Privacy Policy

Launch notice

The operator identity is not configured yet. This document is not ready for a public launch until the legal name, address and registration details are shown on the Legal Notice.

1. Controller and contact

The controller is [operator legal name required], [registered address required], Croatia. Contact: privacy@thekillfeed.com. Full company and DSA contact details are in the Legal Notice.

2. Data, purpose and legal basis

• Account: email, password hash, username, profile and optional language preference — to create and secure the account and perform the Terms (GDPR Art. 6(1)(b)).
• Age check: the birth date is used once to confirm 16+ and then deleted; we retain only the result and timestamp — legitimate interests and legal compliance (Art. 6(1)(c) and (f)).
• Legal evidence: document versions and acceptance time — to establish and defend legal claims and comply with law (Art. 6(1)(c) and (f)).
• Public activity: clips, titles, tags, profile, comments, likes and follows — to provide the service you request (Art. 6(1)(b)). Clips may include your voice, image or gamer identifiers; do not upload another person without a valid basis and permission where required.
• Safety and moderation: reports, notices, moderation decisions, abuse signals and correspondence — legal obligations and legitimate interests in platform safety, fraud prevention and legal claims (Art. 6(1)(c) and (f)).
• Views and security: a keyed, non-reversible viewer value derived from account ID or short-lived connection data prevents artificial view inflation. The deduplication record is retained for up to two days (Art. 6(1)(f)).
• Diagnostics: if Sentry is enabled, technical error and performance data are processed to keep the service reliable (Art. 6(1)(f)); default PII collection is disabled.

We do not sell personal data, use advertising trackers or create advertising profiles. We do not make decisions with legal or similarly significant effects solely by automation; automated report thresholds may temporarily hide a clip pending human review.

3. Required and optional data

Email, username, password, one-time age check and current Terms/Guidelines acceptance are required for an account. Profile fields, language preference, music credit and uploads are optional. Without required data we cannot create the account. A birth date is not retained after the server-side age check.

4. Recipients and international transfers

We use Supabase for authentication and database services, Cloudflare R2 for media delivery and Turnstile abuse prevention, and optionally Sentry for diagnostics and Resend for transactional legal email. Moderators access only what they need. Public content is available worldwide.

Provider locations and subprocessors can change. Where personal data leaves the EEA, we use an applicable adequacy decision or contractual safeguards such as Standard Contractual Clauses and assess supplementary measures. Final production regions, DPAs and transfer safeguards must be recorded before launch; contact us for a copy or description of relevant safeguards.

5. Retention

• Account and public content: while the account exists, then deleted or anonymised unless a legal hold applies.
• Exact birth date: removed immediately after successful age verification.
• View deduplication: up to two days; notifications: up to 90 days; incomplete upload reservations: normally up to seven days.
• Legal acceptance and moderation records: account lifetime and, where needed, the applicable limitation period.
• Formal legal notices: normally up to five years after closure, longer only for an active dispute or legal duty.
• Security logs, email delivery and diagnostics: according to the shortest operational/provider retention configured for the purpose.

6. Your GDPR rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier processing. Download an account copy in Settings or email privacy@thekillfeed.com. We normally respond within one month and may verify identity.

You may complain to the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, or to the supervisory authority where you live or work. See AZOP data-subject rights.

7. Children and age assurance

KILLFEED is not for anyone under 16. We use a proportionate self-declared birth date check and immediately minimise the result. If risk or law requires stronger assurance, we will evaluate the least intrusive method and perform a data-protection impact assessment where required. Report an under-16 account to privacy@thekillfeed.com.

8. Cookies, security and changes

See the Cookie Notice for device storage. We use access controls, row-level database rules, restricted upload URLs and deletion routines, but no system is perfectly secure. Material policy changes will be announced before they apply where practicable; the version date above identifies this notice.