Privacy Policy
Effective 23 September 2026 · Terms of Service
The short version. No accounts, no ads, no tracking, no selling of data — ever. Answers are end-to-end encrypted so our servers can't read them. Rooms and everything in them are deleted within 48 hours. We keep our own daily tallies (how many rooms were created, which chat apps links get opened from) with no cookies, no device identifiers, and no third-party analytics. We only use strictly necessary cookies, which is why there is no cookie banner.
Who we are
BothSay (bothsay.app) is operated by its developer, based in Iceland (the "controller" under EU/EEA data-protection law, which applies to us directly). Contact for anything in this policy, including privacy requests: hello@bothsay.app.
What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
Room content: the question, optional display names you choose,
and answers. Answers are end-to-end encrypted on your device with a
key carried only in the room link's fragment (the part after
#, which browsers never send to servers) — we store and
relay ciphertext we cannot read. |
Running the room you asked for | Contract — Art. 6(1)(b) | Deleted 48 h after creation (24 h if the room is never used) |
| Connection data (IP address, request metadata) handled transiently to serve requests; for rate limiting we briefly store only a one-way hash of the IP | Delivering the site; preventing abuse, spam, and cost attacks | Legitimate interests — Art. 6(1)(f) | Hashes expire within 24 h; never stored with content |
| Aggregate usage counters (e.g. "rooms created today: 14", "room links opened from WhatsApp today: 9"). See Usage statistics below for exactly what is counted and how. | Understanding whether the product works and where people find it | Deriving the labels from a request: legitimate interests — Art. 6(1)(f). The stored counts themselves are not personal data. | Daily breakdowns 30 days; lifetime totals indefinitely (anonymous) |
| Feedback you send through the feedback form (free text; please don't include personal details) | Reading and acting on your feedback | Legitimate interests — Art. 6(1)(f) | Until reviewed and dismissed; at most 200 entries are retained |
| Abuse reports: reported room id, timestamp, short reason — nothing about who reported | Reviewing and removing abusive rooms | Legitimate interests — Art. 6(1)(f) | Until resolved; at most 100 entries |
| If you buy BothSay Plus (when available): payment is handled entirely by Paddle as merchant of record — we never see card details. We store only an opaque transaction reference and random device identifiers (up to 5) used to activate your purchase | Delivering what you bought | Contract — Art. 6(1)(b) | For the life of the purchase or subscription |
Usage statistics (no cookies, no identifiers)
We run our own counters on our own servers instead of a third-party analytics product. When a page is requested, we derive a handful of coarse labels from the request and add one to the day's count for each label; the request details are then discarded. Nothing is set on your device for this, and no label can be traced back to you. The labels are:
- Referring site — the site name (only the domain, e.g. "tiktok.com") if your browser sent one, otherwise "direct".
- Country — a two-letter country code that Cloudflare derives from the IP address. The IP address itself is not stored for this.
- Device and app type — phone / tablet / desktop, and which chat app's built-in browser opened the link (e.g. WhatsApp, Instagram), derived from the browser's User-Agent string. The string itself is not stored.
- Language — the first language your browser prefers (e.g. "is").
- Campaign tag — the
?s=or?utm_source=value on a link we published, if any. - Room settings and timing — group size, room theme, reveal style, how long a room took to reveal, and whether an unrevealed room was empty, partly answered, or fully answered when it expired. Never the question, answers, or names.
- Interface actions — that a share, copy-link, theme choice, "suggest a question" pack, or feedback box was used, sent by the page as a plain "this happened" ping.
- Been here before — when you create or join a room, whether this browser already held keys for other rooms (none / a couple / several). This is read from the room keys the app already keeps so you can get back into your rooms; nothing is written for it, and the answer is a bucket, not a count or an identifier.
Each label is a separate count. We never store them together, so the data cannot describe a person or a visit — only, for example, "41 room views from Iceland today" and, separately, "12 from WhatsApp". Link-preview fetches by chat apps are counted separately from people. Rare labels are folded into "other". Because there is no identifier, we cannot tell whether you have visited before, and we have no way to look up or delete "your" entries — there are none.
Cookies and on-device storage
We use no analytics, advertising, or tracking cookies (our usage counters above work without any), and nothing that follows you across sites. That's why there's no consent banner: EU ePrivacy rules require consent only for storage that isn't strictly necessary, and everything below is either strictly necessary or a function you invoke yourself. You can clear all of it in your browser at any time.
| Item | Type | What it does |
|---|---|---|
bs_gate | Cookie (30 days) | Remembers that you entered the invite code during the private preview. Disappears from use when the preview ends. |
st_admin | Cookie (7 days) | Sign-in session for the site operator only; visitors never receive it. |
| Theme, language, display name | Local storage | Remembers choices you made so you don't repeat them. |
| Per-room tokens and encryption keys | Local storage | Lets you re-open your own rooms and decrypt their answers. Stored only on your device. |
| Plus entitlement | Local storage | Proves a purchase on this device (when Plus is available). |
Service providers
BothSay runs on Cloudflare (hosting, networking, DDoS protection, and the Turnstile bot check on our forms). Cloudflare processes connection data such as IP addresses to deliver and protect the site, under our data-processing agreement, and participates in the EU–US Data Privacy Framework with standard contractual clauses as fallback. Turnstile is a privacy-preserving alternative to CAPTCHAs and is not used to track you. Fonts and all other assets are served by us directly — no third-party font or script CDNs see your visits. When Plus launches, Paddle acts as merchant of record for purchases under its own terms and privacy policy.
We do not sell or share personal information for advertising, so there is nothing for a Global Privacy Control signal to opt out of — but we honor its spirit by default.
International transfers
Cloudflare operates a global network, so requests are served from a location near you and data may transit outside the EEA. Transfers are protected by the safeguards above. The content that matters most — the answers — is end-to-end encrypted wherever it travels.
Link previews and share cards
When someone shares a room link, chat apps fetch a preview containing the question and how many people have answered — never answer content. After a reveal, participants can generate a share image containing the revealed answers; creating and sending that image is their choice.
Your rights
If you're in the EEA, UK, or a jurisdiction with similar laws, you have the right to access, correct, delete, restrict, or receive a copy of your personal data, and to object to processing based on legitimate interests. Email hello@bothsay.app — include the room link where relevant, since we have no accounts to look you up by. Two honest caveats: encrypted answers are unreadable to us, so the most we can do is delete the room (which we will, on request); and most data deletes itself within 48 hours anyway. You also have the right to complain to your data-protection authority — ours is Persónuvernd (Iceland).
California residents: we don't sell or share personal information as defined by the CCPA/CPRA, and we honor the rights above for everyone, regardless of where you live.
Children
BothSay is not directed at children under 13, and we don't knowingly collect their personal information. If you believe a child under 13 has used the service, contact us and we'll delete the relevant rooms.
Security
All traffic is encrypted in transit (TLS). Answers are end-to-end encrypted with keys we never receive; remaining room data is encrypted at rest. Access to operational data is limited to the operator.
Changes
If this policy changes materially, we'll update the date above and note the change here. Continued use after a change means the new policy applies.