Privacy policy

Last updated: 3 November 2026

This policy explains what Clankeeper collects about you, what it stores on your device, who else sees it, and how to change your mind.

Clankeeper is a members' community: a feed, discussion, a directory, private messages and a video library. This site is a public demo. Anyone can sign in and click round it, the community in it (Tidewright Crew, a made-up sailing school) is invented, and everything visitors do is deleted every night - see How long we keep things. Please don't put anything in it you wouldn't want deleted, or anything about a real person.

Who we are

Clankeeper is run by Tamperan Ltd, a company registered in England and Wales with company number 17324867, registered office Piccadilly Business Centre, Blackett Street, Manchester M12 6AE. That company is the data controller for the personal data described here.

To ask anything about this policy, to get a copy of what we hold about you, or to have it corrected or deleted, use our contact form.

What we collect and why

If you create an account

You sign in with Google, or with a link we email to you. Google tells us your name, email address, profile link and profile picture link (whichever of those it shares), whether it has verified your email address, and its own id for your account. We only keep an email address Google says it has verified. If you use the emailed link, we keep the address it went to. Your browser tells us your preferred language and time zone when you sign in, and you can change your time zone on your profile page. We keep all of this with your account so we can sign you in and show you who you're signed in as. We need it to give you the demo you asked to use.

We also keep:

when you last signed in, and a count of the days you've used Clankeeper, so we can see how much it's used;
a record of your signed-in sessions, so we can sign you out of them. Each lasts up to 30 days;
a log of what's done in each space you belong to (who did what, and when), which the space's other members can see on its activity page.

What you add to the community

Your profile (your name, a photo and anything you write about yourself, and whether you appear in the member directory), your posts and comments with the photos and files you attach, your likes, votes and follows, the videos you upload, and the reports you make about other people's posts all belong to you as their author and are kept with your account. In a community, its other members see your name, your profile and what you post where they have access, and the directory lists you only if you've chosen to be in it. On this demo it works differently: each visitor sees only the made-up cast and their own activity, never another visitor's. We use all this to run the community you've joined.

Private messages between two members are stored with your account and shown to the two of you. The people who run the community can't read them. If one of you reports a message, the report keeps that message and the five either side of it, and the moderators see only that. A member can block you, which stops you messaging them.

Reports and moderation. If a post, comment or message is reported, we keep what was reported, the reporter's and moderators' notes, the decision, and any photos or files involved as evidence, so a decision can be appealed. Evidence is deleted once nothing needs it any more (a report still open, or an appeal), and in any case with the nightly clear-out on this demo.

Email we send you

We send the emails that run your account and the community: sign-in links, and, if you've switched them on in the community, a digest of what's new, event reminders, announcements from the people who run the community, and a note when a plan ends. We send no marketing from this demo. The digest and announcements each have an unsubscribe link, and we keep a record of it so we honour it.

Amazon's email service delivers them. When an address bounces (the mailbox doesn't exist) or its owner marks a message as spam, the service tells us, and we add the address to a suppression list so we stop mailing it. That list holds the address, why it was added and when. It's kept for as long as it's needed to stop mail to a dead or objecting address, as the schedule below says: a bounced address is dropped from it after 2 years (a mailbox can mend, and if it hasn't, it bounces again and goes back on); an address the email provider reports as a complaint or an unsubscribe isn't, so it keeps being honoured. Deleting your account takes your addresses off the list.

If you use the contact form

We store the name, email address and message you send, with a note of how you came to the form, and use them to reply. The message itself isn't stored against your account, but if you're signed in when you send it, the record that you sent one is. After 2 years we delete your name, email address and message, take the record off your account, and keep only when it was sent, what it was about, how you found us (search, an ad, email and so on), whether you'd agreed to advertising, and whether and by whom on our side it was dealt with.

The form is checked by Cloudflare Turnstile, so that a bot can't fill the inbox. Cloudflare looks at the browser you're using to decide whether you're a person, and is given nothing you type into the form. Its privacy addendum says what it keeps. It sets no cookie, and loads only on the contact page.

Analytics

We use PostHog, on PostHog's EU cloud, to see which pages are used and where people get stuck, so we can fix what's broken and decide what to build next.

Analytics requests go to our own address first and we pass them on to PostHog with your browser type, but not your IP address. We tell PostHog roughly where you are - your country and, where we know it, your region - from what our network provider (Cloudflare) tells us. We keep the events PostHog receives for 7 years, and they aren't tied to your name or email address.

What runs depends on where you are and what you've chosen. We tell where you are from Cloudflare; if we can't, we treat you as being in the UK or EU.

In the UK, the EU and EEA (including EU territories such as Réunion and Åland), Gibraltar, Jersey, Guernsey, the Isle of Man, Switzerland and Canada, analytics stay off until you choose. A banner asks you on your first visit. Until you've answered, we still count the pages you view, but in a cookieless mode: nothing is written to your device, there's no session recording, and nothing links one visit to the next. If you accept, full analytics start, and the pages counted before you accepted are not joined to you. If you decline, your browser sends PostHog nothing more. (Where we can tell which Canadian province you're in, only Quebec gets this treatment; the rest of Canada is treated like the next group.)
Everywhere else, including the US, analytics are on by default and we don't show a banner. You can switch them off at any time with Manage cookies in the footer. In California, Colorado, Connecticut, Oregon, Texas, Utah and Virginia (or anywhere in the US, if we can't tell which state you're in) the footer also has a Do Not Sell or Share My Personal Information link, which opens the same settings.
If your browser sends a Global Privacy Control signal, we treat analytics as declined, wherever you are, unless you choose otherwise in Manage cookies.

When full analytics are on, PostHog records the pages you visit and what you click (which part of the page, not the words on it), and sets a cookie and an entry in your browser's local storage so it can recognise you between visits. It can also record a replay of how you move around and click on a page. Before anything leaves your browser, all the text on the page and everything you type is masked, so a replay shows the layout and where you clicked, never your posts, your messages or what you entered. Replays are held by PostHog on its EU cloud, on its own schedule.

If you're signed in, analytics are linked to your account. When full analytics are on, PostHog is told your account id, so your activity is tied to it.

Some things are recorded by our server, whatever your cookie choice. Our server tells PostHog when certain things happen in the app - you sign in (with your role and account status), you send the contact form (that you sent one, never what it said), and so on - and when a page fails to load, with the page's address. None of this stores anything on your device. Each is recorded against your account id if you're signed in, against the id in PostHog's cookie if you've let analytics run, and otherwise against an id that isn't linked to you - except page failures, which are only recorded in the first two cases. Our server never sends your name or email address to PostHog.

Our basis for the cookieless page counts, and for the server's own recording, is legitimate interests: knowing the demo works and who uses it, from records that name nobody. If you'd rather they weren't used that way for you, you can object using the contact form. For everything else in full analytics, it's your agreement.

Video

Videos are uploaded to our own storage and then sent to Bunny (Bunny Stream), which processes them and plays them to the members who can watch them. Your browser talks to Bunny to play a video, so Bunny sees your IP address and browser type when you watch one. Bunny is our processor and acts only on our instructions.

Subscriptions and payments

The demo takes no payments. Every plan on it is free, so nothing is paid for and no payment details are collected or held.

Technical logs

Our servers keep technical logs so we can keep the service running and secure. They record your IP address and browser type with each request. We keep them for 2 months.

Cookies

This covers cookies and anything else we store in your browser. You can change your choice at any time with Manage cookies in the footer of every page.

Strictly necessary

These make the site work, so they're always on:

auth - keeps you signed in. It lasts until you close your browser, or for 30 days if you choose to stay signed in.
twad_oauth_state - protects your sign-in against forgery while you're signing in with Google. It lasts 15 minutes and is removed once you're signed in.
consent - remembers your cookie choices, so we don't ask again. It's set when you make a choice and lasts 12 months, and covers this site's subdomains too. It holds your choices, when and how you made them (by clicking, or by your browser's Global Privacy Control signal), the version of this policy you saw and the broad region you were in - nothing that identifies you.
flashtoast - carries a short on-screen message (such as "Saved") from one page to the next. It lasts 15 seconds.
The messages panel's state, in your browser's local storage: whether it's open and whether it's docked or floating, so it stays as you left it from page to page.
An offline page, stored in your browser's cache, so you see a proper message rather than an error if you lose your connection.
The address of the page you're on, kept in your browser's session storage (which is cleared when you close the tab) so the back button works.

Preferences

The messages panel can remember, in your browser's local storage, which conversation you were reading. It does that only if you've allowed preferences in Manage cookies, and forgets it when you withdraw. We set no preference cookies.

Analytics

PostHog's cookie and local storage, described above. Off until you agree in the places listed above - the UK, EU, EEA, Gibraltar, the Crown Dependencies, Switzerland and Canada, and anywhere we can't tell; on by default elsewhere. Turning analytics off clears them.

Advertising

We don't run advertising or ad tracking, and we don't sell or share your personal information, in the ordinary sense of those words or in the senses US state privacy laws give them.

Proof of your choices

We keep a record of each cookie choice you make - when and how you made it, what you chose, the broad region you were in, which version of this policy you saw, and your account id if you were signed in - so we can show that you agreed when you did. While you're signed in we record your current choice against your account each time you sign in. A choice runs out after 12 months, and we delete each record 2 years after that, 3 years after we made it. A record against your account goes sooner if you make a newer choice while signed in before it runs out: 2 years after the newer one replaced it, as long as you still have your account. If you delete your account, we remove your account id from these records, and each then goes 3 years after it was made.

Who else sees your data

The other members of each space you belong to - your name, email address and what you've done in the space.
The other members of a community - your name, your profile and what you post, as above. On this demo, other visitors see none of it.
Google - only if you choose to sign in with Google, which tells Google you signed in to us.
Amazon Web Services - sends the emails you receive, including sign-in links, from its UK infrastructure, and tells us which ones bounced or were reported as spam.
Bunny - processes and plays videos, as above.
PostHog - analytics, on their EU cloud, as above.
Cloudflare - serves the site and filters abusive traffic, and checks the contact form with Turnstile. Each request passes through whichever of its locations answers it, which can be outside the UK and EEA, under its data processing addendum with the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

That is the complete list. We store the files, posts and messages in our own database and storage, not with a third party, and there is no data broker and no tag manager on this site.

Otherwise we don't disclose your data to anyone except with your agreement, or where we need to:

protect, enforce or defend the legal rights, privacy, safety or property of the company, our affiliates or their employees, agents and contractors (including enforcing our agreements and terms of use)
protect against fraud
comply with the law, where we're obliged to disclose data to a government or law enforcement
respond to valid requests from government and public authorities

Such disclosures, if made, may be outside your country of residence.

We may publish aggregate statistics about how Clankeeper is used. They never contain enough detail to identify anyone.

How long we keep things

Everything visitors do on this demo is deleted every night at 3am (London time): the accounts visitors made, their profiles, posts, comments, likes, photos, files, uploaded videos, private messages and conversations, reports, and the rest of what they added, and the demo's community goes back to its made-up starting point. What the nightly clear-out doesn't reach is what's listed below.
Your account is kept until that clear-out, or until you delete it, which you can do from your profile page: it's scheduled for deletion in 14 days, during which you can sign back in and cancel. After that we delete your name, email address, sign-in details, sessions and memberships, and the personal data you added to the community (your profile, photo, files, likes, follows, notifications and blocks). Your posts, comments and private messages stay in the conversations they're part of, with your name taken off them, because deleting them would gut other people's threads. What stays, held against an account id that no longer leads to you: the space activity log entries (with their details removed), and the count of days you used Clankeeper. Your cookie-choice records stay, with your account id removed, and each goes 3 years after it was made. Deleting your account doesn't delete what PostHog holds; ask us through the contact form and we'll have it removed. An open report or complaint by or about you, or a sanction in force against you, holds deletion until it's settled. Moderators' notes and the record of decisions about posts stay, naming nobody, and a course's lessons keep their files as course material.
Backups of the database and files keep daily copies for 7 days, weekly ones for 4 weeks and monthly ones for 2 months, so what the nightly clear-out deleted ages out of them within about 3 months.
Reported files kept as evidence are deleted once the report and any complaint or appeal about it are settled.
Contact-form messages, analytics and technical logs - see each section above.
Records of your cookie choices are deleted 3 years after they're made, or 2 years after a newer choice replaced them if that's sooner, as above.

Here's what our daily clean-up does with each kind of record. This list is read from the schedule the clean-up runs on, so the two can't disagree:

Records of cookie choices: deleted 2 years after a newer choice replaced them or they lapsed.
Email addresses we've stopped mailing because the mailbox bounced: deleted 2 years after they were suppressed (complaints and unsubscribes are kept so they're still honoured).
Contact-form enquiries: anonymised 2 years after they were sent (we keep when it was sent, what it was about, the kind of site the visitor came from, whether they'd agreed to advertising, and whether and by which user it was dealt with - not who they were, how to reach them or what they wrote).
Emailed sign-in links: deleted 1 day after they expire.
Sign-in sessions: deleted 1 day after they expire.
One-time codes that let an app you have connected sign in with your account: deleted 1 day after they expire.
Temporary passes that let an app you have connected act on your account: deleted 7 days after they expire.
Passes that keep a connected app signed in without asking you again: deleted 7 days after the last one issued in a row expires.
The service's technical diagnostic log: deleted 30 days after each line was written.

Your rights

You can download a copy of what we hold about your account from your profile page. You can also ask us for a copy of anything else we hold about you, ask us to correct or delete it, object to how we use it, or ask us to limit what we do with it. Withdrawing consent is as easy as giving it: Manage cookies is on every page. Use our contact form for any of these.

You can also complain to a data protection regulator - in the UK, that's the Information Commissioner's Office.

Changes to this policy

We may update this policy from time to time, and changes take effect when they're published. If we make a material change, we'll ask visitors in the regions where analytics wait for your agreement for their cookie choices again rather than relying on a choice made under the old policy, and we won't make changes that materially affect the privacy of your data without giving you advance warning or the chance to opt in or out.