cavu.social Privacy Policy
Effective 26 October 2026. Last updated 26 October 2026.
This policy explains what the cavu.social account server (account.cavu.social) collects and why. It's run personally by Chris Pardy ("we", "us"); contact account@cavu.social. cavu.page and cavu.games are separate apps and may describe their own data use.
The short version
- What you post to your atproto repository is public and copied across the network. Don't post anything there you want kept private.
- We keep the minimum needed to run your account: your email and sign-in details. We don't keep backups or long-term logs.
- We don't sell your data, show ads, or use your data to train AI models.
What's public by design
Your handle, DID, profile (name, bio, pictures) and the records in your repository (posts, books, game data and files you upload) are public. We publish them to the atproto network, where relays, apps, search engines and archives we don't control can copy and keep them, even after you delete them here. Private data in Spaces is the exception: we share it only with the members and apps the space allows.
What we collect privately
- Account details: your email address, a hash of your password and app passwords, passkeys and two-factor settings, and your account settings.
- Sign in with Google: if you use it, Google tells us a stable account identifier and your email address (and whether Google has verified it). We don't receive your Google password or contacts.
- Sessions and connected apps: which apps you've authorized (for example cavu.page or cavu.games), when, and with what permissions, so you can review and revoke them.
- Technical data: IP addresses and request information are used as requests happen, for security, abuse prevention and rate limiting. We don't keep separate logs beyond the short-lived operational logs our hosting provider holds.
How we use it
To run and secure your account (sign-in, security codes, detecting abuse), to send account and security email (not marketing), to enforce our Terms, to respond to you, and to meet legal obligations.
Who we share it with
We use these providers to run the service, and they process data only on our behalf:
- Fly.io (hosting, USA) and Tigris (storage, USA): run the server and store account data.
- atmos.email (email delivery): sends account email to your address.
- Google: only if you choose Sign in with Google.
We may also disclose information if required by law or to protect people's safety, and we report child sexual abuse material to NCMEC. If cavu.social is transferred to another operator, this policy continues to apply to your data.
How long we keep it
Only as long as your account exists. We don't keep backups. When you delete your account, we delete its private data and stop serving its public data; copies already made by others on the network aren't ours to delete (see above). If you move your account to another server, your data here is removed when you delete the account here.
Your choices and rights
You can view and change your email and profile, review and revoke connected apps and app passwords, export your whole account, move it to another server, or delete it, all from account.cavu.social. You can also email us to ask for a copy of your data or for corrections or deletion. Depending on where you live (for example the EU, UK or California), you may have additional rights, including to object or complain to a regulator.
Where data is stored
Data is stored and processed in the United States. If you're outside the US, you're transferring your data there when you use cavu.social.
Children
cavu.social is only for people 18 and over, and we don't knowingly collect data from anyone younger. If you believe someone under 18 has an account, contact us and we'll remove it.
Security
Passwords are stored hashed, account signing keys are encrypted at rest, and connections are encrypted in transit. No system is perfectly secure; we'll notify affected users of a breach as required by law.
Changes
We'll post changes here and email you about material ones before they take effect.