Privacy Policy
Who is responsible
Cinderlight, owner Verena Böttcher, Altmarkt 10, 01067 Dresden, Germany, email: [email protected]. The legal notice (Impressum) lists the same details.
What we process in the app
- Account: email address and password. The password is stored only as a hash.
- Profile: name, bio, date of birth, profile picture. The date of birth is used to enforce the 18+ age limit and cannot be changed once set.
- Content: posts, chat messages, characters and character sheets, forum threads and comments, likes and votes, uploaded images.
- Communities: memberships and roles, reports sent to community or app teams (reason, note), and the moderation log.
- Notifications: in-app notifications. On Android, a device token for push messages.
- On your device: app settings are stored locally and are not sent to us.
We do not collect location data, do not access your contacts, camera or microphone, show no ads, and use no analytics or tracking services.
Why, and on what legal basis
To run your account and show your content: contract (Art. 6(1)(b) GDPR). To handle reports, prevent abuse and enforce the age limit: legitimate interest and legal obligation (Art. 6(1)(f) and (c)). For push messages: your consent (Art. 6(1)(a)), which you can withdraw per group in Settings or in Android.
Who can see your data
Other members of a community can see your name, picture, bio, posts and messages there. Only invited members and the community team can see private rooms. When you write as a character, the character name is shown and the community team can see who the author is.
Service providers
- Supabase hosts the database, sign-in and file storage. The server region is Ireland (eu-west-1).
- Google Firebase Cloud Messaging delivers push messages on Android. Your device token is sent to Google for this.
For transfers to the US we rely on EU Standard Contractual Clauses or the EU-US Data Privacy Framework where the recipient is certified.
Retention and deletion
We keep your data while your account exists. When you delete the account, your account, profile, chat messages and files are deleted. Communities you owned pass to another member, or are deleted if nobody else is in them. Moderation log entries stay without your name, shown as "Gelöschtes Konto".
You can delete your account in the app under Settings, or email us from your account address with the subject "Delete account". See Konto löschen.
This website
The website runs on our own server, rented from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is in Hetzner's data centre in Helsinki, Finland, inside the EU. We have a data processing agreement with Hetzner.
When you open a page, the server stores technically required data such as IP address, time, requested page and browser identifier in log files, to deliver the site and protect it from attacks (Art. 6(1)(f) GDPR). We delete the log files after 14 days.
The website sets no cookies and loads nothing from other servers. Fonts and images are served from our own server.
If you email us to join the waitlist, we keep your address only to invite you to the beta (Art. 6(1)(a) GDPR) and delete it whenever you ask.
Your rights
You have the right to access, correct, delete, restrict, port and object to the processing of your data (Articles 15 to 21 GDPR). You can export your data and delete your account in the app. For anything else, write to the address above. You may also complain to your data protection authority.
Age limit
Cindel is for people aged 18 and over. If we learn of an account under 18, we delete it.