Privacy policy

1. Who we are and how to contact us

Cured Essence Relay operates this service from London, United Kingdom. For privacy questions, requests about your information or concerns about published material, email art@curedessence.com.

This notice covers Relay. It does not describe every activity of the wider Cured Essence project or the independent websites linked from Relay.

2. Information we handle

• Accounts: your username, email address if supplied, verification status, chosen display name, account identifiers, password hash, account status, permissions and sign-in/session records. We store a protected password hash rather than a readable password. If you create a recovery code, we store its protected hash, expiry and recovery-status timestamps. The readable code is shown only when it is issued or replaced. Prepared email-link records contain a protected token hash, purpose, recipient address, account-version snapshots, expiry and delivery-acknowledgement status; the readable link secret is not stored in those records.
• Material you provide: text, audio, images, film, transcripts, translations, credits, source links, correspondence and the information attached to uploads, such as filename, format, language and duration. Uploaded files may retain embedded metadata.
• Editorial records: authorship, draft/publication status, moderation decisions, publishing permissions, revisions and related timestamps. An admin-only activity history records the account responsible for covered publishing, permission and review changes, the affected record, time and limited status or revision metadata. It does not copy passwords, session tokens, email addresses, uploaded filenames, credit text or the content of submissions into the activity log.
• Security and delivery: requests needed to deliver the service and records used to limit repeated requests or abuse. Application rate-limit records use hashed network or account identifiers with counters and time windows. A hash does not necessarily make information anonymous. Hosting providers may also process network addresses, device/request information and service logs.

We receive information directly from you and, where a Passage concerns other people, from its contributors, credits and attributed sources. Please avoid submitting private or sensitive information about yourself or others unless it is necessary and you have an appropriate basis to share it. Cultural or archival value alone does not establish permission to publish personal information.

You can browse public material without an account. Information required in an account or submission form is needed for that feature; if you do not provide it, that feature may be unavailable.

3. Why information is used

The proposed lawful-basis approach for this draft is:

• Providing the account and services you request: creating accounts, signing you in, saving your settings and providing authorised access — performance of a contract or steps requested before entering one, where that basis applies.
• Operating and protecting Relay: maintaining availability, preventing misuse, managing permissions, reviewing submissions, handling corrections and protecting contributors' rights — legitimate interests in running a safe, reliable cultural publishing service, subject to the rights and interests of affected people.
• Publishing and attributing material: displaying approved Passages and contributions with relevant credits. The basis depends on the material and the people concerned; publication requires a specific editorial assessment. Copyright permission and a data-protection basis are separate questions.
• Meeting applicable legal duties: handling valid legal requests and keeping records that the law requires — legal obligation where applicable.
• Optional processing that requires consent: asking before it takes place and providing a way to withdraw. Withdrawing consent does not undo processing that was lawful before withdrawal.

Information revealing matters such as health, ethnicity, religion or political beliefs needs additional assessment and an applicable condition before use. This draft does not assume that Relay has a general archival exemption.

The application does not currently use advertising trackers or analytics tools. Account permissions and editorial decisions are not determined by automated profiling with legal or similarly significant effects.

4. Publication, access and service providers

Archive previews are public. Full published media, transcripts, timed notes and credits are available to authorised Transceivers; Receive and Receive + Transmit both provide full Archive access. Editorial drafts remain restricted to authorised editors. Receive + Transmit permits contributions for review: authors can see their pending submissions while they have access to the exchange, administrators can review them, and approved contributions are available within that authorised exchange. Publishing permissions remain separate from either paid plan.

Consider the information contained in your material before submitting it. Public material can be copied or shared by other people, and Relay cannot control independent copies or external search results.

Relay is hosted through OpenAI's Sites service and uses Cloudflare services for delivery, database and file storage. Providers process information needed to host, secure and deliver the service. Read the OpenAI privacy policy and Cloudflare privacy policy for their own processing.

Prepared account email provider — switched off: Resend is the proposed service for requested verification and password-reset messages, plus a notification after a completed email password reset. If enabled, it will receive the recipient address and message content, including the single-use link where needed. No live delivery has been verified. Choosing Ireland as the sending region controls routing, not EU-only storage: Resend states that account metadata, logs and API records are stored in the United States. Its contractual, retention and international-transfer arrangements need operator review before activation. See Resend's region and data-residency explanation.

Information may also be disclosed where necessary to deal with a valid legal obligation, investigate abuse, protect someone's safety or resolve a rights complaint. Relay does not operate a personal-data sales or advertising-profiling programme.

Hosting and external services may involve processing outside the UK. The specific processing locations, contractual safeguards and applicable international-transfer arrangements must be confirmed as part of the final review; this draft does not promise UK-only storage. Contact us for the available provider and transfer information.

5. Cookies and optional external services

Account sessions: Relay uses a secure, HTTP-only session cookie, __Host-ce_session, to keep you signed in. It expires after 12 hours for an administrator or seven days for an ordinary account. Signing out revokes the current session; changing or recovering your password revokes previous sessions. You can block or remove cookies in your browser, although sign-in will then be affected.

Saved recovery code: after confirming your password, you can create a code to save privately. A valid saved code lets you replace a forgotten password. Recovery invalidates that code and existing sessions, and shows a replacement code once. The code expires after 365 days and stops working when replaced, revoked, or invalidated by a password or account-status change. Your account settings show the last successful code-recovery date. Saved-code recovery and ordinary password changes do not send the prepared email-reset notification.

Account email — prepared, delivery switched off: when connected, a signed-in account can request verification of its saved email address; verification links expire after 60 minutes. Password-reset requests are available only for active accounts with a verified saved email and an enabled password, with links expiring after 30 minutes. A request response does not confirm an account exists or that mail was delivered. Existing login and permissions do not depend on new email verification. Google-only accounts continue through Google or their existing signed-in password setup.

Opening an email link does not verify an address or reset a password automatically: the page removes the link secret from its address before application requests and waits for an explicit action. A completed email reset invalidates that account's earlier sessions, saved recovery code and older Google sign-in attempts, without signing the account in or switching another currently signed-in account. Sign in normally with the new password and create a fresh saved recovery code. Valid previously issued links can still be confirmed if new email sending is paused. Do not share passwords, recovery codes or email-link secrets with us in ordinary correspondence.

YouTube: a YouTube player and its API load only after you choose “Load YouTube player”. This connects to Google/YouTube, including its privacy-enhanced embed service. Playback can involve network/device information and cookies or similar storage under Google's privacy policy. Choosing “Open on YouTube” takes you to that separate service. The privacy-enhanced embed does not make playback anonymous.

Google sign-in — not currently connected: if enabled later, choosing Google sign-in will request your basic Google identifier and verified email address. It will not request your Gmail messages, contacts or Drive files. Relay will store the identifier and email needed to associate your account. A separate, short-lived sign-in cookie, __Host-ce_google, will expire after ten minutes. Matching email addresses will not silently merge accounts. Google will process the sign-in under its own privacy policy.

If Relay is served beneath a path such as /relay, it uses distinct __Secure-ce_session_<mountidentifier> and __Secure-ce_google_<mountidentifier> cookie names, with the path encoded in the identifier. These cookies are host-only, Secure and HTTP-only, scoped to the application path. The same expiry periods apply; account sessions retain SameSite=Strict and temporary Google sign-in cookies retain SameSite=Lax.

Automatic transcription and translation — not currently connected: uploaded media is not automatically sent to OpenAI's speech or translation service. If these tools open later, an authorised editor will need to confirm permission before sending selected media or transcript text for processing, and this notice will be updated with the applicable arrangements.

Payments — not currently available: the prepared membership integration uses SumUp, but checkout is disabled. No card information is requested through Relay's checkout in this state. Before payments open, we will explain the payment data, provider arrangements and membership terms.

6. How long information is kept

Retention is assessed by purpose: whether an account or publication still needs the information, whether a correction or removal request is outstanding, and whether a specific security investigation, rights dispute or legal obligation requires a record. The final review will set documented review and deletion procedures; this draft does not claim that a complete automated erasure system is in place.

Published cultural material is intended to remain available while it forms part of the service. You can request correction or withdrawal. Removing a public item, hiding a draft or disabling an account does not itself erase the underlying files or records.

Session expiry ends access rather than automatically deleting every database record. Incomplete media uploads expire after 24 hours, with staged-file cleanup triggered by later upload activity or an explicit administrator action. Active uploads and completed media are protected from expired-upload cleanup; storage failures can leave cleanup pending for a later retry. This is not a promise that all upload metadata is erased after 24 hours. Security counters, the editorial activity history and technical records also require a separate retention review.

Email-link expiry prevents further use rather than promising immediate deletion of every record. Expired link records are removed in bounded cleanup during later eligible requests. Successful use and relevant email, password, recovery or account-status changes invalidate earlier links. A resend can leave earlier unexpired links usable, with a limited number outstanding, so an interrupted request does not cancel mail already received. Provider delivery records have their own retention arrangements, which remain part of the final review.

Where a request is accepted, we will explain what can be removed or anonymised and whether a specific lawful reason requires any information to be retained. Providers may have separate retention arrangements for their own records.

7. Your rights and privacy complaints

Depending on the circumstances and applicable law, you may ask to access your personal information, correct it, erase it, restrict its use or receive a portable copy. You may also withdraw consent where processing relies on it. These rights have conditions and exceptions; an email request does not depend on an automated account-deletion button.

Your right to object: you can object to processing based on legitimate interests by explaining your particular circumstances. Contact art@curedessence.com and identify the information or material concerned.

For a data-rights request, use the subject “Privacy request”. Provide enough information to locate the account or publication, but do not send your password. We may ask for proportionate information to verify identity before disclosing or changing personal records.

For a complaint about our handling of personal information, use the subject “Privacy complaint”. We must acknowledge data-protection complaints within 30 days, investigate them and communicate the outcome without unnecessary delay. Statutory requirements for data-rights requests and complaints apply separately.

You can complain to the UK's Information Commissioner's Office. Visit ico.org.uk/make-a-complaint for the ICO's current contact and complaint routes.

8. Updates and related terms

Changes to this notice will carry an updated date. Material changes to data use will be explained before they take effect, with any required permission obtained separately. This draft will be reviewed again when the official domain or optional services are connected.

For use of Relay and submission of material, see the terms of service. Questions and correction requests can be sent to art@curedessence.com.