Privacy Policy — Peridot

This policy explains what personal data Peridot collects, why, who else handles it, how long it is kept, and how to use the rights the EU General Data Protection Regulation (GDPR) gives every person. What the site stores in your browser is listed in the Cookie Policy; the rules of the site are in the Terms of Service.

1. Who is responsible

Peridot is a small, non-commercial community site run by one person, Ken “Krysion” Nisaka (the operator), based in the Kingdom of the Netherlands, who is the controller of the personal data described here. Contact for anything in this policy: hello@krysion.com. Peridot has no advertising, does not sell data, and does not profile anyone for marketing.

The operator may appoint members of the Peridot team (shown with the Peridot team badge) to help run and moderate Peridot. They act for the operator, on the operator's instructions and bound to confidentiality, and see what the operator sees for that work. Wherever this policy says that the operator can read something, that includes them.

2. What is collected, and why

Data	Why	Legal basis (GDPR Art. 6)
Account: email address and password. The password is kept by Firebase Authentication as a salted hash; the operator never sees it.	Creating the account, signing in, verifying the email, password resets.	Contract (1)(b): needed to provide the account that was asked for.
Profile: display name, handle, and optionally pronouns, bio, links, avatar, and banner. The join date and country are added automatically.	Showing who wrote what, and letting people find each other.	Contract (1)(b).
Content: posts, replies, pictures, video, audio, GIF and YouTube links, reactions, follows, and unfinished drafts (drafts are private).	Running the community features.	Contract (1)(b).
Blocks: which accounts a member has blocked, and since when.	Keeping the two apart as the member asked: hiding their posts and replies from each other, and stopping follows, replies, reactions, and notifications between them.	Contract (1)(b).
Sign-in details (private): IP address, city, region, country (worked out by Peridot's own host from the IP address, not by a third-party lookup), browser and device description (user agent), the time of the last visit, and a copy of the email. Collected once per visit while signed in.	Keeping the site safe (spotting hijacked accounts and abuse), moderation, and counting how many members are active.	Legitimate interests (1)(f): running a safe community. Objecting is possible at any time (section 8).
Agreement record (private): which version of the Terms of Service, this Privacy Policy, and the Cookie Policy was accepted, and when (each version accepted is recorded).	Knowing that the current terms were accepted, showing it, and asking again when they change.	Contract (1)(b); legitimate interests (1)(f): being able to show what was agreed.
Security checks: IP address and how the browser behaves on the page, read by reCAPTCHA Enterprise through Firebase App Check.	Stopping bots from creating accounts.	Legitimate interests (1)(f).
Analytics (Google Analytics), only if the banner is accepted: pages opened and a few actions (signing up, posting, replying, reacting, following, using the GIF or emoji picker, using Home filters), tied to a random account ID, never to names, handles, emails, or anything written.	Seeing which pages and features are used.	Consent (1)(a). Declining changes nothing about how Peridot works, and consent can be withdrawn at any time in Settings.
Notifications: when someone replies to, mentions, reacts to, or follows a member, a short record (who, what, a snippet of the text, when) is stored for the member it concerns, together with the member's choices about which kinds to receive and the moment they last opened their notifications. Notices from the operator (why something was removed, what became of a report) are stored the same way.	Telling members what happened, and explaining moderation decisions.	Contract (1)(b); for the operator's notices, legal obligation (1)(c) (explaining moderation decisions).
Push notifications (private, only on a device that allowed them): an address for each device that turned push on (a token issued by Google's push service), a short description of the device, and when it was saved. When a notification is pushed, its text (who, what, a snippet of the post or reply) passes through Peridot's host and Google's push service to reach the device.	Telling a member about a reply, mention, reaction, or follow while Peridot is closed.	Consent (1)(a): nothing is sent to a device until the member turns push on there (in a browser, with the switch in Settings; in the Android app, by allowing notifications when the system asks the first time the app opens), and turning it off in Settings removes the address.
Reports: when a member reports a post, reply, or account, the report stores who reported, what and whom, the reason, the details written, a short copy of the reported text, and the outcome.	Reviewing reports, acting on them, and telling the reporter what was decided.	Legal obligation (1)(c) (handling notices of illegal content) and legitimate interests (1)(f) (keeping the community safe).
Moderation decisions (private to the member and the operator): what was removed or restricted, the reason, the facts, whether it followed a report, a short copy of the content, and, for content that was hidden, a private copy of it while an appeal is possible; the member's appeal and its answer.	Telling the member why (a statement of reasons, as the Digital Services Act requires), handling appeals, reversing a decision when it was wrong, and showing decisions were made properly.	Legal obligation (1)(c) (the statement of reasons); legitimate interests (1)(f) (appeals, and defending decisions).
Emails sent by Firebase: address verification, password reset, and email-change links.	Account security.	Contract (1)(b).
Reports and messages sent to the operator, such as a report about a post or a rights request.	Handling the report or request.	Legal obligation (1)(c) and legitimate interests (1)(f).

Peridot does not ask for special categories of data (health, religion, political opinions, and so on). What a member chooses to write in a post or bio is their own decision; please think before sharing sensitive details about yourself or other people.

3. What other people can see

Public inside Peridot: profile details, posts, replies, reactions (including who reacted), and who follows whom. Signed-out visitors see a short preview of the newest posts.
Technically public: the interface is members-only, but the database behind it can be read without signing in, because that is how link previews (for example on Discord) work. Anything posted should be treated as public.
Private: the email, the sign-in details, drafts, the agreement record, and moderation decisions (with any hidden copy of removed content). Only the member and the operator can read them.
Blocks: a block can be read by the member who made it, the member blocked (Peridot tells them they are blocked when they open the blocker's profile), and the operator. Nobody else is shown who blocked whom.
Suspended accounts: while an account is suspended, others see only its handle and that it is suspended; its posts and replies are hidden in the app (the database behind it stays as described above).

4. Who else handles the data

These services work for Peridot or are contacted by the browser. None of them is given data for its own advertising.

Google Ireland Limited, Firebase: Authentication holds the sign-in, Cloud Firestore holds the profile, content, and private records (the database is in Google's data centre in the Netherlands, region europe-west4), and App Check with reCAPTCHA Enterprise checks that requests come from a real browser.
Google Ireland Limited, Firebase Cloud Messaging: delivers push notifications, and only to devices that turned them on. It receives the device's address and the text of each notification pushed to it.
Google Ireland Limited, Google Analytics: counts visits, and loads only after consent. Google's advertising features and Google signals are switched off, and the data is kept for 14 months.
Netlify hosts the site and runs its small server functions (link previews, the location lookup for sign-in details, and removing a sign-in when an account is deleted). Like any host, it sees the IP address of every request.
Hermes (hermes.nisaka.eu) is the operator's own file server for avatars, banners, and post media.
KLIPY (api.klipy.com) answers GIF searches when the GIF picker is opened, and receives the search words and IP address. KLIPY GIFs in posts load from KLIPY's servers.
YouTube (youtube-nocookie.com, privacy-enhanced mode) loads only when a post embeds a video. While a post is being written, a pasted YouTube link loads its preview picture from i.ytimg.com.
Krysion (krysion.com, the operator's own site) serves the typeface, the footer, and the cookie banner.
cdnjs (Cloudflare) and jsDelivr serve icons and libraries. They see the IP address, as any web request does.

Personal data is not sold, and is given to authorities only when the law requires it.

5. Transfers outside the EU

The database is kept in the Netherlands, but some of the services above are run by companies that may process data outside the European Economic Area, notably in the United States (for example for support, security, or analytics). Where that happens, it relies on a recognised safeguard: an adequacy decision (for example the EU–US Data Privacy Framework, for certified companies) or the European Commission's Standard Contractual Clauses.

6. How long data is kept

Account, profile, content, and private sign-in details: for as long as the account exists. When an account is deleted (by the member in Settings, or by the operator), the profile, handle, posts with their replies and reactions, the member's reactions, follows, and blocks (and other people's blocks of the account), drafts, notifications, reports made, moderation decisions about them, private details, uploaded files, and the sign-in itself (the email address) are erased. Replies on other people's posts that others answered are emptied and shown as “Deleted account”, so conversations keep their shape.
Posts and replies that a member deletes: they are erased from the database at once, with everything under them (for a post: its replies and reactions; for a reply: its reactions and files). A reply that others have answered is emptied and shown as “[deleted]” instead, so their replies keep their place; nothing of the author's stays in it. Copies in Google's own systems disappear on Google's schedule.
Content removed by moderation: when it is hidden, it disappears from the site and its public record at once, and a private copy (with its files) is kept for six months so it can be restored if an appeal succeeds; then it is erased, or later only while an appeal is still open. Content deleted for good is erased at once.
Moderation decisions and appeals: one year after the decision (longer only while an appeal is open), then deleted.
Notifications: 90 days, then they are deleted.
Push addresses: until push is switched off on that device, the member signs out there, the account is deleted, or Google's push service reports the address as no longer valid. A short record that a notification was pushed (its id and time) is kept for six hours so the same one is not sent twice.
Unverified sign-ups: an account whose email is never verified has no profile and is removed after a few days.
Analytics: 14 months, and only with consent.
Reports about a member's content, and rights requests: as long as needed to handle them and to show they were handled, then deleted. A report a member made is deleted with their account.

7. Age

Peridot is for people aged 16 or older. Accounts of anyone younger are removed when found. Anyone who believes a child has an account can tell the operator.

8. Your rights

Under the GDPR, everyone may, free of charge:

Access the data held about them and get a copy: Settings, Your data, Download gives everything as one JSON file straight away.
Correct anything wrong. Most of it can be edited directly on the profile and in Settings.
Erase their data, including the whole account: Settings, Your data, Delete account does it straight away, including the sign-in.
Restrict processing, or object to processing based on legitimate interests.
Receive their data in a structured, common format (portability): the same download.
Withdraw consent to analytics at any time, in Settings, without affecting anything done before.
Complain to a data protection authority, for example the one in the country of residence or work. In the Netherlands that is the Autoriteit Persoonsgegevens; a list for other countries is at edpb.europa.eu.

Everything above that is not a button in Settings (correction of something that cannot be edited, restriction, objection, a question) is done by email to hello@krysion.com, from the address on the account. A reply follows within one month. The operator may ask for confirmation that the request really comes from the account owner before handing over or erasing anything. Members can also delete their own posts, replies, and drafts, change their email and password, choose which notifications they get, and remove their avatar and banner themselves. A suspended member can still download and erase their data.

9. Automated decisions

Nothing about anyone is decided by automated means with legal or similarly significant effect. The bot check (reCAPTCHA) scores whether a request looks automated; if a request is refused, trying again or contacting the operator resolves it.

10. Security

Data is held on Google's and Netlify's infrastructure and travels over encrypted connections. Database rules limit who can write or read private records, new accounts must verify their email, and sign-in is protected against bots. No online service can promise perfect security. If a breach puts people at risk, those affected and the authorities are told as the law requires.

11. Changes

Each version of this policy has a number and a date (at the top), and every earlier version is kept, word for word, and listed at the end of this page. When a change matters, members are told on the site and asked to confirm they have read the new version before going on.