Privacy Policy

Last updated: March 31, 2025

1. Data Controller

Gonzalo Eloy Vazquez Dieguez
IČO: 21111251
Žatčany, Czech Republic
Email: support@rawcast.org

2. Data We Collect

Data	Purpose	Storage
Email address	Account authentication	Supabase (server)
Display name	Identify you to peers	Supabase (server)
Credit balance	Track prepaid transfer allowance	Supabase (server)
Session data	Keep you signed in ("Remember me")	Browser localStorage
Transfer chunks	Temporary file transfer buffer	Browser IndexedDB (cleared after transfer)

3. Data We Do NOT Collect

We do not inspect, store, or log the content of files transferred between users.
All file transfers occur directly between peers via WebRTC (peer-to-peer).
When relay servers are used (TURN), traffic is encrypted and not inspected.
We do not use analytics, tracking pixels, or third-party advertising.

4. Where Data Is Stored

Server-side data is stored on a self-hosted Supabase instance running on Hetzner infrastructure in the European Union (Germany). We do not transfer personal data outside the EU/EEA.

5. Legal Basis for Processing (GDPR Art. 6)

Consent — You provide your email and name when creating an account.
Contract performance — Processing is necessary to provide the service you signed up for.
Legitimate interest — Maintaining service security and preventing abuse.

6. Data Retention

Your data is retained for as long as your account is active. When you delete your account, all associated data (email, display name, credit balance) is deleted immediately and permanently. Temporary client-side data (localStorage, IndexedDB) can be cleared through your browser settings at any time.

7. Your Rights Under GDPR

As a data subject under the General Data Protection Regulation (EU) 2016/679, you have the right to:

Access — Request a copy of the personal data we hold about you.
Rectification — Request correction of inaccurate personal data.
Erasure — Request deletion of your personal data (right to be forgotten).
Data portability — Receive your data in a structured, machine-readable format.
Restrict processing — Request limitation of how we process your data.
Withdraw consent — Withdraw consent at any time by deleting your account.
Lodge a complaint — File a complaint with the Czech data protection authority (ÚOOÚ — Úřad pro ochranu osobních údajů, www.uoou.cz).

To exercise any of these rights, email support@rawcast.org. We will respond within 30 days.

8. Third-Party Services

Supabase (self-hosted) — Authentication and database. Data remains on our own servers.
STUN/TURN servers — Used for WebRTC connection establishment. No personal data is stored.
Lemon Squeezy — Payment processing for credit purchases. See their privacy policy. We do not store payment card information.

9. Data Sharing

We do not sell, rent, or share your personal data with third parties. Data may be disclosed only if required by law or court order.

10. Security

We use industry-standard security measures including encrypted connections (TLS), hashed passwords, and access-controlled server infrastructure. WebRTC transfers are encrypted end-to-end by the protocol.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or in-app notice.

12. Contact

For privacy-related inquiries: support@rawcast.org