Privacy Policy

Last updated 07 October 2026

Who is responsible

Rocoto (https://www.rocoto.space) is run by the operator of Rocoto. For any privacy question write to yakhv67@gmail.com.

What Rocoto stores

Your account: username, e-mail address and a password (stored only as a one-way hash, never in readable form). If you sign in with Google, we receive your verified e-mail address, your name and a Google account identifier from Google; we keep the e-mail and the identifier (to recognise you next time) and do not receive your Google password.
Your profile and settings: picture, banner, bio, colours, wallpaper, custom style code, profile song, privacy choices and blocked people.
What you share: posts, comments, polls and votes, sticky notes, uploaded pictures, audio and video, pathways you create or join, friends and friend requests, your Top 8, notifications and chat messages.
Front-page preview: a short, text-only preview of some public posts (your name, picture, the pathway and the first lines of the post) can be shown to visitors who are not logged in, on the front page. It only includes posts you did not mark private, from members whose profile is set to "Everybody" and who have this switched on. New members have it on (it is announced when you register); members who joined earlier have it off until they switch it on. You can change it any time in Settings → Privacy, and it follows what you delete. The preview is loaded by script and kept out of search engines.
Visits without an account: when you are not logged in, Rocoto keeps a short record of which public page you opened (for example the front page or the login page) or which form you sent, and when. It has no cookie and no readable address: it only holds an anonymous code made from your IP address and browser type with a secret that changes every day, so it cannot be turned back into your address or followed from one day to the next. It is used only to work out the bounce rate (how many first-time visitors leave without doing anything) and is deleted after 90 days. Crawlers and monitoring tools are left out.
Technical data: when you visit, the web server records your IP address, the page requested and your browser type in a log. The site also uses your IP address briefly to limit abuse (for example too many login attempts).

Pictures you upload are re-saved on the server: their size may be reduced and hidden data such as camera and location details is removed.

Why, and on what legal basis

To run your account and the features you use (contract, Art. 6(1)(b) GDPR).
To keep the site secure, prevent spam and abuse, and fix errors, including the server log, and to measure how many visitors leave the front and login pages without doing anything, using the anonymous visit record described above (legitimate interest, Art. 6(1)(f)).
To send you e-mails you asked for: verification and password reset (contract).
To count visits with analytics, only if you accept it (consent, Art. 6(1)(a)). You can withdraw consent at any time with "Cookie settings" in the page footer.

Cookies and similar storage

Login cookie (essential): a signed cookie called session keeps you logged in and protects forms against forgery. It is deleted when you log out or after it expires. It needs no consent.
Your cookie choice: your answer to the cookie notice is saved in your browser (local storage) so we do not ask again.
Analytics (optional): if you accept, Rocoto loads Umami, a privacy-friendly analytics tool that Rocoto hosts itself. It sets no cookies and does not see your posts or messages. It records which page was opened, the referring site, browser, device type and country.

Who else receives data

Hosting: Rocoto runs on a server of Hetzner Online GmbH in Helsinki, Finland. Hetzner processes data on our behalf.
Sign in with Google (optional): if you choose it, your browser is sent to Google and Google tells us who you are. Google's own privacy policy applies to that step.
E-mail: verification and password reset e-mails are sent through Google's Gmail service, so Google receives your e-mail address and the message.
Icons and scripts: the icon font (Font Awesome Free) and the chat script (Socket.IO) are served by Rocoto itself, so no other company sees your visit when they load.
YouTube: a profile song is played from YouTube. Viewing a profile with one loads a thumbnail picture of the video from YouTube; playing it loads the YouTube player itself. Either way, YouTube (Google LLC) receives your IP address and may set its own cookies, under YouTube's privacy policy.
YouTube links in posts: a YouTube link in a post shows a play button. YouTube (Google) is only contacted after you click it, and then receives your IP address and may set its own cookies, under its own privacy policy.
Embedded content: a member may embed other websites on their profile (for example a YouTube video or a music player). It loads as soon as you open that profile, and the other site (for example Google/YouTube) then receives your IP address and may set its own cookies, under its own privacy policy.
Pictures from other sites: a member may show a picture hosted elsewhere on their profile (in their HTML or as a background). Your browser then fetches it from that site, which can see your IP address.
Other members: what you post is visible to logged-in members according to your privacy settings. Your profile can be limited to friends in Settings.

Google, Fonticons and Cloudflare are based in the USA. They use standard contractual clauses or comparable safeguards for transfers from the EU.

Rocoto does not sell your data and shows no advertising.

How long data is kept

Account, profile and content: until you delete your account. Deleting it removes your account and content from the live site. Copies in backups are overwritten within about 14 days.
Unverified accounts: the verification link is valid for 15 minutes; an unverified account can be replaced by a new registration with the same name.
Server logs: about two weeks.

Your rights

You can ask for access to your data, correction, deletion, restriction, a copy in a common format, and you can object to processing based on legitimate interests. You can delete your account yourself in Settings. For anything else write to yakhv67@gmail.com. You also have the right to complain to your local data protection authority.

Children

Rocoto is for people aged 14 and over. If you believe someone younger has an account, tell us and we will remove it.

Security

Connections use HTTPS, passwords are hashed, and the server is protected by a firewall and limits on repeated login attempts. No system is perfectly secure; tell us at once if you find a problem.

Changes

If this policy changes, the date at the top changes. For big changes, members are told on the site.