This policy explains what personal data Shovel collects, why we collect it, who we share it with, how long we keep it, and what you can ask us to do about it. It covers shovel.one and everything we run on it. Words defined in the Terms of Service have the same meaning here.
We collect what an account needs in order to work, whatever you choose to write, and a small amount of technical and usage data. We do not sell personal data and we do not run advertising. Analytics stays off until you accept it. And almost everything you publish on Shovel is public by design, which is the part people most often overlook, so it has a section of its own below.
Shovel is operated by the Shovel team, which decides how and why the personal data described here is used. You can reach us at privacy@shovel.one. This policy covers the Service only, not other sites you reach through links or embedded content, which have their own policies.
Account data. Your email address, a display name, and a username. If you sign in with Google, we also receive the name and profile picture on that Google account, and we store the authorization tokens Google issues so that we can confirm it is you. You may add a biography, a website, a profile picture, and a banner. We never ask for a password, because Shovel does not use them.
Sign in data. When you request a magic link we store the email address and a single use token until it is used or expires. While you are signed in we keep a session record holding the session token, its expiry, and the IP address and browser user agent the session started from.
What you create. Universes, wiki pages and their full revision history, proposals with their reviews and discussions, posts, shovels and drafts, comments, reading lists, likes, stars, votes, bookmarks, follows, join requests and the messages attached to them, and the images you upload.
Images. We store image files as you upload them. We do not strip embedded metadata, so if a photograph carries EXIF data such as GPS coordinates, camera model, or a timestamp, that data stays inside the file, and the file is served publicly. Strip metadata before uploading if you do not want to share it.
Notifications. Your notification preferences, and, if you enable browser push, a record holding the delivery address your browser gives us, the encryption keys that come with it, and the browser user agent. That record identifies a device.
Moderation records. Bans and the reasons recorded for them, decisions on join requests, ownership transfers, and a per universe log of moderation and membership actions, each noting who acted and who was affected.
What you send us. Feedback submitted through the Service, including its category and text. Feedback can be sent anonymously, and when it is we store no link to your account. Also email you send us and our replies.
Technical and usage data. If you accept analytics, the events described below. Separately, our hosting provider keeps standard server logs that include IP addresses, and we record application errors so that we can fix them.
We use personal data to:
Where the EU or UK General Data Protection Regulation applies, our legal bases are: performing our contract with you, for your account, your content, and the core of the Service; our legitimate interests in keeping the Service secure, working, and improving, weighed against your rights; your consent, for analytics and browser push, which you can withdraw at any time; and compliance with legal obligations.
Where Korean law applies, we process personal data on the basis of the agreement you give when you create an account, in order to provide the service you asked for, and to comply with law.
We do not use personal data for advertising, and we do not make decisions about you by automated means that have legal or similarly significant effects.
There are no private universes and no private pages on Shovel. The following can be read by anyone on the internet, signed in or not, and may be indexed by search engines:
Not public: your email address, which is never shown to other users; your drafts and unpublished wiki workspaces; your bookmarks; reading lists, which stay private unless you publish them; the text of a join request, which only you and that universe moderators can read; and the reason recorded for a ban, which is shown only to you and to the moderators of that universe.
We use PostHog to understand how Shovel is used. Analytics is off unless you accept it. Once you do, PostHog records page views and a defined set of product events: signing in, updating your profile, writing a comment, publishing, deleting, liking, bookmarking, linking or unlinking a shovel, marking a shovel as canon, and sending feedback. With them it collects standard technical information such as browser, device type, the page that referred you, and an approximate location worked out from your IP address.
We do not send PostHog your email address, and we do not tie analytics events to your account, with one exception: if you send feedback while signed in and do not choose to be anonymous, your user identifier is attached so that we can follow up with you.
Separately from product analytics, we record application errors, including errors on the server, so that we can diagnose failures. An error report can include a stack trace and the technical context of the failure. Server side error reporting is part of operating the Service rather than analytics, so it is not covered by the consent banner, and we keep it to what we need in order to fix problems.
Push is off until you turn it on and your browser grants permission. When you do, we store the delivery address your browser obtains from its push service, the encryption keys issued with it, and the browser user agent. This is stored per device, so enabling push on a phone does not enable it on a laptop.
Sending a notification means handing an encrypted message to the push service your browser uses, run by Google, Apple, Mozilla, or Microsoft depending on the browser. That service sees the delivery address and the timing, and can therefore tell that you use Shovel. The contents are encrypted so that only your browser can read them.
You can switch push off for individual notification types or entirely in notification settings, or withdraw the permission in your browser. Signing out removes the subscription for that device, and we delete a subscription automatically once the push service reports that the address is dead.
Shovel is used from Korea and elsewhere, and the providers above are based mostly in the United States. Your personal data therefore leaves the country you are in, including to the United States.
Our database is hosted in the United States, in Oregon. Uploaded images are stored with Cloudflare and delivered from its global network, so cached copies may sit close to whoever is reading. Application servers run in Seoul, San Francisco, and northern Virginia. Analytics data is processed in the United States.
For transfers out of the European Economic Area or the United Kingdom, we rely on the European Commission standard contractual clauses and the UK addendum in our agreements with these providers, alongside the safeguards they maintain themselves.
If you are in Korea, this section and the table above together are the notice of overseas transfer required by the Personal Information Protection Act: who receives the data, in which country, what is sent, why, and how long it is kept. The Service cannot be provided without these transfers, so if you object to them, you can ask us to close your account.
Where we have to keep something to meet a legal obligation or to resolve a dispute, we keep it for as long as that requires and no longer.
Traffic to Shovel is encrypted in transit with TLS, and so are the connections to our database. Sign in is passwordless, so there is no password of yours for us to lose. Session cookies are restricted and expire. Access to production systems is limited to the people who operate the Service. Uploads are checked for type and size, and requests are rate limited.
No service can promise perfect security and we will not pretend otherwise. If a breach affects your personal data and the law requires us to tell you, we will, without undue delay.
Wherever you live, you can ask us for a copy of your personal data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, or withdraw a consent you gave. Write to privacy@shovel.one. We answer within the time the applicable law allows, normally within thirty days, and we may need to confirm your identity first. There is no charge, and we will not treat you differently for asking.
If the EU or UK GDPR applies to you, you also have the right to data portability and the right to object to processing based on our legitimate interests, and you may complain to your national data protection authority.
If you are in California, you have the rights to know, delete, and correct personal information, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined there, so there is nothing to opt out of, and we do not offer financial incentives in exchange for data.
If you are in Korea, the Personal Information Protection Act gives you the rights to access, correct, delete, and suspend the processing of your personal data, and to be informed about overseas transfers. You may also raise a matter with the Personal Information Protection Commission, or with the privacy call center run by the Korea Internet and Security Agency on 118.
Two things we cannot undo on request: contributions released under a Creative Commons license, and shared history other people rely on. The next section explains what that means in practice.
To close your account, write to privacy@shovel.one from the address on the account. There is not yet a self service delete button in the Service, so the request is handled by hand, and we will confirm when it is done.
What we delete: your account record and email address, your profile, your sessions and sign in tokens, any Google authorization tokens we hold, your push subscriptions and notification preferences, your drafts, bookmarks, and reading lists, and the private messages you sent to universe moderators.
What stays: content you published under a universe Creative Commons license, and the wiki revision and commit history of the universes you contributed to, including the edit summaries you wrote. That is what makes collaborative work possible, because pulling one contributor out of a shared history misattributes what everyone else wrote. If you ask, we will detach your name from those records so they show a removed user instead of your username. If you own a universe, tell us whether to hand it to another member or delete it with the account.
You can delete individual posts, shovels, and comments yourself at any time, before closing your account or instead of closing it.
Shovel is not intended for children under 14 and we do not knowingly collect personal data from them. We do not ask for a date of birth, so we rely on the age requirement in the Terms of Service and on people telling us.
If you are a parent or guardian and believe your child has given us personal data, write to privacy@shovel.one and we will delete the account and the personal data attached to it.
We update this policy when what we do changes. Where a change materially affects your rights or how we use your data, we will tell you through the Service or by email before it takes effect, and we will update the effective date at the top. Smaller corrections may be made without notice, and the effective date will change for those too.
For anything in this policy, including requests to access, correct, or delete your data, write to privacy@shovel.one. For the Terms of Service, or to report content, write to legal@shovel.one. We are a small team and we read what arrives.
Questions about these documents go to legal@shovel.one. Anything about your personal data goes to privacy@shovel.one.