This Privacy Policy describes how Akatora (“Akatora,” “the Service,” “the Platform”) collects, uses, stores and protects personal data belonging to users (“User,” “you”).
Akatora is a non-profit, non-commercial platform operated by an individual based in Slovenia (the “Operator”).
For the purposes of the General Data Protection Regulation (GDPR), the Operator acts as the data controller.
Contact for all data protection matters: akatoxstudio@gmail.com
The following categories of personal data are collected in connection with use of the Service:
Account data: Email address, username, display name
Profile data: short self-description, gender, birth-year range (generation), languages, hobby interests, avatar and banner images
Location data: General city and country (may be marked private by the User); coordinates the User deliberately selects on the map when creating an event or post (not continuous, live or home-address location data)
Content data: Posts, comments, direct messages, group messages, stream messages, event RSVPs, group memberships, submitted reports and feedback
Technical data: Push notification subscription tokens, login timestamps, hashed IP addresses (used for abuse prevention and to enforce the Europe-only signup restriction described below), country of origin (derived from IP-based geolocation at signup and login), and browser user-agent string (collected during signup, error logging, and push notification registration)
No data listed above is collected for advertising purposes, and no personal data is sold or disclosed to advertisers.
Account and profile data: Provision of the Service the User has registered for (Performance of a contract)
General location (city/country): Displaying nearby groups and events (Performance of a contract)
User-selected event coordinates: Enabling event/post placement functionality initiated by the User (Performance of a contract)
Content data (posts, messages, etc.): Core functionality of the Service (Performance of a contract)
Login timestamps: Platform security and abuse prevention (Legitimate interest)
Hashed IP addresses and country of origin: Enforcing the Service’s Europe-only signup restriction and preventing fraudulent signups or abuse (Legitimate interest)
Browser user-agent string: Diagnosing technical errors and securing account and push-notification delivery (Legitimate interest)
Direct messages between Users are encrypted at rest in the database using server-side AES encryption. This means message content is not stored in plain, readable text. However, this is not end-to-end encryption: the Operator’s server retains the technical capability to decrypt and access direct message content (for example, in response to a report of abuse or a legal request).
Group messages and stream (topic-based) messages are not encrypted. Users should not treat any messaging feature on the Service as a substitute for a fully end-to-end encrypted communication tool, and should exercise discretion regarding sensitive information shared through any messaging feature.
Personal data may be disclosed to the following categories of recipients, strictly as necessary to operate the Service:
No personal data is sold, rented, or disclosed to advertisers or data brokers.
Personal data is stored on servers located within the European Union: Supabase (Ireland) for the database, authentication and personal avatar/banner storage and Oracle Cloud Infrastructure (Milan, Italy) for other user-generated image storage.
Akatora’s frontend, content delivery network, and same-origin API functions are hosted on Vercel. Vercel operates a global infrastructure network, and this processing may take place through servers located outside the EU/EEA. Such processing is subject to Vercel’s own applicable international-transfer safeguards.
Certain other limited processing — authentication via Google, IP-based country lookups via ipdata.info and api.country.is, reverse geocoding via Photon (Komoot), map font delivery via OpenMapTiles, and static asset delivery via GitHub — may involve the transfer of limited data (such as an IP address or map coordinates) to providers that may operate outside the European Economic Area (EEA). These providers operate under their own applicable data transfer safeguards.
Active account data (profile, posts, messages): Retained while the account remains active
Data following account deletion: Deleted or anonymized within 30 days of the deletion request (see also Terms & Conditions, Section 3.3)
Notifications: Automatically deleted after 90 days
Login history: Automatically deleted after 14 days
Signup attempts: Automatically deleted after 30 days
Signup verification tokens: Automatically deleted after 7 days
Profile view records: Automatically deleted after 90 days
Recovery sessions: Automatically deleted after 30 days
Resolved or dismissed bug reports: Automatically deleted 30 days after resolution or dismissal
Admin audit logs: Retained for 2 years
Banned IP records: Retained until manually removed by an administrator
Application logs: Automatically deleted after 30 days
Profile change history: Retention is two-staged. The previous and updated values of a changed profile field are erased after 30 days, leaving only a record of which field changed and when; that limited record is deleted after 365 days.
Moderation action records: Automatically deleted after 2 years (the separate admin audit log, above, has its own 2-year retention)
Account-deletion cleanup jobs: Once a cleanup job completes successfully, the job record is deleted 30 days later. Pending or failed jobs are kept until they complete, so that deletion of the underlying data can be retried.
Image moderation records: Tied to the lifecycle of the underlying image; deletion timing depends on application-level cleanup and may occasionally lag behind removal of the image itself. No fixed retention period applies to this category at present.
Under the GDPR, Users have the right to:
Requests relating to the above rights may be submitted to akatoxstudio@gmail.com.
Please refer to the separate Cookie Notice for information regarding data stored in the User’s browser.
The Service is intended solely for individuals aged 18 years or older. The Operator does not knowingly collect personal data from individuals under the age of 18. Age is confirmed by User self-declaration at the time of registration.
This Privacy Policy may be amended from time to time. The “Last Updated” date at the top of this document will be revised accordingly. Users will be notified directly of any material changes affecting their rights.
Inquiries regarding this Privacy Policy or the processing of personal data may be directed to: akatoxstudio@gmail.com
Last updated: 8 September 2026 (Ljubljana, Slovenia)