Privacy Policy
- We collect your email address, your answer to one question, and a record of when you agreed when you join the waiting list. That's it.
- We use them to tell you about the Alpha and the launch, because you agreed to it. We don't sell them, and we don't use them for ads.
- This site has no analytics, no advertising and no tracking. Even our font is hosted by us. It is delivered through Cloudflare, explained below.
- You can delete your address at any time using the link in our emails (open it and confirm), or by writing to privacy@krummo.app.
1. Who we are
The controller responsible for your personal data under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) is:
Krummo is operated by [TO COMPLETE: full name and postal address].
Contact for anything privacy-related: privacy@krummo.app
We have not appointed a Data Protection Officer. The address above reaches the person who handles data protection.
2. What we collect
When you join the waiting list
| Data | Why |
|---|---|
| Your email address | To contact you about the Alpha and the launch. |
| Your answer to "What brings you here?" (keep me updated, test the Alpha, share as a creator) | To decide who to invite and what to tell you about. |
| When you agreed, and which version of this policy you agreed to | To be able to prove your consent, as the GDPR requires. |
Giving us your email is voluntary. Without it we can't add you to the list, but nothing else on this site is affected.
What we do not collect
- No analytics, advertising or tracking tools, and no cookies.
- No IP addresses or device details are stored with your signup. Our server briefly counts requests per IP address in memory to block abuse, and forgets them within the hour.
- No data is requested from you beyond what's listed above.
Technical data processed to serve the site
Like any website, the infrastructure that delivers this site and its signup service (see section 4) processes your IP address and request details, including in short-lived server logs, to deliver pages, keep the service secure and fix faults. This site and its signup service are delivered through Cloudflare, so your requests pass through Cloudflare's network on the way to us. We don't use these logs to identify or profile visitors.
Emails we send you
When you join, we send one confirmation email with a link to delete your address. After that, we email you when Alpha invites start going out and with occasional updates about Krummo. Every email includes a way to unsubscribe.
3. Why we use your data, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Sending you launch, Alpha and update emails | Your consent, Article 6(1)(a). You can withdraw it at any time. |
| Keeping a record that you consented | Our legitimate interest in being able to demonstrate consent, Article 6(1)(f) together with Article 7(1). |
| Keeping the signup form secure and free of spam and abuse | Our legitimate interest in protecting the service, Article 6(1)(f). |
We don't make decisions about you by automated means that have legal or similarly significant effects. We don't sell your data.
4. Who we share it with
We don't sell or rent your data. We use a small number of service providers (processors) who handle it on our behalf and under our instructions, under data processing agreements:
- Content delivery, DNS and security: Cloudflare, Inc. (USA) sits in front of this website and our signup service. It processes your IP address and request details to deliver pages quickly, absorb attacks and block abusive traffic. It acts as our processor under Cloudflare's data processing agreement.
- Our own server: we run the website, the signup service and the database that stores the waiting list ourselves, on a virtual private server that we administer. Your waiting list data is not handed to a hosting platform or a third-party database service. The server is rented from a server hosting company and is located in a data centre in Germany, within the EU.
- Email delivery: [CONFIRM: name the SMTP provider and country, or say that we send emails from our own mail server].
We may disclose data if the law requires it, for example in response to a valid request from a public authority.
5. Transfers outside the EU/EEA
Cloudflare, Inc. is based in the United States, so your IP address and request details can be processed outside the EU/EEA when you visit the site. Cloudflare's data processing agreement includes Standard Contractual Clauses, and Cloudflare participates in the EU-US Data Privacy Framework [CONFIRM against Cloudflare's current certification].
The waiting list itself is stored on our own server in Germany, within the EU. [CONFIRM: add the safeguard used if the email provider processes data outside the EU/EEA, or remove this note if it doesn't.]
6. How long we keep it
- Waiting list data: until you unsubscribe or ask us to delete it, and in any case we delete the waiting list [CONFIRM: 12 months] after Krummo's public launch.
- Proof of consent is part of the same record and is deleted with it.
- Server and network logs are kept only for a short period, as set by Cloudflare and by our own server's log rotation, and then deleted.
When you unsubscribe, your record is permanently deleted, not just hidden.
7. Your rights
You have the right to:
- Access the personal data we hold about you and get a copy.
- Rectify data that is wrong.
- Erase your data (the "right to be forgotten").
- Restrict how we use your data in certain cases.
- Data portability: receive your data in a structured, machine-readable format.
- Object to processing that relies on our legitimate interests.
- Withdraw your consent at any time. This doesn't affect anything we did before you withdrew.
The quickest way to use the right to erasure or to withdraw consent is the unsubscribe link in any email from us. For everything else, write to privacy@krummo.app. We'll reply within one month, and we may need to confirm it's really you before acting on a request.
You also have the right to complain to a data protection supervisory authority, in particular in the EU/EEA country where you live, work or where you think a violation took place. A list is available from the European Data Protection Board. We'd appreciate the chance to put things right first.
8. Cookies and local storage
This site doesn't set cookies. If you pick an accent colour in the theme demo, your browser stores that choice in its local storage on your device so the page can remember it. It is never sent to us, and it's strictly functional, so no consent is required. You can clear it in your browser settings at any time.
All fonts, scripts and images are served from this site, and we don't use third-party fonts, analytics or advertising. Because the site is delivered through Cloudflare, Cloudflare receives your IP address and request details as described in section 4. Cloudflare may also set a strictly necessary security cookie on some visits, for example to tell humans from bots [CONFIRM against the Cloudflare features enabled on krummo.app]. Such a cookie is needed to protect the service and doesn't require consent.
9. Security
We use measures appropriate to the risk, including encrypted connections (HTTPS), access limited to the people who need it, signed single-purpose unsubscribe links, rate limiting and abuse filtering on the signup form, and collecting as little data as possible. No system is perfectly secure. If a breach puts your rights at risk, we'll notify you and the authorities as the law requires.
10. Age
The waiting list is for people aged 16 or over. We don't knowingly collect data from younger children. If you think a child has joined, write to us and we'll delete the record.
11. When the Krummo app launches
Krummo isn't live yet and the Alpha hasn't started. Creating an account and using the app involves more data than the waiting list does, and we'll publish a full privacy notice for it, and tell you about it, before anyone signs up. As a preview of how we're building it:
- Direct messages and group chats, and their attachments, are end-to-end encrypted on your device. Our servers store only ciphertext they can't read.
- Server channels are not end-to-end encrypted. Their messages are stored in readable form so that search, moderation tools and mentions can work. We'll say so clearly in the app.
- Activity, playtime, library and Steam presence will be under your control, and hideable.
12. Changes to this policy
If we change this policy in a way that matters, we'll update the date above and, if it affects how we use your waiting list data, email you first. Earlier versions are available from privacy@krummo.app on request.