Privacy notice

1.Scope, controller, and applicable law

The hosted-service operator’s legal identity, location, and contact details have not been published yet. We’ll share them before the service opens. The Privacy Notice will identify who is responsible for each service and data use. An independently run installation may have a different responsible party. The hosted app is in development with a target release in Q1 2027 and is not currently accepting accounts or user uploads through this website. Which laws apply depends on the operator, service, users, and data use. We’ll explain the applicable rules once those details are confirmed.

2.Information handled by the current website

The public kookey website is a project presentation site with one data-collecting feature: the waitlist. The form asks for an email address and sends it to a Cloudflare Worker, which stores it as a contact in Resend, our email provider, and asks Resend to send the welcome template configured for the list. The pages still have no account registration, contact form, user uploads, comments, payment flow, embedded video participant, analytics, or advertising integration. The production host, its security or diagnostic logs, and Resend’s retention and transfer terms have not been independently verified yet. We’ll update this notice once those details are confirmed. A review of the site’s implementation does not measure network traffic from the live domain.

3.Information planned for the social service

When the hosted app launches, its account and social features are expected to process identifiers and login credentials; profile names and settings; profile notes; rooms, screenshots, and captions; follows, likes, comments, stories, and messages; user reports, moderation decisions, appeals, and support requests; and technical, security, and reliability logs. Exact categories depend on the release. The app will disclose the data actually collected, feature by feature, before registration and use.

4.Purposes and legal bases

For users in the EU, each processing purpose will be tied to a legal basis under GDPR Article 6. Account administration and requested social features may be necessary to perform the user agreement; security, abuse prevention, service reliability, and responding to rights requests may rely on a documented legitimate interest where that interest is not overridden by people’s rights; legal record keeping may be required by law; and optional processing such as non-essential analytics or optional music integrations will rely on consent when required. Consent can be withdrawn without affecting processing already lawfully carried out. Serbia’s Law on Personal Data Protection separately requires a lawful basis and adherence to its own principles.

Source: Regulation (EU) 2016/679 — General Data Protection Regulation (EUR-Lex) (European Union) · Checked October 8, 2026

5.Public posts, private messages, and visibility

Before publishing, the app will show whether a room, profile, profile note, comment, or story is public, limited to followers, or otherwise restricted. Public material may be viewed, linked, indexed, copied, or captured by other people. Direct messages are intended for their addressed recipients, but recipients can retain or share what they receive. Reported content may be reviewed by authorized moderators to assess a report, enforce rules, or meet legal duties.

6.Service providers and disclosures

The waitlist uses Cloudflare for the form endpoint and Resend to store contacts and send email. The production host for the rest of the site and other service providers for the future hosted service have not been announced. The providers, their roles, purposes, locations, and privacy terms have not all been published yet. We’ll share them before the hosted service receives user data. The hosted app may use providers for storage, sign-in, email, payments, security, or moderation. We’ll identify each provider and its role before it receives user data. The Privacy Notice will identify service providers, explain their roles, and describe any legally required disclosures once the provider arrangements are confirmed.

7.International transfers

The operator’s location, production host, and data-access locations have not been confirmed yet. Before personal data is transferred internationally, the operator will identify the applicable transfer rules, destination, and required safeguards for the relevant jurisdiction. We’ll explain where information is stored or accessed, what safeguards apply, and how to ask for more information once the service setup is confirmed.

8.Retention and deletion

The production host’s log settings and retention period have not been verified yet. We’ll share them once they are confirmed. Retention periods for accounts, content, reports, security records, and legal records have not been set yet. We’ll publish them once the hosted service is ready. Before accounts open, we’ll explain how deletion works in active systems and backups, what exceptions may apply, and how to ask about a record. The planned app has no confirmed retention periods or working deletion process yet.

9.Rights and how to exercise them

Depending on the law and the processing, a person may request access, a copy, correction, erasure, restriction, portability, or object to processing; withdraw consent; and complain to a supervisory authority. Under GDPR Article 12, the controller generally responds within one month, subject to lawful extensions and exceptions. In Serbia, people may exercise rights provided by the Law on Personal Data Protection and complain to the Commissioner for Information of Public Importance and Personal Data Protection. The operator may request proportionate information to confirm identity and protect another person’s data. Contact details for requests are published on the kookey Legal Contact page.

Source: European Commission — Rights of individuals (European Union)

10.Security, breaches, and automated decisions

The operator will use technical and organizational safeguards appropriate to the data and risk, limit staff access, protect credentials, and maintain incident procedures. If a personal data breach occurs, the controller will assess its risks and notify the relevant authority and affected people when and as required by applicable law. No decision producing legal or similarly significant effects is currently made solely by automated processing on the public website. If the hosted app uses automated moderation, ranking, or profiling, we’ll explain its purpose, main logic, and available user controls.

11.Children and changes to this notice

A minimum age has not been confirmed for the hosted service. The hosted service’s age requirements and any parental-authorization steps have not been decided yet. We’ll publish them before registration opens. Whether EU or Serbian child-consent rules apply depends on the service, operator, user, and processing purpose. That legal review is still in progress. We’ll date material changes and notify users through the service when required.

12.Data categories and purposes at a glance

The hosted service is not collecting account or content records today; the waitlist is the only form that collects an email address. Before registration opens, we’ll explain what information the service uses, why it uses it, who receives it, and how long it is kept.

13.Effective date and changes

This information does not yet have an effective date for the hosted service. Before registration opens, we’ll share a Privacy Notice based on the service’s actual providers and data flows, along with how users will hear about material changes.