Privacy Policy

Last updated 2026-10-24

This explains what Zuse (zuse.chat), run by AstroPanda Games, collects about you, why, who sees it, and what you can do about it. We keep it short because the service is small: there are no ads, no trackers and no selling of data.

What we collect

• Your login. Your email address, and either a password (stored only as a salted hash by our sign-in provider, never in readable form) or the identity of the Google or Discord account you signed in with. From Google or Discord we also receive basic profile details such as your name and picture. Your name is kept with your login and is not shown to other users unless you add it to your profile. Your picture is copied to your profile when you sign up (see below); you can change or remove it in Settings.
• Your profile. Your username, and optionally a display name, a picture and a short bio, which other signed-in users can see. The picture is the address of the one from your Google or Discord account, or of a Gravatar you choose; we do not upload or store picture files. Your join date and role (such as channel operator or Zuse staff) are shown too.
• Friends, status and when you were last here. Optional extras on your profile (a status line, pronouns, up to three links), the time your last connection ended, your friends and friend requests, and the people you have blocked (they are not told). You choose who can see when you are online and were last online (everyone, only friends, or nobody), and whether friends can see which public channel you are in. Friend requests that nobody answers are removed after a month.
• What you do in channels. The messages you send, which channels you belong to and your role there, and moderation records: mutes, bans, reports about you or filed by you (including a copy of a reported message), and an audit log of actions by operators and staff, which Zuse staff can read. In a support channel, only you and the people who answer there (Zuse staff and channel operators) can read what you write, and it is stored like other messages.
• XP and levels. How much XP you have and your level, which are shown on your profile, when you were last active enough to earn XP, how much you earned each day (to apply daily limits), and a short log of recent awards and any changes staff made, kept for about 30 days. Your level is public. The leaderboard is public too: it lists your name, picture, level and XP unless you hide yourself in Settings, and levels can give you roles. We also keep your daily streak, and an invite code of your own; if you used someone's invite link (or people used yours) we keep who invited whom and whether it was rewarded, and staff can review invites that look suspicious. XP is included in the copy of your data you can download, and deleted with your account.
• Bots. If you create a bot: its name, which scopes it has, and when each token was created and last used. Tokens themselves are stored only as a hash.
• Technical data. Your IP address and what you request reach our hosting and traffic-protection providers. We use IP addresses briefly, in memory, to limit abuse (for example too many connections or failed sign-ins). Web server request logs (IP address, time and address requested) are kept for about 14 days.
• Browser storage. Your sign-in session is kept in your browser (cookies or local storage) so you stay signed in. We do not use advertising, analytics or tracking cookies.

How we use it

To run the service: sign you in, show your messages to the people in a channel (including recent messages to people who join), keep channels safe (moderation, reports, abuse limits), keep the service working and recoverable (monitoring and backups), answer your messages, and meet legal obligations. We do not use your data for advertising or sell it.

Who sees it

• Other users. Everything you post in a channel is visible to the people who can see that channel, and public channels are open to anyone with an account. Recent messages are shown to people who join later. Assume it can be copied.
• Channel operators see what is in their channels. Zuse staff and the people who run the servers can see stored data, including private channels, when needed to run the service, handle reports, enforce our terms or follow the law. Private channels are not end-to-end encrypted. Zuse staff can also watch a channel, a private one included, without appearing in its user list, to look into abuse; every such visit is logged.
• Companies that help us run Zuse:
  • Supabase: stores accounts, sign-in data and all chat data (database in the United States).
  • Vercel: serves the website.
  • Cloudflare: DNS and traffic protection for zuse.chat, and storage for encrypted backups.
  • Vultr: hosts the server that delivers chat messages.
  • Google and Discord: only if you choose to sign in with them.
  • UptimeRobot: checks that the service is up; it never sees user data.
• Picture hosts. Your picture is not hosted by us. When it is shown, the browser of each person looking at it loads it from Gravatar (Automattic), Google or Discord, who can see that request, including the viewer’s IP address. If you choose a Gravatar, you enter an email address in Settings; we turn it into the picture’s web address with a one-way code and do not keep the email. Anyone who already knows your email address can work out the same code, so use an address you are happy to link to this account.
• Authorities, if we are legally required to, or need to protect people’s safety. We will not hand data to anyone else.

Your data is processed in the United States and in other countries where these providers operate. Where the law requires it, we rely on the safeguards those providers offer for international transfers.

How long we keep it

• Your account and messages stay until you delete your account (in Settings, or by emailing us).
• Encrypted backups: nightly copies are kept for 45 days and the first-of-the-month copy for 13 months. Deleted data can remain in backups until they expire, and we do not restore it unless we have to recover from a failure.
• The staff audit log is kept for 365 days and resolved reports for 365 days after they were resolved; open reports are kept until they are resolved.
• Request logs: about 14 days.

Your choices and rights

In Settings you can change your profile, download a copy of your data, and delete your account, all by yourself. You can also link or remove sign-in methods there.

Deleting your account takes effect immediately and cannot be undone. It removes your login, your profile, your messages and your bots with their tokens, and signs you out everywhere. Channels you own are deleted if nobody else has joined them, and otherwise handed over to Zuse staff so the people in them do not lose their channel. Reports about you, and the copy of a reported message inside them, may be kept where needed for safety, and a record that an account was deleted is kept without anything that identifies you. Deleted data can remain in encrypted backups until they expire (see above).

For anything else, such as a correction we cannot make in Settings, or if you cannot sign in, email contact@zuse.chat. We aim to answer within 30 days. Depending on where you live (for example the EU, the UK or California) you may have further rights, such as objecting to our use of your data or complaining to your data protection authority; write to us and we will honour them as the law requires.

Children

Zuse is not for anyone under 13 (or a higher age where the law requires). We do not knowingly collect data from younger children. If you think a child has an account, tell us and we will remove it.

Security

Connections use encryption, bot tokens and passwords are stored only as hashes, backups are encrypted, and access to the servers is limited. No service is perfectly secure, so please use a strong, unique password or sign in with Google or Discord.

Changes

If we change this policy we will update the date at the top, and tell you on the site if the change matters. See also the Terms of Service.

Contact

AstroPanda Games, contact@zuse.chat.