Privacy Policy

This policy explains what wastedpenguinz.com and the Wasted Penguinz mobile and desktop apps collect about you, why, and what you can do about it. It describes what the service actually does — not a generic template.

1. What we collect and why

Account

A username and a password, which is stored only as a bcrypt hash — we cannot read it. Optionally an email address and a phone number, each confirmed before use. If you switch on two-factor authentication we store your authenticator secret and recovery codes in encrypted form. Legal basis: performance of our agreement with you.

What you post

Messages in public rooms, private messages, group messages, uploaded images and files, reactions, profile fields (bio, favourite track, country, avatar, banner, links) and any support tickets you open. Message bodies and uploaded files are encrypted at rest on our server. Legal basis: performance of our agreement with you.

Technical and security data

Your IP address, browser or app user agent, session identifiers, connection and presence times (including "last seen"), and records of moderation actions taken on your account. IP addresses are used to rate-limit sign-in attempts, to detect and block abuse, and to enforce bans. Legal basis: our legitimate interest in keeping the service secure and usable for everyone.

Activity in the community

XP, levels, badges, quests, streaks, game scores, leaderboard positions and event participation. Legal basis: performance of our agreement with you.

Payments and orders

If you donate, subscribe to VIP, buy merchandise or order a personal service, we record the transaction: amount, currency, date, what was bought, and the identifiers our payment provider gives us. We never see or store your card number — that goes directly to Stripe. For physical orders we also process the delivery name and address you give us. Legal basis: performance of our agreement with you, and our legal obligation to keep accounting records.

Messages we send you

Transactional email (address confirmation, password reset, order confirmations) is sent on the basis of our agreement with you. Newsletters, the weekly digest and streak reminders are sent only if you have opted in, and every one of them carries an unsubscribe link. Legal basis: consent, which you can withdraw at any time.

Push notifications

If you allow notifications, we store the push subscription your browser or device gives us so we can deliver them. Turning notifications off removes it. Legal basis: consent.

Translation

Messages written in another language can be translated for you automatically. The translation runs on our own server, on software we host ourselves — the text of your messages is not sent to Google, DeepL or any other translation service. Translations are cached on our server alongside the message so the same text is translated only once. You can turn this off in Settings. Legal basis: our legitimate interest in an international community being able to understand each other.

2. Who we share it with

We do not sell your data and we do not use it for advertising. We use the following providers, each only for the purpose listed:

Voice and video calls run on our own servers — the media relay (TURN) and the call server (LiveKit) are operated by us in Germany, not by a third party.

Providers outside the EU/EEA receive data under the European Commission's Standard Contractual Clauses, or under the EU–US Data Privacy Framework where they are certified.

We may also disclose data where the law requires it, or where it is necessary to establish, exercise or defend legal claims.

3. How long we keep it

• Your account and what you posted: until you delete your account (see section 5).
• Accounting records — invoices, orders, donations, subscription payments: seven years after the end of the financial year, because Swedish bokföringslagen (1999:1078) requires it. We keep these even if you delete your account; GDPR Article 17(3)(b) allows this where retention is required by law.
• Security and moderation records — including IP addresses attached to bans: as long as needed to keep the ban effective.
• Backups: rotated copies of the database, overwritten in the ordinary cycle.

4. Your rights

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you (access, and portability in a machine-readable form);
• correct data that is wrong or incomplete;
• erase your data — see section 5, which you can also do yourself at any moment;
• restrict or object to processing we carry out on the basis of legitimate interest;
• withdraw consent for newsletters or push notifications, without affecting what was sent before.

Write to privacy@wastedpenguinz.com and we will answer within one month. If you think we have handled your data wrongly you can complain to the Swedish authority, Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, imy.se.

5. Deleting your account

You can delete your account yourself: open Settings → Delete account, confirm with your password, and type your username. It happens immediately and cannot be undone. Precisely what happens:

• Removed: your profile, email address, phone number, two-factor secrets, sessions, friends and blocks, private messages in both directions, push subscriptions and notification settings.
• Kept, but no longer linked to you: posts you made in the public rooms. They stay so that other people's conversations still make sense, and are shown as "Deleted user" with no way back to your identity.
• Kept: records of purchases, donations and subscription payments, for the seven-year accounting period described above.
• Kept: moderation records, where removing them would let a ban be evaded.

If you would rather have your public posts removed as well, email us and we will consider the request.

6. Security

Passwords are hashed with bcrypt. Message bodies and uploaded files are encrypted at rest. All traffic runs over TLS. Two-factor authentication is available to every account and required for staff. The server is hardened — key-only SSH access, an active firewall, automatic security updates and rate limiting on sign-in.

7. Cookies and local storage

We set one cookie: your signed-in session. There are no advertising or analytics cookies and no third-party trackers. We use your browser's local storage to remember preferences such as your theme.

8. Children

The service is not intended for children under 13, and we do not knowingly create accounts for them. If you believe a child has an account here, contact us and we will remove it.

9. Changes

If we change this policy we will update the date at the top and, for anything significant, tell you in the app.