nothing in sameorigin is public and nothing is indexed. this is what we hold, why, and for how long.
who holds it
jonas schmedtmann, lda., a company registered in portugal under nipc 513845518, is the controller. write to [email protected]. small enough not to need a data protection officer.
what we hold
your email address, to sign you in and to send the weekly digest if you turned it on. never shown to other members. we need it for the membership; the digest is your choice and settings turns it off.
your handle, avatar, optional link, intro line and the timezone your browser reports. shown to members.
what you write: posts, replies, reactions, and messages in general, in your room and in private conversations.
your sign-ins: the device string, the ip address and the last-seen time of each, so you can end them from settings. we keep those to protect the account.
payment: your paddle customer and subscription ids, the state of the subscription, and the events paddle sends us. we never see your card.
moderation: reports and queue items. the mod log carries the action, never the handle.
push notifications, if you turn them on: one subscription per device, issued by your browser's push service.
we hold all of it to give you the membership you paid for and to keep the place usable, and payment records because tax law says so. no profile, no ads, nothing sold, ever.
cookies
one, the one that keeps you signed in. no tracking cookies, no third-party cookies, and so no cookie banner. the public pages — the hero, sign in, join and these three — are counted by a self-hosted umami at umami.jonas.io: no cookies, no ip address kept, nothing personal. it is never loaded once you are inside.
who else touches it
convex, eu-west-1 in ireland: the database and the backend.
paddle, the merchant of record: payment, invoices and vat.
cloudflare: the domain, the front of the site, and the mail that carries your sign-in codes.
openai: the moderation model reads the text of posts, replies and general messages to flag them. never rooms, never private conversations, under any setting or flag.
github, google or discord, only if you pick one to sign in with. they tell us your email address.
the app files are served from a server in ashburn, in the us.
for the american ones we rely on the eu-us data privacy framework and the standard contractual clauses. nobody else gets your data.
decisions
the model flags. it removes nothing and decides nothing; a person looks at everything in the queue. no profiling, no recommendation model, no automated decision with a legal effect on you.
how long
while you are a member, and while a lapsed seat is still yours to come back to.
delete your account in settings and your email, sign-ins, avatar, timezone, link and push devices are erased then and there, the subscription is cancelled and the seat is freed. what you wrote stays, with the author shown as a deleted member. copies can sit in a backup for a short while after.
handled moderation items go after ninety days.
payment records stay as long as tax law makes us keep them.
your rights
you can ask for a copy of your data, correct it, delete it, restrict or object to what we do with it, or take it elsewhere. "download my data" and "delete account" in settings do the first and the last without asking anyone; write to [email protected] for the rest and we answer within a month. if we get it wrong you can complain to the data protection authority where you live; ours is the cnpd, www.cnpd.pt.