Looner Community

Privacy policy

Draft · 2026-10-draft

Working draft prepared while the service is being built. Before public launch it must be reviewed by a lawyer and completed with the data controller's details.

1. Data controller

The data controller is the operator of Looner Community (details to be completed before launch). Contact: kontakt@looner.local.

2. What data we process

  • Account data: email, username, password hash (Argon2id), date of birth (only to check that you are an adult; never displayed), preferred language.
  • Profile data you choose to provide: display name, bio, interests, location, photos.
  • Content: posts, comments, chat and private messages, reactions, reports.
  • Technical data: sessions (token hash, browser), security events with a keyed hash of the IP address — we never store IP addresses in plain form.
  • When you sign in with Google: your Google account ID and email address.

3. Purposes and legal bases

  • Providing the service (Art. 6(1)(b) GDPR).
  • Security, abuse prevention and moderation (Art. 6(1)(f) GDPR).
  • Optional features — only with your consent, which you can withdraw in the settings (Art. 6(1)(a) GDPR).

4. Cookies

We only use strictly necessary cookies: the login session, short-lived cookies that secure Google sign-in, your chosen interface language and your browser's time zone (to display dates correctly). We do not use advertising cookies or hidden tracking. Analytics tools may only ever be enabled with your consent.

5. Retention periods

  • Account and content — until the account is deleted (after the grace period the data is permanently deleted or anonymised).
  • Files of deleted photos — removed from storage within 30 days.
  • Security events and the moderation log — up to 12 months.
  • Backups — up to 14 days.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can export your data (JSON) and delete your account yourself in the settings. You may lodge a complaint with your data protection supervisory authority.

7. Recipients

Our hosting provider, email (SMTP) provider, optionally an S3 file storage provider, and Google (when you sign in with Google). We never sell data. User content is not sent to external translation services.