Plazer privacy policy

1.1The controller of personal data processed in connection with using Plazer is Michał Fox, ul. Józefa Mackiewicza 25, 31-214 Kraków, Poland, email: kontakt@plazer.org ("we").

1.2This policy covers the plazer.org website, the app at app.plazer.org, the central server at api.plazer.org and the community server at srv.plazer.org. Capitalised terms have the meaning given to them in the Terms of service.

1.3This policy does not cover Third-party servers. The controller of data on such a server is the person who runs it.

2.1This is how data processing in Plazer looks in a few sentences. The details follow below.

• We do not ask for a phone number or an email address. You sign up with a name and a password.
• Only the participants know what is said in direct messages, groups and private channels. We store and relay ciphertext we cannot read.
• We use no analytics, ads, tracking pixels or third-party scripts, neither on plazer.org nor in the App. None of them sets cookies.
• We do not sell data or share it for marketing.
• You download your account data in the App settings and delete the Account there yourself.

3.1The plazer.org website describes Plazer. It has no forms or accounts, uses no analytics, ads or external scripts, and loads its fonts and images from its own server.

3.2The server that delivers the website keeps a standard access log: IP address, date and time, the address of the page opened, the response code and the browser header (User-Agent). We use it to protect the website against abuse and to diagnose failures.

3.3The website stores the theme you picked in your browser's storage if you change it, and once installed as an app also a copy of its pages and files for offline use. This data stays on your device, never reaches us, and you remove it by clearing the site data in your browser.

4.1When you use the App, the Central server and our Community server process the following data:

Account

username, display name, the password as a bcrypt hash that cannot be reversed, and the date the Account was created.

Profile, if you fill it in

pronouns, bio, colour, avatar, banner, status, profile colours, per-server profiles and your time zone if you turn on showing your local time.

Keys

public keys of the account and its devices, device certificates, the signed device list and the encrypted envelope of the identity key, which only your Recovery key opens. Private keys and the Recovery key never reach us.

Sign-in and security

sessions (a hash of the token, a shortened browser description, the last IP address, when it was created and last used), the authenticator app secret and backup codes encrypted with AES-256-GCM, the public keys of passkeys and the account security log.

Relationships and settings

friends and invites, blocks, ignored people, your private notes about others, message requests, server memberships and roles, account, privacy and notification settings, saved and scheduled messages and favourite GIFs.

Content readable by the server

messages, attachments, reactions and polls in public channels of Central server servers and of srv.plazer.org.

Calls

who called whom, when, for how long, who answered and whether the camera was on. We never see the video or hear the audio.

Reports

the reason, a description of up to 1000 characters and the evidence: a channel message as we hold it, or for an encrypted conversation the copy provided by the reporter.

Data export

the file with your Account data that we prepare when you ask for it.

Correspondence

your email address and the message when you write to us at kontakt@plazer.org.

4.2A username and a password are needed to create an Account. The rest of the profile is optional.

5.1Your device encrypts the content of direct messages, groups and private channels, their attachments and the names and avatars of private groups with the MLS standard (RFC 9420). We store and relay only ciphertext and hold none of the keys that open it.

5.2To deliver a message, the Central server sees metadata: who writes to whom, when and how many bytes, group membership, presence, typing indicators and read status. Our Community server also sees who writes in private channels, when and how much, and their names and topics.

5.3Public channels of Central server servers work differently: their content is readable by the server, and the Central server prepares the preview of a pasted link. It then fetches the linked page from its public address and keeps a thumbnail of its picture for as long as the message exists.

6.1We process IP addresses in the following places:

Session

the last IP address the session was used from. The device list shows only the network: /16 for IPv4 and /48 for IPv6.

Security log

when you sign in from a new browser we record the browser description and the network at the same precision, never the full address.

Known sign-in places

a cryptographic hash of the browser, the system and the network, from which the IP address cannot be read. It is used to recognise a sign-in from a new place.

Rate limits

request counters tied to an IP address, which expire within an hour at most.

Unfinished sign-up

the address it was started from, to limit mass account creation.

Voice calls

our relay carries the call when devices cannot connect directly. It then processes IP addresses and relays encrypted video and audio, while hiding your address from the other participants.

Access log

the HTTP server in front of the App, the Central server and the Community server records the IP address, date and time, the requested address, the response code and the browser header.

6.2The technical logs of the Plazer programs themselves contain error descriptions and, when an error concerns a specific account, its identifier. They contain no IP addresses and no message content.

7.1When you turn notifications on, your browser creates a subscription with its vendor's push service and gives us its address and the keys for encrypting notifications.

7.2We encrypt every notification with your browser's key and pad it to a fixed size. The push service sees the subscription address, the time and the size of a notification, but not who wrote, in which conversation or what.

7.3Community servers, Third-party servers included, wake your devices through the Central server and never get your subscription address.

8.1We process data for the following purposes:

Providing the Services

running the Account, delivering messages, servers and calls, notifications, data export and Account deletion. Legal basis: performance of a contract, article 6(1)(b) GDPR.

Security

protecting accounts from takeover, detecting new sign-ins, rate limits, protection against spam and abuse, and logs. Legal basis: our legitimate interest in keeping the Services secure, article 6(1)(f) GDPR.

Moderation

handling reports and acting on illegal Content. Legal basis: obligations under Regulation (EU) 2022/2065, article 6(1)(c) GDPR, and our legitimate interest in keeping the community safe, article 6(1)(f) GDPR.

Correspondence and complaints

replying to messages and handling complaints. Legal basis: article 6(1)(b) and (f) GDPR.

Legal claims

establishing, pursuing and defending legal claims. Legal basis: article 6(1)(f) GDPR.

8.2The spam filter automatically assesses message requests using, among other things, the age of the sender's account, the number of their requests and the number of blocks. It may move a request to filtered requests, but it makes no decisions with legal effects on you. We do not profile Users for marketing.

9.1Retention periods come from the settings of our servers and from the Plazer code:

Account, profile, keys, relationships and settings

until the Account is deleted, which happens 7 days after you ask for it. We then remove them, and an anonymised record with the identifier and a deleted account label stays in the database.

Unfinished sign-up

24 hours at most, together with the address it was started from.

Sessions

until you sign out, and 30 days at most without use.

Known sign-in places

180 days after the last sign-in from that place.

Security log

for as long as the Account exists. After the Account is deleted the entries stay with the anonymised record, without a name or profile.

Message ciphertext

until every recipient device has fetched it, 30 days at most. A device inactive for 30 days is removed from conversations.

Encrypted attachments

90 days after they were sent, or earlier if the author deletes them or the group is deleted.

Content readable by servers

for as long as the server it was published on exists. A message deleted by its author or a moderator stops being visible to everyone. After an Account is deleted its messages stay under the deleted account label.

Call entries

30 days after the call ended.

Notification subscriptions

until you turn notifications off, sign the device out or the session expires.

Data export

7 days after the file is ready.

Reports

for as long as needed to handle them and to protect against repeated abuse.

Technical logs

until overwritten in the rotation cycle: the logs of the Plazer programs take at most five files of 20 MB per service.

Correspondence

for as long as needed to deal with the matter, and if it concerns a complaint or a claim, until the limitation period ends.

10.1We pass data on only where the Services need it or the law requires it:

• the Polish provider of the infrastructure Plazer's servers in Poland run on, which stores data on our behalf;
• the push service of your browser's vendor, for example Google, Apple, Microsoft or Mozilla, to the extent described under push notifications;
• operators of Third-party servers you join yourself: such a server receives your Account identifier, name, profile, public keys and whatever you publish there;
• a server's moderators when you report a message or a person on that server;
• public authorities where the law requires it.

10.2Other Users see what you show them: your profile, messages and presence, according to your privacy settings.

11.1The servers behind the app and the Central server (app.plazer.org and api.plazer.org) and the community server srv.plazer.org run in Poland, in the European Union, with a Polish infrastructure provider.

11.2Browser push services may process data outside the European Economic Area, in particular in the United States. Such transfers rely on the European Commission adequacy decision for the EU-US Data Privacy Framework, for providers covered by it, or on standard contractual clauses.

11.3These providers receive only the subscription address and an encrypted notification of fixed size, never message content.

12.1Under the GDPR you have the right to:

• access your data and get a copy, including as a file from the App settings;
• rectify your data, most of which you can correct yourself in the settings;
• erasure, including by deleting the Account;
• restriction of processing;
• data portability in a structured format;
• object to processing based on legitimate interest.

12.2To exercise your rights, write to kontakt@plazer.org. We reply within one month. We do not know your email address, so we may ask you to confirm the Account is yours, for example through an action taken from the signed-in Account.

12.3You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, or with the supervisory authority of the country where you live.

13.1Neither the plazer.org website nor the App sets cookies.

13.2The App keeps the device's private keys, the state of encrypted conversations, the session and your settings in the browser's storage on your device. Where the browser supports it, private keys cannot be exported from it.

13.3This storage is strictly necessary for features you use, so it does not require consent. You remove it by signing out or clearing the site data in your browser, but the device then has to be added to the Account again.

14.1We use technical and organisational measures appropriate to the risk: encrypted connections, end-to-end encryption of private conversations, bcrypt hashes instead of passwords, storing only hashes of session tokens, encrypted two-step verification secrets and a root key kept off the servers.

14.2What exactly protects Plazer, what the planned audit will cover and how to report a vulnerability is on the Security page.

14.3If a personal data breach occurs, we will notify the President of UODO and, where the breach is likely to result in a high risk to your rights, you as well, in a way available in the App.

15.1When we change how we process data, we will update this policy and the date at its top. We will announce significant changes in the App before they take effect.

15.2This policy is in force from 25 October 2026. The Polish version is binding, and the English version is a translation of it.