Privacy Policy

DRAFT, not yet in effect

Raftie is a place to practise speaking languages with real people in live voice rooms. This policy explains what we collect when you use it, why, who helps us run it, and the choices you have. We keep it short and we only collect what the app needs to work.

Raftie is run by [COMPANY OR OWNER NAME], [ADDRESS]. You can reach us at [CONTACT EMAIL].

What we collect

• Your Google account basics. When you sign in with Google we receive your name, email address and Google’s account id. We don’t receive your Google password or contacts.
• Your profile. The name you show (it starts as the first name on your Google account, and you can change it), the languages you speak and learn, your level, and an avatar colour we pick for you.
• Your date of birth. We ask once, to check you are 13 or older. It is never shown to anyone.
• What you do in Raftie. Rooms you start (their name, language, level, tags and seats, and when they opened and closed), which rooms you are in and when, rooms a host removed you from, who you follow and who follows you, who you block, reports you send, and reports other people send about you (including what they wrote).
• A sign-in cookie. It keeps you signed in for up to 30 days. We store only a scrambled (hashed) copy of it.
• Technical data. Like any website, our hosting provider and its network see your IP address when they carry your traffic. Our own server keeps, in memory only, when you were last active (to show people you follow that you are online) and, for visitors who aren’t signed in, how many requests an IP address has made (to stop abuse). We don’t write either to our database.

What we don’t collect

• Voice is not recorded. Voice travels live between the people in a room and is not stored by us or our voice provider.
• Room chat is not stored. Chat messages are kept in memory only while people are in the room (at most the last 50), so people who join late can catch up. They are gone shortly after the last person leaves, or when our server restarts.
• No camera, no video, no contacts, no precise location, and no advertising or analytics trackers.

Who can see what

• Anyone, even without signing in, can see your name, avatar colour, languages, the year you joined, and the room you are talking in. Rooms and the people in them are shown in the public lobby.
• Outside rooms, whether you are online is shown only to people you follow. While you are in a room, anyone can see that.
• Who you block, who reported whom, your email address and your date of birth are never shown to other people.

Why we use it

• To run your account and the rooms, chat, follows and safety features you use (this is needed to provide the service you asked for).
• To keep people safe: checking age, acting on reports, and preventing abuse (our legitimate interest in a safe community, and legal duties).
• We don’t sell your data, and we don’t use it for advertising profiles.

Who helps us run Raftie

These providers process data for us, only to provide their service:

• Google, for sign-in. Opening the sign-in button loads it from Google, which then sees your IP address and uses its own cookies there.
• Google Fonts, which serves the fonts the site uses; your browser fetches them from Google, which sees your IP address. [Owner: we plan to serve the fonts ourselves, which removes this.]
• DigitalOcean and its network partner, which host our servers and carry traffic to them.
• Neon, which hosts our database.
• LiveKit, which carries live voice between people in a room. It receives your user id, display name, avatar colour and IP address, and keeps call logs (who was in which room, and when), but not the audio.

Some of them may process data outside your country, including in the United States. [Lawyer: confirm transfer safeguards, e.g. Standard Contractual Clauses, for each provider.]

How long we keep it

• Your account and profile: until you delete your account.
• Sign-in sessions: they expire after 30 days and are deleted soon after.
• Rooms: kept as a history after they close (their details and who hosted them), until the host’s account is deleted. [Owner: decide a retention period.]
• Reports, removals from rooms, follows and blocks: deleted when either person’s account is deleted. [Owner: we plan to keep reports after deletion, for safety.]
• Accounts that sign in but never finish setting up: [Owner: decide, e.g. deleted after 30 days].

Teenagers

Raftie is for people aged 13 and older. If someone tells us they are under 13, we delete their account straight away and keep none of their details. If you believe a child under 13 is using Raftie, tell us at [CONTACT EMAIL] and we will remove the account. [Lawyer: some EU countries set the age of digital consent at 14, 15 or 16; check whether parental consent is needed for users below that age where Raftie is offered.]

Your choices and rights

• You can change your name and languages at any time from your profile.
• You can ask for a copy of your data, ask us to correct it, or ask us to delete your account by writing to [CONTACT EMAIL]. [Owner: a “Delete account” button in the app is planned.]
• If you are in the EU or UK you can also complain to your local data protection authority.

Cookies and storage

We set one cookie, to keep you signed in. It is needed for the service, so there is nothing to opt into. The Google sign-in button comes from Google and Google’s own cookies apply to it. If someone enters a birth date under 13, we remember that on the device (in the browser’s storage, until it is cleared), so the age check can’t simply be retried.

Changes

If we change this policy in a way that matters, we will tell you in the app before it takes effect.