Privacy & Data Protection

1. Controller and contact

AURORA UAP is an independent personal project operated by Iliyan Danielov Iliev, an individual. For privacy questions and requests to access, correct, erase or withdraw consent regarding report data, contact [email protected]. A private residential address is not published.

2. Data and purpose

When reporting is enabled, we collect a two-letter country code, region and approximate area, local observation date/time, time zone, category, a description of 50–5,000 characters, language and policy acknowledgment version. We also store random request/receipt IDs, timestamps, review status and an audit trail of moderation decisions. The purposes are private intake, abuse prevention and human review; reports are not automatically published.

The report description itself does not require contact details, private addresses, exact GPS coordinates or uploads. Submitting a report requires a separate account with a verified email. Verified-email sign-in may also remain available when report submissions are temporarily disabled. Supabase Auth processes the account email and sign-in security information; Brevo delivers AURORA UAP transactional sign-in and invitation emails. The content of locally saved report drafts is not sent to these providers. AURORA will store a separate account identifier linking a verified account to the private report; this identifier is never part of a public dossier. Donations are voluntary and never a condition of reporting. Do not submit personal information about witnesses, children or third parties. Free-text descriptions can nonetheless contain personal information and are handled as private data.

3. Processing basis

Submission is voluntary and requires explicit consent before the report is processed for human moderation. Cloudflare may process separate technical security and delivery data under the applicable terms. The controller is documenting the lawful basis for these separate security and delivery activities. Any future public publication requires a distinct legal basis and review.

4. Storage, access and publication

Received reports are stored in a private Cloudflare D1 quarantine, separate from the public case archive. Access is restricted to an authorized moderator using Cloudflare Access. Cloudflare provides infrastructure, and Supabase Auth provides account authentication and may process security data, including IP addresses. Processor terms, processing locations and international transfers are subject to ongoing documented controller review. A moderator's approval does not publish a report; any later publication requires a separate review, minimization and removal of personal data.

5. Retention and deletion

Planned rules: rejected reports are deleted within 90 days of decision; pending reports receive review within 180 days of receipt; approved but unpublished reports are reassessed within 12 months of the latest decision. Retention handling is under the controller's responsibility; automatic deletion is not currently enabled. Security-log and backup retention periods are still being finalized. Individual erasure requests are assessed alongside backup restoration safeguards. After verified-email sign-in, you can view only your own private report receipt references and statuses through “View my private reports”, including if intake is temporarily disabled. Request report or account erasure via the privacy contact above; requests are handled manually after identity verification, and opening the email link does not itself erase any data. For an individual request, contact us with your retained receipt reference. Erasing a private report and deleting a Supabase account are separate steps; we must verify the requester’s identity first, and backup-retention procedures remain under review.

6. Your rights

Under applicable GDPR rules, you may request access, rectification, erasure, restriction, portability or object to processing, as applicable; you may withdraw consent where consent is the lawful basis. Reasonable verification of the relationship to the report may be needed. You may lodge a complaint with the Bulgarian Commission for Personal Data Protection.

7. Local drafts, security and minors

When live submissions are disabled, a saved draft remains only in your browser and a downloaded JSON file remains on your device — nothing is sent to AURORA. You can erase the browser draft in the form. This applies to draft content only; account sign-in separately involves Supabase and Brevo. When live intake is enabled, Cloudflare Turnstile and anti-abuse systems may process technical data. Only people aged 18 or older may submit reports. A submitter must explicitly self-declare adulthood before submission; AURORA does not collect a date of birth or identity document and does not store a separate age-confirmation field in D1. Self-declaration is not independent age verification. Do not submit identifying information about minors or third parties.

8. Advertising, cookies and consent choices

On public editorial pages, AURORA loads the official Google AdSense publisher script to support Google's published Privacy & messaging consent interface and prepare for future advertising. When the script is requested, Google may receive technical information, such as IP address, browser and device details, even when no ad is displayed. Google and participating ad technology providers may use cookies or similar technologies for ad delivery, fraud prevention, measurement and, where permitted and chosen, personalized ads. The published consent message for visitors in the EEA, UK and Switzerland offers Consent, Do not consent and Manage options. Nonessential cookies and data processing subject to consent must respect those choices. AURORA does not install manual ad units on the report, authentication, moderation or donation pages. The site's AdSense application is under review; neither approval nor advertising income is guaranteed.

You can revisit your choice using the Privacy and cookie settings link on editorial pages, or open those settings on the homepage. The control depends on Google's consent API being available in your browser and region. For information about Google's ad data practices, see Google's advertising technologies policy.