Privacy Policy

This website, Achtually, is designed to operate with minimal data collection. We do not require accounts, do not track users across sessions, and automatically delete all debate content shortly after each session ends.

What We Collect and Why

Session Cookies

When you join a debate room, we set a single strictly necessary session cookie containing a randomly generated token. This cookie exists solely to maintain your connection to the debate room and is required for the service to function. It is:

• Marked HttpOnly — inaccessible to JavaScript
• Marked SameSite=Strict — not sent on cross-site requests
• Not used for tracking or analytics
• Automatically invalidated when the debate room closes

As this cookie is strictly necessary for the service to function, it does not require your consent under the ePrivacy Directive.

Debate Content

When you participate in a debate, the following is temporarily stored for the duration of the room's lifetime:

• Your chosen username (session-scoped, not linked to any account)
• Messages you send during the debate or in spectator chat
• Emoji reactions you add to messages
• Your connection status within the room

All of this data is stored in isolated, ephemeral storage attached to the debate room. It is permanently and automatically deleted when the room closes — at most 10 minutes after the debate concludes, or 30 minutes after creation if no debate takes place. We do not retain, export, or analyse debate content.

Server Logs

Our infrastructure generates operational logs for the purpose of monitoring system health and diagnosing errors. These logs record events such as debates being created or ended, and errors that occur during operation. Logs do not contain message content, usernames, or IP addresses. Logs are retained for a maximum of 3 days by our infrastructure provider, Cloudflare, after which they are automatically deleted.

Analytics

Legal Basis

The processing of data described in this policy is based on the following legal bases under Article 6 of the GDPR:

• Contract performance (Art. 6(1)(b)) — debate content and session cookies are processed to provide the service you have requested
• Legitimate interests (Art. 6(1)(f)) — operational logs are processed to maintain the security and reliability of the service

Data Retention

• Debate content, usernames, and session tokens: deleted within 10 minutes of debate conclusion, or 30 minutes after room creation if unused
• Server logs: maximum 3 days, retained by Cloudflare
• Analytics data: aggregated and anonymised, retained by Cloudflare Web Analytics

Data Recipients

All data is processed on infrastructure provided by Cloudflare, Inc., acting as a data processor on our behalf under a Data Processing Agreement. Cloudflare is certified under the EU-US Data Privacy Framework. No data is shared with any other third party.

Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — you may request information about data we hold about you
• Right to erasure — you may request deletion of your data. Given our retention policy, all debate content is automatically deleted within 10 minutes of room closure. In practice, any data associated with your use of the service is likely already deleted by the time a request is received. We will confirm this upon request.
• Right to restriction — you may request that we restrict processing of your data
• Right to object — you may object to processing based on legitimate interests
• Right to lodge a complaint — you have the right to lodge a complaint with your local data protection authority

Children

Achtually is not directed at children under the age of 16. We do not knowingly collect data from children. If you believe a child has used this service, please contact us.

Contact

Achtually is a free, non-commercial project based in the United Kingdom. If you have any questions about this privacy policy or wish to exercise your rights, please contact us.