Privacy notice

This is a translation of the Spanish privacy notice. If the two versions differ, the Spanish version prevails.

Last updated: [COMPLETE: date, for example January 1, 2027].

Who is responsible for your data

[COMPLETE: your full name or your company's name], with address at [COMPLETE: full address], is responsible for the processing of your personal data in La casa de las salas sin ventanas (the app for Windows and Android, and this site).

For any privacy matter, write to [COMPLETE: privacy contact email].

What data we process

Data you give us when you create your account and use the platform:

• Your email address. It is stored encrypted.
• Your nickname, your status and whether you are a man or a woman. Gender is only used so that notices use the right grammatical form in Spanish (for example, "amigo" or "amiga").
• Your password. We do not store it as is: we only store a fingerprint that cannot be reversed.
• Your profile photo, if you choose to upload one, or the avatar you pick.
• What you publish: permanent messages, posts and replies, and the messages in the general chat and in rooms.
• Your friendships, requests, blocks, saved rooms, privacy options, language and time zone.
• The results of your games and your statistics.

Data generated when you use the platform:

• Every time you sign in: the date, your IP address (encrypted), a code for your device (encrypted), the type of device and the app version.
• The reports you make or that others make about you, and the sanctions you receive.
• On Android, a code to send you notifications.

We do not ask for sensitive, financial or property data. The platform does not ask for your real name.

What we use your data for

Purposes necessary to provide the service:

• Creating your account, verifying your email and signing you in.
• Showing your profile, your messages, your posts and your games to other people, according to your privacy options.
• Sending you verification and password recovery codes.
• Protecting security and coexistence: detecting duplicate accounts, handling reports and enforcing the community rules.
• Handling your requests and complying with legal obligations.

Purposes that are not necessary:

• None. We do not use your data for advertising, we do not sell it and we do not build commercial profiles.

Messages and reports

Messages in the general chat, in rooms and private messages are not stored in the database: they can only be seen while the session lasts.

Permanent messages and posts are stored, because they are meant to be read later.

Messages do not have end-to-end encryption: the server sees them as they pass through it.

When someone makes a report, the last 20 items of the session history of the person reporting and of the reported person are stored with it. They may include private messages. Only the moderators and administrators read them, to handle the report.

Moderators and administrators only read a conversation of permanent messages when someone reports it, and this is recorded.

Who we share your data with

We do not sell or share your data with other companies for their own purposes.

For the platform to work, some providers process data on our behalf and only to provide their service to us:

• Vultr, in whose data center in Mexico City the server with the database is located.
• Cloudflare, which protects the site and routes connections to the server.
• Brevo, which sends the codes to your email (your email address, your nickname and the code).
• Backblaze, which stores the encrypted database backups in [COMPLETE: region you choose, for example the United States].
• Google (Firebase Cloud Messaging), only on Android, for notifications.

We may hand over data to an authority when a law or an order from a competent authority requires it.

How long we keep your data

As long as your account exists. If you delete your account:

• Your email address, password, photo, status, friendships, requests, blocks, saved rooms and notifications are deleted.
• Your posts and permanent messages remain under the name "Deleted user", so that other people's conversations are not left incomplete.
• Your nickname is reserved for 30 days and then released.
• Sign-in records, reports and sanctions are kept for 12 months (sanctions, 12 months after they end) for security and to prevent someone from coming back with another account after a ban.
• If your account had an active ban, a fingerprint of your email address and your device is kept until the ban ends, so that you cannot come back with a new account.

Your rights (ARCO)

In Mexico these are called ARCO rights. You can request at any time, free of charge:

• Access: knowing what data of yours we hold. In the app, Options, Account, "Export my data" gives you a copy.
• Rectification: correcting inaccurate data. You can change almost all of it yourself in your profile and your options.
• Cancellation: having us delete your data. You can delete your account in the app, in Options, Account, or on the "Delete your account" page of this site.
• Objection: having us stop using your data for a given purpose.

You can also revoke your consent or limit the use of your data.

For anything you cannot do yourself in the app, write to [COMPLETE: privacy contact email] with your name or nickname, the email address of your account, the right you want to exercise and what you are asking for. We will answer within 20 business days at most, and if your request is granted we will carry it out within the following 15 business days. These periods can be extended once for an equal period, if there is a justified reason.

If you do not agree with the answer, you can go to the Secretaría Anticorrupción y Buen Gobierno (the Mexican Ministry for Anti-Corruption and Good Governance), the personal data protection authority in Mexico.

Minors

You must be at least 13 years old to create an account. If you are under 18, you need permission from your mother, your father or your guardian, who can ask us at any time to see or delete the data in your account.

Security

Email addresses, IP addresses and device codes are stored encrypted. Passwords are stored as a fingerprint that cannot be reversed. The connection between the app and the server is encrypted. Only the main administrator and the secondary administrators can see other people's email addresses, and only to moderate.

Cookies

This site does not use tracking or advertising cookies.

Changes to this notice

If this notice changes, we will let you know with an announcement inside the platform and we will change the "Last updated" date. If the change adds a new purpose that requires your consent, we will ask you for it first.