;fill-rule:nonzero;'/%3e%3crect%20x='0'%20y='0'%20width='402'%20height='874'%20style='fill:url(%23_Radial1);fill-rule:nonzero;'/%3e%3crect%20x='0'%20y='0'%20width='402'%20height='874'%20style='fill:url(%23_Radial2);fill-rule:nonzero;'/%3e%3cdefs%3e%3cradialGradient%20id='_Radial1'%20cx='0'%20cy='0'%20r='1'%20gradientUnits='userSpaceOnUse'%20gradientTransform='matrix(332.79,667.511,-474.535,293.935,-131.375,-348.307)'%3e%3cstop%20offset='0'%20style='stop-color:rgb(4,58,138);stop-opacity:0.82'/%3e%3cstop%20offset='1'%20style='stop-color:rgb(4,58,138);stop-opacity:0'/%3e%3c/radialGradient%3e%3cradialGradient%20id='_Radial2'%20cx='0'%20cy='0'%20r='1'%20gradientUnits='userSpaceOnUse'%20gradientTransform='matrix(-370.503,78.9926,-77.5328,-451.817,433.911,955.302)'%3e%3cstop%20offset='0'%20style='stop-color:rgb(219,70,159);stop-opacity:0.2'/%3e%3cstop%20offset='1'%20style='stop-color:rgb(219,70,159);stop-opacity:0'/%3e%3c/radialGradient%3e%3c/defs%3e%3c/svg%3e)
Last updated: 2 October 2026
1. Who is responsible
The operator identified in the Impressum is responsible for personal data processed by Globytalk. Use the contact details there for privacy questions and requests.
2. Accounts and profiles
Google sign-in requests profile and email access. We store your Google account ID, email address, and initial display name and profile-photo URL. Discord sign-in requests identify and email access. We store your Discord account ID, email address, and initial display name (or username) and avatar URL. These details create or link your Globytalk account; a matching email may link a provider to an existing account. Later sign-ins retain the name and avatar you manage in Globytalk. We do not request access to your Gmail, Google Drive, Discord messages or server membership. Provider access/refresh tokens used during the sign-in exchange are not saved to our account database. The sign-in provider independently processes the authentication request under its own privacy policy. Account authentication supports the service you request (Article 6(1)(b) GDPR).
Profile and sign-in records
We also store your Globytalk user ID, account creation/update times, username, display name, optional bio, avatar, profile color, country, direct-message preference, username/display-name change history and relevant moderation/deletion status. Profile information is shown to other users where the feature exposes it; your authentication email and provider IDs are not public profile fields. Our own sign-in sessions use refresh-token hashes, creation/expiry/revocation times and a browser user-agent string. Refresh credentials normally expire after 30 days; expiry is not the same as database erasure. If you use email-code sign-in, we process the email address, verification code, expiry, attempt count and verification status and send the code through our configured email provider.
IP addresses and country lookup
Authenticated requests can record your IP address, first/last-seen timestamps and request count for security and abuse investigation. At sign-in, the current country lookup sends the IP address to ip-api.com and may use findip.net as a configured fallback; these providers receive that address. Country updates can also use a local IP database. The derived country is used for discovery/presence. Provider details, retention and any international-transfer safeguards must be completed below. The current IP lookup uses an HTTP endpoint for ip-api.com; this integration needs a security/privacy review before final publication.
3. Rooms, messages and calls
We use your IP address to derive a country for discovery and presence, and process room membership, messages, uploads, reactions and friend relationships to provide communication features (Article 6(1)(b) GDPR). Room chats can be read by guests subject to room access restrictions. Direct messages are available to their participants. Voice and video are relayed by our calling infrastructure; do not treat a room as private or end-to-end encrypted. Participants can independently copy or record what you share.
4. Links and media
Chat previews fetch external images and page metadata through our server so displaying a preview does not directly contact that external site from your browser. Following a link opens the destination and its own privacy practices apply. Uploaded files, cached previews and database backups have separate retention schedules.
5. Cookies and browser storage
The app uses authentication/session storage, saved preferences, room read positions and an account-scoped local message cache. Attachment metadata may be stored in the cache; image bytes may be held temporarily in browser memory. Browser data can be removed in your browser settings. Any use of device storage or access that is not strictly necessary requires the appropriate prior consent under §25 TDDDG; the final classification and any required consent controls must be completed before release.
6. Security and call diagnostics
Security and abuse prevention may involve account, connection and server log data, relying on the legitimate interest in protecting the service (Article 6(1)(f) GDPR, subject to balancing). Where enabled, call diagnostics contain account/room identifiers, connection events, broad browser/OS information and call-quality measurements, but not audio recordings. The diagnostic store keeps up to seven daily buckets. Logs, exports and backups have separate retention. The operator must specify the diagnostic legal basis and any required consent before final publication.
Reports and moderation
When you report a user, message or room topic, we store your account reference, selected reason, optional explanation, target reference, submission time and review status. A copy of the relevant profile, message text and attachment references, or room topic is available to authorized moderators for up to 30 days, including if the original content changes or is deleted. Anonymous room identities can be linked to the underlying account by moderators; that account reference is not returned to the reporter. Reporters are not identified to the reported person through this feature. Saved content is hidden after 30 days and cleared by the next scheduled cleanup while the service is running. Reports, explanations, moderation records, uploaded files and backups have separate retention schedules.
7. How long data is kept
Persistent-room messages normally expire after 24 hours; the room retention setting may differ. Ephemeral-room history is deleted when the room is deleted after inactivity. Direct messages and account data follow the account/message deletion lifecycle, subject to legal obligations and justified security needs. Deleting message records does not itself erase uploaded file bytes or backups. The remaining retention periods are listed below and must be completed by the operator.
8. Your rights
Under the applicable GDPR conditions, you may request access, correction, deletion, restriction and portability of your data. You may object to processing based on legitimate interests and withdraw consent without affecting processing that was lawful before withdrawal. You may complain to a data protection supervisory authority, including in the EU country where you live, work or believe an infringement occurred. Contact the operator using the Impressum. We may need proportionate identity verification to protect your account.
9. Minimum age and required information
Globytalk is offered only to people aged 16 or over. We do not invite younger children to create accounts. Some account and connection data is necessary to supply the requested service; without it, sign-in or communication may not work. Optional profile information can be omitted.
- Service providers, locations and international transfers
- Not yet provided
- Logs, uploads and backup retention
- Not yet provided
- Call diagnostics: purpose and legal basis
- Not yet provided