Privacy Policy

1. Data we collect

• Host: name and email address, provided when creating a session, and the language of the website when creating it (English, German or Japanese), so that a statement of reasons for a moderation decision reaches you in your language
• Session details, Gamer world: game, date/time, platform, spots needed, and optional details such as mode, rank, region/server, voice chat, language, role wanted and a note
• Host contact methods: the contact options a host adds (e.g. Discord, Telegram, Steam, WhatsApp, X or LINE name, or an in-game name) and an optional contact link
• Joining players: player name, community platform, community username, and age confirmation (18+), provided when joining a session
• Confirmations: which confirmations were given when creating or joining a session (age, Terms, Privacy Policy), with version and time
• Account (optional): if you sign up, your email address and password, managed by our authentication provider
• Notification channels (optional): if enabled, a Discord webhook URL or Telegram chat ID needed to deliver join notifications — never shown to anyone but the host, used only to notify the host when someone joins
• Reports (optional): if you report a session, the reason you pick, your explanation of why the content is illegal or against the rules, the link to the reported session (filled in automatically), your name and email address (optional for reports of child sexual abuse), your statement that the information is given in good faith, and a pseudonymized value of your IP address. It is formed from your IP address with a secret key (keyed hash, HMAC-SHA-256); the IP address cannot be calculated back from it, but it is still personal data, not anonymous. It is used only to limit report spam — your IP address itself is not stored. The value is stored with the report and deleted with it (see section 4). We also store the language of the website when you report. If you give an email address, we send you a confirmation of receipt through Resend and, after our decision, the decision with its reasons (see section 3); we store whether and when this message was sent and, if it failed, the error text (without the email address). The reason, explanation and link of your report – not your name and not your email address – are also sent as a notice by email to our mailbox contact@filqk.com, so we can react quickly. We need these details to handle reports as required by Art. 16 of the Digital Services Act (DSA). Reports are seen only by the operator of FilQk.
• Moderation: when a session is created, its public text fields are checked automatically against a word list based on our Community Rules. Sessions with clearly prohibited words are not created (nothing is stored). Sessions with borderline words are published and flagged for review; the flag stores which field and which word matched. If we hide a session (after a report, after the word check or on our own initiative), we store the time, the ground, the facts and the legal basis of the decision and send the host a statement of reasons (Art. 17 DSA): by email through Resend or, if the host started the FilQk with the Discord bot, as a direct message from the bot on Discord. We store whether and how the statement was sent, when, and, if it failed, the error text (without the email address). If there are signs of a criminal offence, the statement may be delayed (see section 4).
• Cookies: FilQk only uses cookies that are technically necessary to provide the service: one that remembers the language you chose (1 year, only set when you switch the language), one that lets a guest host manage the session they created (30 days), and, if you have an account, login cookies from our authentication provider that keep you signed in. FilQk does not use cookies for advertising or tracking. The legal basis for storing and reading these cookies is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG): they are strictly necessary to provide the service you request, so no consent is needed. The related processing is based on Art. 6(1)(b) GDPR (guest host, account) or Art. 6(1)(f) GDPR (language).
• Server logs (hosting by Vercel): every time you open a page on filqk.com, our hosting provider Vercel processes the technically necessary request data: your IP address, date and time, the page requested (address and parameters), request method, status code, your browser's identifier (user agent) and the Vercel region that handled the request, plus messages from our application, which in some cases contain an ID such as a session or Discord ID, or a shortened email address (everything before the @ except the first character is replaced by asterisks). We can view these logs to find errors; they are deleted automatically after 1 day. Vercel also uses this data on our behalf to fend off attacks and misuse (firewall). Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in running the website securely and without errors.
• Nothing loaded from other servers: filqk.com does not load fonts, scripts or images from other companies' servers. The fonts (Geist and Noto Sans JP) are Google Fonts, but filqk.com delivers them itself — your browser does not connect to Google. The only exception is our database provider Supabase: when you log in or sign up, and when you come back to a session page's tab (to update the open spots), your browser connects directly to Supabase, which sees your IP address. Links to other services (e.g. sharing via WhatsApp or X) only load something when you click them.
• Logs at Supabase and Resend: our database and authentication provider Supabase logs requests to its interfaces and to the database, including sign-ins; these logs are deleted after 1 day. Our email provider Resend stores every email we send, with its content (recipient, subject, text, delivery status) – including statements of reasons to hosts, decisions to reporters and messages from the contact form – and deletes it after 30 days. Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in finding errors and being able to trace delivery.

2. Why we collect it

Data is collected solely to operate the core function of FilQk: letting a host create a session (a gaming session), letting people join it, notifying the host when a spot is filled, keeping FilQk safe through moderation and reports, and answering requests sent through the contact form or by email.

3. Who has access

• Session details (everything listed above for the Gamer world, but not the host's name or email address) are public: anyone can see them on the session page, in the calendar and in search, so people can find and join sessions.
• The host's contact methods and the optional contact link are only shown to people who have joined the session, so they can reach the host. Before joining, visitors only see which kinds of contact the host offers (e.g. Discord), not the names or handles themselves.
• On filqk.com, a joining player's name and contact details are visible only to the host of that session. They are sent to the host by email and, if the host enabled it, via Discord or Telegram. Exception: for a FilQk started with the Discord bot, the name you enter when joining is also shown on the FilQk card on Discord, visible to everyone who can see that channel (see section 5).
• The operator of FilQk (see the Imprint) can see session data, host contact details, reports and moderation data in order to moderate FilQk, and reads the emails sent to contact@filqk.com.
• FilQk uses the following service providers to operate the platform. They process data on our behalf and are bound by their data processing terms:
• Supabase (database and authentication): our contracting party is Supabase Pte. Ltd., Singapore. The data is stored in the EU (Ireland). Where data is processed outside the EU, this is safeguarded by the EU Standard Contractual Clauses.
• Resend (transactional email delivery: join notifications to hosts, statements of reasons to hosts, confirmations of receipt and decisions to reporters, notices of new reports and messages from the contact form to contact@filqk.com): our contracting party is Plus Five Five, Inc. (Resend), USA. The data is processed in the USA, safeguarded by the EU-US Data Privacy Framework and the EU Standard Contractual Clauses.
• Vercel (hosting): our contracting party is Vercel Inc., USA. We have a data processing agreement with Vercel (Data Processing Addendum). The data is processed in the USA, safeguarded by the EU Standard Contractual Clauses.
• IONOS (mailbox contact@filqk.com): our contracting party is IONOS SE, Germany. Emails to contact@filqk.com arrive in this mailbox, including messages from the contact form and notices of new reports. We have a data processing agreement with IONOS. The emails are not forwarded to any other provider.
• Telegram (only if a host turns on notifications via Telegram): Telegram processes the notifications under its own responsibility, in accordance with its own privacy policy.
• Discord (if a host turns on notifications via Discord, and for statements of reasons sent as direct messages to hosts who started a FilQk with the Discord bot): Discord processes the notifications under its own responsibility, in accordance with its own privacy policy (see also section 5).
• A copy of the Standard Contractual Clauses can be requested informally by email to contact@filqk.com.

4. Data retention

We keep data only as long as it is needed for its purpose:

• Session data (website and the Discord bot): 7 days after a session has ended, the joining players' data and the host's contact methods are deleted, and the host's name, email address, Discord ID and language are removed or replaced with placeholders. The remaining session details (e.g. game, note) are kept without them. Why: host and players need the data to meet up, and for a few days afterwards for follow-up questions or a report.
• Session-related records (which confirmations — 18+, Terms and Rules, Privacy Policy — were given when creating or joining a session, with version and time): deleted 7 days after the session has ended, together with the session data. Why: they show that the confirmations were given for this session, which matters only while the session and its data exist.
• One-time confirmation in the Discord bot (18+, Terms and Rules, time and version): deleted 12 months after you last used the bot, or at once with /filqk-delete-my-data. Why: so we don't have to ask you again before every FilQk, and can show that you gave the confirmation; after a year without use it is no longer needed.
• Timezone and server settings in the Discord bot: your timezone is deleted 12 months after you last used the bot (or with /filqk-delete-my-data); a server's timezone and card language 12 months after the last FilQk on that server. Why: they are only needed while you or the server use the bot.
• Notification channels (Discord webhook URL, Telegram chat ID): for guest hosts, deleted 7 days after the session has ended, together with the session data; for registered hosts, they belong to the account and are kept until you disconnect them or your account is deleted. Why: only then can we notify you about further sessions too.
• Reports, including name, email address, explanation, link, language, the pseudonymized IP value and the status of the decision email: open reports are kept until they are handled, then deleted 30 days later. Why: to handle the report, and to be able to answer questions about the decision for a short time afterwards.
• Moderation data of a hidden session (the facts and legal basis of the decision, and the channel, time, status and any error text of the statement of reasons to the host): deleted 6 months after the decision. Only the fact that the session is hidden, since when and on which ground (e.g. "rule 6") is kept, so that it stays hidden. Why: during this time the host can contest the decision, and we must be able to explain it (cf. Art. 20 DSA).
• Emails to contact@filqk.com (including those from the contact form): deleted 6 months after the request has been dealt with; notices of new reports 30 days after the decision on the report; requests about your data protection rights 3 years after they have been dealt with, so that we can show that we answered them.
• Pseudonymized IP value of the contact form: deleted after 24 hours, at the latest after 48 hours (see section 6).
• Server logs at Vercel: 1 day (see section 1).
• Logs at Supabase: 1 day; sent emails at Resend: 30 days (see section 1).
• Account: until the account is deleted — on request to contact@filqk.com.
• Exception if there are signs of a criminal offence (Art. 18 DSA): if there are signs of a criminal offence involving a threat to the life or safety of persons, we inform the competent law enforcement authorities. We then keep the data concerned – such as the session with the host's and players' data, the report and the moderation data – beyond the periods stated here for as long as the authorities need them. During this time they are not deleted, even on request, and are used only for this purpose (Art. 17(3)(b) and (e) GDPR). We check at least every 3 months whether keeping them is still necessary. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 18 DSA, where an authority requests or orders that the data be kept; otherwise Art. 6(1)(f) GDPR (our legitimate interest in supporting the investigation of the offence and defending against legal claims).
• You may request removal of your data at any time by contacting contact@filqk.com.

5. FilQk Discord bot

FilQk can also be used from Discord: a server admin adds the FilQk bot to their server, a host starts a FilQk there with /filqk, and others join with a button on the FilQk card the bot posts in the channel. Sessions started this way also appear on filqk.com and can be joined there too. The rest of this policy applies to the bot as well; this section adds what is specific to it.

• Data we process: your Discord user ID, username, display name or server nickname; the IDs of the server, the channel and the bot's messages; the session details the host enters (game, start time, players needed, an optional "Looking for" text and an optional server invite link); and who joined or left which session, and when. A host who starts a FilQk on Discord does not give FilQk an email address.
• Language: with every click, Discord tells the bot your Discord language setting. The bot uses it to show you its private replies (confirmations, error messages, the form) in your language. It is stored in one case only: when you start a FilQk with /filqk, we store the language with the session (only English, German or Japanese, nothing otherwise), so that a statement of reasons for a moderation decision reaches you in your language. It is deleted with the rest of the host's data 7 days after the session has ended (see section 4).
• "Create FilQk" on a message: if you right-click a message (on phones: long-press it) and choose Apps → Create FilQk, Discord sends the bot the text of that one message, also if someone else wrote it. The bot reads it once, at that moment, only to pre-fill the FilQk form (game, players needed, start time, platform) using simple text rules — no AI service. The message text is not stored, not logged and not passed on. Only what you then send with the form is processed, as described above; nothing is created unless you send it. The bot does not read any other messages. The /filqk command itself reads no messages. If you type a text into its optional "details" field (for example "Fortnite PC 20:00"), the bot reads that text in the same way: once, at that moment, only to pre-fill the form. It is not stored, not logged and not passed on either.
• One-time confirmation: before your first FilQk on Discord, you confirm with one click that you are 18 or older and that you accept the Community Rules and the Terms. At the same time we tell you that your Discord name is shared with the host and players of the FilQks you join or host, and point you to this Privacy Policy. Sharing your name is part of the service you use (Art. 6(1)(b) GDPR, see section 8) — it is not based on consent. We store the time and version of this confirmation so we don't have to ask again.
• Settings (optional): if you set a timezone with /filqk-timezone, we store it so that times you type are read correctly. A server admin can store a timezone and a card language for the server with /filqk-setup; without this setting, cards are in English.
• Who sees what: the FilQk card shows the host's and the players' Discord names to everyone who can see that channel. If you join a FilQk that was started on Discord via filqk.com, the name you enter is shown on its Discord card — the join form tells you so before you join. On filqk.com, Discord names are not public: the session page, the calendar and search show neither the host's name nor the players' names. Only people who have joined on filqk.com see the host's Discord name, so they can reach the host.
• Statement of reasons by direct message: if we hide a FilQk you started with the bot, the bot sends you the statement of reasons as a direct message (see section 1, "Moderation"). If you don't allow direct messages from the bot, it doesn't arrive; we store this with the error text, and you can contact contact@filqk.com.
• Discord: the bot runs on Discord. Discord delivers and stores the messages, buttons and cards and processes this data under its own privacy policy. For users in the EEA, Discord Netherlands BV is responsible; Discord transfers data to the USA on the basis of the EU-US Data Privacy Framework and standard contractual clauses.
• Retention: as described in section 4. In addition, 7 days after a session has ended the names are removed from its card, and the bot's "is full" message under the card is deleted.
• Deleting your data yourself: the command /filqk-delete-my-data deletes your data at once, after you confirm it: your one-time confirmation and timezone, your participation in every FilQk (your spot is freed) and your name on the cards; FilQks you host are cancelled and anonymized. Messages other users wrote and copies they made (e.g. screenshots) are outside our reach. Server admins can delete FilQk cards in their server at any time.
• Like FilQk itself, the bot is only for people aged 18 and older.

6. Contact form

You can reach us through the contact form at filqk.com/contact or by email to contact@filqk.com, for example with a general question, an objection to a moderation decision, a data protection request or as an authority.

• Data: the category you choose, your email address, optionally your name, for an objection optionally the session code, your message and the language of the website.
• Purpose: to handle your request and reply to you.
• Sending and storage: the form sends your message through our email provider Resend by email to contact@filqk.com; replies go to your email address. Your message, name and email address are not stored in our database, only as an email in our mailbox at IONOS (see section 3). We do not send you a confirmation email.
• Protection against misuse: to limit the number of messages, we store a pseudonymized value of your IP address (keyed hash, HMAC-SHA-256; the IP address cannot be calculated back from it) with the time, and nothing else. The value is deleted after 24 hours, at the latest after 48 hours. The form also uses a hidden field and a time token against automated requests. Our server logs for the form contain no email address, no name and no message text.
• Retention: see section 4 (emails to contact@filqk.com, IP value).
• Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in answering requests and protecting the form against misuse. Where we are legally obliged to handle the request – requests to our point of contact under Art. 11 and 12 DSA, objections to moderation decisions and requests about your data protection rights (Art. 15–22 GDPR) – Art. 6(1)(c) GDPR.

7. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Access (Art. 15 GDPR): you can ask which data we hold about you, and receive a copy.
• Rectification (Art. 16 GDPR): you can have incorrect data corrected and incomplete data completed.
• Erasure (Art. 17 GDPR): you can have your data deleted.
• Restriction of processing (Art. 18 GDPR): you can have the processing of your data restricted, for example while its accuracy is being checked.
• Data portability (Art. 20 GDPR): you can receive the data you provided to us in a common, machine-readable format, or have it sent to someone else.
• Objection (Art. 21 GDPR): you can object to processing based on our legitimate interests — see the box below.
• Withdrawal of consent (Art. 7(3) GDPR): where we process data on the basis of your consent, you can withdraw it at any time with effect for the future; processing before the withdrawal remains lawful. At present, FilQk does not base any processing on consent (see section 8). You can delete your data in the Discord bot at any time with /filqk-delete-my-data.
• Complaint (Art. 77 GDPR): you can complain to a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You can also contact the authority where you live.
• To exercise your rights, an informal email to contact@filqk.com is enough.

8. Legal basis for processing

We process your data on the following legal bases under the GDPR and the TDDDG:

• Art. 6(1)(b) GDPR — to provide the service you request: creating, showing and joining sessions (on filqk.com and through the Discord bot), passing on contact details between host and joining players, passing on your Discord name to the host and players of the FilQks you join or host through the Discord bot (without it, host and players could not find each other), join notifications, and your account
• Art. 6(1)(f) GDPR — our legitimate interests (you can object, see section 7): server logs, records showing that the 18+ confirmation and the acceptance of the Terms and Rules were given (per session and the one-time confirmation in the Discord bot), the security of FilQk (e.g. limiting report spam and messages through the contact form with a pseudonymized IP value), moderation (automatic word check, reports, the notice of new reports to contact@filqk.com, and in the Discord bot at most 3 open FilQks per host), answering requests sent through the contact form or by email, and keeping data if there are signs of a criminal offence, where there is no legal obligation (see section 4)
• Art. 6(1)(c) GDPR — where we are legally obliged to process or keep data, e.g. handling reports of illegal content under Art. 16 DSA (reporter's name and email address, explanation, link, language, confirmation of receipt and notice of the decision), the statement of reasons to the host under Art. 17 DSA (with the host's language and the record of sending it), requests to our point of contact under Art. 11 and 12 DSA, requests about your data protection rights, and keeping data if there are signs of a criminal offence under Art. 18 DSA (see section 4)
• Section 25(2) no. 2 TDDDG — for storing and reading the technically necessary cookies (see section 1)

9. Changes to this policy

FilQk may update this privacy policy from time to time. Material changes will be reflected on this page.

This privacy policy is available in German, English and Japanese. The German version is binding; the other languages are translations.

Version 1.8, last updated: 15 October 2026.

10. Contact

Questions about this privacy policy or your data can be directed to contact@filqk.com.