How we handle your data.

1. Data we collect

In short: account basics (email, password hash), content you post, and minimum metadata needed to deliver messages. Not your contacts, not your location, not your browsing history outside Clikkin.

Account data

• Email address — for recovery and system notifications. Not used for marketing unless you opt in.
• Password hash — Argon2id. We cannot read or recover your password.
• Display name & avatar — only what you choose to show.

Content

• Posts, messages, media, and reactions you create. Visible to the audience you choose.
• Direct messages are end-to-end encrypted. We cannot read them.

Metadata

• Device type and OS version (for compatibility debugging).
• Aggregate usage counts (posts per day, etc.) — no per-session tracking.
• IP address at signup only (abuse prevention). Discarded after 30 days.

2. How we use it

In short: to deliver the service, keep it safe, and reply to you. That's the whole list.

3. Who we share with

In short: sub-processors listed publicly, audited annually. Nobody else.

We notify admins 30 days before adding or changing a sub-processor. Subscribe to the list.

4. Storage & security

In short: encrypted at rest, encrypted in transit, DMs end-to-end encrypted. SOC 2 Type II audited.

• TLS 1.3 for everything over the wire.
• AES-256 at rest. Keys managed in AWS KMS with automatic rotation.
• Direct messages use the Signal protocol. We hold no private keys.
• Annual third-party penetration test. Latest report: Feb 2025.
• Bug bounty program with payouts up to $10,000. Scope and rules at trust.html.

5. Retention

In short: we keep it as long as you have an account, unless you ask us to delete sooner.

6. Your rights

In short: you own your data. Export, delete, correct, or port it from Settings → Privacy. No forms, no delays.

We respond to rights requests within 30 days, typically the same day for app-initiated ones. If you think we got it wrong, you may lodge a complaint with your local Data Protection Authority.

7. Children

In short: 13+ in most jurisdictions, 16+ in the EU. If we learn we've collected data from a child below the age of consent, we delete it immediately.

Clikkin is not directed at children under 13 (or under 16 in the EU / UK). We don't knowingly collect data from them. If you believe we have, email contact@clikkin.com and we'll delete it within 24 hours.

8. International transfers

In short: EU data stays in the EU by default. Other transfers use Standard Contractual Clauses.

If you sign up with an EU billing address or phone country code, your account is provisioned on our Frankfurt region and never leaves unless you opt to travel it. For cross-border support or global sub-processors, we rely on the EU Commission's Standard Contractual Clauses and the UK IDTA where applicable.

9. Cookies & analytics

In short: one session cookie and, on the marketing site, one self-hosted analytics pixel that doesn't fingerprint. No third-party trackers.

10. Law enforcement requests

In short: valid warrant required. We publish a transparency report twice a year. We will challenge overbroad requests.

We require a court order or subpoena issued under US law, served to our registered agent. We do not respond to informal requests, foreign government requests without MLAT, or requests for bulk data. Where legally permitted, we notify the affected user before disclosure.

11. Changes to this policy

In short: 30 days' notice for anything material. Every change is logged.

12. Contact our DPO

Our Data Protection Officer is reachable at contact@clikkin.com. EU representative for GDPR Article 27: Clikkin EU Rep, c/o Privee Representatives, Dublin 2, Ireland. UK representative: Clikkin UK Rep, c/o Privee Representatives UK Ltd, London EC2A 4NE.