Privacy policy

Account: your email address, a securely hashed password or the fact that you sign in with Google, and the dates your account was created and last updated.

Profile: username, display name, bio, profile picture, avatar colour, whether your account is private, your theme choice, and a record of username changes.

Activity: your replies and reposts with the day and time they were written, your likes, who you follow and who follows you, follow requests, accounts you have blocked, and the day counts used to work out your streak.

Messages: direct messages and message requests, including their contents, participants and timestamps.

Bar games: a room code, the nickname you join with, and the answers you give in that room. Guests do not need an account and we do not create one for them.

Technical: ordinary server logs from our hosting and database providers, such as IP address, timestamp and requested page, plus counters used to enforce rate limits so nobody can flood the site.

Posts, likes, reposts, follows and profiles are visible to anyone unless your account is private. Your email address is never shown to other users. Direct messages are private to the people in the conversation.

To provide the service you asked for (performance of our agreement with you): your account, profile, posts, likes, reposts, follows, streaks, messages and game rooms.

To keep llanakin safe and working (our legitimate interest): rate limits, abuse and spam prevention, blocking, moderation, security logs and debugging.

To send necessary emails (performance of our agreement): confirming your address, resetting your password, sign in links and account changes. We do not send marketing email.

To meet legal obligations where we have to keep or hand over records.

We use no advertising or analytics cookies. We store only what the site needs to work: a login session and your theme choice kept in your browser's local storage, and a small same origin cookie holding your session token so that profile pictures of private accounts can be shown to the right people. Clearing your browser storage logs you out.

If you choose Google sign in, Google tells us your email address and basic profile details so we can create or match your account. We get nothing else, and we do not post anything to your Google account. Google's own privacy policy covers what Google does with the sign in.

We use a small number of providers that process data on our instructions: our hosting, database, authentication and file storage provider, our email delivery provider for account emails sent from notify.llanakin.com, Google for optional sign in, and an automated language model service used only to draft the daily question, which never receives your posts, messages or account details.

Some of these providers may process data outside the EU and EEA. Where that happens, the transfer relies on the European Commission's standard contractual clauses or another legal transfer mechanism.

Account, profile and post data is kept while your account exists. Deleting a post removes it right away; copies can remain in backups for up to 30 days. Direct messages are kept until you or the other person deletes the conversation, or until the account is deleted. Game rooms and their answers are deleted when everyone leaves or after a short period of inactivity. Security and rate limit logs are kept for a short period, normally no more than 90 days.

In settings you can change your username, display name, bio and picture, switch between the light and dark theme, make your account private and approve followers, and block accounts. You can delete any of your own posts.

To delete your account, write to hello@llanakin.com from the address you signed up with, or the address on your account. We remove your profile, posts, likes, reposts, follows and messages, and confirm when it is done. Replies from other people that quoted or answered you stay, with your name no longer attached.

Under the GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable form. Where we rely on consent you can withdraw it at any time. Write to hello@llanakin.com and we answer within one month.

If you think we handle your data wrongly you can complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or to the supervisory authority in your own country.

llanakin is not for children under 16. We do not knowingly collect data about them, and we delete such an account and its data when we learn of it. See the terms of use.

Data travels over encrypted connections, passwords are stored hashed, and access to personal data is limited by database level rules so accounts can only reach what they are allowed to see. No service is perfectly secure. If a breach is likely to put you at risk we inform you and the supervisory authority as the law requires.

We update this policy when the service changes. Significant changes are announced in the app or by email before they take effect, and the date at the top always shows the current version.

For any privacy question or request: hello@llanakin.com.