Privacy

Hekhal is a free, openly licensed library of primary mystical texts, run by Vincent Couey. Most of it can be read without an account, and reading collects nothing about you beyond what any web server receives, plus an anonymous visit count. This page lists everything the site does with personal information, in plain terms. If something here is unclear or you think it is wrong, write to [email protected].

We do not sell personal information, we do not show advertising, and we do not track you across sites. The one measurement we run is a cookieless visit counter, described below.

Reading the site

• Hosting. The site is served by Cloudflare. Like any host, Cloudflare receives your IP address and browser details in order to deliver pages and protect the site from attack. Their handling is governed by Cloudflare's privacy policy.
• Analytics. Hekhal counts visits with Cloudflare Web Analytics. It sets no cookies, stores nothing in your browser, and does not build a profile of you; it reports totals such as page views, the pages that were read, and which site referred the visit. It runs on every page from 21 September 2026. There is no advertising or cross-site tracking of any kind.
• Fonts are served from hekhal.org itself, so no font provider sees your visit.
• Images from Wikimedia Commons. Some pages display public-domain images hosted by Wikimedia, which means your browser requests those images from Wikimedia directly.
• Browser storage. Two reading preferences (the view mode and whether the reader panel is open) are kept in your browser's local storage. They never leave your device.

Accounts

• An account stores your email address, display name, handle, role and the date you joined. If you set a password it is stored only as a salted, slow hash (PBKDF2), never in readable form.
• Signing in sets one cookie, __hekhal_session. It is essential, it lasts up to a year, and it cannot be read by scripts on the page.
• Sign-in links and six-digit codes are sent by email. The codes are stored only as keyed hashes, expire after 15 minutes, and are deleted a day later.
• What you save, collect or set reminders for is private to your account. Reminder emails are sent only if you ask for them.
• Comments are public and appear under your handle. A contributor profile, if you fill one in, is public.

The board

• Posting is anonymous. To limit spam and enforce bans we store a keyed hash of your IP address, which identifies repeat posts without storing the address itself.
• The country Cloudflare associates with your connection is stored with each post and shown publicly beside it.
• Images are re-encoded in your browser before upload, which strips embedded metadata such as camera details and location, and are stored with our host.

Applications and messages

• The reviewer and Targum-access forms collect what you type into them (name, email, credentials or expertise, and your note) plus a keyed hash of your IP address. Your application is emailed to the editor so it can be answered.
• Applications submitted before 21 September 2026 stored the full IP address instead. We no longer do this, and we will remove it from any earlier application on request.
• Email you send us is kept for project recordkeeping and is not shared.

Services that process data for us

• Cloudflare: hosting, the database and image storage, and the spam check on forms (Turnstile), which receives your IP address to decide whether a request is automated.
• Resend: sends sign-in, receipt and reminder emails, so it receives the address the email goes to.
• Member dues are not currently active. If they are turned on, payment will be handled by Stripe, and Hekhal will never see or store card details.

Keeping and removing your information

Account details, comments and posts are kept for as long as the account or post exists. Removing a comment from the site hides it; if you want it or your account erased entirely, ask and we will delete it. You can also ask for a copy of what we hold about you, or for a correction. Write to [email protected] from the address on your account and we will act on it within 30 days.

Changes

When what the site collects changes, this page changes with it, and the date at the top is updated.