Privacy Policy

1. What we collect, and why

When you just browse

Like every website, ours receives some technical information from your browser when a page loads: your IP address, browser and device type, the page you asked for, the page that sent you here, and the time. Our host (WordPress.com) keeps this in server logs to run and protect the site. Jetpack’s login protection and the Akismet spam filter use IP addresses to block attacks and spam.

If your cookie choices allow analytics, Google Analytics (loaded through Google Tag Manager) and Jetpack Stats also record which pages you view, roughly where you are (city or region level, worked out from your IP address), your device type, how you got here, and clicks on the “Buy on Amazon” buttons. We look at these numbers as totals, such as which reviews are popular or which shelves people browse, never to identify you.

If you join the Common Room

• Account details: your email address (to log in and for the emails you choose to get), a public nickname, and your password, which is stored securely using a cryptographic hash, so nobody, including us, can read it.
• Age: you give your date of birth when you join. We use it once, to check that you are at least 13 and whether you are 18 or older, and keep only the result: “18 or older,” or, for members under 18, the month they turn 18. When that month arrives, the 18+ After Dark board opens for them and the month is deleted. The date itself is not stored, and moderators only ever see “18 or older” or “under 18.” If you entered the wrong date, email us and we will correct it.
• What you post: threads, replies and reports. Posts are public (except the After Dark board, which only adult members can see) and show your nickname.
• Internet address: the IP address you signed up from and that each post came from, used to stop spam, ban evasion and abuse. It is deleted after 90 days.
• Your settings: your email notification choices and whether you ticked the box to get Cece’s newsletter.

New posts are checked by Akismet, an anti-spam service run by Automattic, which receives the post text, your nickname, email and IP address for that check.

If you comment on a review

The comment form asks for your name, email and an optional website, and stores them with your comment, your IP address (deleted after 90 days) and browser details. Your email is never shown publicly. Comments are checked by Akismet. Your name and comment are public. If you ask, the form can remember your details in your browser for next time, and you can choose to sign in with a WordPress.com account or get emails about new comments or posts through WordPress.com’s subscription service. Comment pictures come from Gravatar, which works by looking up a hashed version of your email address.

If you use one of the forms

• Contact form: your name, email and message.
• Author and beta reading submissions: your first and last name, email, book title, format, genre, summary, deadline and a link to the book, plus anything you choose to send Cece afterwards, such as an advance copy or a manuscript.
• Mailing list: your email address.

Form entries are saved in the site’s database and emailed to Cece so she can answer. Manuscripts and advance copies are treated as confidential: they are read only by Cece (and, where needed, the one other person who helps her run the site), never shared, and deleted when you ask or when we no longer need them.

Amazon links and the shop

Book buttons and shop pages link to Amazon with our affiliate tag. When you click one, you leave our site and Amazon’s own privacy notice applies. Amazon may place cookies on your device to know the visit came from us, and it tells us totals (for example, that something sold), never who bought it. We do not get your name, address or anything you bought. If analytics is allowed, we also count that an Amazon button was clicked.

Embedded content and pictures from other sites

Some pages show things from other services: an Instagram feed on the homepage, Goodreads widgets on the About page, GIFs from Giphy inside reviews, reviewer badges from NetGalley and BookSirens, and images served through WordPress.com’s image network. The Instagram and Goodreads pieces only load if your cookie choices allow embeds (or you click to load one). When any of these load, that company receives your IP address and the page you were on, and the Instagram and Goodreads pieces may set their own cookies.

Likes and sharing buttons

Reviews have Like and Share buttons provided by Jetpack. Liking a post requires a WordPress.com account and is handled by WordPress.com. Share buttons only send the page link to the service you pick.

2. Cookies and similar tech

Cookies are small files a site stores in your browser. We use a few that the site cannot work without, like keeping you logged in and remembering your cookie choices, and optional ones for analytics and embeds. The full list, with names and how long each lasts, is in the Cookie Policy.

The banner you see on your first visit lets you accept, reject or choose. You can reopen it any time:

Open cookie settingsUse the “Cookie settings” link at the bottom of every page.

If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of advertising cookies and of any selling or sharing of your information, and we apply it automatically.

3. How we use it

• To run the site and the Common Room: logging you in, showing your posts, sending the emails you asked for, and keeping under-13s out and the 18+ board for adults only.
• To moderate: reviewing reports, removing posts that break the house rules, and stopping spam, abuse and ban evasion.
• To answer you: replying to messages, considering book and beta reading requests, and keeping a record of what was agreed.
• To send the newsletter, only if you opted in. Every email will have an unsubscribe link.
• To understand what readers like and improve the site, using analytics totals.
• To keep the site secure and to meet legal obligations, such as answering a valid legal request or a copyright complaint.

We do not use your information for automated decisions that have legal or similarly significant effects on you, and we do not build advertising profiles.

4. Legal bases (if you are in Europe or the UK)

Where the EU or UK GDPR applies, these are the legal bases we rely on for each thing we do:

Our legitimate interests are protecting the site and its members from attacks, spam and abuse; keeping community discussions readable and usable; and answering the people who write to us. You can object to any processing based on legitimate interests (see section 8). Where we rely on consent, you can withdraw it at any time, which does not affect what happened before.

Separately from these legal bases, EU and UK rules on cookies require your consent before optional cookies and similar technology are used on your device. That is what the cookie settings record.

5. Who helps run the site

We share information only with the services that make the site work, and only what they need. They are:

If we start using an email newsletter service, we will name it here before your email address goes to it. We may also disclose information if the law requires it, to protect someone’s safety, to deal with fraud or abuse, or, if the site or business ever changes hands, to the new owner, who would have to honor this policy.

6. Selling, sharing and ads

We do not sell personal information, and we have not sold any in the past 12 months. We do not share it for cross-context behavioral advertising (the ads that follow you from site to site), and the site shows no ads.

If we ever add advertising tags, for example to measure a Google Ads campaign, they will sit under the “Advertising” switch in cookie settings, stay off in Europe, the UK and Canada until you agree, and stay off for anyone whose browser sends a Global Privacy Control signal. We will update this policy first.

7. How long we keep things

• Common Room accounts: until you close your account. Closing it removes your email, nickname, age status, sign-up details and settings from the site straight away. Posts stay up under “Former member” so threads still make sense; email us if you want your posts removed too. Sign-ups that are never confirmed are deleted after 48 hours.
• Posts and comments: as long as they are published. Spam is deleted.
• Internet addresses stored with posts, comments and Common Room sign-ups: 90 days, then deleted automatically.
• Form entries and emails: as long as we need them to answer you or work with you. We review and clear out old entries at least once a year.
• Mailing list: until you unsubscribe or ask us to remove you.
• Google Analytics: event data is kept for 14 months, then deleted by Google.
• Server and security logs: for the periods set by WordPress.com and Automattic, generally a few weeks to a few months.

“Deleted” above means removed from the live site and our records. Copies can remain for a limited time in our hosting provider’s backups and logs until they are overwritten. Where it is needed to stop abuse, we may also keep a minimal record, such as the fact that an account was banned, for as long as that need lasts.

8. Your choices and rights

Depending on the law where you live, you may have the right to ask us to:

• tell you what personal information we have about you and give you a copy;
• correct anything that is wrong;
• delete your information (we may keep a little where the law requires it or to stop repeat abuse);
• restrict (pause) how we use it while a concern is sorted out;
• stop using it for a particular purpose, or stop sending you email.

Whatever the law where you live, we will do our best to honor requests to see, correct or delete your information; some of the rights above apply only where the law gives them. Email cecerants@gmail.com with your request. We aim to reply within 30 days. If a request is complex and the law allows more time, we will tell you within those 30 days that we need it, and why. To protect you, we may ask you to confirm the request from the email address we have on file. You will not be treated differently for using these rights. You can also let someone you authorize make a request for you; we will check that they really act for you.

Members can change their nickname and email settings, and close their account, from their Common Room account page. Anyone can change cookie choices in cookie settings.

Europe and the UK

You also have the right to data portability, to object to processing based on legitimate interests, and to complain to your local data protection authority. We would appreciate the chance to sort it out with you first.

US states with privacy laws

Residents of California, Colorado, Connecticut, Virginia, Oregon, Texas and other states with consumer privacy laws have rights to know, access, correct, delete and opt out of selling, sharing or targeted advertising. We honor those requests whether or not a particular law applies to a site our size. Because we do not sell or share personal information, there is nothing to opt out of today, and Global Privacy Control signals are honored automatically. If we deny a request, you can appeal by replying to our answer; we will respond within 45 days.

Do Not Track

Browsers’ older “Do Not Track” setting has no agreed meaning, so we do not respond to it. We do honor Global Privacy Control, as described above.

9. Kids, teens and the 18+ sections

This site is not meant for children under 13, and we do not knowingly collect personal information from them. The Common Room refuses sign-ups from anyone who gives a date of birth under 13. If you believe a child under 13 has given us information, email us and we will delete it.

Many reviews discuss adult content. Your Kink, Your Kindle and the After Dark board are for adults only: Your Kink, Your Kindle asks visitors to confirm they are 18 or older, and After Dark is visible only to members whose age check at sign-up showed they are 18 or older, or whose 18th-birthday month has since arrived. Members aged 13 to 17 can use the all-ages boards.

10. Security

The site runs on WordPress.com with encrypted connections (HTTPS), passwords stored as cryptographic hashes, login protection, spam filtering and a small number of people with admin access. No website is perfectly secure, so please use a password you do not use anywhere else. If we learn of a breach that affects your information, we will tell you as the law requires.

11. Where your data lives

We are based in the United States, and so are the services that run the site, so information about visitors from outside the US is processed there. For visitors from the EU, the UK and Switzerland, these safeguards apply:

• Google (Analytics, Tag Manager, Search Console, Fonts), Amazon (Associates) and Meta (Instagram) are certified under the EU-U.S. Data Privacy Framework. You can check each certification on the Data Privacy Framework list.
• Automattic (WordPress.com, Jetpack, Akismet, Gravatar) describes the safeguards it uses for international transfers in its privacy policy.
• Goodreads, Giphy, NetGalley and BookSirens only receive what your browser sends them directly when their content loads (Goodreads only if you allow embeds). Their own privacy policies cover that.

Email us if you would like more detail on any of these safeguards or a copy of the relevant terms.

12. Changes to this policy

If we change this policy, we will update the date at the top. If a change matters, such as using your information in a new way, we will put a notice on the site and, for members, send an email, and we will ask for your consent again where the law requires it.