This Privacy Policy describes how personal data is processed in connection with the website umaru.fun (the "Site"). It applies to every visitor and registered user of the Site.

1. Who we are

The operator of the Site is the controller responsible for the personal data described in this Policy. For any question or request under this Policy, contact: [email protected].

2. Data we process

• Account data: your nick and a password hash (scrypt). We do not collect your email address, real name, phone number or postal address, and the Site has no fields for them.
• Profile data you choose to publish: about line, signature, tag, country, personal links and avatar.
• Content: posts, comments, uploaded images and other materials you submit, together with related metadata (time, authorship, board).
• Technical data: IP address, user agent, referrer, requested path, HTTP status code and time of each request. This data is generated automatically by our web server.
• Cookie data: see Section 4.

3. Purposes and legal bases

We process personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR): creation and operation of your account, and publication of your content at your request.
• Legitimate interests (Art. 6(1)(f) GDPR): keeping the Site available and secure, preventing abuse, spam and attacks, enforcing the Terms of Service and defending legal claims, and displaying advertising. The processing is limited to what these goals require.
• Legal obligation (Art. 6(1)(c) GDPR): where retention or disclosure is required by applicable law.

4. Cookies

The Site uses the following cookies:

• sid - keeps you logged in. Strictly necessary. Lifetime: 30 days. HttpOnly.
• csrf - protects forms against cross-site request forgery. Strictly necessary. Session lifetime.
• lang - stores your language choice. Functional; set only when you select a language.

Advertising scripts are loaded on every visit. They are provided by third parties and may set their own cookies or identifiers; see Section 7.

5. Retention

• Logs (IP, user agent, referrer, path): 90 days, then deleted automatically.
• Sessions: until expiry (30 days) or logout.
• Account and profile data: until you request deletion.
• Posts and images: until you request their removal or they are removed under the Terms of Service. Copies of your posts contained in other users' posts or in server backups are not removed automatically.
• Backups: residual copies may persist in server snapshots for a limited period until rotated out.

6. Your rights

Where the GDPR or a similar law applies to you, you have the right to: access your data; rectify inaccurate data; erase data; restrict or object to processing; receive your data in a portable form; withdraw consent at any time where processing is based on it, without affecting the lawfulness of processing before withdrawal; and lodge a complaint with a supervisory authority in your country of residence.

Requests: [email protected]. We respond within 30 days. We may ask you to confirm control over the account before acting on a request.

7. Recipients and international transfers

• Cloudflare Turnstile - anti-bot check at registration; Cloudflare, Inc. (USA) receives your IP address for that purpose.
• Advertising partners - advertising is loaded on every visit. They may set cookies and process your IP address and device data under their own policies; some of them are located outside the EEA and the UK.
• Hosting provider - our server operator stores the data described above on our behalf.

Where personal data is transferred outside the EEA or the UK, we rely on appropriate safeguards (including standard contractual clauses) or on your consent where that is the applicable legal basis.

8. Security

Passwords are stored as scrypt hashes. Session tokens are stored hashed and session cookies are HttpOnly. Forms are protected against CSRF. Access to the server is restricted. No method of transmission or storage is perfectly secure, and absolute security cannot be guaranteed.

9. Children

The Site is not directed at children below the age of digital consent applicable in their country (13 years, or up to 16 in some EEA states). If you are below that age, do not register. If we learn that we process data of a child below the applicable age, we will delete that data.

10. Changes

We may update this Policy. The current version is always published on this page with its effective date. Material changes are additionally announced on the Site. Continued use of the Site after the effective date constitutes acknowledgment of the updated Policy.

11. Contact

[email protected].

Effective date: 29 September 2026.