Privacy Policy

Data controller

OBSCURUM INK, SARL with a share capital of €10,500.00, 19 rue des Boucheries Saint-Ouen, 76000 Rouen, France, 814 428 405 R.C.S. Rouen. Contact for any question about your data: [email protected].

Data processed

• Guests: an anonymous technical identifier, the chosen nickname and the room language.
• Members: email address, password (never stored in plain text, only as an encrypted hash), nickname and sign-up date.
• Content: messages and topics posted in rooms, reactions, private messages, game drawings, friends list, blocks and invitations.
• Connection and security data: IP address, browser and device type, dates and times of connection and of entering rooms.
• Moderation: reports (category, description, optional contact email), together with a copy of the last 50 messages of the conversation concerned, the IP addresses of the reporter and the reported person, as well as moderation decisions and bans.
• Premium: subscription status and history, purchase platform, and customer and subscription identifiers at the payment provider. We never receive your bank details.
• Information visible to other Users: nickname, colour, messages posted in the room, the Premium badge where applicable and, if a Premium Member has added you as a friend, your online presence. To stop being visible to someone, block them.
• Preferences saved on your device (theme, sounds, language): see the Cookie Policy.

We do not ask you for any sensitive data (origin, opinions, religion, health, sexual orientation…). If you mention any in a conversation, you do so on your own initiative: be careful.

Purposes and legal bases

• Providing the Service (rooms, private messaging, games, account, service emails): performance of the contract (Article 6(1)(b) GDPR).
• Managing the Premium subscription, billing and accounting: performance of the contract and legal obligations (Article 6(1)(b) and (c)).
• Ensuring security, automatically filtering prohibited content, handling reports and applying sanctions: legitimate interest in protecting Users and the Service (Article 6(1)(f)), and legal obligations under the Digital Services Act.
• Retaining connection data and responding to requests from authorities: legal obligation (LCEN and French Decree No. 2021-1362 of 20 October 2021).
• Establishing, exercising or defending our legal rights: legitimate interest.
• Displaying advertising, where applicable: non-personalised ads by default, personalised only with your consent (Article 6(1)(a)).

The automatic filter only blocks a message or asks for confirmation. Significant sanctions (suspension, ban) are decided by a moderator. Two measures are automatic: removal from a room after 3 reports (it does not prevent joining another room) and the 30-day ban of the account and IP address of a User removed from more than 3 rooms within 30 days. These decisions can be challenged at [email protected] and are then reviewed by a person.

Retention periods

• Room messages: deleted with the room, within the hour after the last participant leaves.
• Private rooms and their messages: 30 days after their last activity.
• Private messages: deleted after 24 hours. If either participant is Premium, the conversation is kept while their subscription is active, and only the Premium member sees messages older than 24 hours.
• Guest accounts: deleted 30 days after the last connection, together with their private conversations (for both participants).
• Member accounts: kept as long as the account exists. Deletion from Settings is immediate: profile, nickname, messages, private conversations (for both participants), friends, blocks and private room are erased. A request by email is handled within 30 days.
• Connection data (IP address, browser, dates): 1 year, as required by law.
• Reports and related evidence: 1 year after they are handled, or until the end of any ongoing proceedings.
• Bans: for the duration of the sanction, then 1 year after it is lifted or expires. If a banned account is deleted, a non-reversible fingerprint of its email address is kept for the same period, to prevent signing up again to get around the sanction.
• Room removal history (used for the automatic ban): 60 days.
• Billing references (customer and subscription identifiers at the payment provider): 10 years after the account is deleted (Article L. 123-22 of the French Commercial Code); invoices are kept by Stripe, Apple or Google.
• Record of an account deletion (technical identifier and date, to prove the request was carried out): 1 year, or 10 years if it contains billing references.

Some of this data (connections, reports, bans) is kept for these periods even after the account is deleted, to meet our legal obligations and protect Users.

Recipients and processors

Your data is only accessible to the Publisher's authorised staff (the moderation team for reports and connection data) and to our processors, within the limits of their tasks:

• Supabase Inc.: database, accounts and real time, hosted on Amazon Web Services in Frankfurt (European Union);
• Hostinger International Ltd. (Cyprus): website hosting;
• Stripe Payments Europe Ltd. (Ireland): subscription payment on the website;
• RevenueCat Inc. (United States): management of subscriptions bought in the apps (technical identifier and subscription status);
• Apple and Google: in-app purchases, which they process as independent controllers;
• Resend (United States): sending notification emails to the moderation team;
• Cloudflare, Inc. (United States): anti-bot protection of the sign-in, sign-up and forgotten-password forms (Turnstile) — IP address and technical browser information, used only to tell a human from a bot;
• Google: if advertising is enabled, Google AdSense.

Data may be disclosed to judicial or administrative authorities upon request, or where required by law. No data is sold or rented.

Transfers outside the European Union

Some providers are based in the United States. These transfers are covered by the European Commission's adequacy decision on the EU–US Data Privacy Framework for certified companies or, failing that, by the European Commission's standard contractual clauses.

Security

Exchanges are encrypted (HTTPS), passwords are never stored in plain text, access to data is restricted by security rules at database level and connection data can only be read by the moderation team. No system being infallible, never share sensitive information in a conversation.

Your rights

You have the right to access, rectify, erase, restrict and port your data, the right to object to processing based on legitimate interest, the right to withdraw your consent at any time and the right to give instructions about what happens to your data after your death.

You can delete your account yourself at any time from Settings. To exercise them, write to [email protected], preferably from your account's email address. We reply within one month and may ask you to prove your identity if in doubt. Data that the law requires us to keep cannot be erased before the end of its retention period.

You can also lodge a complaint with the French data protection authority (CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr, or with the authority of your country of residence.

Minors

The Service is prohibited for people under 18. If we learn that data concerns a minor, the account is suspended and the data deleted, except for data needed to protect the minor or required by law.

Changes

This policy may change. The date of the last update appears at the top of the page; any significant change is announced in the Service or by email.