Legal

Privacy Policy

Last updated 19 September 2026

This policy explains what information Lyceum collects when you read, sign up and take part, what we do with it, and the choices you have.

At a glance

Reading is open to everyone — no account needed.
We collect what you give us to sign up and take part, plus security logs.
One sign-in cookie. No ads, no analytics, no selling your data.
Your name and photo appear next to what you publish.

1. Information we collect

You can read everything on Lyceum without an account. We only collect personal information when you sign up, when you take part, and when your browser talks to our servers.

When you create an account

Username and email address. Your email is how you sign in.
Password. Stored only as a one-way bcrypt hash — we never keep or see the password itself.
First and last name, if you choose to give them.

When you use your account

Profile details you add later, such as a bio and a profile photo.
Comments you write, and any files you attach to them.
Posts and media, if you are an author or editor — including the images and documents you upload for them.
Likes — which posts you have liked, so the heart stays filled on your next visit and you can take a like back.
Notifications addressed to you, for example when someone replies to your comment.

Automatically

Account activity.When you register, sign in, sign out or change your password, and when you create, edit or delete posts and comments, we record what happened, when, your IP address and your browser’s user-agent string. We also keep the time of your last sign-in.
Server logs. Like most websites, our servers log each request: IP address, date and time, the address requested, the response status, the referring page and the user agent.
View counts. Opening a post adds one to its total. That number is not linked to you.

2. How we use your information

To create and run your account and keep you signed in.
To publish your posts and comments under your name.
To remember your likes and deliver your notifications, including live ones while the site is open.
To let our editors review comments before they appear, and to remove spam.
To keep the service secure — for example, limiting repeated sign-in attempts from the same IP address — and to investigate and fix problems.

We don’t use your information for advertising, we don’t build marketing profiles, and we don’t send marketing email.

3. What other people can see

Everyone: posts you publish and your comments once they are approved, shown with your username, name and profile photo. Each post shows how many people liked it — never who.
Lyceum staff: admins and editors can see account details (including email addresses), activity records and comments awaiting review through our admin panel, because they need them to run and moderate the site.

4. Cookies and local storage

We store only what is needed to keep you signed in. There are no analytics, advertising or third-party tracking cookies, and our fonts are served from our own servers, so loading a page doesn’t contact a font provider either.

refreshToken

Cookie — httpOnly, sent only to our sign-in endpoints

Keeps you signed in and quietly issues fresh access tokens. Scripts on the page cannot read it.

Lasts: Up to 30 days, or until you log out

lyceum_token

Local storage

A short-lived access token that proves who you are on each request.

Lasts: Until it expires or you log out

Staff signing in to the admin panel get the same pair, with the local storage entry named lyceum_admin_token. Because both are strictly necessary for signing in, we don’t show a cookie banner. If you block them you can still read everything — you just won’t stay signed in.

6. How long we keep it

While your account exists, we keep your account information.
When your account is deleted, your profile, likes and notifications are deleted with it. Posts, comments and files you created stay on the site but are no longer linked to you. If you want those removed as well, say so in your request and we will delete them.
Activity records and server logs are kept for security and troubleshooting. Once your account is deleted they are no longer tied to it, though they may still contain the IP address and user agent of the original request.

7. Your choices and rights

See and correct your details. Update your name, username, email, bio and photo from your dashboard → Edit profile.
Take back a like. Tap the heart again and the record is removed.
Get a copy of your data. Ask us for a copy of the personal information we hold about you.
Delete your account. Account deletion is handled by our team — email privacy@lyceum.com from the address on your account and we will confirm and delete it.

Depending on where you live, data protection law may give you further rights — for example to object to or restrict how we use your information, or to complain to your local data protection authority.

8. How we protect it

Passwords are hashed with bcrypt, connections are encrypted with HTTPS, the sign-in cookie cannot be read by scripts on the page, and repeated sign-in attempts are rate-limited.

No system is perfectly secure, so please use a password you don’t use anywhere else, and log out on shared computers — logging out removes the sign-in token from that browser.

9. Children

Lyceumis not directed at children under 13, and we don’t knowingly collect their information. If you believe a child has created an account, contact us and we will delete it.

10. Changes to this policy

When we change this policy we update the date at the top of the page. If a change is significant, we will also post a notice on the site before it takes effect.

11. Contact us

Questions about this policy, or a request about your data? Email privacy@lyceum.com and we will get back to you.