Privacy Policy
This Policy applies to everyone who visits needmoretruth.com (the "site") or writes to the person who runs it (the "Operator").
Last updated: 2026-10-17 · Version: 2026-10-17-v32
Your right to object
Where the Operator relies on legitimate interests (Section 2), you may object at any time, on grounds relating to your particular situation, by writing to [email protected]. The Operator then stops that processing, unless the Operator has compelling legitimate grounds that override your interests, rights and freedoms, or needs the data for a legal claim.
1. Who is responsible, and how to reach the Operator
The Operator is the controller (개인정보처리자 under the Republic of Korea Personal Information Protection Act, "PIPA") and the person responsible for personal-data protection under PIPA Article 31. The Operator is one person and runs the site from the Republic of Korea. Contact: [email protected], in English or Korean. Mail to [email protected], the address on the site's profile, reaches the same mailbox.
2. What the site handles, and why
Visiting. Each request carries your IP address, the page address and technical details such as the browser type. Cloudflare handles each request to deliver and protect the site. It also counts visits without cookies, by measures such as page, referring site, browser and country. The server counts requests from one connection for about a minute, using a value computed from the IP address with a key that is replaced every day. It does not store the IP address. Email. If you write to either address, the Operator receives your email address, the name you use, your message and its mail headers, in order to read and answer it. Sign-in. If anyone other than the Operator tries to sign in through GitHub, GitHub sends the site the profile of that account. The site checks the username, refuses the sign-in and stores nothing. Former members. Until 17 October 2026 the site ran a community with member accounts. Its member data was deleted from the live site that day. Backups made before then are kept to restore the site after a failure, and records of actions taken with its administration tools are kept so that those actions can be checked later. Section 5 says for how long. Bases. Where the GDPR applies, each case rests on the Operator's legitimate interests (GDPR Article 6(1)(f)): delivering and securing the site and knowing how it is used, answering mail, restoring the site after a failure, and being able to check what was done with its administration tools. Nothing is required of you beyond what a browser sends to load a page.
4. Providers and transfers abroad
The Operator entrusts the work below to three providers outside the Republic of Korea. This is entrustment under PIPA Article 26 and transfer abroad under PIPA Article 28-8. Server. OVH Hosting Inc., 1801 McGill College Avenue, Suite 800, Montréal, Quebec H3A 2N4, Canada ([email protected]). Work: hosting the site and its backups. Country: Canada, at OVH's data centre in Beauharnois, Quebec. What and how: the request data in Section 2, over an encrypted connection as each request arrives, and the backups. Period: as Section 5 sets out. Network edge and off-site backup. Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, United States ([email protected]). Work: DNS, HTTPS, the tunnel to the server, protection against attacks, the visit statistics and the off-site backup. Country: each request passes through the Cloudflare data centre nearest the visitor, in any country where Cloudflare operates. The backup is set to be stored in the Asia-Pacific region, which Cloudflare does not guarantee, so the Operator cannot tell which country holds a copy. What and how: the request data with each request, over an encrypted connection, and the site's daily backup bundle, encrypted before it leaves the server. Period: request data for as long as Cloudflare's own rules keep it; backup copies as Section 5 sets out. Mail. Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland. Work: holding the Operator's mailbox. Country: Switzerland, Germany or Norway, where Proton states its servers are. What and how: the email you send, when you send it. Period: as Section 5 sets out. Basis. In the Republic of Korea, these transfers rest on PIPA Article 28-8(1)(iii)(a): they are the entrustment and storage needed to provide the site and to answer your mail, and their details are set out above. For the EU/EEA and the UK, Canada and Switzerland have adequacy decisions, Germany and Norway are in the EEA, and for Cloudflare the safeguard is the Standard Contractual Clauses in the data processing addendum that Cloudflare publishes. To refuse these transfers, do not visit the site and do not send mail. The site cannot be delivered without them. Apart from these providers, the Operator gives personal data to nobody unless a law that binds the Operator requires it.
5. How long it is kept, and how it is destroyed
Visits. The server keeps no record of individual visits. A request count is deleted after about a minute. Email. Kept until the exchange is finished and no longer needed, and deleted earlier if you ask. Former member and community data. On 17 October 2026 every member account and everything tied to one (profiles, posts, comments, messages, reports, support tickets, Archive deposits and their files, consent and moderation records) was deleted from the live database and the server's disk. Copies remain in backups made before that day. The last of those on the server's disk goes about three months later, and each off-site copy goes 91 days after it is written. Until then a backup is used only to restore the site, and member data restored from it is deleted again. A backup cannot be edited to remove one person, so a request to delete data held in a backup is met when that backup expires. Administration records. Records of actions taken with the site's administration and moderation tools in the year before 17 October 2026 (who acted, when, from which daily connection value, on what, and what was done) are kept apart from other data until 17 October 2027 and then deleted. Destruction. Data whose period has passed, or whose purpose has ended, is deleted without delay so that it cannot be recovered. Data in a backup is deleted when the backup expires.
6. Your rights, and how to use them
You may ask the Operator to show you the personal data the Operator holds about you, to correct or delete it, or to stop or restrict processing it. You may also object, as set out at the top of this Policy. A legal representative may make the same requests for a child under fourteen. Write to [email protected]. If a request is refused, you are told why, and you may contest the refusal by writing again. You may also complain to the data-protection authority where you live. In the Republic of Korea, that is the Personal Information Protection Commission.
7. Security
Pages are served only over HTTPS. The site reaches the server through an encrypted tunnel instead of an open port. Only the Operator's GitHub account can sign in. The application reaches the database with an account that can read and write data and do nothing else. Containers cannot raise their own privileges. Off-site backup copies are encrypted before they leave the server, and the newest backup is restored in an automated test every week.