Privacy Policy
Effective 16 September 2026 · Terms of Service
The short version. No accounts, no ads, no tracking, no selling of data — ever. Answers are end-to-end encrypted so our servers can't read them. Rooms and everything in them are deleted within 48 hours. We only use strictly necessary cookies, which is why there is no cookie banner.
Who we are
BothSay (bothsay.app) is operated by its developer, based in Iceland (the "controller" under EU/EEA data-protection law, which applies to us directly). Contact for anything in this policy, including privacy requests: hello@bothsay.app.
What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
Room content: the question, optional display names you choose,
and answers. Answers are end-to-end encrypted on your device with a
key carried only in the room link's fragment (the part after
#, which browsers never send to servers) — we store and
relay ciphertext we cannot read. |
Running the room you asked for | Contract — Art. 6(1)(b) | Deleted 48 h after creation (24 h if the room is never used) |
| Connection data (IP address, request metadata) handled transiently to serve requests; for rate limiting we briefly store only a one-way hash of the IP | Delivering the site; preventing abuse, spam, and cost attacks | Legitimate interests — Art. 6(1)(f) | Hashes expire within 24 h; never stored with content |
| Aggregate usage counters (e.g. "rooms created today: 14") with no names, content, identifiers, or IPs attached | Understanding whether the product works | Not personal data | Indefinitely (anonymous) |
| Feedback you send through the feedback form (free text; please don't include personal details) | Reading and acting on your feedback | Legitimate interests — Art. 6(1)(f) | Until reviewed and dismissed; at most 200 entries are retained |
| Abuse reports: reported room id, timestamp, short reason — nothing about who reported | Reviewing and removing abusive rooms | Legitimate interests — Art. 6(1)(f) | Until resolved; at most 100 entries |
| If you buy BothSay Plus (when available): payment is handled entirely by Paddle as merchant of record — we never see card details. We store only an opaque transaction reference and random device identifiers (up to 5) used to activate your purchase | Delivering what you bought | Contract — Art. 6(1)(b) | For the life of the purchase or subscription |
Cookies and on-device storage
We use no analytics, advertising, or tracking cookies, and nothing that follows you across sites. That's why there's no consent banner: EU ePrivacy rules require consent only for storage that isn't strictly necessary, and everything below is either strictly necessary or a function you invoke yourself. You can clear all of it in your browser at any time.
| Item | Type | What it does |
|---|---|---|
bs_gate | Cookie (30 days) | Remembers that you entered the invite code during the private preview. Disappears from use when the preview ends. |
st_admin | Cookie (7 days) | Sign-in session for the site operator only; visitors never receive it. |
| Theme, language, display name | Local storage | Remembers choices you made so you don't repeat them. |
| Per-room tokens and encryption keys | Local storage | Lets you re-open your own rooms and decrypt their answers. Stored only on your device. |
| Plus entitlement | Local storage | Proves a purchase on this device (when Plus is available). |
Service providers
BothSay runs on Cloudflare (hosting, networking, DDoS protection, and the Turnstile bot check on our forms). Cloudflare processes connection data such as IP addresses to deliver and protect the site, under our data-processing agreement, and participates in the EU–US Data Privacy Framework with standard contractual clauses as fallback. Turnstile is a privacy-preserving alternative to CAPTCHAs and is not used to track you. Fonts and all other assets are served by us directly — no third-party font or script CDNs see your visits. When Plus launches, Paddle acts as merchant of record for purchases under its own terms and privacy policy.
We do not sell or share personal information for advertising, so there is nothing for a Global Privacy Control signal to opt out of — but we honor its spirit by default.
International transfers
Cloudflare operates a global network, so requests are served from a location near you and data may transit outside the EEA. Transfers are protected by the safeguards above. The content that matters most — the answers — is end-to-end encrypted wherever it travels.
Link previews and share cards
When someone shares a room link, chat apps fetch a preview containing the question and how many people have answered — never answer content. After a reveal, participants can generate a share image containing the revealed answers; creating and sending that image is their choice.
Your rights
If you're in the EEA, UK, or a jurisdiction with similar laws, you have the right to access, correct, delete, restrict, or receive a copy of your personal data, and to object to processing based on legitimate interests. Email hello@bothsay.app — include the room link where relevant, since we have no accounts to look you up by. Two honest caveats: encrypted answers are unreadable to us, so the most we can do is delete the room (which we will, on request); and most data deletes itself within 48 hours anyway. You also have the right to complain to your data-protection authority — ours is Persónuvernd (Iceland).
California residents: we don't sell or share personal information as defined by the CCPA/CPRA, and we honor the rights above for everyone, regardless of where you live.
Children
BothSay is not directed at children under 13, and we don't knowingly collect their personal information. If you believe a child under 13 has used the service, contact us and we'll delete the relevant rooms.
Security
All traffic is encrypted in transit (TLS). Answers are end-to-end encrypted with keys we never receive; remaining room data is encrypted at rest. Access to operational data is limited to the operator.
Changes
If this policy changes materially, we'll update the date above and note the change here. Continued use after a change means the new policy applies.