Privacy Policy
Who we are
This website, creaticampus.esquine.com, is the site of the journal CreatiCampus, published by Esquine (Esquine CreatiResearch Institute, Indonesia). This policy explains what personal data the site and its account system store, why, and how you can access or delete it. Contact: [email protected].
Reading the journal
You can read and download every article without an account. The site sets no advertising or third-party tracking cookies. To show anonymous view counts, the site keeps only aggregate counters plus a short-lived one-way hash used to count a visitor once per day; these hashes are deleted after about a day.
What the account system stores
Account: your name, e-mail address, role (author, reviewer or editor), and when the account was created and verified. If you register with a password you may also give your affiliation and ORCID iD.
Password: never stored in readable form. We store only a PBKDF2-SHA256 hash with a random per-user salt. One-time links (sign-in, e-mail verification, password reset) are stored only as hashes and expire.
Google and ORCID sign-in: if you choose “Continue with Google”, we request only the openid, email and profile scopes, and store your Google account identifier, e-mail address and name. We do not access your Gmail, Drive, contacts or any other Google data. If you use ORCID, we store your ORCID iD and name. You can unlink a sign-in method on the account page.
Sessions: when you sign in, a secure, HttpOnly session cookie is set. The server stores only a hash of the session token, with its creation, last-use and expiry times (30 days). You can sign out of one or all devices at any time.
Audit log: for security, sign-in and editorial actions are recorded in an append-only audit log (who, what, when, outcome, browser user agent). Your IP address is never stored in full: we keep only its network (IPv4 /24 or IPv6 /48) and a salted one-way hash of the address. Secrets are redacted.
Submissions: manuscripts you submit, their files, the author details you enter, review assignments, reviews and editorial decisions are stored to run peer review.
How we use it
Only to run the journal: signing you in, handling submissions and peer review, sending service e-mails (verification, sign-in links, submission updates) and protecting the site against abuse. We do not sell, rent or share your personal data for advertising, and we do not use Google user data for any other purpose.
Service providers
Cloudflare hosts the site and its database and file storage (Cloudflare Pages, D1 and KV). Resend delivers our e-mails, so it processes your e-mail address and the message content. Google and ORCID process your sign-in only if you choose them. These providers act on our behalf under their own privacy terms.
Retention
Account data is kept while your account exists. Expired sessions and one-time links are deleted automatically. Audit log entries are kept for 24 months. Published articles are permanent parts of the scholarly record; records of submissions and peer review are kept as long as needed for the integrity of the journal.
Your rights: access and deletion
You can see and change your details, sign-in methods and sessions on the account page (/account/). To request a copy of your data, a correction, or deletion of your account, e-mail [email protected] from the address on the account. We will reply within 30 days. Deleting an account removes your profile, credentials, linked identities and sessions; published articles and records we must keep for the integrity of peer review are retained.
Changes
We will post any change to this policy on this page with a new effective date.