Privacy policy

Last updated: 2026-09-24

Kontrastas stores only the data needed to operate the publication: petition signatures, comments, reader accounts, and (if you pay for closed material) a Stripe payment record. We do not sell your data and use privacy-friendly analytics only.

Data controller

Kontrastas editorial team, Vilnius, Lithuania. Contact: kontaktas@infokontrastas.lt.

Data we collect

• Petition signatures: full name, email, optional city, hashed IP address for deduplication.
• Reader accounts: email (via Supabase Auth), display name, your comments.
• Donations: amount, Stripe session ID, donor email if shared by Stripe.
• Analytics: aggregate page-view counts via GoatCounter. No cookies, no cross-site tracking. IP addresses are not stored — only a temporary anonymized hash for counting unique visitors.

Legal basis

GDPR Art. 6(1)(a) — consent (comments), (b) — contract (payments), (f) — legitimate interest (fraud prevention, petition integrity).

How long we keep it

• Petition signatures — for the lifetime of the petition + 1 year.
• Comments — for the lifetime of your account.
• Donation records — 7 years (accounting requirement).

Third parties

• Supabase (EU-hosted Postgres)
• Stripe (payments)
• GoatCounter (hosted analytics, cookieless)
• Vercel (hosting) and our own image server (Oracle Cloud)
• Mailjet (newsletters and email delivery) — you receive email only if you subscribed, and every email carries an unsubscribe link.
• images.weserv.nl (image-resizing proxy) — your browser fetches page images from it directly, so it sees your IP address and the image URL.
• Meta / Facebook — embedded video players on some articles. They load only when you open a page that contains one; Meta then receives your IP address, the page URL, and, if you are logged in to Facebook, your Facebook cookies.

Your rights

Under GDPR you can access, correct, delete, or export your data, and lodge a complaint with the Lithuanian State Data Protection Inspectorate. Email kontaktas@infokontrastas.lt.