Privacy Policy

Account Information

• Username / Fluxer ID
• Email address (required for account registration, password resets, and administrative notices)
• Password hash (never stored in plaintext)
• Device identifiers and session tokens
• Account creation timestamp
• Optional profile details you add, such as an avatar, display name, or bio
• Date of birth, if you enter one to access an age-gated channel

Technical Metadata

• IP addresses you connect from, and connection timestamps. Your most recent IP address and the IP address from account creation are kept for the life of your account
• The IP address and approximate location of each signed-in session, kept while the session lasts and for 30 days afterwards
• Server and security logs that include IP addresses, kept for up to 14 days
• Browser, device, and operating system details sent when you connect
• Channel membership metadata
• If a community bans you, the ban record stores the email address on your account and the IP address you last used so that it can be enforced, until the ban is lifted or your account is deleted

Date of Birth (Age-Gated Channels)

• If you access a channel that requires an age check, you may be asked to enter your date of birth
• This is used solely to confirm eligibility for that channel - it is never sold, shared with third parties, or used for any other purpose
• We do not independently verify dates of birth

Message Content and Files

• Messages, files, images, and voice messages you send are stored on this server indefinitely unless you delete them or your account is deleted. Closing your account does not automatically delete messages you have sent (see Section 08)

Support, Reports, and Moderation Records

• Emails you send to the operator and any attachments
• Reports about content or users, and notes about moderation actions and appeals

What we do not collect

• Phone number
• Real name or any government-issued identity
• Advertising identifiers or tracking cookies
• Full card numbers, CVV codes, or bank account details (Premium subscribers: see Section 16 for what payment-related data is held and by whom)

Information is processed solely to:

• Operate and maintain the Server
• Deliver messages and provide communication features
• Reset passwords and recover accounts
• Send security alerts and administrative notices
• Provide support and handle reports, moderation, and appeals
• Process Premium purchases
• Notify you of material changes to these policies
• Maintain security and prevent abuse
• Comply with valid legal obligations

We do not use any collected data for advertising, analytics, profiling, AI training, or sale to third parties under any circumstances.

Your email address is collected at registration and used exclusively for:

• Password resets - initiated by you or by an admin at your request
• Security and moderation notices - unauthorised login alerts, account suspension notices, and similar
• Billing receipts and notices - if you subscribe to Premium
• Policy updates - notification of material changes to these Terms or this Privacy Policy

Your email address is never sold, rented, or shared with any third party other than the email delivery provider that sends these messages for us (see Section 05). It is not used for marketing, newsletters, or promotional communications of any kind.

Upon verified account deletion, your email address is removed from our systems, subject to the backup and legal retention periods in Sections 07 and 08.

Some channels on this Server are restricted to users who confirm they meet an additional minimum age. If you access such a channel, you may be prompted to enter your date of birth.

This data is:

• Used only to confirm eligibility for that specific channel or content area
• Not sold to, shared with, or disclosed to any third party
• Not used for profiling, advertising, or any secondary purpose
• Retained for the lifetime of your account and removed upon account deletion

We do not perform independent verification of dates of birth. Providing a false date of birth to bypass restrictions is a violation of our Terms of Service.

We do not sell, rent, or trade your personal data, and we do not share it for advertising. It is shared only as described below.

Service providers process data on our behalf, only to run the Server:

• Hosting: Contabo, in St. Louis, Missouri, United States
• Email delivery (password resets, security notices, receipts): Google
• Payments: Stripe (see Section 16)
• Security and delivery: Cloudflare proxies connections to the Server to protect it from attacks, so it sees the IP addresses and traffic of people connecting
• Voice servers in St. Louis, Missouri and Houston, Texas, which carry voice and video call traffic
• If you turn on push notifications: device push tokens and message or event identifiers go to Apple's, Google's, or your browser vendor's push service so they can wake your device. They do not receive message content. If you use the official Fluxer app with this Server, Fluxer's own push relay notice may also apply

People and communities you choose. Messages and files go to the people and channels you send them to. Recipients can save or pass on what you share.

Legal and safety disclosures are described in Section 06.

Business changes. If the Server is sold or transferred, personal data may transfer with it. Where practical, you will get at least 30 days' notice and a chance to delete your account first, and the recipient must honour this policy.

Legal process. We disclose user data in response to valid legal process under United States law, such as a search warrant, court order, or subpoena. We review each request and may narrow or reject requests that are invalid or overbroad. Authorities should send requests to admin@badlands.chat and identify the requesting authority, the legal basis, and the specific information sought.

Without legal process. We do not voluntarily hand user data to law enforcement, except in these cases:

• Mandatory child-safety reports. If we become aware of apparent child sexual abuse material (CSAM), we are required by 18 U.S.C. § 2258A to report it to the National Center for Missing & Exploited Children (NCMEC), including the content and related account information, and to preserve that material for the period the law requires (currently one year)
• Emergencies. If we have a good-faith belief that there is an emergency involving danger of death or serious physical injury to a person, we may disclose the information needed to address it, as the law permits
• Protecting people and the Server. We may disclose the minimum necessary to protect the safety, rights, or property of users, the public, or the operator, to enforce our Terms, or to deal with fraud, security, or technical problems

Notice to you. We will tell an affected user before disclosing their data in response to legal process, so they have a chance to object, unless the law or a court order forbids it, notice would endanger someone, or the disclosure is an emergency or a mandatory CSAM report. If notice is delayed because of a legal restriction, we will tell you once the restriction ends, where practical.

What we can produce. We can only produce data we actually hold: account metadata (including email address), IP logs within their retention window, channel membership records, message content and files stored on this server, support and report records, and, for Premium subscribers, the operator-held billing records described in Section 16. We hold no phone numbers, real identity information, full card numbers, or bank details to produce - card and bank information is held only by Stripe.

The Server generates operational and security logs. By default:

• Server and security logs, including IP addresses, are rotated and kept for up to 14 days. Account-level IP records are kept as described in Section 01
• Message content, files, account data, device identifiers, and metadata are retained until you delete them or your account is deleted. Messages you sent are not automatically deleted when you close your account (Section 08)
• Email addresses are retained for the lifetime of your account
• Date of birth entries are retained for the lifetime of your account
• Support emails and attachments are kept for up to 12 months after the issue is resolved
• Reports and moderation records, including a snapshot of reported content, are kept for up to 1 year after resolution, longer only for an active investigation or where the law requires. Material reported to NCMEC is preserved for the period the law requires
• Deleted data may remain in encrypted backups for up to 14 days before it is overwritten, and is not used for any purpose in the meantime
• Billing and transaction records are kept for as long as tax and accounting law requires (typically up to seven years), even after your account is deleted. Card numbers are never stored by us
• Accounts with no sign-in for 24 months may be deleted after 30 days' notice to the registered email address

If you deactivate or delete your account, associated local data - including your email address and date of birth - will be removed from this server, subject to the backup and legal retention periods in Section 07. Messages you have sent are not automatically deleted and may remain visible to other users in channels unless you delete them before closing your account. You can delete your messages yourself, or email the operator to ask for their deletion, and we will make reasonable efforts to do so.

To delete your account or request a data export, use your account settings where available, or contact the operator at admin@badlands.chat from the email address on your account.

Texas and some other US states give residents privacy rights over their personal data. We extend the following to every user, wherever you live:

• Find out whether we hold personal data about you and get a copy of it, in a portable format where we can
• Correct inaccurate data
• Have your data deleted (subject to Sections 07 and 08)
• Withdraw any consent you have given

We do not sell personal data, and we do not use it for targeted advertising or profiling, so there is nothing to opt out of.

To make a request, email admin@badlands.chat from the address on your account. We may need to verify your identity first. We will respond within 45 days, and may extend that once by up to 45 more days if reasonably necessary, in which case we will tell you why. If we decline a request, we will explain why. You can reply to appeal, and we will answer your appeal within 60 days.

Reasonable administrative and technical safeguards are implemented to protect infrastructure and stored data, including TLS encryption in transit, firewalled infrastructure, containerised services, and salted password hashing. No internet-based system can be guaranteed completely secure. To report a security vulnerability, email admin@badlands.chat.

Breach notification. If a security incident occurs that results in unauthorised access to your personal data, the operator will notify affected users without unreasonable delay, and within the time required by applicable law (for Texas residents, no later than 60 days after we determine a breach occurred), via the email address on file. The notice will explain what data was involved and what steps are being taken, and we will give regulators any notice the law requires.

Messages, including direct messages and group messages, are not end-to-end encrypted. They are encrypted in transit between your device and the Server, but the Server must be able to process them to work. This means the operator and administrators with access to the Server can technically read message content and files, and your hosting provider can technically access stored data. Do not send anything through the Server that you would not want the operator to be able to see.

The operator accesses message content only when needed to investigate a report, enforce the Terms, respond to a credible safety issue or legal request, fix a technical problem, or help you with a support request.

Connections to the Server pass through Cloudflare, which decrypts and re-encrypts them as it forwards them, so Cloudflare can technically see traffic in transit. The Server does not run automated scanning of message content.

The operator cannot prevent or be held liable for any unauthorised access, disclosure, or data loss resulting from actions or negligence of the user, including but not limited to compromised passwords, leaked credentials, phishing, or insecure client software or devices.

This service is restricted to individuals 18 years of age or older. We do not knowingly collect information from minors. Accounts identified as belonging to a minor will be terminated immediately and any associated data removed. If you believe a minor is using the Server, contact admin@badlands.chat.

We do not use advertising or analytics cookies, tracking pixels, or third-party analytics. The Fluxer app uses your browser's local storage for sign-in sessions, interface state, and preferences. Cloudflare, which protects the Server, may set strictly necessary security cookies (for example, to tell people from bots), and embedded YouTube content may set its own cookies when you interact with it.

Some features reach third-party services:

• Link previews: when a message contains a link, the Server may fetch the linked page to build a preview, so the website sees a request from the Server rather than from your device
• GIF search: searches may be sent to a GIF provider through the Server
• Embedded media such as YouTube videos: playing an embed connects your device to that provider, which handles your data under its own privacy policy

We honour Global Privacy Control signals, though they change nothing in practice because we do not sell or share personal data for advertising.

The Server is operated from the United States. Your data is stored on servers in St. Louis, Missouri, and voice traffic is handled by servers in St. Louis and Houston, Texas. Connections also pass through Cloudflare's global network. Your data is subject to US law, including lawful access by US authorities. Badlands is intended for users in the United States. If you access it from another country, your data will be transferred to and processed in the United States.

If you purchase a Premium subscription, payment-related data is split between two parties depending on sensitivity:

Held by Stripe, never by us

• Full card number, CVV, and expiration date
• Bank account or other payment method details
• Billing address and cardholder name, as entered at checkout

This data goes directly to Stripe, our payment processor, and never reaches the operator's own systems. Stripe's handling of it is governed by Stripe's own Privacy Policy.

Held by the operator

• Your Fluxer user ID
• Your Stripe customer ID and subscription ID (opaque references used to look up billing status, not payment details)
• Subscription status, billing cycle (monthly/yearly), and current period end date
• The email address used at checkout (used to match your subscription to your account and for billing-related notices)

This operator-held data is used only to grant, display, and manage your Premium status. It is retained for as long as your account exists, and afterwards for as long as tax and accounting law requires (Section 07). It is never sold, shared with third parties beyond Stripe, or used for advertising.

This Privacy Policy may be updated from time to time. A change is material if it reduces your protections, collects more data, keeps data longer, or adds new recipients of your data. Material changes take effect no sooner than 30 days after notice is sent to your registered email address, so you can review them, delete your data, or close your account first. A change may take effect sooner where required by law or needed urgently for security, in which case you will be told as soon as reasonably possible.

Other changes take effect when posted, and the "Last updated" date above shows when. Continued use after a change takes effect constitutes acceptance of the revised policy.

Badlands is a sole proprietorship operated from 1942 W Gray St, Unit #543, Houston, TX 77019.

For questions about this Privacy Policy, data requests, or concerns about how your information is handled, contact the operator at admin@badlands.chat. We respond to data requests within the timeframes in Section 09.

Legal requests must be formal and served under valid United States legal process (see Section 06).