Privacy Policy

Last updated: 18 October 2026 · version POL-PRIV-FD02-383843f24cdc · working version (controller details to be completed)

§ 1. Controller and contact

1. The controller of personal data is [OPERATOR], [ADRES], [KRS], [NIP], [REGON]. 2. Contact for personal data matters: [E-MAIL]. 3. Data Protection Officer: [OPERATOR] states whether one has been appointed and provides contact details. A DPO is not required until counsel confirms such an obligation.

§ 2. Scope of zero-knowledge — what is true

1. Encrypted in the browser: the content of messages, the content of replies, and the content and name of new attachments. The key is in the part of the link after the # sign. The browser does not send that part to the server. The controller has no key to these data — including in the database, in file storage and in backups. 2. Not zero-knowledge (processed by the controller): creation, opening, end-of-viewing and expiry times; status; chosen theme; viewing time; size, MIME type and random identifier of an attachment object; IP address and request data in server logs; buyer data; data of reports voluntarily submitted. 3. What the browser sends apart from the # key: — the PRO licence key is sent when licence status is checked (home page and pricing, when a licence is saved), at activation, and when messages or attachments with PRO functions are created; — the room identifier and the sender token are sent when status is checked and when a message is cancelled; — the part after the # sign is never sent. 4. Limitation of the model: the controller supplies the application code. Modified code running in the browser could pass on the key. Description of this limitation: [to be confirmed]. 5. Attachments uploaded before 16.10.2026 were stored under a different model: the file key was kept in the database until the end of the message. This model is no longer used. 6. E-mail addresses in transaction data. The buyer’s e-mail address is needed for payment, for delivering and recovering the licence, for transactional contact, complaints and purchase documentation. It is stored in plaintext in the licence record and in the payment record. Limiting its entries in payment events to the necessary fields is in progress.

§ 3. Categories of persons, data, purposes, legal bases and recipients

Each category sets out the data, purpose, basis, recipients, period (§ 8) and rights (§ 6). The bases are proposals for legal confirmation. A. Users of messages (sender and recipient) — Data: encrypted message and reply content; times; status; theme; viewing time; room identifier; token hashes; request data in logs. — Purpose: delivery, completion and security of messages. — Proposed basis: Art. 6(1)(b) GDPR (performance of the service); point (f) for logs. — Recipients: DigitalOcean (hosting); Cloudflare (proxy; R2 for attachments). B. Buyers of a PRO licence — Data: e-mail address; payment and order identifiers; amount, currency, status; licence type; activation and expiry dates; encrypted e-mail address and its hash for recovery; device identifier hash; versions of accepted texts and time of acceptance; payment event data (the buyer’s e-mail address in plaintext in the event metadata is being removed); provider notification content is being limited to the necessary fields. — Purpose: completing the purchase, issuing and recovering the licence, payment handling, complaints, accounting. — Proposed basis: Art. 6(1)(b) GDPR; for accounting documents Art. 6(1)(c) GDPR. — Recipients: Stripe, Inc. (payments); Resend (e-mail delivery); DigitalOcean; Cloudflare. — Past transactions and subscriptions concluded through Paddle before the Stripe implementation (LEGACY): Paddle.com Market Ltd. (Merchant of Record). Data from these transactions is processed within the scope of past orders and active subscriptions until they end. C. Golden List (reporting party and entry) — Data: e-mail address of the reporting party; name, type, language, URL and description; icon and creative; moderation and payment status; view and click counters (without personal data). — Public: name, description, type, URL and icon. The e-mail address is not published. — Purpose: publication, moderation, payment handling. — Proposed basis: Art. 6(1)(b) GDPR. — Recipients: Resend; Stripe. D. YouTube channel promotion (reporting party) — Data: e-mail address; channel name and address; promotional video address; description; language version; period; time stamp of confirmation of the right to the channel; accepted texts and acceptance time. — Public: entry fields and the embedded YouTube player. — Purpose: broadcasting, moderation, payment handling. — Proposed basis: Art. 6(1)(b) GDPR. — Recipients: Resend; Stripe; YouTube/Google (player; data is passed when the video is played, see § 4 item 6). E. Banner advertising (advertiser) — Data: e-mail address; campaign name; target address; creatives (desktop and mobile); slot and period; view and click statistics assigned to the campaign; texts of statements and acceptance time. — Purpose: broadcasting, settlement, moderation. — Proposed basis: Art. 6(1)(b) GDPR. — Recipients: Resend; Stripe; Cloudflare R2 (creatives). F. Contact form — Data: sender’s e-mail address; subject; message content; technical data needed for limits (IP address in process memory, not written to the database). — Flow: the message is sent by e-mail to the controller through Resend. The sender receives confirmation of receipt. The content is not stored in the database. Until 16.10.2026 the content was passed to Abacus.AI (historically, § 4 item 8). — Proposed basis: Art. 6(1)(b) or (f) GDPR. — Period: § 8, item 12. G. Abuse report — Data: category; address or content identifier; description; e-mail address of the reporting party (if provided); good-faith statement; report number; status and decision with reasoning. — For a Golden List entry the report does not contain the reporter’s identifier. — Purpose: handling the report, security, legal obligations. — Proposed basis: Art. 6(1)(c) and (f) GDPR. — Period: § 8, item 14. H. Security and server logs — Data: IP address; time; request method; redacted path (without query parameters containing tokens); response code. — Purpose: security, diagnostics, protection against abuse. — Proposed basis: Art. 6(1)(f) GDPR. — Period: 14 days (§ 8, items 10–11). I. Statistical events (event table) — Types: PAGE_VIEW (page path); ROOM_CREATED (room identifier, theme, validity period, whether an attachment exists); ROOM_READ; CODE_ACTIVATED; AD_CLICK; PAYMENT_SUCCESS (provider, payment identifier, licence type; the e-mail address in the event metadata is being removed). — Purpose: statistics in the administrator panel. — Proposed basis: Art. 6(1)(f) GDPR. — Period: § 8, item 8.

§ 4. Recipients of data

1. DigitalOcean — hosting of the application servers, Frankfurt region. Data processing agreement: [OPERATOR] to confirm. 2. Cloudflare, Inc. — proxy and traffic protection; file storage in Cloudflare R2. Data processing agreement: [OPERATOR] to confirm. 3. Resend — e-mail delivery: licences, licence recovery, contact form, Golden List, YouTube and advertising messages. Data processing agreement: [OPERATOR] to confirm. 4. Stripe, Inc. — payment provider. Card details are entered on the Stripe page. The controller’s role towards Stripe: [to be confirmed]. 5. Theme fonts (no Google in page operation). Theme fonts, including Inter, are files of the Application served from the Application’s own domain. They are not downloaded from Google servers while the page is operating. The user’s browser does not connect for this purpose to fonts.googleapis.com or fonts.gstatic.com, so Google does not receive the user’s IP address for this reason. 6. YouTube (Google). Channel promotion players are embedded from youtube-nocookie.com. Data is passed to YouTube when the video is played. The player is loaded only after an explicit user action (the “Load video” button). 7. Paddle.com Market Ltd. — only for past transactions and subscriptions (LEGACY). Data from past transactions in which Paddle acted as Merchant of Record, and from active subscriptions concluded before the Stripe implementation. 8. Abacus.AI — historically only. Until 16.10.2026 the content of the contact form was passed to this provider. From that date the form sends messages through the Application server and Resend. Whether, and for how long, the provider keeps earlier messages: [to be confirmed]. 9. Public authorities — only on the basis of applicable law. No AWS is a recipient. Files are stored in Cloudflare R2.

§ 5. Transfers outside the EEA

Providers based in the USA: Cloudflare, Stripe, Resend, YouTube (Google, when a video is played after a click). The transfer mechanism (DPF or SCC) and the assessment of impact: [to be confirmed]. A copy of the safeguards applied may be obtained by writing to [E-MAIL].

§ 6. Rights of data subjects

1. Access, rectification, erasure, restriction of processing, portability, objection, and withdrawal of consent where consent was required. 2. Complaint to the President of the Personal Data Protection Office (UODO). UODO contact details: [OPERATOR] will complete them after verification. 3. Time limit for responding to a request: [OPERATOR]. 4. The controller does not take decisions based solely on automated processing and does not profile users. 5. Because of the zero-knowledge model, the controller cannot find or decrypt message content on request. An access request covers the metadata described in § 2 item 2.

§ 7. Security

1. Encryption in the browser (AES-256-GCM; HKDF-SHA256 for file keys); HTTPS connections. 2. Request limits for sensitive routes; protection of forms (a field invisible to humans, limits on length and on the number of reports). 3. Deletion of content after a message ends; file deletion is verified and errors are retried. 4. Administrator passwords are stored as bcrypt hashes. The administrator session lasts 24 hours. 5. The limits described in § 2 and § 8 apply. No safeguard is absolute.

§ 8. Retention: periods by category

Principle: data is kept only for as long as needed for a specific purpose or as required by law. Categories are not kept indefinitely. Periods whose automatic enforcement is in progress are target periods. 1. Encrypted message content and IV — location: messages table; period: deleted after viewing ends; if viewing is not ended, deleted after the viewing time expires; not longer than the validity period (max. 7 days). 2. Message row (times, status, theme, viewing time, token hashes) — location: messages table; period: deleted no later than 5 minutes after the validity period expires. 3. Reply (encrypted) — location: messages table; period: deleted after the sender first collects it. 4. Attachment (encrypted file) — location: Cloudflare R2 and deletion queue; period: deleted after the message ends; errors are retried. 5. Attachment reservation before a message — location: Cloudflare R2 and queue; period: 24 hours from the reservation. 6. Attachment name, MIME type and size — location: messages table; period: as for the message row. 7. Theme usage (ThemeUsage) — location: theme usage table; period: the room identifier is deleted together with the message row; daily aggregates by theme are kept for 24 months. 8. Events (PAGE_VIEW, ROOM_CREATED, ROOM_READ, CODE_ACTIVATED, AD_CLICK, PAYMENT_SUCCESS) — location: events table; period: raw events for 90 days, then daily aggregates without identifiers for 24 months. 9. E-mail address in a payment event — location: events table; period: removed from the metadata (immediately on implementation). 10. Proxy server logs (IP, time, method, redacted path) — location: log files; period: 14 days (daily rotation). 11. Application and scheduled task logs — location: log files; period: 14 days; e-mail addresses are not written to them. 12. Contact form — location: Administrator’s mailbox; Resend; period: no record in the database; mailbox: 12 months from the end of the matter; Resend according to its own policy. 13. Request limits (form, login, recovery) — location: process memory; period: until the end of the limit window; cleared on restart. 14. Abuse reports — location: reports table; period: 12 months from closing the matter; longer only in the case of a dispute, a claim, a legal obligation, security or a request from an authority, until that reason ceases. 15. PRO licences (key, type, dates, transaction identifiers) — location: licences table; period: until the end of the licence; after it ends, the licence record with transaction identifiers is kept for 24 months, then deleted. 16. PRO buyer e-mail address: plaintext field, encrypted field, hash — location: licences table; period: packages: deleted after the limit is used up or the licence expires; subscriptions: 30 days after expiry; Lifetime: not cleared while the licence exists. 17. Recovery attempts (e-mail hashes, IP, user agent) — location: attempts table; period: successful: 24 hours; unsuccessful: 30 days. 18. Payment record (amount, currency, status, identifiers, e-mail address, versions of accepted texts) — location: payments table; period: e-mail address: until the transaction is handled, then deleted; record with amount and identifiers: accounting and tax periods. 19. Raw payment provider notification — location: payments table; period: 30 days, then deleted; only the necessary fields are kept (identifiers, amount, status). 20. Payment events (transaction history) — location: payment events table; period: 24 months from the event. 21. Golden List entry (name, description, URL, status) — location: entries table; period: after expiry the entry is not published; the entry is deleted 12 months after expiry, unless a dispute is pending. 22. E-mail address of the Golden List reporting party — location: entries table; period: deleted 90 days after the entry expires or is rejected. 23. YouTube promotion and advertising reports (e-mail address, campaign data) — location: reports table; period: the e-mail address is deleted 90 days after the report is closed; the record without the address is kept for 24 months. 24. Banner creatives — location: Cloudflare R2; period: deleted after broadcasting ends and after the slot retention period (24 hours in the database). 25. Administrator accounts (e-mail, password hash, dates) — location: administrators table; period: until the account is withdrawn. 26. Database backups — location: server backup directory; period: 60 days; restore points before implementation: the 3 most recent; backups containing keys: sanitised within 24 hours. 27. Application source copies — location: server backup directory; period: in accordance with the restore-point policy.

§ 9. Cookies and browser storage

Cookies: — NEXT_LOCALE — the remembered language of the page. Necessary. A session cookie: it expires when the browser is closed. — admin_token — administrator authentication (httpOnly, secure in the production environment, sameSite: lax). Set only when an administrator logs in. Validity: 24 hours. A user of the service without an administrator account does not receive it. — Cloudflare — traffic protection cookies. Names and periods: [OPERATOR] will confirm after checking. — Stripe — on the payment page, in accordance with Stripe’s policy. — YouTube — a player loaded after an explicit user action may set its own cookies (§ 4 item 6). Browser storage (localStorage and sessionStorage). The data remains in the browser. Some of it is sent to the server only when a given function is used: — keymes_messages — the list of messages sent from this device (the /sent page): room identifier, label, creation and expiry times, last known status and the status link. The link contains the sender token and the encryption key (the part after #). When status is checked or a message is cancelled, the browser sends the room identifier and the sender token. The part after # is never sent. Expired entries are deleted automatically. An entry may be removed in the browser settings. — homer_pro_license — the PRO licence key saved on this device. Sent to the server when licence status is checked (home page and pricing, when a licence is saved), at activation, and when messages or attachments with PRO functions are created. The server checks it in the licence key register. Necessary for PRO to work. — homer_device_id — a random device identifier (UUID v4), created in the browser when a PRO licence is saved or activated on the device. Sent together with the licence key. The server stores only its SHA-256 hash, to link the licence with the device. Necessary for licences assigned to one device (Unlimited and Lifetime). — homer_cookie_consent — the choice in the cookie banner (accepted or essential-only), with no expiry date. Not sent to the server. Necessary to remember the choice. — homer-apicache:* (sessionStorage) — short-lived cache of public page data (themes, advertising, Golden List, YouTube channels), valid for 60 seconds. It contains no message content. Cleared when the tab is closed. Analytics and marketing cookies: the Application does not use them. The pages do not send data to third-party analytics tools. Cookie banner: it records the user’s choice. Whether the banner requires real consent for optional elements (the embedded YouTube player): [to be confirmed].

§ 10. Changes to the Policy

The controller may update this Policy. Changes are marked with a date. Method of notifying significant changes: [to be confirmed].

Privacy principles

  • 🔒 ZERO-KNOWLEDGE — message content is encrypted in the browser (scope in § 2)
  • 🗑️ DATA SCOPE — described in §§ 3 and 9
  • ⏰ RETENTION PERIODS — § 8; some periods are being implemented