Privacy policy
In short
- We only ask for a username, an email address and a password. We do not ask for your real name, date of birth or phone number.
- We show ads on the site: our own and ads served by Google AdSense. Google sets advertising cookies only with your consent, which you can change whenever you like.
- We count visits with our own simple tool, without cookies and without tracking individuals.
- We do not sell your data or give it to others for marketing.
- You can delete your account yourself, in your settings, at any time.
1. Who is responsible for your data
The data controller is:
Splendido Solutions d.o.o.Stjepana Vukovića 8b, 42000 Varaždin, Croatia
VAT ID: HR42172723674
For any questions about personal data, contact us through the Contact form (topic “Personal data and privacy”) or by post at the address above.
2. What data we process, why, and on what legal basis
2.1. When you just read, without an account
We process the technical data of every request: your IP address, browser and device type, the address of the page you opened (including any search term) and the time. We need it to run the site, for security and to fix errors. The legal basis is our legitimate interest (Art. 6(1)(f) of the General Data Protection Regulation, GDPR). We do not track visitors ourselves or build profiles; what Google does when it shows ads is described in the section on ads.
Visit statistics
To know how much the site is visited and which content is read, we use our own simple visit statistics tool. It counts visits, not people: it sets no cookies, stores nothing on your device and does not recognize you on your next visit. When you open a page, the tool receives its address, your IP address and your browser and device type, and turns them only into aggregate visit numbers — with no profile of an individual visitor and no link to your account. In the same way, without any identifier that could recognize you, the tool also counts a few actions on the site: sharing content or comments, “Load more”, opening the menu with more options, and changing the theme. We do not share this data with anyone. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
Search
We log the terms you type into the search box, together with the time of the search and the number of results found, so that we know what visitors are looking for and what the site is missing. We do not log your IP address, browser or account with the search term, so we cannot link a search to you; even so, please do not type personal data into the search box. We delete the log after one year. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
2.2. When you open an account
We process your username (public), your email address (never public), your password — stored only as a cryptographic hash from which we cannot read it — the date you registered, the time of your last login, the number of consecutive failed login attempts, your notification settings, and the version of the Terms of use that applies to you together with the date you accepted it. The legal basis is the performance of a contract, namely the Terms of use (Art. 6(1)(b) GDPR).
2.3. Login and security
For every device you are logged in on, we record the IP address and browser type at login and at last use, and the time of your last activity. If you use a passkey, we keep its public key, the name you gave it and the time it was last used; your fingerprint or face never leaves your device. We keep backup codes and one-time confirmation codes only as a hash. The legal basis is the performance of a contract and our legitimate interest in keeping the service secure.
2.4. What you publish
We process the jokes, stories and memes you submit, your comments, votes, reports of inappropriate content and your list of saved content. Published content and comments are public, together with your username. It is not public who voted how (only the total is shown), what you saved, what you reported, or content that is waiting for review or was rejected. We resize the images you submit and convert them to the WebP format; we do not keep the original file or the data embedded in it (for example the location where a photo was taken). We may also share published content on our social media profiles, without your username. The legal basis is the performance of a contract.
2.5. Notifications
We use your email address for messages that are necessary for your account to work and, unless you have turned them off, for notifications about comments. If you turn on push notifications, we keep the subscription address and keys issued by your browser, and your browser type; the notification is delivered to your device, encrypted, by your browser maker's service (for example Google, Apple, Mozilla or Microsoft). The legal basis is the performance of a contract and, for push notifications, your consent, which you give by turning them on and withdraw by turning them off in your settings or browser.
2.6. When you contact us through the Contact form
We process your name, email address, the topic and text of your message, your IP address and browser type, and, if you are logged in, your username. We need them to reply and to act on your report, request or appeal. The legal basis is our legitimate interest in answering inquiries and, for reports of illegal content and requests concerning personal data, a legal obligation (Art. 6(1)(c) GDPR). For each new message our team also gets a short notice in our internal notification tool, with your IP address and browser type (not your name, address or the text of the message), so that we can spot abuse of the form early.
2.7. Moderation and the activity log
We record editors' decisions about your content and account (for example the reason for a rejection or a block), reports concerning your content and security-relevant actions on your account, together with the IP address and browser type. The legal basis is our legitimate interest in enforcing the Terms of use and preventing abuse, and the legal obligations of a service provider.
You do not have to give us any data, but without a username, an email address and a password you cannot open an account.
4. Who has access to the data
- Our editors, to the extent needed for moderation and support.
- Service providers that process data for us under contract: server hosting and backup storage, and email delivery. The site and its database are hosted on servers in Germany, inside the European Union.
- The provider of our team's internal notification tool: for each message from the Contact form it receives only the sender's IP address and browser type (see section 2.6).
- Your browser maker's push notification services, if you have turned on push.
- The social networks where we publish content (Meta Platforms): they receive only the content of the post, not your data.
- Google Ireland Limited, as an independent controller, for showing ads: it receives your browser's technical data when you open a page with Google's ads (see Ads). Google may also process data in the United States, on the basis of the European Commission's adequacy decision (the EU-U.S. Data Privacy Framework).
- Google Ireland Limited, for protecting the registration and contact forms (reCAPTCHA): it receives your browser's technical data when you open those pages (see Form protection).
- The authorities, when the law requires us to share data.
We do not sell data or pass it on for anyone else's marketing. If any of our other providers were to process data outside the European Economic Area, the transfer would be based on an adequacy decision of the European Commission or on standard contractual clauses.
5. How long we keep data
- Account data: as long as the account exists. When you delete your account, your email address, password, passkeys, device logins, notifications and your content reports are deleted immediately.
- Published content and comments: remain after the account is deleted, without your name (“Deleted user”); votes remain without any link to you. Your name, email address, IP address and browser data are removed from the activity log.
- Username of a deleted account: stays reserved permanently, so that no one can take it over and pose as you. For this purpose we keep only its cryptographic hash, not the name itself.
- Sessions: 30 minutes from your last activity, or until you log out.
- Device logins (remembered devices): 30 days from last use, or until you log out.
- One-time codes and password reset links: at most 24 hours.
- Notifications (bell and push): 90 days.
- A comment you delete: stops being visible immediately; we keep the record to handle reports and appeals.
- Removed images: permanently deleted from the server after 30 days.
- Search terms: one year.
- Messages from the Contact form, the log of sent emails, content reports and the activity log: as long as needed to handle your inquiry, keep the service secure and protect legal claims.
- Server logs: a limited time, as long as needed for security and fixing errors.
6. Your rights
You have the right to find out whether we process your data and to get a copy of it, to ask us to correct inaccurate data, to ask for erasure, to ask us to restrict processing, to receive the data you gave us in a portable format, to object to processing based on legitimate interest, and to withdraw your consent to push notifications at any time.
You can do some of this yourself in your settings: change your email address and password, turn notifications on or off, and delete your account. For everything else, contact us through the Contact form; we reply within one month at the latest. Before acting on a request, we may ask you to confirm your identity.
If you believe that we process your data in breach of the law, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop.hr.
7. Children
Accounts can be opened by people aged 16 or over. We do not knowingly collect data from younger people; if we learn that an account was opened by someone younger, we will close it and delete the data. Parents and guardians can contact us through the Contact form.
8. Automated processing
We do not profile users and we do not make automated decisions that would have a legal or similarly significant effect on you. The only automated check is the word filter for comments and submitted content, described in the Terms of use; decisions about content and accounts are made by people.
9. How we protect data
We store passwords only as a hash. After several failed login attempts, an account is temporarily locked. We offer two-factor authentication (2FA) with a passkey. We notify you by email of every change to your password, email address or passkeys. Traffic between your device and the site is encrypted (HTTPS).
10. Changes to this policy
We may change this policy when the site or the law changes. We publish the new version at this address, with the date from which it applies; we notify registered users of important changes in advance.