Privacy notice
What we collect, why, how long we keep it, and how you get it back or get rid of it. Written to satisfy the GDPR and the Swiss Federal Act on Data Protection.
Controller
MastrLabs GmbH, Musterstrasse 1, 3600 Thun, Switzerland. Contact: privacy@peerforge.social
Data is hosted in Switzerland. Where a processor outside Switzerland or the EU is used, transfers rely on standard contractual clauses.
What we process, and on what legal basis
Account data: email address, username, display name, language, password hash or passkey credential. Basis: performance of the contract.
Content you publish: posts, forum threads, replies, media, sources and disclosures. Basis: performance of the contract. Public content is visible to everyone by design.
Wallet addresses you connect, plus the signature that proves ownership. Basis: consent, and connecting a wallet is optional. We never receive private keys or seed phrases and never ask for them.
Usage data: device type, coarse language and region, feature usage, and ranking events that produce the why am I seeing this explanation. Basis: legitimate interest in operating and improving the service.
Payment data: invoices, amounts, transaction hashes. Card details are processed by the payment provider, never by us. Basis: contract and legal retention duties.
Moderation data: reports, decisions, appeals. Basis: legitimate interest in a safe service and compliance with legal duties.
What we do not do
We do not sell personal data, and the public API exposes public data only.
We do not build advertising profiles from sensitive categories. Promoted placements are labelled and are not targeted using special category data.
We do not write personal data to a blockchain. Attestations contain hashes and minimal metadata only, because a blockchain cannot be corrected or erased.
Cookies and similar technology
Strictly necessary cookies: session, security and load balancing. No consent required.
Preference cookies: language, content mode, feed controls. Set only after you use those features.
Analytics: privacy friendly and aggregated, activated only with your consent. You can withdraw consent at any time in Settings.
How long we keep things
Account and content: until you delete them or close the account.
Deleted account: removed within 14 days, apart from data we must keep, for example invoices for 10 years under Swiss accounting rules.
Backups: rolling retention of at most 90 days.
Moderation decisions and appeals: 2 years, so that repeat behaviour and appeals can be assessed fairly.
Your rights
Access, rectification, erasure, restriction, objection, and data portability. Use Settings, Account, where export and deletion are self service, or write to us.
An export is delivered as JSON within 24 hours. Deletion is scheduled 14 days out and can be cancelled during that window.
You may complain to your supervisory authority, in Switzerland the FDPIC, in the EU your national authority.
Processors we use
Hosting and database: Infomaniak, Switzerland.
Object storage and media delivery: Infomaniak, Switzerland.
Email delivery, payment processing and error monitoring: named in the current processor list, available on request.
Security
Encryption in transit, hashed credentials, passkey support, session revocation, rate limits, malware scanning of uploads and least privilege access for staff.
Report a vulnerability privately to security@peerforge.social, never in the public forum.
This document is the operator version of a standard template and has been written to match how the platform actually works. Before launch it must be reviewed by a lawyer admitted in the operating jurisdiction. Nothing here is legal advice.