Privacy Policy

This policy explains how KoalaForums (“we”, “us”) collects, uses, and protects your personal information, and the rights you have over it. We are the data controller for your account. Questions? Email privacy@koalaforums.com.

When you create an account we collect your email and a username. If a feature asks you to confirm your age, we store your birth year only — never the full date. Anything you choose to publish (posts, reviews, lists, ratings, comments, uploads, edits) is associated with your account.

We detect your country at sign-in from your IP address and store it as a two-letter country code, not your raw IP. Standard server logs (IP, user-agent, timestamps) are kept transiently for security and abuse prevention. Where a legal complaint mechanism exists (e.g. a DMCA notice), we retain a salted hash of the submitter’s IP and the user-agent string for audit purposes.

If you contact us by email or a contact form, we keep that message and your address for as long as needed to handle your request and any follow-up.

• Operate the service — authentication, account recovery, features
• Personalize what you see from your own activity
• Apply moderation and enforce our terms
• Detect abuse and respond to legal or safety requests
• Process payments and manage subscriptions (where offered)
• Send transactional email you ask for (sign-in, receipts, replies)

We do not sell your data, we do not show third-party tracking ads, and we do not run cross-site advertising trackers.

We use a single essential cookie for your Supabase login session. That cookie is strictly necessary to keep you signed in and cannot be turned off while you use an account. We set no third-party advertising or analytics cookies and load no cross-site tracking pixels.

If we ever enable product analytics, it is cookieless and privacy-first (no cross-session identity, no personal identifiers), and it stays off unless you opt in via the cookie banner. We also honor your browser’s Global Privacy Control (GPC) and Do-Not-Track signals — if either is present, no analytics runs regardless of the banner. You can change your choice anytime from the “Your Privacy Choices” link in the footer.

We keep the list short and use reputable processors, each bound by a data-processing agreement to use your data only to provide their service to us:

• Supabase — database and authentication (stores your account and content).
• Stripe — payment processing, where a paid plan is offered. Your card details go directly to Stripe; we never see or store them. See Stripe’s privacy policy.
• Resend — sends transactional email (sign-in links, receipts, replies).
• Self-hosted fonts — our fonts are served from our own domain. We do not use Google Fonts or any third-party font CDN, so no font provider sees your IP.

Wherever you live, you can ask us to access the data we hold about you, export a copy, correct it, delete it, and opt out of any non-essential processing. To exercise them:

• Export your data instantly at /account/export.
• File an access, correction, or deletion request at /api/privacy/data-requests or from your account settings.
• Or email privacy@koalaforums.com and we will verify and respond within the timeframe your law requires (45 days under CCPA/CPRA; one month under GDPR).

California residents have the right to know, delete, correct, and opt out of the sale or sharing of personal information, and not to be discriminated against for exercising these rights. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. Because there is no sale or share, there is nothing to opt out of — but we still honor the Global Privacy Control signal as a valid opt-out and record it as your “Do Not Sell or Share” choice. Categories we collect: identifiers (email, username, IP-derived country), commercial information (subscription tier, if any), internet activity (your posts, ratings, and session timing), and inferences drawn from your own activity.

Our legal bases for processing are:

• Contract — operating the service you signed up for.
• Legitimate interest — security, moderation, and fraud prevention.
• Consent — optional analytics, marketing email, and any age-gated content opt-in (withdrawable at any time).
• Legal obligation — responding to lawful requests and safe-harbor duties.

You have the rights of access, rectification, erasure, restriction, portability, and objection, and may lodge a complaint with your supervisory authority. KoalaForums is not directed to children: we do not knowingly collect data from anyone under 13 (US) or under your country’s digital-consent age (13–16 in the EU). If a parent/guardian believes a child has created an account, email privacy@koalaforums.com and we will remove it.

Account data is kept while your account is active. When you delete your account we remove identifying data within 30 days. Messages sent to our contact address or forms are retained only as long as needed to resolve your request, then deleted. A limited set of records (payment receipts, moderation and legal notices) is retained where the law or our safe-harbor obligations require it.

We may update this policy; material changes will be surfaced in-app or by email. For any privacy question or to exercise your rights, contact privacy@koalaforums.com.