Privacy & Cookie Policy

1. What we collect

Account: username, email address, password (stored only as a one-way hash), country, and anything you add to your profile such as a bio or avatar.

Social login: if you sign in with Google, Facebook, Kakao, Naver, Discord, X or Microsoft, we receive your account ID, email address and name from that service. We never get your password there.

What you do on the site: posts, comments, images you upload, Likes and Hmms, scraps, reports, and private messages.

Technical data: your IP address, browser and device type and request times in server logs, used for security and to keep the site running.

Visit statistics: the page you open, the site you came from, your device type and your browser's time zone (for example Asia/Seoul, used as a rough region). We don't use cookies for this and don't store your IP address: it is turned into a random code that changes every day, so we can count daily visitors without recognising anyone.

2. Why we use it, and the legal basis

To run your account and show your content — performing our agreement with you (GDPR art. 6.1 b).

Points, levels, notifications and messages — the same agreement.

Security, spam and abuse prevention, moderation and handling reports — our legitimate interest in a safe community (6.1 f) and legal obligations under the EU Digital Services Act (6.1 c).

Emails about your account (password reset, important changes) — the agreement. Newsletters only if you opt in (consent, 6.1 a).

Visit statistics to improve the site — legitimate interest (6.1 f). Cookie-free, IP addresses not stored, raw records deleted after 90 days.

Spam protection at sign-up (Cloudflare Turnstile, when switched on) — legitimate interest in keeping bots and spammers out.

We do not sell your personal data, and we don't use it for advertising profiles.

3. Who we share it with

Other members see what you post publicly: your username, level, country flag, profile and content. Private messages are only visible to the sender, the recipient and, when a message is reported or needed for safety, our moderators.

Service providers who process data for us under data processing agreements: hosting (Vultr, servers in Seoul, South Korea), DNS and network security (Cloudflare), email delivery, and the login services you choose to use.

South Korea has an EU adequacy decision, so data stored there has protection recognised as equivalent to the EU's. For providers in the US or other countries we rely on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

Authorities, if the law requires it.

4. How long we keep it

Account data as long as you have an account. When you close it we delete or anonymise your personal data within 30 days. Server logs are kept for up to 90 days. Data we must keep by law (for example bookkeeping) is kept as long as the law says. See the Data Policy for what happens to your posts.

5. Your rights

You can ask for a copy of your data, have wrong data corrected, have data deleted, restrict or object to processing, and get your data in a portable format. Where we rely on consent you can withdraw it at any time.

Write to admin@kommu.live. We answer within one month. If you're unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or the data protection authority where you live (in Korea, the Personal Information Protection Commission).

6. Children

The site is not for children under 14. If we learn an account belongs to someone younger, we close it and delete the data.

7. Cookies

We only use cookies the site needs to work or to remember a choice you made. No advertising or tracking cookies, so we don't ask for cookie consent (Swedish Electronic Communications Act, chapter 9 section 28).

sid — keeps you logged in (30 days)

theme — light or dark mode (1 year)

km_view — your list view setting

km_ref — remembers who invited you, so they get their bonus (30 days)

oauth_state — protects social login (10 minutes)

Visit statistics use no cookies or similar storage on your device.

Embedded videos and posts (YouTube, Instagram, X, TikTok) are loaded from those services and may set their own cookies under their policies. If we ever add analytics or advertising cookies, we will ask for your consent first and update this policy.

You can delete cookies in your browser at any time; you'll be logged out.

8. Changes

When we change this policy we update the date below, and we tell members about important changes.