Privacy Policy

1. Who is responsible for this site

ShardTale is written and published by Lauren Bennett, a private individual acting in her own name. There is no company, no partnership and no editorial staff behind this address. She is the person accountable for the personal information described in this policy, in the sense given to that role by the Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, and by the Québec Act respecting the protection of personal information in the private sector (RLRQ c. P-39.1), as amended by the statute commonly known as Law 25.

• Postal address: 35 Rue Beaubien E, Montréal, QC H2S 1P7, Canada
• Telephone: +1 514-999-0795
• Written enquiries: desk@shardtale.com

The same person acts as the contact for access requests, corrections and complaints. There is no separate privacy officer, because there is no organisation to appoint one.

2. What this policy covers

This policy covers the pages published at shardtale.com and nothing else. Where a page links out to Google Play or to any other external address, that destination is governed by its own policy and is entirely outside the control of this site. Following such a link takes you to a third party and this policy stops at that point.

3. What the site does not collect

ShardTale is a reading site. It has no form of any kind: no contact form, no search box, no comment field, no sign-up, no login, no basket and no checkout. Nothing on any page asks you to type anything, and no script on any page sends information from your browser to this site or to anyone else.

• No account is created, because there are no accounts.
• No newsletter list exists, so no address is ever added to one.
• No advertising network, tag manager, pixel, heat-map tool or social widget is embedded in these pages.
• No profile is built about you, and no automated decision is taken about you.

If you choose to write to the address in section 1, you send that message from your own mail provider. In that case the operator receives whatever you put in the message — typically your address, your name if you sign it, and the contents. That correspondence is used only to answer you.

4. What is processed automatically when a page is delivered

Serving a web page cannot happen without some technical processing. Two parties are involved: the hosting provider that stores the files, and Cloudflare, Inc., the content delivery and security network placed in front of the site. Their systems handle, for each request:

• the address of the page requested and the time of the request;
• the referring address, when your browser sends one;
• the user-agent string, which describes the browser and operating system;
• the IP address of the connection, from which an approximate country is derived;
• technical delivery results such as status codes, transferred size and Core Web Vitals timings collected by the network provider.

This processing is necessary to deliver the pages, to keep the site available and to defend it against automated abuse. It is carried out in the legitimate interest of running a working website and, so far as consent is relevant under Canadian law, on the implied consent that arises when a browser requests a page. The operator does not use these records to identify individual readers and does not attempt to match them to any other source.

Cloudflare may add its own performance measurement script to the delivered page and may set strictly technical cookies of its own, such as a bot-management cookie. Those are described in the Cookie Policy. They are set by the network provider rather than by this site, and the operator has no access to any personal file assembled from them.

5. Storage on your own device

This site sets no cookies of its own. It writes exactly one entry into the session storage area of your browser, named st_banner_v1, and only after you press a button on the notice at the foot of the page. The entry records whether you chose to accept or decline that notice, so that the notice does not reappear on every page of the same visit. It contains no identifier, it never leaves your device, and your browser discards it when the tab is closed. Clearing site data removes it immediately.

6. Purposes and legal footing

The purposes are narrow and can be stated in full: delivering the requested pages; keeping the site reachable and secure; understanding, in aggregate and without identifying anyone, how quickly pages load; and answering messages sent voluntarily by e-mail. No personal information is processed for marketing, and none is sold, rented, traded or shared for anyone else's commercial purpose. Under PIPEDA the operator relies on consent implied by the act of requesting a page, together with the exceptions that permit processing strictly necessary for the delivery and security of an online service. Under Québec law the same processing is limited to what is necessary for the purposes set out here.

7. Commercial electronic messages

ShardTale sends no commercial electronic messages. There is no mailing list, no promotional message and no automated reply. The obligations of Canada's Anti-Spam Legislation (CASL), S.C. 2010, c. 23 are therefore met by the simple fact that nothing is ever sent. If you write first, the reply you receive is correspondence you requested, not marketing.

8. Transfers outside Québec and outside Canada

Both the hosting provider and Cloudflare operate distributed networks, so a request from Montréal may well be answered by a server located elsewhere in Canada, in the United States or in Europe. The limited technical records described in section 4 may therefore be processed outside Québec and outside Canada, where they can in principle be accessed by local authorities under local law. Before entrusting delivery to these providers the operator assessed the arrangement as required by Québec law, and relies on the providers' written data-processing commitments, on the fact that no name, address, telephone number or account of any reader is transmitted by these pages, and on the short retention periods set out below.

9. How long records are kept

• Hosting access logs: retained by the provider for a short operational period, ordinarily not more than thirty days, then overwritten.
• Cloudflare security and delivery records: retained by that provider under its own schedule, which for standard service is measured in days rather than months.
• E-mail correspondence: kept for as long as needed to deal with the matter and, where a complaint or a rights request is involved, for two years afterwards so that the handling can be evidenced.
• The st_banner_v1 entry: held on your device only until the browser tab is closed.

10. Your rights

Under PIPEDA and under Québec law you may ask what personal information about you is held, ask for a copy of it, ask for it to be corrected if it is inaccurate or incomplete, and revoke a consent you previously gave. Québec law also gives a right to ask that information be de-indexed or ceased to be circulated in the circumstances the statute describes. Because this site collects no identifying information through its pages, a request will usually concern e-mail correspondence you have sent, and it will be answered within thirty days of receipt.

Write to the address in section 1. Please describe what you are asking for clearly enough that the correspondence can be located. Identity is verified only to the extent needed, normally by replying from the same address you originally wrote from.

11. Complaints

If the answer does not satisfy you, two independent authorities can be approached:

• Office of the Privacy Commissioner of Canada (OPC), 30 Victoria Street, Gatineau, QC K1A 1H3, priv.gc.ca
• Commission d'accès à l'information du Québec (CAI), the provincial authority for private-sector personal information in Québec

Neither route requires a lawyer, and neither is affected by anything said elsewhere on this site.

12. Readers under sixteen

The site is written for adults and is not directed at children. The pages are not intended for readers under the age of sixteen, and no one under that age should send correspondence to the address in section 1 without the agreement of a parent or guardian. If it emerges that a message came from a younger reader, it will be deleted once the matter it raises has been dealt with.

13. Security

Pages are served over an encrypted connection. The site is a set of static files with no database, no administration panel exposed to the public and no server-side processing of reader input, which removes most of the ways a site of this kind is usually compromised. Access to the publishing account is protected by a unique password and a second factor. No arrangement is perfect, and no promise of absolute security is made here.

14. Changes to this policy

If practice changes — a different host, a different network provider, a new feature — this page is rewritten before the change goes live, and the date at the top is moved forward. There is no archive of earlier versions and no notification list; the version you are reading is the one in force.

15. Contact

Questions about this policy go to desk@shardtale.com, or to the postal address in section 1. The related documents are the Terms of Use and the Cookie Policy.