Privacy Policy

01  Who we are and scope

MyCamy is the Operator of the Service. This Policy applies to the Service only. It does not apply to third-party websites we link to, which have their own policies.

For the purposes of the GDPR, the Operator is the controller of personal data described in section 3.

02  Data we collect

Data you give us

• Account details — the username, optional email address and password you choose when registering.
• In-app activity — task progress, virtual item balance, and which photographs you have unlocked.
• Messages — in this deployment messages are displayed on your own device and are not transmitted to or stored by us.
• Communications — if you contact us, we receive whatever you choose to include in the message.

Data collected automatically

• Device and browser information — such as browser type, screen size, language and timezone, used to make the Service work on your device.
• Server logs — such as IP address, timestamp, requested page and browser type, generated by our hosting provider for security and diagnostics.

Data we do not collect

• We do not record, store or review video or audio captured by your camera or microphone.
• We do not ask for, and you must not provide, government identification numbers, payment card details or precise location.

03  Where data is stored

The following data is stored in your own browser on your own device. It is not transmitted to our servers, and we cannot see it. Clearing your browser storage, or using a different browser, device or profile, means the data is no longer available to you.

04  How we use data and legal bases

• To provide the Service — to create your account, match you with other users, display content and apply age and eligibility checks. Legal basis: performance of a contract.
• To maintain security and prevent abuse — for rate limiting, enforcing these Terms and investigating reports. Legal basis: legitimate interests.
• To improve the Service — to understand aggregate usage and fix errors. Legal basis: legitimate interests.
• To comply with legal obligations — where we are required to retain or disclose information. Legal basis: legal obligation.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

05  Camera and microphone

When you press Start, your browser asks for permission to use your camera and, where available, your microphone. The Service streams that media directly to the other party for live display.

We do not record, store or archive any audio or video. A recording happens only if you deliberately use your operating system's or browser's built-in screen recording, which is outside our control.

Your camera is accessed only while a video session is active. You can revoke access at any time through your browser's site settings, or by closing and reopening the page.

06  Cookies and similar technologies

This deployment uses no advertising cookies and no third-party tracking. We use browser local storage, as listed in section 3, to keep you signed in and to remember your preferences. These are not cookies in the sense of the ePrivacy rules, they are not used to build a profile, and they are not shared with anyone.

07  Sharing and third parties

We do not sell or rent personal data. We share data only in these circumstances:

• Service providers — hosting and content delivery providers who process data on our instructions, under contract and subject to confidentiality.
• Other users — the information you choose to display in your profile or say in a conversation is visible to the person you are interacting with.
• Legal or safety reasons — where required by law, or to protect the safety of any person, the Service or the public. We will narrow any request to what is legally required.
• Business transfer — if the Operator is sold or reorganised, personal data may transfer to the new entity, who must honour this Policy.

Pages we link to, including promotions, are operated by third parties. Once you follow a link, their privacy practices apply and we have no control over them.

08  International transfers

Our hosting and content delivery providers may process data outside your country of residence. Where personal data is transferred outside the EEA or UK, we rely on an adequacy decision or on standard contractual clauses, together with supplementary measures where appropriate.

09  Retention

Because account data is held in your own browser, its retention is controlled by you: it persists until you delete it or clear your browser storage.

Server logs are retained for a limited period for security and diagnostics, and are then deleted. Where we are required by law to retain specific records, we do so for the required period and restrict them to that purpose.

10  Security

The Service is served over HTTPS in production. We apply access controls to administrative functions and limit who may change content.

You are responsible for the security of your own device and for keeping your account credentials confidential. Because account data lives in your browser, anyone with access to your unlocked device can read it. Use a private browsing window on shared devices, and sign out when you are done.

11  Your rights

Where the GDPR, the UK GDPR, the CCPA/CPRA or similar law applies to you, you have the right to:

• Access — obtain a copy of the personal data we process about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted, where we are not required to keep it.
• Restriction and objection — limit or object to processing based on legitimate interests, including any direct marketing.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — withdraw consent at any time, where processing relies on consent.
• Complain — lodge a complaint with your local supervisory authority.

California residents: under the CCPA/CPRA you have the right to know what personal information is collected, to request deletion, to correct inaccurate information, to opt out of sale or sharing, and to limit use of sensitive personal information. MyCamy does not sell or share personal information as those terms are defined by the CCPA.

To exercise any right, email us at the address in section 13. We may ask you to verify your request. We respond within the period required by applicable law, generally within 30 days. We do not discriminate against you for exercising a privacy right.

Because most data is stored on your device, the fastest way to exercise access, correction and deletion rights is to delete your local data directly: clear site data for this domain in your browser, or delete your account and reset the site.

12  Children

The Service is intended solely for adults aged 18 or older and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact us and we will delete it.

13  Changes and contact

We may update this Policy. Where a change materially affects your rights, we will make reasonable efforts to bring it to your attention through the Service. Continued use of the Service after a change takes effect means you accept the updated Policy.

We aim to respond to substantiated requests within 30 days.