Publish approved Privacy Policy update

privacy-policy.md

@@ -1,6 +1,6 @@
 # Privacy Policy
 
-**Last updated:** 2026-09-12
+**Last updated:** 2026-10-28
 
 This Privacy Policy explains how Majjo Duran collects, uses, stores, and protects data when you use our services. It works alongside our Terms of Service.
 
@@ -12,8 +12,7 @@ We do not sell personal data or use advertising trackers. We aim to collect only
 
 This policy applies to user-facing services covered by our Terms of Service:
 
-- **Plex** — media streaming and playback
-- **Seerr** — media request management
+- **Plex** — media streaming and playback, including its supporting media-request service
 - **Bitwarden (Vault)** — password and credential management
 - **Slink** — image upload, storage, and link sharing
 - **Speed Test** — browser-based connection testing
@@ -31,7 +30,7 @@ Depending on the service you use, we may process:
 - **Device and client data** — device name, platform, application or browser type, client version, and identifiers supplied by the service
 - **Playback and media activity** — watch history, media titles and metadata, playback devices, timestamps, bandwidth, transcoding, sessions, and user statistics
 - **Request activity** — Seerr requests, requester, approval or denial state, requested media, timestamps, and history
-- **Vault and authentication metadata** — login and session events, known-device checks, failed authentication, and security events where logged; private vault contents and raw credentials are not used for analytics or AI training
+- **Vault and authentication metadata** — login and session events, known-device checks, failed authentication, and security events where logged; private vault contents and raw credentials are excluded from analytics and AI training. Vault data is stored per account, with selected items shared where users enable supported sharing features
 - **Slink account and upload data** — usernames, account settings, uploaded image files, filenames, image type and size, dimensions, share/privacy/password/expiration settings, upload and deletion times, storage usage, and access activity where logged
 - **Speed test data** — test results (download, upload, ping, jitter), timestamp, and network or ISP classification; IP addresses are redacted and result identifiers are obfuscated before storage, and ISP lookup uses a local offline database rather than a third-party lookup
 - **Email account data** — mailbox contents, message metadata such as senders, recipients, and subjects, spam and malware filtering, and mail server logs including IP addresses and login and delivery events
@@ -40,6 +39,7 @@ Depending on the service you use, we may process:
 - **Access and security logs** — IP, host, path, method, status code, timestamp, duration, routed service, user-agent, TLS/router metadata, and traffic volume
 - **Enforcement data** — warnings, bans, suspensions, blacklists, moderation actions, suspected cheating or exploitation, scanner/probing records, and incident notes
 - **Support communications** — Discord, email, or other support messages related to access, moderation, content, or service issues
+- **Supporting operational records** — relevant information retained in administrative conversations, AI-assistant memory, support or incident records, notifications and internal documentation; these records may contain personal or sensitive service information
 
 Data is generally collected when you interact with a service, when your client connects, when a public share link is requested, or when security systems observe traffic reaching our infrastructure.
 
@@ -58,17 +58,24 @@ Data may be used to:
 - Document donations and deliver supporter perks
 - Train or evaluate internal AI models as described in Section 4
 
+Management access to mailbox contents and related data is limited to what is reasonably necessary to diagnose and resolve service problems, investigate abuse or security incidents, or comply with binding legal requirements. We limit access to the information needed for the specific purpose and do not routinely read private correspondence. Authorized administration uses administrative accounts or system access; users do not need to disclose their private passwords.
+
 ## 4. AI & Automated Processing
 
 We use AI and automated systems for moderation, security monitoring, abuse detection, service operation, and service improvement. These include both self-hosted AI systems running on infrastructure we control and cloud-based AI providers.
 
-**Self-hosted moderation AI:** We deploy and operate self-hosted AI models for content moderation and abuse detection. These systems run on infrastructure we control — they do not send your data to external AI providers for moderation. Service data, including user-uploaded content, messages, chat, metadata, and activity associated with your account, may be processed by these internal AI systems to classify content, detect violations, flag suspicious behavior, and support moderation decisions. AI-assisted moderation may classify or flag content automatically. In serious cases, automated moderation may remove, hide, or replace content with a placeholder notice before human review. Automated moderation is not infallible — such actions may be reversed after human review, and you may contest a moderation action by contacting management. Automated moderation applies to uploaded content regardless of privacy or share settings, including uploads that are not publicly shared. Uploads may be checked against content policies, including content that exposes personal information, credentials, or technical secrets. The verdicts of automated moderation and the AI's explanatory reasoning about processed content may be recorded in an audit log, together with technical details such as confidence scores, content identifiers, and timestamps.
+**Self-hosted moderation AI:** We deploy and operate self-hosted AI models for content moderation and abuse detection. These self-hosted content-moderation systems run on infrastructure we control. Cloud-assisted operational and security-event review is described separately below. Service data, including user-uploaded content, messages, chat, metadata, and activity associated with your account, may be processed by these internal AI systems to classify content, detect violations, flag suspicious behavior, and support moderation decisions. AI-assisted moderation may classify or flag content automatically. In serious cases, automated moderation may remove, hide, or replace content with a placeholder notice before human review. Automated moderation is not infallible — such actions may be reversed after human review, and you may contest a moderation action by contacting management. Automated moderation applies to uploaded content regardless of privacy or share settings, including uploads that are not publicly shared. Uploads may be checked against content policies, including content that exposes personal information, credentials, or technical secrets. The verdicts of automated moderation and the AI's explanatory reasoning about processed content may be recorded in an audit log, together with technical details such as confidence scores, content identifiers, and timestamps.
 
-**Cloud-based AI:** We also use cloud-based AI providers, including Ollama Cloud and OpenAI, for operational tasks such as service administration, support, media management, and troubleshooting. Our cloud AI providers do not use service data to train their models. Data sent to these providers is limited to what is reasonably necessary for the task and is processed under the provider's applicable terms and privacy practices. Where a provider offers no-log or zero-retention processing, that protection applies.
+**Cloud-based AI and security assistants:** We use cloud providers to assist with service administration, support, media management, troubleshooting and review of network/web security events. Automated security assistants may review limited request metadata and incident information to help investigate abuse and protect services. We limit information supplied to what is reasonably necessary, without treating public-facing traffic as anonymous data.
 
-**Internal AI training:** Service data, including user-linked and identifiable data, may be used to train internal AI models. These models are internal-only, access-controlled, and not exposed to users or third parties.
+- **Ollama Cloud** is used for operational tasks involving private or identifiable service information, subject to the exclusions below. Ollama states that cloud prompt and response content is processed transiently, is not retained beyond fulfilling the request, and is not used to train its models. Limited account and operational metadata may still be retained under its privacy policy.
+- **OpenAI** is used for security review of traffic reaching public-facing services and for game-server maintenance. These tasks are intended to use public information and limited technical records rather than private mailbox or vault contents. Technical records may nevertheless contain IP addresses, player identifiers or other personal information. Our Codex account is configured not to use its content for model training. OpenAI may retain content and metadata for abuse prevention and other purposes under the applicable product terms; this is not zero-retention processing. A default abuse-monitoring period does not guarantee that every category of data is deleted by that deadline.
 
-**What is never used for AI:** Raw passwords, secrets, private vault contents, and credential material are never used for AI processing or training.
+**Operational memory:** AI assistants and supporting administrative systems may retain relevant service information, support context and incident records on our own systems. We use safeguards intended to reduce unnecessary capture of sensitive information, but these are not a guarantee against incidental exposure. Provider-side content retention limits do not delete our own conversation history, operational memory or other records. Their retention and handling of rights requests follow Sections 7, 12 and 13.
+
+**Internal AI training:** We may use service logs and other eligible service data, including user-linked and identifiable data, to train or evaluate private internal AI models in the future, without a separate service opt-in, subject to applicable law and the exclusions below. We currently have no plans to carry out such training. Any such models are internal-only, access-controlled, and not sold, published, shared with third parties or exposed to users. Deletion of source records does not automatically remove their influence from a model already trained on them. Requests concerning source data, training datasets, operational memory and trained models are assessed separately under applicable law; this technical distinction does not remove mandatory privacy rights.
+
+**Credentials and incidental exposure:** We do not intentionally collect or use users' private passwords, secrets, credential material or private vault contents for AI tasks, and exclude them from training datasets. Material submitted to a service may nevertheless contain inadvertently exposed sensitive information—for example, credentials visible in an uploaded screenshot—which may be encountered during moderation or support. This is not permission to use exposed credentials or to retain them unnecessarily.
 
 ## 5. Slink Sharing & Third-Party Caching
 
@@ -100,16 +107,20 @@ We retain data for as long as reasonably necessary to operate, secure, moderate,
 - **Email contents and logs** — retained while the mailbox is active; after a mailbox is deleted, contents may persist in rotated backups until the retention window expires
 - **Donation and supporter records** — retained for bookkeeping and to document supporter perks and history
 - **Game worlds and player state** — retained as part of the active world or server history; individual player data may remain embedded in shared world files and backups
-- **Playback, request, and dashboard history** — may be retained indefinitely to provide history and service functionality
+- **Playback, request, and dashboard history** — currently may be retained indefinitely to provide history and service functionality, subject to applicable deletion rights. No automatic one-year playback-history expiry is currently in effect
 - **Access and security logs** — retained as needed for diagnostics, bandwidth monitoring, abuse prevention, and security analysis
-- **Enforcement and moderation data** — including automated moderation verdicts and reasoning records, and originals of content removed by automated moderation — may be retained permanently where necessary to prevent evasion and protect users and services
+- **Enforcement and moderation data** — relevant ban/restriction records and archived abuse evidence may be retained indefinitely, including permanently where necessary and permitted by applicable law, to enforce restrictions, prevent evasion, substantiate findings, protect users and services, and establish, exercise or defend legal claims. Depending on the case, this includes email addresses, usernames, IP addresses, device names, incident records, relevant communications, automated moderation verdicts and reasoning, and originals of removed content. We limit retained information to what is necessary and restrict access to authorized management. These records can remain after account closure and are not subject to routine log or backup expiry
 - **Support communications** — retained as needed for support, moderation, and enforcement
 
-Data connected to suspected abuse, compromise, illegal content, rights complaints, cheating, or security incidents may be retained longer while necessary to investigate, document, or prevent recurrence.
+Data connected to suspected abuse, compromise, illegal content, rights complaints, cheating, or security incidents may be retained longer while necessary to investigate, document, or prevent recurrence. If a restriction is overturned, we may retain the original case record together with the additional evidence and decision that corrected it, assessed case by case. The record must reflect the revised outcome rather than treating the original finding as established abuse.
+
+**Backups:** Our LXC containers are backed up daily, with three days of backups currently retained. We plan to extend this to seven days; that extension is not yet in effect. Copies of deleted data included in those backups may remain until the applicable backup expires. This describes LXC backups, not a universal expiry for all service records, shared game worlds or separately retained evidence archives.
+
+**Operational copies:** Supporting administrative records and AI-assistant memory are retained where needed for service operation, support or security and are considered when handling relevant access, correction and deletion requests. They are distinct from provider-side inference logs and from routine backups.
 
 ## 8. Data Storage & International Processing
 
-Primary service storage and most sensitive operational data are hosted on private infrastructure in Stockholm, Sweden. Email services are hosted on infrastructure operated by a provider within the European Union.
+Primary service storage and most sensitive operational data are hosted on private infrastructure in Stockholm, Sweden. Email services are hosted on infrastructure operated by a provider within the European Union (Finland).
 
 Limited data may be processed outside Sweden or the European Union when you interact with third-party services or when infrastructure providers are required to deliver the service. In particular, public Slink images and links may be fetched or cached globally by Discord, browsers, recipients, and content-delivery networks. Game publishers, platform providers, email providers, DNS providers, and cloud AI providers may also process limited data in other jurisdictions under their own terms.
 
@@ -122,8 +133,8 @@ We do not sell personal data or voluntarily share it with unrelated third partie
 - **Payment and donation platforms** — such as Ko-fi and PayPal, which process donations under their own terms and privacy practices; we receive only what is needed to deliver supporter perks
 - **Discord** — messages and usernames used for support or community access, plus shared Slink images and link metadata when users post links to Discord
 - **Game and platform providers** — such as Microsoft, Mojang, Xbox, Pocketpair, and Steam when their games, accounts, networking, or software are used
-- **Cloud AI providers** — including Ollama Cloud and OpenAI; limited task data when cloud inference is used. These providers do not use service data to train their models. Where a provider offers no-log or zero-retention processing, that protection applies.
-- **Legal authorities or rights holders** — only where legally required or reasonably necessary to respond to valid legal or rights complaints
+- **Cloud AI providers** — Ollama Cloud and OpenAI receive limited task information as described in Section 4, with different content-retention arrangements. Provider processing is distinct from our own storage and any future internal training
+- **Legal disclosures** — we may preserve and disclose data we hold when required by applicable law or a valid, binding legal demand. We verify the validity and scope of the demand and provide the required data to the legally entitled recipient. A complaint alone does not entitle its sender to unrelated personal data; disclosures in responding to rights complaints are limited to what is necessary and legally permitted
 
 ## 10. Cookies & Sessions
 
@@ -131,7 +142,7 @@ Cookies, session tokens, and local storage are used for login sessions, authenti
 
 ## 11. Security Monitoring
 
-Security monitoring may log request metadata, classify traffic by ASN/provider or GeoIP, detect suspicious patterns, and automatically rate-limit or temporarily block traffic. Game servers may additionally log connections, commands, chat where enabled, suspicious gameplay, and administrative actions.
+Security monitoring may log request metadata, classify traffic by ASN/provider or GeoIP, detect suspicious patterns, and automatically rate-limit traffic or block it temporarily or permanently. Game servers — including community game servers — may additionally log connections, commands, chat where enabled, suspicious gameplay, and administrative actions.
 
 Provider or datacenter classification alone is not treated as conclusive proof of abuse. Legitimate platform proxying or caching of public Slink links, including Discord image fetching, may originate from shared cloud or CDN infrastructure.
 
@@ -146,7 +157,7 @@ Subject to applicable law, you may request:
 - Deletion, subject to Section 13
 - A structured, machine-readable copy where reasonably available
 - Withdrawal of consent where consent is the applicable legal basis
-- Contest a moderation action affecting your content and have it reviewed by a person
+- Contest a moderation action, account restriction or network block affecting you and have it reviewed by a person
 
 To exercise these rights, contact management using the details below. We may need to verify your identity before fulfilling a request.
 
@@ -156,12 +167,14 @@ Some data may not be immediately or fully removable, including:
 
 - Security, ban, moderation, and enforcement records required to prevent evasion or protect services
 - Player state or contributions embedded in shared game worlds where separation is not technically reasonable
-- Data in rotated backups until the retention window expires
-- Donation and supporter records where retention is required for accounting purposes
+- Data in rotated backups until the applicable retention window described in Section 7 expires
+- Donation and supporter records retained where necessary for bookkeeping and documenting supporter perks and history
 - Data required for an active investigation, legal obligation, or rights complaint
 - Copies downloaded, reposted, recorded, or cached by other users or third parties outside our control
 
-Deleting data required to operate an account may result in loss of access. Requests are normally scheduled within 30 days after identity verification.
+Deleting data required to operate an account may result in loss of access. We respond to rights requests without undue delay and within the timeframe required by applicable law, explaining any permitted extension, retained categories or refusal. Identity checks are limited to what is reasonably necessary. Retention exceptions are assessed for the relevant records and do not automatically justify retaining all data about a person.
+
+Relevant operational copies, including AI-assistant memory and supporting records, are considered separately from the original service data. Deleting source data does not automatically remove its influence from an already-trained model, as explained in Section 4; requests remain subject to applicable rights.
 
 ## 14. Children's Data
 
@@ -185,5 +198,3 @@ For privacy questions, access requests, deletion requests, or concerns:
 
 - Discord: `@majjoduran`
 - Email: `support@majjoduran.xyz`
-
----