Privacy Policy#
Wusoup is operated by Taoensso LLC, a Wyoming limited liability company, with Peter Taoussanis as its owner and sole operator. Taoensso LLC is the controller of personal data processed by Wusoup.
Wusoup takes your privacy very seriously and complies with the EU's General Data Protection Regulation (GDPR). The same level of privacy protection is offered to both EU and non-EU users.
I'd like this policy to be as clear and fair as possible - please let me know if anything is unclear, or if you have any concerns!
Cookies and tracking#
Wusoup does not track you across the internet, and it does not embed third-party advertising or social tracking tools. Wusoup uses only first-party cookies for secure authentication, security, and a small number of interface preferences.
Authentication cookies are set during login or onboarding. Starting a Google, Discord, or Facebook login also sets a temporary security cookie that is deleted when the login finishes and expires automatically after 10 minutes. These cookies do not contain personal information or provider access tokens.
Personal data stored#
| What data | When it's collected | Why it's collected | How it's stored, and for how long | Comments |
|---|---|---|---|---|
| Part of your IP address (x.y.z.000) | Automatically when you visit Wusoup | Security: rate-limiting, and to help detect malicious requests | On my (EU) server, for <30 days | Doesn't directly identify you, but can identify your country and city |
| Your browser data (user agent) | Automatically when you visit Wusoup | Analytics: so I know which devices to optimise for | On my server, for < 30 days | Doesn't directly identify you |
| Your email address | When you choose to join Wusoup or allow a login provider to share it | Used for logging in (email links) and notifications (e.g. new messages) | On my server, until your account is deleted | Never shared with other users or used for marketing |
| Your login provider account ID | When you choose Google, Discord, or Facebook login | Used to recognise your account on future provider logins | On my server, until disconnected or your account is deleted | Wusoup does not store provider access tokens |
| A friend's email address (+ optional note) | When you choose to invite a friend by email | To send them your one-time invitation, and show you whether they've joined | On my server, for < 60 days | Only ever used for that one invitation, never for marketing. If you're the friend: just ignore the email, or reply to it and I'll delete your address right away |
Personal data shared#
Wusoup does not sell personal data or share it for advertising, marketing, profiling, or tracking. The following service providers process limited personal data only as needed to operate Wusoup:
- Hetzner Online GmbH hosts Wusoup on a dedicated server in Germany. Wusoup account and service data are stored there.
- Amazon Web Services, Inc. provides transactional email delivery through Amazon Simple Email Service (SES). It receives the email address and email content needed to deliver messages such as login links and notifications.
These providers process data on Wusoup's behalf and are not permitted to use it for their own marketing.
If you choose Google, Discord, or Facebook login, your browser is redirected to that provider and the provider will learn that you chose to sign in to Wusoup. Wusoup requests only the minimum account details needed to authenticate you: a provider-specific account ID and your email address. Wusoup does not send your Wusoup profile, messages, contacts, or activity to the login provider.
Requests from public authorities#
For any request from a public authority seeking Wusoup user data, Taoensso LLC will:
- Review the request's legal basis, scope, and validity before responding.
- Challenge the request when there are reasonable grounds to consider it unlawful.
- Disclose only the minimum information legally required.
- Document the request, the response, the legal reasoning, and the people involved.
These safeguards apply to all Wusoup user data, including personal data received from login providers such as Facebook.
Wusoup allows you to decide what profile information to share with other Wusoup or internet users:
- Your email address will never be shared.
- Your chosen username will be shared, but may be anonymous.
- Your age and location (country, city) may be shared or hidden (you decide).
- Your uploaded profile photos may be shared with all active Wusoup members, or only users you've pinned (you decide).
Your profile options should make it clear what will be visible, and to whom. Please let me know if anything is unclear!
Message privacy#
The messages you write on Wusoup are visible only to:
- The message recipient.
- Me (Peter Taoussanis, Wusoup's author).
I will review a user’s messages only when necessary to investigate potential violations of Wusoup’s Community Rules or Terms of Use. In such cases, I will make every effort to view only the minimum number of messages required to complete the investigation.
In cases involving serious illegal activity (such as fraud, abuse, or child endangerment), I may report such activities to the appropriate law enforcement agencies.
Analytics and community statistics#
Your behaviour on Wusoup (e.g. logging in, starting chats, sending messages, opening help links from the UI) may be recorded for analytics and aggregate statistical purposes to help me understand community trends like engagement over time and the usage of certain features.
Aggregate community statistics may be shared publicly for fun, but will never personally identify any individual users.
You can see these aggregates on the public community stats page.
Account security#
It is solely your responsibility to ensure that you keep private any credentials used to log in to your Wusoup account:
If you have a Wusoup password: use a strong password (some minimums are enforced) and keep your password private.
If you have email login enabled: use a strong email password and follow any other security recommendations from your email provider.
Export or delete your data#
You can permanently delete all your data on Wusoup at any time via your account options here.
If you ask Facebook to delete data associated with Wusoup through Facebook's Apps and Websites settings, Wusoup immediately deletes the Facebook-specific account ID used for login and returns a confirmation code. This disconnects Facebook login from your Wusoup account. To delete the entire Wusoup account and all its data, use the account-deletion link above.
To get an export of your data, just let me know. (I can also make this self-serve in future if there's interest).
Note that for privacy and technical reasons, Wusoup may store only your most recent messages from each chat - and may regularly delete messages from old inactive chats!
Automatic data deletion#
As a privacy measure, all your data (including messages) may be automatically deleted if you don't log in for more than 24 months.
In this case, warning emails will be sent at 3 months, 1 month, and 48 hours before deletion. This behaviour is intended to cover cases like someone passing away, etc.
Also note that for privacy and technical reasons, Wusoup may store only your most recent messages from each chat - and may regularly delete messages from old inactive chats!
Technical security measures#
Wusoup is designed, built, and deployed following security best practices including:
- Forced strong HTTPS everywhere with HSTS (preload).
- Single-tenant hardened server deployment with 2FA SSH access, hosted in Germany under EU data protection laws.
- Updated, mature server software including: NGINX, JVM, etc.
- Modern browser protections incl. anti CSRF/XSS, CSP, strict transport security, etc.
- Scrypt key derivation to protect passwords and prevent brute-forcing.