Privacy Policy

TL;DR: We only collect what we need to make Estopia work (username, email, etc.). We don't sell your data, track you, or show ads. All your messages are stored securely, and you control your data.

This Privacy Policy describes how Estopia ("we", "our", or "us") collects, uses, stores, and shares personal data when you use our products and services. It currently applies to:

• Estopia Chat (App)

This policy also applies to all websites and services operated under the estopia.net domain.

1. Who We Are

Estopia is an independent software platform offering communication services. Estopia is operated by a team of developers, with Jay as the sole owner of the company.

Data Controller:

• Jay Brammeld (Sole Owner)
• 📧 jay@estopia.net
• 📍 3 Braemount, Cowdenbeath, KY4 9RB, United Kingdom
• 🌍 Data hosted securely on UK servers

2. What This Policy Covers

This Privacy Policy applies to:

• All services operated under the Estopia name
• All domains and subdomains of estopia.net
• The Estopia Chat mobile application and its associated features

As we expand, newly released Estopia products will also fall under this policy unless explicitly stated otherwise. As new services are released under the Estopia platform (e.g., web, iOS, or desktop apps), they will follow this Privacy Policy or include an addendum if unique privacy needs arise.

3. Information We Collect

We collect the following data when you use Estopia Chat:

• Account Info: Username, email, phone number, profile photo
• Login Credentials: Via email/password, Google, or Passkeys
• Media Access: Microphone, camera, and screen for voice/video calls, voice notes, and screen sharing
• Uploaded Files: Media or other files uploaded
• Device Hardware: Operating System, Version, Browser Information and your IP Address

We do not collect:

• Location data
• Sensitive personal data (e.g., biometric, health, or financial data)
• Advertising or tracking identifiers

4. How We Use Your Information

We use your data to:

• Create and manage your Estopia account
• Provide messaging, calling, and screen sharing features
• Authenticate users and protect against abuse
• Distribute uploaded media or files

We temporarily access your microphone, camera, and screen during calls and screen sharing. This data is streamed in real-time and is not recorded, stored, or shared. Screen sharing is only active during your session and with your explicit permission.

5. Legal Bases for Processing

Under GDPR, we process personal data based on:

You are prompted to grant permission before any access to your microphone, camera, or screen is initiated.

6. Data Sharing Across Estopia Services

If you'll use multiple Estopia services in the future:

• Your account information may be shared across services to provide a consistent experience.
• We do not sell or share your data with third parties for advertising or analytics.

7. Third-Party Services

We may use:

• Google OAuth2 – for sign-in
• Cloudflare DNS – to resolve our domains (not for proxying traffic)

No data is shared with third-party analytics or ad providers.

8. Cookies and Web Usage

Across all pages and subdomains of estopia.net, we may use cookies or similar storage for:

• Login session tokens (e.g., keeping you signed in)
• Security features (e.g., CSRF protection)

We do not use cookies for:

• Advertising
• User tracking

We do not respond to "Do Not Track" (DNT) signals.

9. Data Storage and Security

• Data is stored on the site without a third party
• All data is transmitted over HTTPS
• Passwords are securely hashed
• We use protective measures such as rate limiting to prevent abuse

All data is encrypted in transit.

We comply with the General Data Protection Regulation (GDPR) in the European Economic Area and the UK GDPR. Your personal data will not be transferred outside the UK/EU without adequate safeguards.

10. Data Retention and Deletion

• Data (messages, profiles, etc.) connected to your account is retained until you delete it unless it has been reported.
• If your data connected to your account has been reported, it will only be deleted once your account is fully deleted, only after 60 days (used for appeals only).
• You can delete your account or request data deletion by contacting us

Data exports will be provided in a standard machine-readable format (e.g., JSON or CSV) upon request.

11. Children's Privacy

Estopia is intended for users aged 13 and over. We do not knowingly collect personal information from children under 13 years old, in compliance with the U.S. Children's Online Privacy Protection Act (COPPA) and similar laws worldwide. If we learn that we have collected personal data from a child under 13, we will delete that information promptly.

Parents and guardians are encouraged to supervise their children's use of Estopia services.

12. Your Privacy Rights

Depending on your location, you may:

• Request access to your data
• Correct inaccurate data
• Delete your data
• Object to or restrict processing
• Export your data (data portability)
• File a complaint with a data protection authority

To exercise these rights, contact support@estopia.net.

13. California Consumer Rights (CCPA)

We comply with the California Consumer Privacy Act (CCPA):

• We do not sell your data
• You may request:
  • Access to your collected data
  • Deletion of your data
  • A "Do Not Sell My Personal Information" option (for transparency)

14. Data Breach Notification

We are working to implement a formal data breach notification process. In the event of a breach, affected users and authorities will be notified within 72 hours, as required by law.

15. Policy Updates

We may update this Privacy Policy to reflect new features, legal changes, or new services. Updates will be posted on our website or displayed in-app with a new effective date.

16. Contact Us

For any privacy concerns, contact:

📧 support@estopia.net

17. International Users and Data Transfers

If you use Estopia services outside the United Kingdom or European Union, please be aware that your personal data may be transferred to and processed in the UK, where our servers are located. We take all reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy and applicable privacy laws, including GDPR, CCPA, LGPD (Brazil), and PIPEDA (Canada).