Privacy policy

Updated: 18 October 2026

Controller and purposes

Rodolphe Bũhnemann, independent professional: 26 rue Balay, 42000 Saint Étienne, Loire, France. He handles data protection, rights requests and incidents and checks administration several times daily. Contact.

Depending on the features used, Keoby processes identity, username, e-mail, profile, authentication, posts, relationships, messages, media, AI conversations and memories, games, support, preferences, choice records and payment/credit references. Contractual service delivery, legal duties and legitimate interests in security and proportionate inactivity management provide the relevant purposes and bases. Optional trackers require consent where applicable; withdraw it through cookie settings. Required fields are identified; missing data may prevent the requested service.

The latest activity date is updated at most daily for inactivity management; this field contains no IP or page history. Technical logs may contain connection information.

Recipients and transfers

OVH provides hosting and S3 storage declared in France. Replicate and OpenAI process inputs/files needed for selected AI features; avoid unnecessary sensitive or third-party information. Stripe handles payments and its own duties; Mailtrap sends e-mails; Discord receives diagnostics. Other users see content according to visibility and participation. Authorities may receive legally required data.

Some providers or infrastructure are outside the EU. Registered offices do not establish processing locations. Regions and safeguards depend on the service and contract; ask the controller for further transfer information. Google AdSense is not currently activated.

Retention and rights

Retention follows purpose, deletion requests, third-party rights and legal duties. Review may start after 24 months of observed inactivity, followed by 30 days’ notice before a closure decision. Subscriptions, balances, pending operations and justified holds are checked. Closure does not mean complete erasure.

Download archives expire after 7 days by default. Closed tickets, closed rights requests and completed games have proposed review thresholds of 24, 36 and 36 months; these do not automatically delete data. Relevant accounting documents are retained for 10 years from financial year-end. Necessary dispute evidence may be held with restricted access. Backups expire through their own rotation, rather than immediately on closure.

Request access, rectification, erasure, restriction, objection and applicable portability via “My personal data” or contact, including without an account. Consent can be withdrawn without affecting earlier lawful processing. Proportionate identity checks may apply. The usual response period is one month, with a reasoned extension under GDPR conditions. Automated downloads may need a supplementary response. You may complain to the CNIL or the competent authority. Registration is restricted by Keoby policy to people over 15; an age declaration is not identity verification and does not replace local rules or safeguards for minors.

Protection when serving advertisements

When already present in your account, your declared birth date is also consulted to apply advertising safeguards. This check does not transmit it to the advertising network or request a new identity document. Without a usable date, or for a declared minor, optional repeat-display identifiers and external advertising are not permitted by this mechanism. Internal promotions without those identifiers may still appear. This is a declaration-based check, not proof of adulthood; registration restricted to people over 15 does not prove that you are 18. You can request correction of your account data.