Your privacy matters

Privacy Policy

Working draft · Review and complete before public launch

This draft describes the current development release and is not a final privacy notice. Before launch, the operator must identify the data controller, hosting and email providers, applicable legal basis, international transfers, retention schedule, user-rights process, and required regional disclosures with qualified privacy counsel.

1. Information used by this release

When you apply for an account, the service processes your nickname, email address, and password. Passwords are stored as bcrypt hashes and are not saved as plain text. Pending application details are available to authorized administrators for review. If approved, the service creates a profile that can hold an optional short introduction. Rejected applications and their account records are removed. The service also creates security session records and one-time password-reset tokens.

2. How information is used

Account information is used to review applications, secure approved accounts, provide account sign-in, save your introduction, and respond to password-reset requests. A short arithmetic challenge and temporary, in-memory request counters help limit automated sign-in attempts.

3. Email and service providers

Password-reset email is sent through the SMTP provider configured by the service operator. Registration approval is handled by an administrator and does not send an email. If email is not configured in a local development environment, reset links are printed to the local server terminal for testing and are not emailed. Production mode refuses to start without SMTP configuration.

4. Cookies and security

The service uses a first-party, HTTP-only session cookie with SameSite protection. Production cookies are marked Secure and require HTTPS. The service also uses a per-session request token to help protect account changes from cross-site requests. These measures reduce risk but cannot guarantee that a service or device is completely secure.

5. Storage and retention

The current release stores account and profile data in a SQLite database in the configured data directory. Session and one-time reset records expire; account records remain until an operator deletes them. A public deployment needs a documented retention schedule, verified deletion and export procedures, backups, access controls, and a process for privacy requests before collecting member information.

6. Sharing and tracking

This release does not include third-party analytics, advertising pixels, public profile discovery, direct messages, media uploads, or payment processing. Information is shared with the configured email provider only as needed to send account messages, and with hosting providers needed to operate the service. The operator must update this notice before enabling additional features or providers.

7. Your choices and contact

Do not use a real password you use elsewhere when testing this development site. To ask about account data, deletion, or privacy, contact the FunZone4U administrator. The operator must replace this placeholder with verified contact details and explain how requests are handled before public launch.