Privacy Policy
Version 2026-10-22 · applies to Crypt Chat, Crypt Poll, Crypt Todo, Crypt Paste and this site.
In short
- No accounts, no ads, no tracking, no analytics services, no cookies.
- We store what you put into a space, for the period you choose, on a server in Germany (EU).
- Deleted and expired content is kept for up to 3 months to investigate abuse, then permanently erased.
- Web server logs with IP addresses are kept for about 14 days. Other abuse protection uses only scrambled (hashed) IP addresses.
- The operator can view content to handle abuse reports and run the service. Every view is logged.
1. Who is responsible
Crypt is run by Jojaweb (the "operator", "we"). Contact for privacy questions and requests: contact@jojaweb.lu.
2. What we store and why
- Content you create: chat messages, names you type, reactions, polls and votes, todo lists and items, pastes, titles and settings. Needed to provide the service you asked for.
- Secret links: we store only an irreversible fingerprint (hash) of each link's token, so we cannot rebuild your links.
- Device ID: your browser creates a random ID (not linked to your identity). It is sent with requests and stored on the server only in hashed form, so that e.g. each device votes once, slow mode and muting work, and you can delete your own messages.
- Web server logs: IP address, time, requested address (without link tokens), browser type, referring page (if your browser sends one), response status and size. Used for security and troubleshooting.
- Abuse protection: scrambled (keyed-hash) IP addresses for rate limits and the daily creation limit, blocks against abusive networks, and abuse reports you send us.
- Operator action log: what the operator viewed or changed, and why.
- Anonymous usage statistics: counts per hour (for example "12 new spaces"). They contain no personal data.
We do not sell data, show ads, use tracking or analytics services, or build profiles.
3. Stored in your browser
Crypt uses your browser's local storage (not cookies) for: your device ID, the version of the Terms you accepted, the list of spaces you recently opened (including their links, so you can reopen them) and the name you use in chats. You can remove the list with "Forget all" on each app's start page, or clear all of it in your browser settings.
4. How long we keep data
| Data | Kept for |
|---|---|
| Content you create | The period you choose (1 day, 7 days, 30 days or until deleted), then up to 3 months more to investigate abuse, then permanently erased. Content unchanged for 2 years is deleted the same way. |
| Chat history | Busy rooms keep only the newest messages (1,000 per person who posted, at least 1,000 and at most 50,000); older ones are erased. |
| Deleted content (by you or the operator, or burned after reading) | Up to 3 months to investigate abuse, then permanently erased |
| Backups | 7 days (rolling) |
| Web server logs, including IP addresses | About 14 days |
| Abuse-prevention counters (hashed IP addresses) | 48 hours |
| Blocks of abusive networks (hashed IP addresses) | Until the block ends |
| Abuse reports | Until handled, then 1 year; the reporter's hashed IP address is removed after 48 hours |
| Operator action log | 1 year |
| Anonymous usage statistics (counts only) | Indefinitely |
5. Who can see your data
- People with a link to a space see its content, according to the link's level (admin, participate or view).
- The operator can view any content to handle abuse reports, enforce the Terms and run the service. Each view and action is recorded in the operator action log.
- Our hosting provider runs the server in Germany (EU) on our behalf.
- Authorities, only where we are legally required to share data.
Notifications to the operator about new spaces and reports contain only the app name and event type, never content or IP addresses, and run on the operator's own server.
6. Legal bases
- Providing the service you request under the Terms: GDPR Art. 6(1)(b).
- Security, abuse prevention, logs, backups, keeping deleted content for 3 months and the operator action log: our legitimate interest in a safe, working service, GDPR Art. 6(1)(f).
- Sharing with authorities when required by law: GDPR Art. 6(1)(c).
7. Your rights
You have the right to access, correct, delete or restrict the processing of your data, to data portability, and to object to processing based on legitimate interest. Because there are no accounts, we can only find your data through a space's link. Email contact@jojaweb.lu with the link (or the space ID) and what you want. For deletion requests, the admin link proves the space is yours. Admins can also delete a space themselves in its settings.
8. Complaints
You can complain to a data protection authority. In Luxembourg this is the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu.
9. Changes
If this policy changes, we update the version date above.