RookPrivacy policy
Controller
secnetic GmbH
Seitenstettengasse 5/37, A-1010 Wien, Österreich
Company register no.: FN 598979b
RookTalk: hello@rooktalk.com
Company: office@secnetic.at
For data protection requests write to hello@rooktalk.com.
In short
- Voice, room chat, files and private messages are encrypted on your device. The server only relays and stores ciphertext and does not read the content. Room names, welcome messages, uploaded sound effects, display names and profile photos are not end-to-end encrypted.
- The secret part of an invite code never reaches the server. The server only knows a verification hash derived from it.
- No ads, no third-party tracking or analytics tools. The website sets no cookies. We never sell your data.
- Your conversations, messages and files are not analyzed with AI.
- Servers run in data centers in Germany (Frankfurt) and Austria.
Our domains
rooktalk.com is the RookTalk website. api.rooktalk.live hosts the app's servers (sign-in, rooms, voice relay, updates). A lighter version of RookTalk is also being prepared at rooktalk.live. During the domain move the app also uses the older api.blackcatgamelabs.com address for profile photos, sound effects and voice relay. It is the same server and this policy covers it too. This policy covers both domains and the app.
Data processed in the app
Account. If you create an account we store your e-mail address, username, display name, your first and last name if you enter them, a password hash, an optional profile photo and your encryption keys for private messages (the private key encrypted). First and last name are not shown to other users. The e-mail address is used for verification, password reset and e-mail change codes. As a guest no account is created. Your nickname is stored with the chat messages and files you send for 30 days.
Sessions and devices. When you sign in we store, for each session, the IP address, rough location (city and country that Cloudflare derives from the IP), operating system, browser details and the time of last use. Your account also keeps the time, IP address, rough location and operating system you were last seen with. We use this to protect your account, prevent abuse and provide support.
Install data. When the app starts it sends a randomly generated install ID, the app version, operating system, IP address, rough location, first and last start time and the number of starts. If you are signed in, this is linked to your account. We use it to see which versions are in use and to plan updates and fixes.
Rooms. We store the room name, room code, a verification hash of the secret, the owner, room admins and IP hashes of banned participants. Rooms nobody has entered for 60 days are deleted. Persistent rooms on Plus and Premium stay as long as the plan runs. Sound effects uploaded to a room and its welcome message are stored on the server too. The server sees the sender name, time and size of chat messages.
Voice and screen share. Voice and screen share are end-to-end encrypted with the room key, relayed through a media server (SFU) and never recorded. Other people in the room never see your IP address; everyone connects only to the server.
Room chat and files. Messages and files are stored encrypted for 30 days and then deleted automatically.
Private messages. Messages between two friends are encrypted with a key only those two accounts know and kept until both people have deleted the conversation or one of the accounts is deleted. If only you delete it, the other person keeps their copy.
Friends. Friend requests and your friends list, online status and current room are processed so they can be shown to your friends.
Automatic error reports. If an error occurs, the app sends an error report to our own server: the error message, a technical trace, version, platform, language setting, install ID, IP address and rough location. No voice, chat or file content is included. The latest 2000 reports are kept and older ones are deleted.
Bug reports. A report you send from the app yourself is e-mailed to hello@rooktalk.com with its text, app version, platform, account, IP address, rough location and the current room code, and a copy is kept with the error reports.
Updates. On start the app asks the update server for the current version. This request processes your IP address and app version.
Paid plans. Your plan type and end date are stored with your account. Plan changes, whether made by a payment or by our support team, are logged. Payments are taken by Paddle.com Market Limited, the Merchant of Record for our orders. Paddle processes card and billing details under its own privacy policy; we never see your card number. Plan change records are kept after account deletion for accounting and abuse prevention.
Stored on your device. Your session token, settings and room list are stored on your device. The room list synced with your account is encrypted with a key derived from your password before it is sent to the server, which does not read it.
Security. To prevent abuse, sign-in attempts, room joins and reports are rate-limited by IP address (or its hash) for a limited time.
Website
The website uses no cookies, tracking or advertising tools and has no analytics code on its pages. Cloudflare, which serves the site, counts requests in aggregate (page views, country, browser type, response code); we look at these totals in our management panel to improve the site and to tell bots from people, and we do not follow individual visitors. Fonts are served from this website as well, not from Google. The web server keeps access and error logs (IP address, time, requested address, browser information) to serve the site and investigate faults. Logs are deleted after 14 days. The site and the installer are served through Cloudflare.
Artificial intelligence
Your conversations, messages and files are not analyzed with AI and are not used to train AI. Noise suppression (RNNoise, a small neural network) runs only on your device.
Legal basis
Account, session, room, message and plan data are processed to provide the service (GDPR Art. 6(1)(b)). Security, rate limiting, install data, error reports and server logs rest on our legitimate interest in keeping the service safe and working (Art. 6(1)(f)). Plan change records rest on our accounting duties (Art. 6(1)(c)).
Recipients and transfers
Hosting: Hostinger International Ltd. (server in Frankfurt, Germany) and our own server (Austria). Content delivery, DNS and rough location from the IP address: Cloudflare, Inc. E-mail: our own mail server. Payments: Paddle.com Market Limited (United Kingdom). Cloudflare, Inc. is based in the US and certified under the EU-US Data Privacy Framework. Data is never sold and is not passed to any other third party unless the law requires it.
Retention
- Account: until you delete it. Unverified sign-ups are deleted after 7 days.
- Sessions: when you sign out, or 6 months after last use.
- Install data: 12 months after the app was last started.
- Rooms: after 60 days without a visit. Persistent rooms while the plan runs.
- Room chat and files: 30 days.
- Private messages: until both people delete the conversation or one of the accounts is deleted.
- Sound effects: until they are deleted.
- Plan change records: also after you delete your account, as long as needed for accounting and abuse prevention.
- Automatic error reports: the latest 2000 reports.
- Verification codes: 15 minutes.
- Server logs: 14 days.
Your rights
You have the rights of access, rectification, erasure, restriction of processing, data portability and objection. You can object at any time to processing based on our legitimate interest (Art. 6(1)(f)). You can delete your account inside the app. For requests write to hello@rooktalk.com and we reply within one month. If you live in Turkey you also have the rights in Article 11 of Law No. 6698 (KVKK); we answer free of charge within 30 days, and you may complain to the Turkish Personal Data Protection Board. You may lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).
Changes
We update this policy when the service changes. The current version is always on this page, dated at the top. Payment and refund rules are in the refund and cancellation policy, and the rules for using the service are in the terms of use.