Privacy

Privacy statement

Beta version, 12 October 2026. Written in plain language, based on what the platform really does.

What we process and why

• Account: e-mail address (signing in with a code), creation date, sessions. If you switch on the second step: the secret of your authenticator app (encrypted) and your recovery codes (only as a hash); both are gone when you switch the second step off or delete your account. Basis: contract.
• Rooms: screen name per room, memberships, rooms you follow, settings. Basis: contract.
• Messages and topics: what you write, with time and room. Chat disappears after the room's retention period (30 days by default); topics stay as long as they are published. Basis: contract.
• Moderation: automatic pre-checking of text, reports, decisions with a reason, appeals and an audit log. Basis: legitimate interest (safety) and legal obligations.
• Audio table: who is at the table and in which role; short fragments from speakers can be checked automatically as text. Fragments are deleted immediately; only when there is a signal does a short text stay for 30 days for the room's moderation. No conversations are recorded. Basis: legitimate interest; you see this before you turn on your microphone.
• Paying: subscription, status and invoice details at our payment provider; we do not keep card or account numbers. Basis: contract and legal retention obligation (7 years for invoice data).
• Partner sites: if you sign in via a partner site, we only receive an anonymous link from that site — no e-mail address, no roles. The link applies to one room.
• Technical: IP address and browser in security logs (briefly), usage meters without content.
• Measuring whether it works: a small number of events without content (room opened, joined in, first message, reply received, came back, embed loaded) with a code per account that cannot be traced back instead of your data, kept for 90 days and only looked at as totals. No message text, no e-mail address, no tracking across websites. Basis: legitimate interest (improving the product).
• Sites and visitors: what a station puts on its site, and the number of visitors per day: counted with a daily changing code derived from the IP address, without a cookie, and deleted after 35 days. Basis: legitimate interest.
• Song requests: artist, title and a short greeting; only the host sees the greeting. Deleted after 30 days. Basis: contract.
• Recordings: when a host records a broadcast, we keep the recording until the host deletes it; everyone at the table sees that recording is on. Basis: the host's contract; participants see it in advance.
• Own domain: the DNS settings of a station's domain, such as the mail records we copy when it moves to our nameservers; no personal data of visitors. Basis: contract.
• Gifts to a creator's own account: who gave which effect, the amount and whether the payment arrived, for the limits and for questions. The payment itself happens at the creator's own payment service (Mollie, Stripe or PayPal): you pay the creator directly and give your payment details only to that service. We store the creator's key encrypted. Basis: contract.

What we do not do

• No advertising network, no tracking across sites, no selling of data.
• Private content never goes to advertising and not to routine external AI.
• No newsletter without separate consent.

Processors

• Hosting in Amsterdam (UpCloud); security and cache via Cloudflare.
• Live chat transport (Centrifugo) on our own servers.
• Audio/video: LiveKit Cloud (project data in Frankfurt).
• Automatic text checking and AI drafts for session reports: OpenAI moderation and, where needed, Anthropic — only text from public conversations, without names; for a doubtful case also the title and at most five earlier public contributions from the same conversation, so the meaning is judged in context; a draft only from public rooms and only when the host asks for one; the AI conversation starter only in public communities that switched it on themselves, with at most twenty recent messages from people in that conversation, without names, and only when someone asks for it. Never private or members-only content.
• Speech-to-text for the sample: Deepgram — only audio bytes, no identity.
• Paying: Stripe. E-mail: Amazon SES.
• Not a processor but a service of its own: streams from YouTube or Twitch in a room. Their player only loads once you click Watch the stream; from then on their own privacy rules apply. YouTube videos come from youtube-nocookie.com, and a TikTok live opens on TikTok itself.
• Own domains through our nameservers: Bunny DNS (BunnyWay, Slovenia) runs the DNS zone of that domain. Certificates for https: Let's Encrypt (with ZeroSSL as fallback); only the domain name is sent.
• Radio: the streaming service a station uses; we only fetch which song is playing. Your own station with Groot runs at SendFM, the radio service of the owner of HangLobby (website in the Netherlands, radio servers in Germany). For that we pass on the name of the station and the e-mail address of the owner, and for a request from the music only which song (no name or greeting).
• Recordings of broadcasts: object storage (S3) in the EU, only when a host records.
• Gifts to a creator's own account do not run through our payment provider but through the creator's own payment service; that service is not our processor.

Retention periods

• Chat messages: the room's retention period (30 days by default). Topics: as long as they are published.
• Reports and audio signals: 30 days; moderation decisions and the audit log: up to 1 year.
• Account: until you delete it. Deleting erases your messages, frees your screen name and is applied again after a backup restore.
• IP address with neighbourhood notices and the replies to them: 180 days, only visible to platform administration, to tackle abuse and answer a police demand.
• Photos with neighbourhood notices: cleaned when added (location and other data in the file removed) and faces, licence plates and other text made unrecognisable; only that version is kept, at most until a week after the notice expired.
• Site visitors: 35 days. Song requests (with the greeting): 30 days. Gifts to a creator's own account: 13 months. Recordings: until the host deletes them.

Your rights

Access and export: My rooms → Your data. Deleting: on the same page. Appeal against a moderation decision: via the decision itself. For other requests or complaints, mail the contact address above; you can also go to the Dutch data protection authority.