Ghost Room beta
Instant feedback
Sign in
Privacy & terms Contact

Privacy & terms

Back

Privacy Notice

1. Who we are

This service is operated by a private individual.

2. What we collect

We collect only the data needed to operate the service and keep it safe:

Account data (open beta users):

  • name or display name
  • email
  • hashed password
  • email verification codes and verification timestamps

Chat data:

  • room titles and descriptions
  • participant display names
  • public messages and questions
  • ratings (if used)
  • poll votes and reactions

Technical data:

  • IP address
  • browser headers
  • device fingerprint
  • timestamps (used for security and abuse prevention)
  • audit logs for moderation and account actions
  • client error reports and operational diagnostics

Cookies:

  • session cookie for login and CSRF protection
  • The site uses only essential cookies.

3. Legal basis

We process data on the following grounds:

  • providing the chat service (contract-like use)
  • legitimate interest (security, rate limiting, preventing abuse)
  • consent for any optional cookies or features that may require it

4. Why we use this data

  • operate the chat and let users join rooms
  • authenticate and verify open beta accounts
  • protect the service from spam and attacks
  • enforce bans and moderation actions
  • troubleshoot issues and maintain performance

There is no automated decision-making or profiling.

5. Storage and retention

  • Chat rooms and messages remain until removed by the site owner.
  • Open beta account data is kept until the user requests deletion or the account is removed.
  • Email verification codes expire automatically after a short time and are deleted after successful verification.
  • Audit logs, client error reports, and security data are kept only as long as needed for protection, debugging, and abuse prevention.
  • Backups (if any) follow the same deletion rules.

Data is hosted within the EU/EEA.

6. Security

We take basic measures to protect personal data:

  • hashed passwords (bcrypt/argon2)
  • private realtime channels for host-only moderation data
  • security headers, CSRF protection, and rate limiting
  • access to server and admin tools is restricted
  • security monitoring and log checks

7. Your rights

You can request:

  • access to your data
  • correction or deletion
  • restriction of processing
  • objection to processing based on legitimate interest
  • portability for your account data

We respond within 30 days.
For complaints, you may contact the Finnish Data Protection Ombudsman.

8. Sharing and transfers

  • We do not sell personal data.
  • Data is shared only with service providers needed to run the website (for example, hosting or email).
  • There are no transfers outside the EU/EEA unless legally required safeguards are in place.

9. Contact