Last updated: March 2, 2026 · Effective: March 2, 2026
The data controller responsible for processing your personal data is:
If you have questions about data protection, you can reach the data controller at the address above.
This privacy policy explains how we collect, use, store, and protect your personal data when you use:
Together, these are referred to as the "Service." The Service is a micro-blogging platform where users can post short text entries, share links, and upload images. The source code is available as open source at github.com/kibotu/trail.
We are committed to protecting your privacy. We process personal data only to the extent necessary to provide and improve the Service, and in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Telecommunications-Telemedia Data Protection Act (TTDSG), and other applicable data protection laws.
When you sign in via Google OAuth, we receive and store:
We do not receive or store your Google password. Authentication is handled entirely by Google's OAuth 2.0 service.
You may optionally provide additional profile information, including:
When you use the Service, you may create and submit content, including:
We automatically collect certain data about how you use the Service:
When you access the Service, we automatically process:
The Android app may additionally collect, through integrated third-party SDKs:
| Purpose | Data Used |
|---|---|
| Providing and operating the Service (account creation, authentication, posting, commenting) | Account data, profile data, content, technical data |
| Displaying your public profile and content to other users and visitors | Profile data, content |
| Generating link preview cards for shared URLs | URLs you post (sent to Iframely API) |
| Sending you notifications (claps, @mentions, comments) | Account data, interaction data |
| Providing search functionality | Content (indexed for full-text search) |
| Content moderation (responding to reports, enforcing policies) | Content, report data, account data |
| Spam protection and rate limiting (preventing abuse) | IP address (temporarily; auto-deleted after 1 hour) |
| View count deduplication (preventing inflated counts) | Irreversible hash of IP + User-Agent (raw values not stored) |
| Bot protection | User-Agent header (checked in real time, not stored) |
| Monitoring and improving performance, stability, and security | Crash reports, analytics |
| Complying with legal obligations | As required by applicable law |
We do not use your data for automated decision-making or profiling. We do not sell your personal data.
Under Art. 6(1) GDPR, we process your personal data on the following legal bases:
| Legal Basis | Processing Activities |
|---|---|
| Contract performance (Art. 6(1)(b)) | Account creation, authentication, providing the Service (posting, commenting, interactions), profile management, notifications |
| Legitimate interests (Art. 6(1)(f)) | Spam protection and rate limiting (temporary IP processing), view count deduplication (hashed identifiers), bot protection, analytics and performance monitoring, crash reporting, security measures, content moderation. Our legitimate interest is operating a reliable, secure, and abuse-free Service. You can object to processing based on legitimate interests (see Section 11). |
| Legal obligation (Art. 6(1)(c)) | Compliance with applicable laws, responding to lawful requests from authorities, record-keeping obligations |
| Consent (Art. 6(1)(a)) | Optional marketing communications (if any). You can withdraw consent at any time. |
Think carefully before posting personal information. Once published, your content may be indexed by search engines, cached by third parties, or embedded on other websites. While you can delete your content from the Service, we cannot guarantee removal from third-party caches or archives.
The Service integrates the following third-party services, each with their own privacy policies:
| Service | Purpose | Privacy Policy |
|---|---|---|
| Google OAuth 2.0 | User authentication | Google Privacy Policy |
| Google Play Services | App distribution and services (Android) | Google Privacy Policy |
| Google Analytics for Firebase | Anonymized usage analytics (Android) | Firebase Privacy |
| Firebase Crashlytics | Crash reporting (Android) | Firebase Privacy |
| Iframely | URL preview / link card generation | Iframely Privacy Policy |
When you post a URL, that URL is sent to the Iframely API to generate a preview card (title, description, thumbnail). Iframely may log these requests according to their own privacy policy.
We do not sell, rent, or trade your personal data. We may share your data only in the following circumstances:
The Service is hosted on servers located in Germany. If you access the Service from outside the European Economic Area (EEA), your data will be transferred to Germany, which is within the EEA and subject to GDPR.
Some third-party services (Google, Firebase, Iframely) may process data outside the EEA. These providers maintain appropriate safeguards such as EU Standard Contractual Clauses (SCCs) or adequacy decisions. For details, please refer to their respective privacy policies linked in Section 7.
| Data Category | Retention Period |
|---|---|
| Account data | Until you delete your account. After requesting deletion, your content is hidden immediately and permanently deleted after 14 days. Backup removal may take an additional 30 days. |
| Content you create (posts, comments, images) | Until you delete the content or your account |
| Profile data | Until you modify or delete it, or delete your account |
| Rate limit records (IP-based identifiers) | Automatically deleted after 1 hour |
| View deduplication hashes (irreversible; no raw IP) | 24 hours (used to prevent duplicate view counts within a day) |
| Server access logs (web server level) | Up to 90 days |
| Analytics data (Firebase) | Per Google's retention settings (default: 14 months) |
| Crash reports (Crashlytics) | Per Google's retention policy (90 days) |
After account deletion, we may retain certain data where required by law (e.g., for tax or legal compliance purposes) or to the extent necessary to resolve disputes or enforce our terms.
Under the GDPR, you have the following rights regarding your personal data:
To exercise any of these rights, please contact us at contact@kibotu.net. We will respond within one month as required by the GDPR (extendable by two months for complex requests).
You have the right to lodge a complaint with a data protection supervisory authority if you believe your data is being processed unlawfully. You can contact the supervisory authority in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement. In Germany, the relevant authority depends on the federal state (Bundesland) where the data controller is located.
The Service is not intended for children. In accordance with Art. 8 GDPR and its German implementation, we do not knowingly collect personal data from anyone under the age of 16. If you are under 16, you may only use the Service with the consent and supervision of a parent or legal guardian.
If we become aware that we have collected personal data from a child under 16 without parental consent, we will promptly delete that data. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at contact@kibotu.net.
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
However, no method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
The Website uses cookies and similar technologies for the following purposes:
| Cookie / Technology | Purpose | Type |
|---|---|---|
| Session cookie | Maintaining your authenticated session | Strictly necessary (no consent required) |
| Firebase Analytics (App) | Anonymized usage statistics | Analytics (legitimate interest) |
Strictly necessary cookies are required for the Service to function and cannot be disabled. You can configure your browser to block or delete cookies, but this may impair the functionality of the Service.
We may update this privacy policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via the Service. We encourage you to review this page periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.
If you have any questions about this privacy policy, your personal data, or wish to exercise your data protection rights, please contact: