Version 2026-11-02
Privacy notice
Effective 1 November 2026. This notice is written for a small, self-hosted, friends-only service. It is not legal advice; the operator should confirm the applicable privacy and child-safety obligations for the audience and jurisdiction.
What we collect
- Account: username, display name, bio, profile image, post images you upload, account status, passkey public keys, a one-way fingerprint of a recovery key if you create one, and timestamps.
- Legacy signup verification: older pending accounts created before invitation-only registration may include who they said they knew and contact methods they chose to provide. This is shown only to admins reviewing the request and is deleted when the account is approved or deleted. New accounts require an invitation and do not collect this.
- Social graph: friend requests, accepted friendships, blocks, and invitation use. Invitation secrets are stored as one-way hashes, not as usable codes.
- Posts: text, audience choice, comments, reactions, edits, and timestamps.
- Chat metadata: Matrix user ID, room IDs, membership, device/session metadata, and timestamps. Message contents are end-to-end encrypted ciphertext; the operator does not hold decryption keys.
- Moderation: reports, the text you submit, reports you make or receive, moderation notes, and audit rows.
- Security: server-side session records (hashed token, expiry), a rotating keyed hash of the client IP for rate limiting and abuse triage, and application logs without message bodies or credentials.
We do not use advertising, third-party analytics, tracking pixels, social plugins, third-party fonts, or CDNs. We do not sell personal data.
Why we process it
To create and secure accounts, enforce invitation-based admission, enforce the friend graph, show posts to the selected audience, connect accepted friends in encrypted chat, deliver invites, handle reports and legal obligations, prevent abuse, back up and restore the service, and comply with applicable law.
End-to-end encrypted chat
Direct messages and the shared Lobby room use Matrix end-to-end encryption, including encrypted chat attachments. The server stores room metadata and encrypted events. It cannot read message contents, decrypt attachments, or recover deleted messages. The Messages view keeps its device keys in your browser's IndexedDB; clearing site data can remove the only local copy, so use the classic chat on an existing device if you need to export keys. If you report a chat, an administrator can see the metadata and the context you submit, not the ciphertext's plaintext.
Retention
- Account and profile data: until you delete your account or an administrator closes it.
- Posts and comments: until you delete them, an administrator removes them, or the account is deleted.
- Encrypted chat: until the room is purged by the operator or Matrix retention rules remove it. Other members may keep copies on their devices.
- Moderation and audit records: retained as needed for safety, disputes, and legal obligations; deleted or archived when no longer needed.
- Logs: short retention (about 14 days), without message bodies, passwords, tokens, or full IP addresses.
- Signup verification: until the account is approved or deleted; contact details are then deleted.
- Browser chat cache and encryption keys: stored on your device in IndexedDB until you clear site data. The server cannot recover a removed device key; old encrypted messages may become unreadable.
- Backups: encrypted, rotated, and retained for a limited recovery window; restored data is subject to the same rules.
Who can see what
Your profile, posts, post images, and profile image are visible to accepted friends. Post images follow the visibility of their post. Posts marked only me are visible only to you and cannot be shared by link. If you create a share link for a friends post, any signed-in member with that link can open that one post. Chat is visible to room members and, in encrypted rooms, only devices with keys. Administrators see account records, reports, metadata, and audit logs, but not encrypted message contents. Service providers that host the VPS or backup storage may process data on the operator's behalf under their terms.
Your choices and rights
You can edit your profile, change your profile image, remove a passkey, rotate or remove a recovery key, revoke sessions, export your data, and request deletion from settings. Depending on your jurisdiction, you may also have rights to access, correct, delete, restrict, or object to processing, and to complain to a supervisory authority. Use the privacy contact below. We may need to verify that the request comes from the account holder.
Account deletion removes the social profile and deactivates the Matrix account. It revokes unused invitations you created but does not delete an account that already joined with one. Encrypted messages already delivered to other people's devices cannot be recalled, and screenshots, downloads, or keys already obtained cannot be taken back. Some records may be retained where required by law or for a legitimate safety investigation.
Children
The service is for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has created an account, contact the abuse address immediately.
Security
We use HTTPS, strict security headers, passkeys or high-entropy recovery keys, server-side hashed sessions, CSRF and Origin checks, rate limits, re-encoded profile and post images, encrypted backups, and least-privilege administration. No system is perfectly secure. Report a vulnerability to the security contact; do not test against another person's account.
Changes and contact
Material changes will update the version date on this page. Privacy: hello@kituwa.com · Abuse: hello@kituwa.com