EFMA (https://wiki.efma.ngo) is a volunteer encyclopedia of Andean music. Reading it needs no account and we don’t track readers. This page explains what we store about people who sign in to contribute.

What we collect

  • From Google or Facebook, when you sign in: your email address, an account identifier and your name as a suggestion for your display name. We never see or store your password.
  • What you choose to publish: username, display name, profile details and avatar, and your edits, comments and votes. These are public.
  • Security records: sign-in sessions (with IP address and browser name), and a log of sensitive actions such as sign-ins, moderation and deletions.
  • Sign-up checks: when an account is created we note the country and the network block it came from (not the full address) and a random identifier of the browser, so moderators can tell when one person opens many accounts or comes back after a suspension. We don’t fingerprint your device.
  • Staff two-step verification: an encrypted secret for your authenticator app and hashed recovery codes.

Cookies

We don’t use advertising, analytics or tracking cookies, and nothing is set while you just read. Signing in uses only these, all limited to this website:

  • Session: keeps you signed in (up to 60 days).
  • Sign-in protection: two short-lived cookies (minutes) that tie the Google/Facebook step and the welcome form to your browser.
  • Browser identifier: a random value, set when you start signing in and kept up to 400 days, used only for the sign-up checks above.

Why

To run your account, to show who wrote what (the history of an encyclopedia has to be traceable), to send the few emails the service needs (invitations, account approval or suspension), and to protect the site against spam, bots and abuse.

We rely on the agreement you make when you create an account (running it and publishing your contributions) and on our legitimate interest in keeping the encyclopedia secure and its history intact. You must be at least 14 years old to create an account.

Who processes it for us

  • Cloudflare (hosting the website, network, file storage, the anti-bot check on the sign-up form, and the country of a visit) and netcup (our server and database, in Germany).
  • Resend, to deliver email.
  • Google or Facebook, only for the sign-in you choose.
  • OpenRouter receives article text, never personal data, when a translation is generated.

We don’t sell or share personal data with anyone else.

How long we keep it

  • Sessions end after 14 days without use and at most after 60 days; their records are erased 30 days later.
  • IP addresses in the security log, and the network block recorded at sign-up, are erased after 180 days.
  • Your account data stays until you delete your account.
  • If an account is suspended for breaking the rules, its sign-up checks (browser identifier, country, network) are kept even if the account is later deleted, so a suspension can’t be avoided by deleting and coming back.

Deleting your account

You can delete your account at any time from Account & security. It erases your email, your Google/Facebook link, your sessions, your two-step data, your sign-up checks, your notifications and watchlist, and your profile details. Your edits and comments stay in the encyclopedia’s history under “deleted user”. If you remove EFMA from your Facebook settings, Facebook asks us to do the same and gives you a code to check its status at /eliminacion.

Your rights and contact

You can ask for a copy of your data, its correction or its deletion, or object to how we use it, by writing to privacidad@efma.ngo. We answer within 30 days. You can also complain to the data protection authority of your country.