Introduction

I am committed to safeguarding the privacy of my service users at Istorya.

This policy applies where I am acting as a data controller with respect to the personal data of my service users; in other words, where I determine the purposes and means of the processing of that personal data.

Your use of my service manifests your consent to transmission of personal data specified in this policy.

How I use your personal data

I may process information included in your personal profile on my service ("profile data"). The profile data may include your matching details such as your college and gender, as well as your match preferences. I do not ask for your real name, phone number, address, or payment details. The profile data may be processed for the purpose of enabling and monitoring your use of my service and pairing you with the right people.

I may process data about your use of my service ("usage data"). The usage data may include your IP address (which is hashed for privacy), referral source, length of visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of your service use. This usage data may be processed for the purposes of analyzing the use of my service. The legal basis for this processing is your consent in the form of use of my service as stated in Section 1, and my legitimate interests, namely monitoring and improving my service.

I may process information contained in any enquiry you submit to me ("enquiry data").

I may process information relating to my customer relationships, including contact information ("customer relationship data"). The customer relationship data may include your contact details, and information contained in communications between me and you (such as messaging via my Facebook profile). The customer relationship data may be processed for the purposes of managing my relationships with users, communicating with users, and keeping records of those communications.

I may process information that you provide to me for the purpose of receiving notifications ("notification data"). The notification data includes browser device tokens and may be processed for the purposes of sending you alerts when a match is found.

I may process information contained in or relating to any communication that you send to me ("correspondence data"). The correspondence data may include the communication content and metadata associated with the communication. The correspondence data may be processed for the purposes of communicating with you and record-keeping.

I may process information about your client application (web browser) and its environment (operating system and hardware) used to access my service ("client data"). The client data may include browser fingerprint (via FingerprintJS), a device ID cookie, and a one-way hashed IP address. I need this kind of data for safety checks, stopping spam, enforcing bans, and the proper administration of my service. I do not use this for ads or tracking across other sites.

I may process information that you send in text messages through my service ("message data"). The message data is saved in a locked, unreadable form instead of plain text. The message data may be processed for the purposes of enabling such transfer and administering my service. I need this kind of data for the proper administration of my service.

I may process information about your communication with other users in my service ("communication data"). The communication data may include client and usage data for both sides, the time and date of communication happened and its length.

I may process information about your ban ("ban data") in case you have been banned for violating my community rules. The ban data may include your safety identifiers (browser fingerprint, device ID cookie, hashed IP) necessary to block you from using my service for a determined period. This helps prevent immediate re‑entry, even if cookies are cleared. I need this kind of data for the proper administration of my service.

I may process complaint information ("complaint data") if another user of my service complains about you. I need this kind of data for the proper administration of my service.

I do not process information relating to financial transactions, as I do not sell your data or request payment details.

Like many site operators, I may process information that your browser sends whenever you visit my site ("log data"). The log data may include your IP address, browser type and version, the pages of my site that you visit, the time and date of your visit, the time spent on those pages and other statistics. I need this kind of data for the proper administration of my service.

I may process any of your personal data identified in this policy where necessary for the establishment, exercise or defense of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.

I may process any of your personal data identified in this policy where necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, or obtaining professional advice.

In addition to the specific purposes for which I may process your personal data set out in this Section, I may also process any of your personal data where such processing is necessary for compliance with a legal obligation to which I am subject, or in order to protect your vital interests or the vital interests of another natural person.

Please do not supply any other person's personal data to me, unless I prompt you to do so.

Providing your personal data to others

I may display the following data to other users: your selected college and your gender (for matching purposes).

I may disclose your personal data to my insurers and/or professional advisers insofar as reasonably necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, obtaining professional advice, or the establishment, exercise or defense of legal claims.

In addition to the specific disclosures of personal data set out in this Section, I may disclose your personal data where such disclosure is necessary for compliance with a legal obligation to which I am subject, or in order to protect your vital interests or the vital interests of another natural person.

My service relies on connecting you with other users. While communicating, identifying safety identifiers might be processed by my backend, but your IP address and personal identity are not shown to the other user by the service’s interface.

International transfers of your personal data

Users of my service may be located in multiple locations. I have developed data practices designed to assure information is appropriately protected but I ask you to be aware of the privacy and data protection laws in the jurisdiction in which you reside. As otherwise stated in this policy, you acknowledge that, the ultimate responsibility for the information you choose to share is yours.

You acknowledge that personal data that you submit for publication through my service may be available, via the Internet, around the world. I cannot prevent the use (or misuse) of such personal data by others.

Retaining and deleting personal data

Personal data that I process for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

I will retain your profile data as long as your session is active, or as long as I consider necessary for the purposes described in this policy.

I will not retain your message data indefinitely. Messages are kept only to keep the chat running, and to keep the system lightweight, I automatically remove messages after a short period (a few hours).

I will retain your ban data as long as it is necessary to maintain the ban technically for a determined period.

I will not retain your communication data indefinitely. I store minimal information related to whom and when you communicated beyond the active session logs.

Notwithstanding the other provisions of this Section, I may retain your personal data where such retention is necessary for compliance with a legal obligation to which I am subject, or in order to protect your vital interests.

How I protect your personal data

I employ proper technical and physical measures to protect the personal data of my users from loss, destruction, change, unauthorized access, disclosure, or any other illegal forms of processing.

I employ a modern means of protection for the personal data of all users according to the current state of the industry. This includes, for example, firewalls, password protection and other access and authentication controls.

I use a secure server software (SSL) to encrypt user data before it is sent to me, and my database is hosted in a secure environment.

Only authorized personnel have access to user data.

However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. I cannot ensure or warrant the security of any information you transmit to me or store on my service, and you do so at your own risk. I also cannot guarantee that such information may not be accessed, disclosed, altered, or destroyed by breach of any of my physical, technical, or managerial safeguards. If you believe your personal data has been compromised, please contact me as provided below.

Children’s online privacy

Protecting the privacy of young children is especially important. My service is built for college student conversations and is not intended for children or minors under the age of 18 years. I do not knowingly collect data from children under 18 years of age and do not wish to do so.

By using my service, you represent that you are at least 18 years of age. If you are under 18 years of age, then please do not use or access my service at any time or in any manner. If I learn that personal information from users less than 18 years of age has been collected, I will take reasonable measures to promptly delete such data from my records.

About cookies

A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server.

Cookies may be either "persistent" cookies or "session" cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date; a session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed.

Cookies do not typically contain any information that personally identifies a user, but personal information that I store about you may be linked to the information stored in and obtained from cookies.

Cookies that I use

I use cookies for the following purposes:

(a) authentication and sessions - I use a session cookie to keep you signed in while you chat and navigate my website;

(b) safety and anti-abuse - I use a device ID cookie and browser fingerprinting to stop spam and enforce bans and maintain community safety.

Managing cookies

Most browsers allow you to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version.

Blocking all cookies will have a negative impact upon the usability of many websites.

If you block cookies or deny fingerprint-based safety checks, you will not be able to use all the features on my website and may not be able to connect to chats.

External URLs

I reserve the right to place external links to websites and third party goods throughout my service.

I attempt to always provide links and URLs to respected websites, however, I do not accept responsibility for any contents, security, or actions taken on such websites.

When you navigate to any third party website, any personal data that you provide is managed exclusively by the privacy policy of that particular website and I do not assume any responsibility for the data you decide to provide.

Do Not Track mechanisms

Your browser may deliver a "Do-Not-Track ('DNT') signal," or similar mechanism for exercising choices about the collection of information about your online activities. Because technology continues to change, I do not guarantee that I will honor DNT signals or similar mechanisms at this time.

Amendments

I may update this policy from time to time by publishing a new version on my website.

You should check this page occasionally to ensure you are happy with any changes to this policy.

Contact

If you have any questions, concerns, recommendations, or notice a bug, please message me directly on my Facebook profile: facebook.com/ke1th.dev.

© 2026 Istorya - All rights reserved.