This Privacy Policy explains how cr0bar Limited (“EEPSKI!”, “we”, “us”) processes personal data when you use the Service. We are based in the United Kingdom. For UK GDPR we are the controller of personal data described here. For people in the EEA we also apply the EU GDPR.
If you have questions or want to exercise your rights, email privacy@eepski.com. You can also contact the Information Commissioner’s Office (ICO) at ico.org.uk. EEA users may contact their local supervisory authority.
1. Data we collect
Account data
When you register we collect your email address, username, date of birth, password hash (we never store your password in plain text), and optional display name. Date of birth is shown in your Settings as read-only and is not shown on your profile. If you enable two-factor authentication we store an encrypted authenticator secret, backup-code hashes, and passkey credentials you register.
Profile and content
You may add a bio, avatar and header image. Posts, replies, reposts, likes, dislikes, bookmarks, follows, mutes and blocks are stored so the Service can work. Media is processed by our media service and referenced from your posts.
Technical data
We process IP address, device/browser type, and security logs as needed to keep the Service available, prevent abuse, and meet legal duties. When your IP address changes we store that address, the time we noticed the change, and the country for that IP. Country comes from IPinfo’s Lite API, which receives the IP address and not your username. We reuse a country we have already stored for that IP instead of asking again. The last five of these records are shown in your Settings. Session cookies and CSRF tokens are used to keep you signed in securely. See our Cookie Policy.
Age verification
If you use the Service from a country where we must check age, or you have done so before, we ask for a photo of the front and back of a driving licence, passport, or national ID card, and a short video of you reading a one-time code. Employee IDs and other workplace cards are not accepted. Staff compare the document with the date of birth from registration, and the video with the code. You cannot use the rest of the Service until a staff member approves the check. The photos and video are stored separately from posts and are visible only to staff while the check is waiting. As soon as the check is approved or rejected, we delete those files. We keep the outcome, the date of the decision, and the date of birth on your account. If you delete your account while a check is still waiting, the files are deleted then.
Communications
If you write to us, we keep the correspondence as needed to respond. We send transactional email (confirm your address, reset a password). We do not currently send marketing email. If we ever do, we will only do so with a lawful basis and a clear opt-out.
2. Why we use your data (lawful bases)
- Contract — to create and run your account, show your feed, deliver posts, and provide Settings, export and deletion tools (UK GDPR Art. 6(1)(b)).
- Legitimate interests — to keep the Service secure, score Community Signal, detect spam and abuse, and understand how features are used in aggregate. We balance these interests against your rights (Art. 6(1)(f)).
- Legal obligation — to keep records required by UK law, including the Online Safety Act 2023, tax and accounting rules, and to respond to lawful requests (Art. 6(1)(c)).
- Consent — where we use non-essential cookies or similar technologies, or if we later offer optional features that need consent (Art. 6(1)(a); PECR). You can withdraw consent at any time.
We do not use your content to train general-purpose AI models for unrelated products. We do not sell your personal data.
3. Who we share data with
We share personal data only as needed:
- The public — your profile, posts and public interactions are visible to other users and may be indexed. Private graph actions (mutes, blocks) are not shown to the other person as a notification of that action beyond the ordinary effect (their posts leaving your feed).
- Processors — hosting, email delivery, media processing and similar vendors who act on our instructions under a written contract.
- IPinfo — when we have not already stored a country for an IP address, we send that address to IPinfo’s Lite API to learn the country. We do not send your username or the contents of your account.
- Authorities — if required by UK or EU law, a court order, or to protect someone’s vital interests.
- Successors — if we transfer the Service as part of a reorganisation, with appropriate safeguards.
4. International transfers
Our primary operations are in the United Kingdom. If we transfer personal data outside the UK or EEA, we will use a lawful mechanism such as the UK International Data Transfer Agreement / Addendum, EU Standard Contractual Clauses, or an adequacy decision.
5. How long we keep data
We keep account and content data for as long as your account is active. If you delete your account we remove or irreversibly anonymise personal identifiers from live systems, and we soft-delete posts so they leave feeds. Backup copies and security logs are retained only for a limited period. Suspended accounts may be retained so the restriction remains effective and so we can review appeals. We may keep a minimal record of a ban (for example username history and the reason category) to prevent evasion and to meet online-safety duties. Photos and video from an age check are deleted as soon as that check is approved or rejected. We do not keep them after the decision. We do keep the date of birth from registration, and a record of whether the check was approved or rejected and when.
6. Your rights
Under UK GDPR and, where applicable, EU GDPR you can:
- access a copy of your personal data (Settings includes an export);
- rectify inaccurate data;
- erase data in certain cases (including deleting your account);
- restrict or object to processing based on legitimate interests;
- data portability for information you provided to us;
- withdraw consent where processing is based on consent;
- complain to the ICO or your local EU authority.
We will respond within one month, or explain if we need more time (up to two further months for complex requests). We may need to verify it is you. Some rights are limited — for example we may refuse to erase data we must keep for a legal claim or a statutory duty.
7. Children
You must be 16 or older to register. In some countries the legal minimum is higher, and we will not let the account be used until staff have checked an ID against the date of birth you gave us. If you believe a child has created an account, contact privacy@eepski.com and we will delete it.
8. Automated decision-making
Community Signal scoring uses reactions from people you follow to decide what appears in your home feed. That is a product ranking, not a solely automated decision producing legal or similarly significant effects. Account suspensions for serious abuse may involve automated signals but are subject to human review on request.
9. Changes
We will post updates on this page. If we make a material change to how we use personal data we will give additional notice where required by law.