Effective date: 1 August 2026

This Privacy Policy explains how Kiri Kiri Basara (“KKB”, “we”, “us” or “our”) collects, uses, stores and shares personal data when you visit kirikiribasara.com, create or use a KKB Community account, post comments, or otherwise interact with the website.

1. Scope of this policy

This policy applies to personal data processed through the KKB website and KKB Community. It does not apply to third-party websites that you reach through external links. Those services operate under their own privacy notices.

KKB Community allows registered users to create an account, verify their email address, sign in, upload an avatar, post comments and replies, identify spoilers, receive public Staff or Patreon Supporter badges where applicable, reset their password and delete their account.

2. Personal data we collect

When you access the website, our server, hosting provider, security tools, content-delivery or caching services, and consented analytics services may process technical and usage information, including:

your IP address and approximate location derived from it;
browser type, browser version, operating system and device information;
the page or file requested, the referring page, and the date and time of the request;
server response information, diagnostic data and security events; and
interaction and analytics information where you have consented to analytics technologies.

2.2 Account registration and account management

When you register for KKB Community, we collect your chosen username, email address and password. Your username is used as your public display name. Your email address is used for account administration, verification, security messages, password reset and Patreon supporter matching. Your email address is not intentionally displayed publicly.

Passwords are processed by WordPress and stored as password hashes. We do not intentionally store or log your password in readable form. We also process account role, registration time, verification status, verification-token metadata, login/session information and limited security diagnostics.

2.3 Public profiles and avatars

Your username, avatar and any public badge attached to your account may be displayed beside your comments. If you upload an avatar, the image is stored as a WordPress media file and is publicly accessible wherever it is shown. Replacing or removing your custom avatar deletes the previous custom avatar associated with your account.

2.4 Comments, replies and moderation

When you post a comment or reply, we process the comment text, the related article, date and time, reply relationship, spoiler status, moderation status and your account association. WordPress also records technical comment metadata, which may include your IP address and browser user-agent.

The following information may be visible publicly:

your username or display name;
your avatar;
a Staff or Patreon Supporter badge, where applicable;
the text of your comment or reply;
the date and time of posting;
the relationship between comments and replies; and
whether the comment was marked as containing spoilers.

A spoiler label only hides the comment in the public interface until a reader chooses to reveal it. It does not encrypt the comment or prevent authorized administrators from accessing it.

2.5 Patreon supporter information

KKB synchronizes information from the KKB Patreon campaign to recognize active paid supporters. The Patreon API may provide us with a supporter’s full name, email address, supporter status and current entitled amount.

For account badge matching, Patreon email addresses are normalized and converted into keyed cryptographic hashes. We store and compare these hashes rather than storing raw Patreon email addresses in the badge list. These hashes are pseudonymous personal data because they can still be matched against a known account email address.

Where a KKB Community account email matches an active paid Patreon membership, a public “Patreon Supporter” badge may appear beside that user’s comments. Staff badges take priority where both apply. This badge publicly reveals that the account is recognized as an active paid supporter.

We also publish the names supplied by Patreon for active paid supporters in the supporter strip shown on the website. The entitled amount is used to order supporter names but is not intentionally published in that strip. Supporters may request removal of their public name or badge by contacting us at [email protected].

2.6 Messages sent to us

If you contact us, we process the information you provide, such as your name, email address, message content and any information necessary to respond to or resolve your request.

3. How and why we use personal data

We process personal data for the following purposes and legal bases:

Purpose	Legal basis
Operate the website and provide requested pages and features	Our legitimate interests in operating a reliable website and, where applicable, performance of the service requested by you.
Create and administer KKB Community accounts, verify email addresses, authenticate users and reset passwords	Performance of our Community service and steps taken at your request before providing it.
Publish and manage comments, replies, avatars and public account information	Performance of the Community service requested by you and our legitimate interests in maintaining coherent discussions.
Moderate comments, prevent abuse, protect accounts, investigate incidents and maintain security logs	Our legitimate interests in protecting KKB, its users and the integrity of the website.
Match Patreon supporter accounts, display Patreon badges and recognize supporters publicly	Performance of supporter benefits and our legitimate interests in recognizing supporters, balanced against your right to opt out of public recognition.
Send email verification and password-reset messages	Performance of the requested account service and our legitimate interests in account security.
Measure traffic and understand how visitors use the website through Google Analytics and Microsoft Clarity	Your consent, where consent is required for analytics cookies or similar technologies.
Comply with legal obligations and establish, exercise or defend legal claims	Compliance with a legal obligation and/or our legitimate interests in protecting our legal rights.

Where we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against your rights and reasonable expectations.

4. Cookies and similar technologies

The website uses cookies and similar technologies. Some are essential for the website and KKB Community to work, while others are used only for analytics after consent where required.

4.1 Essential technologies

Essential technologies may be used for WordPress login and session management, “Remember me”, account security, cookie-consent choices, load balancing, caching and fraud or abuse prevention. Refusing these technologies may prevent account login or other requested features from working correctly.

4.2 Analytics consent

Google Analytics and Microsoft Clarity are treated as non-essential analytics services. Where required by law, they are enabled only after you provide consent through our cookie settings tool. You may withdraw or change your consent at any time through the cookie settings available on the website. Withdrawal does not affect processing that occurred before consent was withdrawn.

5. Google Analytics

We use Google Analytics to understand website traffic and usage patterns. Depending on our configuration and your consent, Google Analytics may process information such as page views, session statistics, approximate location, browser and device information, referral information, interactions and pseudonymous identifiers stored in cookies or similar technologies.

We do not intentionally send your KKB account password or the content of private account-management fields to Google Analytics. Google processes Analytics data under its own terms and privacy information. User-level and event-level Analytics data is retained according to the retention setting configured for our Analytics property; aggregated reports may remain available for longer.

More information: Google Privacy Policy and Google Analytics data safeguards

6. Microsoft Clarity

We use Microsoft Clarity to understand how visitors interact with the website and to identify usability or technical problems. Clarity may collect page-rendering information and interaction events such as mouse movements, clicks, scrolling, navigation, selections, window resizing and related diagnostic or performance information. Session recordings are reconstructed from page and interaction data; they are not conventional video recordings.

Clarity uses pseudonymous identifiers and may use first-party and third-party cookies when consent is granted. Sensitive content and input fields are masked in accordance with Clarity’s masking controls, although masking settings must be maintained correctly by us.

Microsoft states that Clarity playback data is generally retained for 30 days, while click/heatmap data and sessions that are labeled or favorited may be retained for up to 9 months.

More information: Microsoft Clarity privacy FAQ, Clarity data collection and Microsoft Privacy Statement

7. Security and anti-abuse services

7.1 Cloudflare Turnstile

We use Cloudflare Turnstile on registration, sign-in, verification-resend and password-reset request forms to distinguish legitimate users from automated abuse. Your browser loads the Turnstile component from Cloudflare. The resulting token and your remote IP address are sent to Cloudflare for validation, together with browser or environment signals used to assess whether the request appears automated.

We store only limited sanitized failure information for troubleshooting and do not intentionally retain the submitted Turnstile token in our local diagnostic records.

More information: Cloudflare Turnstile documentation and Cloudflare Privacy Policy

7.2 Wordfence and website security

We use Wordfence and related WordPress security controls to protect the website, accounts and administrative access. Depending on configuration, these tools may process IP addresses, request paths, login attempts, user identifiers, roles, timestamps and security-event information. Administrators may be required to complete multi-factor authentication through Wordfence.

8. Email verification and account messages

We send operational emails for email-address verification and password reset. These messages may contain your email address, username, the purpose of the message and a single-use security link. They are not marketing emails.

Verification links are valid for 24 hours. We store a cryptographic hash of the verification token rather than the raw token. After successful verification, the temporary token metadata is deleted. Pending unverified accounts remain until they are verified, deleted by an administrator or removed during an account review.

Emails are sent through WordPress and our hosting or email-delivery provider, which may process recipient addresses, message content, sending times, delivery status and technical logs as necessary to deliver and secure the service.

9. Who receives personal data

Personal data may be accessed or processed by:

authorized KKB administrators, editors and moderators who need access for account administration, moderation, security or support;
our website hosting, database, caching, content-delivery, backup and email-delivery providers;
Defiant/Wordfence for website and login security;
Cloudflare for Turnstile and related delivery or security services;
Patreon for supporter synchronization and the maintenance of the underlying Patreon membership;
Google for Google Analytics, where you have provided the required consent;
Microsoft for Microsoft Clarity, where you have provided the required consent;
professional advisers, public authorities or other parties where disclosure is required by law or necessary to protect legal rights.

We do not sell your personal data. Service providers receive only the data reasonably necessary for their role, subject to their applicable contracts, privacy terms and legal obligations.

10. International transfers

Some service providers may process personal data outside the European Economic Area. Where such transfers are subject to the GDPR, they are handled using an applicable legal safeguard, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism. Provider-specific details are available in the privacy information linked in this policy.

11. How long we keep personal data

We keep personal data only for as long as necessary for the purpose for which it was collected, subject to legal, security and operational requirements. The main retention criteria are:

Data category	Retention period or criterion
Verified Community account	Until you delete the account, an administrator deletes it, or it is no longer reasonably necessary to provide the Community service.
Pending unverified account	Until verified, manually deleted or removed during an account review. The verification link itself expires after 24 hours.
Verification token metadata	Deleted after successful verification; otherwise retained with the pending account until that account is removed.
Comments and replies	Generally retained for the life of the relevant article or discussion, including after account deletion, unless removed through moderation or following a valid request.
Comment IP address and browser user-agent	Retained with the comment for security, moderation and abuse-prevention purposes unless separately erased or the comment is deleted.
Custom avatar	Until replaced, removed or the associated account is deleted.
Patreon badge-match hashes and supporter names	Updated during successful Patreon synchronization. Removal following cancellation depends on the next successful synchronization or a manual removal request.
Security and diagnostic logs	For as long as reasonably necessary to investigate incidents, prevent abuse and maintain the website, according to our and our providers’ configured schedules.
Google Analytics	According to the retention setting configured in our Analytics property; aggregated reports may remain longer.
Microsoft Clarity	Generally 30 days for playback data and up to 9 months for click/heatmap data and labeled or favorited sessions.
Emails and delivery logs	For as long as necessary to deliver the message, troubleshoot delivery and protect account security, according to the relevant provider’s retention schedule.
Backups	Until the backup is overwritten or expires under our normal backup cycle. Backups are not normally edited individually when a live account is deleted.

12. Account deletion and retained comments

Ordinary Community users can delete their account after confirming their password. When an account is deleted, the WordPress account, associated user metadata and custom avatar are deleted, and authentication cookies are cleared.

Existing comments are generally retained to preserve the continuity of discussions. The public author name is changed to “Deleted user”, the comment email and URL fields are cleared, and the comment is detached from the deleted WordPress account.

Technical metadata attached to retained comments, including the original IP address and browser user-agent, may remain in the database until it is separately erased or the comment is deleted. Account deletion therefore does not necessarily remove every item of personal data connected with a past comment. You may contact us to request review or erasure of retained data, subject to applicable legal exceptions.

Older copies may also remain temporarily in backups until those backups expire through the normal backup cycle.

13. Your data-protection rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

request access to personal data we hold about you;
request correction of inaccurate or incomplete data;
request deletion of personal data;
request restriction of processing;
receive certain data in a portable format;
object to processing based on legitimate interests;
withdraw consent at any time where processing is based on consent; and
lodge a complaint with a competent data-protection authority.

To exercise these rights, contact [email protected]. We may need to verify your identity proportionately before acting on a request. We normally respond within the period required by applicable law.

The Czech supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic.

Supervisory authority contact information: Office for Personal Data Protection

14. Whether providing data is required

You must provide a username, email address and password to create a KKB Community account. Without this information, we cannot create or secure the account. Posting comments, uploading an avatar and connecting the same email address to an active Patreon membership are optional.

15. Children’s privacy

The website and KKB Community are not directed to anyone under the age of 18. We do not knowingly create Community accounts for or collect personal data from children under 18. If you believe that a child has provided personal data to us, contact [email protected] so that we can review and, where appropriate, remove it.

16. Automated decision-making

We do not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects. Security tools such as Cloudflare Turnstile may automatically assess whether a request appears automated or abusive, but this is used only to protect forms and accounts.

17. Security

We use reasonable technical and organizational measures to protect personal data, including password hashing, email verification, access controls, security monitoring, multi-factor authentication for administrators, cryptographic token handling and bot protection. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

18. External links and embedded content

Articles may contain links to or embedded content from third-party websites, including video and social-media services. When you activate or visit third-party content, that provider may receive your IP address, browser information, cookies or account identifiers under its own privacy terms. We are not responsible for third-party privacy practices.

19. Changes to this policy

We may update this Privacy Policy when KKB Community features, service providers, legal requirements or our data practices change. The updated version will be posted on this page with a revised effective date. Where a change is material, we may also provide a prominent website notice or send an account email where appropriate.

20. Contact us

Questions, requests or concerns about this Privacy Policy can be sent to: [email protected]

Table of Contents