Who is responsible
Space Codex operates the platform. Each community that runs on it decides who may join, what roles exist, and which integrations receive its data. For anything specific to one community, its committee is the first point of contact.
What is stored
- Account — email address and authentication state, held by Supabase Auth. Passwords are never visible to the platform.
- Profile — display name, username, and anything else you choose to add.
- Membership — which communities you belong to, your state in each, roles assigned, positions held, and the history of those assignments.
- Events — registrations, cancellations, and check-in times.
- Plans — subscription records and the entitlements they grant, including expiry.
- Administrative audit — a record of actions taken by administrators inside a community, so decisions can be traced after a committee changes.
- Notifications — in-app messages addressed to you and whether they were read.
- Abuse prevention — sign-in attempts are rate limited. The address used is stored only as a salted hash, never in readable form, and the counter expires on its own.
What is not stored
No payment card details: the platform does not process payments yet. No advertising or analytics trackers, and no third-party tracking cookies.
Cookies
Who else receives data
- Supabase hosts the database and authentication as a processor.
- Outbound webhooks. A community administrator can register endpoints that receive events from that community, such as a member being approved. Those requests are signed, but the receiving system is chosen and controlled by the community, not by us. Ask the committee which endpoints are registered — the list is on the community's integrations screen.
Retention
Membership and event records remain while the community exists, because a community's history is part of what the platform is for. Administrative audit entries are kept for the same reason. Rate-limit counters are removed automatically once their window has passed.
Your rights
You can view and edit your profile at any time. To request a copy of your data, correction, or erasure, contact us. Erasure anonymises historical actor references rather than deleting audit history outright, so a community's record of decisions stays intelligible.