Privacy & Data Protection
Privacy Policy
PTEC Library is a free digital library run by the Phnom Penh Teacher Education College. We collect only the data needed to run the library, we never sell it, and you can delete your account at any time.
- Last updated:
- Version:
- 2.0
- 10 min read
- 10 min read
Available in English and Khmer.
On this page
The short version
What we collect
Your account details, the library activity that powers your features, and technical logs needed to run the service securely.
What we never do
We do not sell your data, show ads, or track you across other websites. Your notes and reading activity stay private.
Your controls
Edit your profile, export a copy of your data, or permanently delete your account and its data — any time, from your settings.
Ask us anything
Questions or a data request? Reach the library through the contact page and we will respond within 30 days.
1. Who we are and what we collect
Who runs the library, and what information reaches us.
Overview
This policy explains what personal information PTEC Library collects, why we collect it, where it is stored, who can see it, and the choices you have. It describes how the service actually works today — not a generic template.
It applies to the public library website and its progressive web app. It does not cover other websites we link to, such as the main PTEC website or Google.
Who operates the service
The e-Library is operated by the Phnom Penh Teacher Education College (PTEC). The library director owns this policy and the web team maintains the service.
For any privacy question or data request, use the contact page. We aim to respond within 30 days.
Information we collect
We collect three kinds of information: the account details you provide, the library activity that makes features work, and technical records that keep the service secure. The table below lists each category with its purpose, source, and how long we keep it.
Who can see each category
- You onlyNobody else can see it
- You + library staffLibrarians can see it
- PublicAnyone on the internet
- Technical stewardInfrastructure access only
| Data | Examples | Purpose | Retention | Visibility | Details |
|---|---|---|---|---|---|
| Account & sign-in | Email, display name, profile photo | Run your account and sign you in | Life of account | Technical steward | |
| |||||
| Download access profile | Institution, role, phone, purpose | Authorise thesis downloads | Life of account | You + library staff | |
| |||||
| Library activity (private) | Saved books, lists, progress, notes, highlights | Power your reading features | Life of account | You only | |
| |||||
| Reviews & comments (public) | Rating, review or comment text | Shown publicly on the site | Until you delete it | Public | |
| |||||
| Contact messages | Name, email, message, IP address | Reply to your enquiry | Up to 2 years after resolution | You + library staff | |
| |||||
| Download & view logs | Item opened, timestamp | Security and catalog statistics | 1 year, then anonymous counts | Technical steward | |
| |||||
| Search queries | Search terms, anonymous session code | Improve the catalog and answers | Up to 365 days | Technical steward | |
| |||||
| Push notifications | Browser notification token | Send new-book or post alerts | Until you unsubscribe | Technical steward | |
| |||||
| Security & rate limiting | IP address, timestamps | Prevent abuse and spam | Short-term | Technical steward | |
| |||||
| Device storage | Theme, language, offline book cache | Preferences and offline reading | Until you clear it | You only | |
| |||||
Account & sign-in
Technical steward- Examples
- Email, display name, profile photo
- Purpose
- Run your account and sign you in
- Retention
- Life of account
- Source
- You, or Google sign-in
- Who can access it
- You; technical steward
- Shared with
- Supabase, Google
Download access profile
You + library staff- Examples
- Institution, role, phone, purpose
- Purpose
- Authorise thesis downloads
- Retention
- Life of account
- Source
- You (optional)
- Who can access it
- You; librarians (aggregate)
- Shared with
- Not shared
Library activity (private)
You only- Examples
- Saved books, lists, progress, notes, highlights
- Purpose
- Power your reading features
- Retention
- Life of account
- Source
- You
- Who can access it
- You only
- Shared with
- Not shared
Reviews & comments (public)
Public- Examples
- Rating, review or comment text
- Purpose
- Shown publicly on the site
- Retention
- Until you delete it
- Source
- You
- Who can access it
- Everyone
- Shared with
- Not shared
Contact messages
You + library staff- Examples
- Name, email, message, IP address
- Purpose
- Reply to your enquiry
- Retention
- Up to 2 years after resolution
- Source
- You
- Who can access it
- Library staff
- Shared with
- Gmail (reply delivery)
Download & view logs
Technical steward- Examples
- Item opened, timestamp
- Purpose
- Security and catalog statistics
- Retention
- 1 year, then anonymous counts
- Source
- Automatic
- Who can access it
- Technical steward
- Shared with
- Not shared
Search queries
Technical steward- Examples
- Search terms, anonymous session code
- Purpose
- Improve the catalog and answers
- Retention
- Up to 365 days
- Source
- Automatic
- Who can access it
- Technical steward
- Shared with
- Google (AI answer)
Push notifications
Technical steward- Examples
- Browser notification token
- Purpose
- Send new-book or post alerts
- Retention
- Until you unsubscribe
- Source
- You (opt-in)
- Who can access it
- Technical steward
- Shared with
- Browser push service
Security & rate limiting
Technical steward- Examples
- IP address, timestamps
- Purpose
- Prevent abuse and spam
- Retention
- Short-term
- Source
- Automatic
- Who can access it
- Technical steward
- Shared with
- Cloudflare (CAPTCHA)
Device storage
You only- Examples
- Theme, language, offline book cache
- Purpose
- Preferences and offline reading
- Retention
- Until you clear it
- Source
- Your browser
- Who can access it
- You (on your device)
- Shared with
- Not shared
No categories match this filter.
2. How we use, share and protect it
What the data is for, what your browser stores, who else sees it, how it is kept safe, and for how long.
How we use information
We use your information only to run the library and improve it. Specifically:
- To create and secure your account and sign you in.
- To power features such as saved books, reading lists, reading progress, notes, and highlights.
- To publish the reviews you choose to post, shown with your display name and photo.
- To reply to messages you send through the contact form.
- To keep download and search counts, find searches that return no results, and improve the catalog.
- To protect the service against abuse, spam, and unauthorised access.
We do not use your information for advertising, profiling for marketing, or automated decisions that affect you.
Cookies and device storage
We keep the number of cookies to a minimum and use no advertising or cross-site tracking cookies. What we store falls into these groups:
- A sign-in cookie that keeps you logged in (only after you log in).
- A small preference for your chosen language.
- Settings saved in your browser, such as light or dark theme and reading preferences.
- Offline storage used by the app: when you save a book to read offline, the file and some pages are cached on your device so you can open them without a connection.
You can clear this data at any time from your browser settings. Aggregate, cookieless analytics (Vercel Analytics) count page visits without identifying you or following you across sites.
When information is shared
We do not sell or rent your personal data, and we do not share it with advertisers. We share information only in these limited situations:
- With the service providers listed below, who process data on our behalf under their own security terms.
- Publicly, only for the reviews you choose to post — shown with your display name and photo.
- When required by law, or to protect the safety, rights, or security of users, the public, or the library.
Third-party service providers
We rely on a small set of trusted providers to run the service. They process data only to provide their service to us, not for their own purposes.
- Supabase
- Database and sign-in (accounts, library data)
- Vercel
- Website hosting, cookieless aggregate analytics, avatar storage
- Zima Storage
- Storage of book, thesis, and journal-article files
- Optional Google sign-in and AI-assisted search (server-side)
- Gmail / SMTP
- Delivery of sign-in and contact-reply emails
- Cloudflare Turnstile
- Spam protection on contact and sign-in forms
Public and private information
Most of what the library stores about you is private. The only content shown publicly is what you deliberately post: book reviews and post comments, displayed with your name and photo.
Your notes, highlights, reading progress, saved books, and reading lists are private to your account. They are not shown in the admin panel and are not visible to library staff during normal operations.
The web team's technical steward can access the database to operate and repair the service, under access controls, audit logging, and quarterly access reviews. This access exists to run the service, not to browse your activity.
Data storage and security
We protect your data with three separate measures — it is important not to confuse them:
- In transit: every connection between your device and the service uses HTTPS/TLS encryption, so data cannot be read as it travels.
- At rest: account and activity data are held in our managed database (Supabase/PostgreSQL); files are held on the library's file storage. These are protected by the providers' storage safeguards and by our access controls.
- Access control: who can read what is enforced on the server by database row-level security and permission checks — not merely hidden in the interface.
No online service can promise perfect security, but we limit what we collect, restrict who can reach it, and log privileged access.
Data retention
We keep information only as long as it is needed. In practice:
- Account and library activity: kept while your account exists.
- Contact messages: kept up to 2 years after your enquiry is resolved, then deleted.
- Raw download and view logs: kept up to 1 year, then reduced to anonymous counts.
- Search queries: kept up to 365 days; they are linked to a rotating anonymous session code, never to your account or a raw IP address.
- Security and rate-limit records: kept short-term to prevent abuse.
- Admin action logs: kept at least 2 years as an accountability record.
3. Your rights and choices
What you can see, change, export or delete — and how student information is protected.
Children and student information
The library serves teacher trainees, educators, researchers, and the public. It is an educational service and is not directed at young children.
Where the library holds information about students — such as an optional institution or student ID entered to request a thesis download — it is provided by the account holder and used only to authorise that access.
Your privacy rights
You are in control of your account data. From your account settings you can review and edit your profile, export a copy of your library data, and permanently delete your account. You can also contact the library about any privacy matter.
Everything you need to review, export, or remove your data is in one place.
- Edit your profileUpdate your name, photo, and account details, or change your password.Open account settings
- Export your dataDownload a copy of your reading progress, saved books, notes, and highlights.Export from your dashboard
- Delete your accountPermanently remove your account and its data. This cannot be undone.Delete in account settings
- Ask about your dataRequest a copy, a correction, or raise a privacy concern with the library.Contact the library
You'll need to be signed in to use these controls.
Account deletion and data export
You can export a copy of your library data (reading progress, saved books, notes, and highlights) at any time from your dashboard.
You can permanently delete your account from your settings. Deleting your account removes your profile, notes, highlights, reading progress, saved lists, saved books, reviews, and notification subscriptions. A few records are kept for the reasons below:
- Contact-form threads are kept under our retention rule but detached from your account.
- If you performed staff or admin actions, the audit record of those actions is kept as an accountability record.
- Deletion propagates to backups as older backups rotate out, within about six months.
Accounts with staff or admin roles cannot self-delete here; ask a super admin to remove the account.
4. Changes and contact
How updates to this policy are announced, and how to reach us.
Policy changes
When we change what we collect, keep, or share, we update this page and its version below in the same change. Significant changes will be noted here. The date and version at the top always reflect the current policy.
- Version 2.0CurrentEffective:
Expanded and clarified: disclosed the optional download access profile, push notifications, IP and rate-limiting data, cookieless analytics, and AI processing of search terms. Separated data in transit, at rest, and access control. Added category-based retention, deletion exceptions, and a complaints channel.
- Version 1.0Effective:
First published privacy policy covering account data, library activity, storage, visibility, and retention.
Contact and complaints
If you have a question about your data, want a copy of it, or want to make a correction or complaint, contact the library through the contact page. We aim to respond within 30 days.
If you are not satisfied with our response, you may escalate your complaint to the library director through the same channel.