Privacy policy

Fragroom is a social network for people who play games. This page describes what the service actually does with your information today. It is written from the software itself, and it changes when the software does.

Who is responsible

Operator

Sajal Jahan

Email

sajaljahan@gmail.com

1. How we capture data

When you create an account

• Your email address — you type it, or a sign-in provider gives it to us. It identifies your account and is how you get back in.
• Your date of birth — you type it. Fragroom is for people 16 and over and we have to be able to check that. It is never displayed and is not readable through our public interface by anybody, including you.
• Your password, if you choose one. It is hashed by our authentication provider before it is stored; we never see it.
• Your country — when you set up your profile we suggest one, from the country our hosting provider derives from your IP address. It is saved only if you confirm it.

When you sign in with, or connect, another account

• Google, Discord and Twitch send us your email address and the profile details they return, such as your name and picture address, which our authentication provider stores with your sign-in. For Discord and Twitch we also store the account id and display name, so the connection can be shown on your profile.
• Steam gives us no email address. Its sign-in returns your Steam account number; we then ask Steam for your public display name, avatar and profile address, and store all four. If you sync your achievements, we ask Steam which games you own and which achievements you have unlocked, and store that progress.
• What you are playing on Steam — only if you turn on “Show what I’m playing on Steam” in Settings. Every minute we ask Steam which game you are in, and store the game’s id and name while you play. We do not read or keep anything else Steam sends back, such as a real name or a country.
• Epic Games gives us your Epic account id and Epic display name, through the basic_profile scope — no email address, no avatar, and nothing about your games, friends, purchases or entitlements. We store the id and the name. If your Fragroom display name is empty, we fill it with your Epic name. While you finish signing up, the id and name are held in two cookies that last at most 15 minutes. The access token Epic returns is used once and not stored.
• Your Discord gaming accounts. When you connect Discord we ask for its connections scope and read the gaming and streaming accounts you have linked there — Steam, Epic Games, PlayStation, Xbox, Bungie, Riot Games, Battle.net, Roblox, Twitch and YouTube. We keep one only if Discord has verified it and you have chosen to display it on your Discord profile, and for each we store the platform, its account id and its name. We do not read your servers, friends, messages or activity.

We never receive your password for any of these services, and we cannot post, message or act as you on any of them.

When you connect a YouTube channel

Connecting YouTube is optional. It lets your profile show a LIVE badge while you are streaming, without you having to tell us.

• We ask Google for youtube.readonly, the narrowest scope that can answer which channel is yours. We cannot upload, edit, comment or delete anything.
• We keep your channel’s public id and its title, and the address of the channel page built from the id. Not your videos, subscribers, watch history or email.
• The access token is used once and thrown away. We ask for no refresh token. Whether you are live is then a public question, which we ask with our own key.
• If you connect YouTube through Discord instead, we read the YouTube account you have linked there and keep the same things.

Fragroom’s use of information received from YouTube APIs follows the Google Privacy Policy. This feature uses YouTube API Services, and using it means you also accept the YouTube Terms of Service. You can revoke Fragroom’s access at any time at your Google account permissions page, or disconnect the channel in Settings → Connected apps.

What you create

• Your profile — handle, display name, bio, avatar, status, favourite games, social handles and the decorations you choose.
• Posts and comments — the text, the pictures you attach, tags, the game a post is about, and any YouTube or Twitch link you paste.
• Messages — direct messages and messages in Fragroom rooms, with any pictures or GIFs attached.
• Fragrooms you create or join, with their photos, rules, invites and join requests.
• Reactions, buddies, blocks, starred chats, your wishlist, favourite streamers and Gaming Buddy Match preferences.
• Reports you file about a post, a comment or a person.

Captured automatically while you use Fragroom

• Post views — one record that you have seen a post, which is how a post’s view count is made.
• Notifications created by what other people do, such as a reaction, a comment or a buddy request.
• Whether you are online — shown to others while you have Fragroom open, over a live connection. It is not stored.
• Server logs — our hosting provider records requests, including IP addresses, and we log errors so we can fix faults.
• Cookies — the ones that keep you signed in, and short-lived ones used while you sign in or connect an account, which last at most 15 minutes. A post you have not finished is kept by your own browser on your device, and never reaches us until you post it.

What we do not capture

• No advertising or tracking cookies, and no analytics.
• No location beyond the country suggestion above.
• No payment details. There is nothing to buy.

2. How we use data

• To run your account — signing you in, and sending confirmation, sign-in and password-reset emails.
• To show what you share to the people it is meant for — your profile, posts, comments, messages and Fragrooms.
• To check your age — that is the only use of your date of birth.
• To connect your gaming accounts — showing them on your profile, showing a LIVE badge while you stream on YouTube or Twitch, syncing Steam achievements, telling you when a game on your wishlist is released, and suggesting people who play the same games.
• To keep Fragroom safe — reviewing reports, removing content, warning or banning accounts, and keeping a record of those actions.
• To find and fix faults, using error logs.

We do not use your data for advertising, we do not build profiles of you for anybody else, and we make no automated decisions about you that have legal or similarly significant effects.

3. How we share data

With other people on Fragroom

• Anyone, including people who are not signed in: your profile (handle, display name, bio, avatar, status, games and the names of your connected accounts), the game you are playing on Steam if you turned that on, and posts and comments that are not inside a private Fragroom.
• Members of a private Fragroom: the posts and room messages inside it.
• Only the people in the conversation: direct messages.
• Never shown to anybody: your email address, your date of birth, and the account ids of your connected services — except a YouTube channel id, which is public on YouTube itself.

With the companies that run Fragroom for us

These companies process data on our behalf and only on our instructions:

• Supabase — the database, the account system, file storage and live connections. Your data is stored in Ireland, inside the EU.
• Vercel — serves the website, keeps its request logs, and supplies the country suggestion.
• Resend — sends our emails. It sees your email address and the contents of those messages.

With services we ask on your behalf

These requests come from our server, so these services see our server, not your IP address.

• IGDB and Twitch — the game names you search for, and Twitch channel ids, to show game details and who is live.
• Steam — your Steam account number, to read your public name, your owned games and your achievements.
• YouTube — channel ids, to tell whether a connected channel is live.
• GIPHY — the words you type into the GIF search. A GIF you send is copied into our own storage, so the people who read your message never contact GIPHY.

Signing in or connecting with Discord, Google, Twitch, Steam or Epic Games happens on their own site, in your browser, and is covered by their privacy policies as well as this one.

Loaded directly by your browser

• Game covers from IGDB, streamer pictures and stream previews from Twitch, video thumbnails from YouTube and Twitch, and GIF previews from GIPHY while the GIF picker is open. The company serving each picture sees your IP address.
• The full emoji list in the reaction picker loads its pictures from cdn.jsdelivr.net when you open it.
• YouTube and Twitch players load only when you press play on a clip or a stream preview. The player then comes from YouTube (through youtube-nocookie.com) or Twitch, which receives your IP address and may set its own cookies under Google’s or Twitch’s policy. If you never press play, no player loads.

We do not sell your data. We do not share it with advertisers. There is no advertising on Fragroom.

4. How long we retain data

• Your account, and everything attached to it, stays until you delete the account in Settings, or until we remove it — for example because it belongs to somebody under 16, or after a moderation decision.
• When your account is deleted, the database removes in the same moment: your profile and date of birth, your connected accounts, your posts (with their pictures’ records, comments, reactions and views), your comments and reactions, the Fragrooms you created (including posts other people made inside them), your memberships, buddies, blocks, notifications, the reports you filed and the reports about you, and your direct-message conversations — including the other person’s messages in them.
• Uploaded files — avatars, post pictures, message attachments and Fragroom photos — are deleted from storage when you delete the picture, post, message or Fragroom yourself. When you delete your whole account, they can no longer be reached by anybody, because the storage is private and the records that pointed to them are gone, but the files are not yet deleted automatically. Write to us and we will delete them.
• A deleted post or comment is removed completely, with its reactions, replies and views.
• A deleted message loses its text, attachments and reactions at once. A placeholder remains that says a message was removed, with who sent it and when.
• Disconnecting an account deletes what we stored about it. Disconnecting Discord also deletes the gaming accounts Discord verified for you. A display name that was copied into your profile stays until you change it.
• The game you are playing on Steam is replaced at every check, once a minute, cleared when you stop playing or turn the switch off, and no longer shown once you disconnect Steam.
• Reports are kept until the reported content, the reported account or the reporter’s account is deleted.
• Moderation records. When an account is warned or banned we keep a record of what was done, when, and why, including the text of a warning. These records are kept after the account is deleted, so that deleting an account cannot erase a ban.
• Notices from Fragroom staff stay until staff remove them or your account is deleted.
• Emails are also kept by Resend, and server logs by Vercel, for a limited time under their own retention rules.
• Backups. We do not currently keep separate backups of the database, so data that is deleted is gone.

Nothing is deleted on a timer: data leaves Fragroom through the actions above.

Why we are allowed to hold it

Under the GDPR we rely on performance of a contract for what the service cannot work without — your account, your profile and what you choose to post, send or connect. We rely on legal obligation for your date of birth, because an age limit we do not check is not an age limit. We rely on our legitimate interest in keeping Fragroom safe and working for reports, moderation records and error logs.

What you can ask us to do

If you are in the EU or the UK you have the right to see the data we hold about you, to correct it, to have it deleted, to receive a copy in a portable form, and to object to how we use it. You can also complain to your national data protection authority.

Write to sajaljahan@gmail.com and we will answer. We aim to do so within a month, which is what the law allows.

Children

Fragroom is not for anyone under 16. We ask for a date of birth at sign-up and refuse accounts below that age. If you believe somebody under 16 has an account, tell us and we will remove it.

Changes

When this policy changes in a way that matters, the date at the top changes with it. Fragroom is built quickly; when a feature adds data this page does not describe, this page is updated with it.