Privacy Policy

Your account. Username, email address, password (stored only as a scrypt hash, never in plain text), account creation date, the date you accepted the terms, last activity, your account type and, if applicable, a ban. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Login sessions. A random code in the session cookie; on the server we keep only its cryptographic fingerprint, its creation and expiry dates, when it was last used and your browser type (user agent), so we can limit the account to 3 devices, show you where you're signed in (the device list in the app) and protect the account. When you sign in a TV or browser with a QR code, the code shown and the device type are kept for at most 10 minutes. If you add a passkey, we keep only its public key, the name of the device you made it on and when it was used; the private key stays on your device. Legal basis: the contract and our legitimate interest in security (Art. 6(1)(b) and (f)).

Chat messages. The messages you send to the team or to other users in the app, with their dates, who has read them, who you blocked and the messages you report. The team reads its own conversations; it sees conversations between users only when a message in them is reported. Legal basis: the contract and our legitimate interest in keeping chat safe (Art. 6(1)(b) and (f)).

Profile and friends. The avatar, bio and favourite shows you choose (other signed-in users can see them), your friends list and friend requests. Your friends see whether you're in the app or watching LIVE and when you were last active; this is kept only in the server's memory, not stored. You can choose to get messages from friends only. Legal basis: the contract (Art. 6(1)(b)).

Notifications. If you allow them, we keep your phone's notification code (from Apple) so we can send you new messages, friend requests and replies from the team. Show reminders stay on your phone only. You can turn them off at any time in your phone's settings. Legal basis: your consent (Art. 6(1)(a)).

Messages you send us. Your name, email address, subject and message from the contact form or your emails, so we can reply. Legal basis: our legitimate interest in replying and, for account-related requests, the contract (Art. 6(1)(f) and (b)).

Technical and security data. Your IP address, date and time, the page requested and your browser type appear in server logs. The IP address is also used to limit login, signup and message attempts so we can stop abuse. Legal basis: our legitimate interest in protecting the service (Art. 6(1)(f)).

Viewer count. While a ToonMax page is open, your browser sends a signal every 15 seconds with a random code generated for that tab, which is not saved on your device. We use it only to count how many viewers are online right now. For the number of distinct visitors per day we use a fingerprint of your IP address and browser type, hashed with a random key that changes daily and exists only in server memory, so it can't be linked across days. We keep only totals. Legal basis: our legitimate interest in knowing our audience (Art. 6(1)(f)).

Your preferences. The language you choose for the announcement videos and, if you choose it, the site version (web or TV) are kept in your browser. Details in the Cookie Policy.

A username, email address and password are required to create an account; without them we can't provide the service. Everything else is generated automatically when you use the site.

Only ToonMax team members who need the data can access it, and they are bound by confidentiality. We also use:

• our hosting provider, whose servers run the site and store the data;
• Cloudflare, which delivers the site and protects it from attacks, processing your IP address and requests to the site;
• our email provider, for the messages you send us and our replies;

We only disclose data to authorities when the law requires it or to defend our rights.

Some providers, such as Cloudflare, may also process data outside the EEA, including in the United States. In those cases we rely on the safeguards provided by the GDPR: a European Commission adequacy decision (for example, the EU-U.S. Data Privacy Framework) or the Commission's standard contractual clauses.

• Account: for as long as it exists. You can delete it yourself, immediately, in the app (Account → Delete account); if you ask us to close it, we delete it within 30 days. We may delete accounts unused for more than 2 years after telling you by email.
• Sessions: until you log out, or at most 30 days.
• Chat messages: 180 days after they're sent, then deleted automatically (and with your account).
• Profile, friends and notification codes: while you have the account. You can delete it at any time in the app (Account → Delete account); it goes immediately, with everything tied to it.
• Messages you send us: at most 12 months after your request is resolved.
• Server logs: normally no more than 30 days.
• Abuse-limiting data: only in server memory, for at most 24 hours.
• Viewer-count data: only in server memory, until the end of the day at the latest; we keep only anonymous totals.

Under the GDPR you have the right:

• to access your data and get a copy of it;
• to have inaccurate data corrected;
• to have your data erased ("right to be forgotten");
• to restrict processing;
• to data portability for the data you gave us;
• to object to processing based on our legitimate interest;
• to withdraw consent where processing is based on it, without affecting the lawfulness of processing before the withdrawal.

Write to us at [email protected], ideally from your account's email address so we can confirm it's you. We reply within one month.

You also have the right to lodge a complaint with the data protection authority of the EU country where you live, work or where you believe the infringement took place. The list of authorities is on the European Data Protection Board website (edpb.europa.eu).

We use encrypted connections (HTTPS), store passwords only as salted scrypt hashes, keep only fingerprints of session codes on the server, use HttpOnly cookies and limit repeated login attempts. Access to the admin panel is restricted to the ToonMax team.

An account can be created from age 16, or younger with the consent of a parent or guardian. If you learn that a child gave us data without that consent, write to us and we will delete the account.

When we change this policy we update the date above. For important changes we tell you on the site or by email.