Privacy notice

What Dog Ears collects, why, who else handles it, how long it is kept, and what you can ask for. Plain language, and specific to how this site actually works.

Last updated: 14 October 2026

1. WHO IS RESPONSIBLE

Dog Ears is run by Joos Vollebregt, in Belgium, who is the controller of the personal data described here. For anything in this notice, write to admin@dog-ears.com, or use the contact form.

2. WHAT WE COLLECT, AND WHY

If you apply for membership

Your name, email address, what you intend to use Dog Ears for, an optional affiliation and note, and whether you might support the project. We use it to decide on your application and to tell you the outcome. Basis: steps you asked us to take before membership (GDPR Art. 6(1)(b)). Please don't include sensitive details (health, beliefs and the like) — they aren't needed.

If you become a member

Your email address and password (the password is stored only as a hash, by Supabase).
Your display name. It is shown publicly — to anyone, signed in or not — on every quote you contribute. A pen name is fine; ask us if you want it changed.
Your collection: the quotes you collect and like, your categories, private notes, and exercise answers. Only you can see these.
The quotes you contribute, and your display settings.

Basis: providing the service you signed up for (Art. 6(1)(b)).

If you write to us

Your name, email address, the reason and your message (and, for a quote report, which quote). For a "close my account" request sent while signed in, also your account's id, so we delete the right account. Basis: answering you (Art. 6(1)(b)/(f)).

To keep the site safe and working

Spam protection: Cloudflare Turnstile checks that a person is filling in the sign-in, sign-up, password-reset and contact forms. It processes your IP address and browser signals.
Rate limits: to stop abuse of those forms we keep a keyed hash (never the address itself) of your IP address and of the email address typed in, for at most about ten hours.
Logs: our hosting and database providers keep short-lived technical logs, and we log errors, which can include an email address.
Admin record: consequential admin actions (approving, rejecting, granting or revoking access, closing an account, renaming) are logged with the email address they concerned.

Basis: our legitimate interest in a secure, working site (Art. 6(1)(f)).

We don't sell your data, show ads, use third-party analytics or tracking cookies, or send marketing email.

3. COOKIES AND BROWSER STORAGE

Nothing here tracks you. All of it is either needed to keep you signed in or remembers a choice you made.

Sign-in cookies (Supabase) — keep you signed in.
dogears_last_active — a timestamp used to sign you out after two hours of inactivity.
Local storage — your theme, sort and display choices, reading speed, and unsaved drafts of a quote you are adding. Drafts and account-specific settings are cleared when you sign out.

4. WHO ELSE HANDLES IT

These services process personal data for us:

Supabase (USA) — the database and sign-in system. Everything above is stored on its servers in London, United Kingdom.
Vercel (USA) — hosts the site; the code that handles your requests runs in London.
Cloudflare (USA) — Turnstile spam protection.
Resend (USA) — sends our emails, from its EU region.
Porkbun (USA) — forwards mail sent to admin@dog-ears.com.
Google (USA) — the operator's Gmail mailbox, where notifications of new applications, messages and sign-ups arrive.

The United Kingdom, where the database and the site's code run, is recognised by the European Commission as protecting personal data adequately. Where a service is based in the USA, the transfer relies on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. Nobody else receives your data, except where the law requires it.

5. HOW LONG WE KEEP IT

Applications: while you are a member. A rejected, withdrawn or never-used application is deleted automatically after 12 months, as is an approval that was never used to sign up.
Messages to us: deleted automatically once they are 12 months old and we have dealt with them.
Your account: until you close it. Closing it deletes your profile, collection, notes, likes, application and messages. Quotes you contributed stay in the database — they are published works, not your personal data — but your name is removed from them and replaced by "A former member".
Admin record: the email address in an entry is replaced by a one-way hash after 24 months.
Rate-limit records: about ten hours.
Backups and providers' logs: for the limited periods those services keep them, after which deleted data is gone from them too.

6. YOUR RIGHTS

You can ask us to:

See and take your data. Members can download it all as one file here:

Correct it — including your display name or email address.
Delete it. Members: choose "Close my account" on the contact form. Applicants and anyone who wrote to us can ask the same way.
Restrict or object to how we use it.

We may ask you to confirm it's really you, usually by replying from the address we hold. We answer within one month. If you're unhappy with how we handle your data, you can complain to the Belgian Data Protection Authority, Gegevensbeschermingsautoriteit, or the authority where you live.

7. SECURITY

Connections are encrypted (HTTPS). Database rules let each member reach only their own private data; admin access needs a second factor; forms are protected against bots and floods. If a breach puts your data at risk, we report it to the Belgian Data Protection Authority within 72 hours where the law requires it, and tell you directly, without undue delay, when the risk to you is high.

8. CHILDREN

Dog Ears is not meant for anyone under 16, and we don't knowingly accept applications from them.

9. CHANGES

When this notice changes, the date at the top changes with it. If a change matters to how your data is used, we'll tell members by email.