02 October 2026
What personal data Joy of Mags collects, why we use it, how long we keep it and the rights you have over it.
1. Controller and contact
Joy of Mags is the controller for the personal data described in this notice. For any privacy question, or to exercise your rights, contact privacy@joyofmags.com.
2. What we collect and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Email address, password hash | Creating and securing your account | Contract |
| Date of birth | Age eligibility (16+) and mature-content gating (18+) | Legal obligation / legitimate interests |
| Display name, handle, bio, avatar | Your public profile and creator credit | Contract |
| Publication and issue metadata, uploaded PDFs and covers | Hosting and displaying your magazines | Contract |
| Purchase and subscription records | Granting access, receipts, accounting | Contract / legal obligation |
| Stripe account identifiers and capability flags | Creator payouts through Stripe Connect | Contract |
| Page-view events with a browser session identifier | Creator reading analytics | Legitimate interests |
| Bookmarks, reading progress, follows | Your library and resume-reading features | Contract |
| Content reports: your email, account ID if signed in, the reason, pages and details you submit | Investigating the report, sending your receipt, following up, and keeping a record of the decision | Legitimate interests / legal obligation |
3. What we do not collect
- We never see or store card numbers. Payments are handled on Stripe's hosted checkout.
- We do not use advertising or cross-site tracking cookies.
- We do not sell personal data.
- If you report content, your identity is kept confidential and is never shared with the creator or publisher you reported.
4. Who we share data with
- Lovable Cloud — application hosting, database, authentication and file storage.
- Stripe — payment processing, creator onboarding and payouts (Stripe is an independent controller for its own compliance purposes).
- Email delivery provider — account and transactional email.
- Law enforcement or regulators where we are legally required to disclose.
5. International transfers
Our processors may process data outside the UK/EEA. Where they do, transfers are covered by UK International Data Transfer Agreements, the EU Standard Contractual Clauses or an adequacy decision.
6. How long we keep it
Account and profile data is kept for as long as the account exists and deleted within 30 days of closure. Purchase records are kept for seven years for tax and accounting purposes. Analytics events are retained in identifiable form for 24 months. Full detail is in our Data Retention Schedule.
7. Your rights
We respond to requests within one month. Send them to privacy@joyofmags.com.
- Access a copy of your data, and have inaccurate data corrected.
- Erasure, subject to records we must keep (for example purchase history) and to other readers' purchased access.
- Restriction of and objection to processing based on legitimate interests, including analytics.
- Portability of the data you provided to us.
- Complain to the Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
8. Security
We protect personal data and uploaded content using a combination of transport encryption, access controls and managed hosting security.
- TLS/SSL encryption. Every connection to Joy of Mags uses HTTPS with TLS 1.2 or higher. This encrypts data travelling between your browser and our servers — including login credentials, payment sessions, PDF downloads and anything you type into a form. It also helps confirm you are connected to the real joyofmags.com site, not an impostor, and prevents anyone on the network from reading or tampering with the data in transit.
- Encryption at rest. The database and file storage that underpin Joy of Mags are encrypted at rest by the managed platform.
- Row-level security. Database access is constrained by row-level security policies so a signed-in user can only read or change records they are allowed to access.
- Short-lived signed URLs. PDFs and covers are served through time-limited signed URLs, so direct links expire quickly.
- Server-side access gates. Paid or restricted issues are checked on the server before the PDF is served, not just hidden in the interface.
- Password hashing. Passwords are handled by the managed authentication service and are never stored or visible to us in plain text.
- No card data on our servers. Payments are handled on Stripe's hosted checkout pages. We never see or store full card numbers.
- Least-privilege access. Access to production systems and data is limited to the people who need it to run or support the service.
9. Platform security assurances
Joy of Mags runs on Lovable's managed cloud infrastructure. The platform handles underlying hosting, database, authentication, file storage, automated backups and security monitoring. Lovable publishes its own platform security evidence, which you can review at the link below.
10. Children
Joy of Mags is not intended for under-16s. If we learn that an account belongs to someone under 16, we close it and delete the associated data.