Your privacy matters. Chunky Guys is built to be a safe, respectful space for bears, cubs, chubbier guys, and their admirers; and that includes treating your personal data with care. This Privacy Policy explains what we collect, why, how long we keep it, and how you stay in control.

Our hosting and core infrastructure runs on French-owned providers within the EU, giving your data strong protections under UK/EU privacy law.

If we make meaningful changes, we’ll let you know.

1. What This Policy Covers

This policy applies to:

• The Chunky Guys mobile app,
• The Chunky Guys website, including our online store, and
• The backend API and services that support them.

In the app, authentication is handled entirely through your ATProto/Bluesky PDS. We never receive or store your Bluesky password.

“Personal data” means any information that identifies you directly or indirectly, such as your handle, date of birth, photos, private media, name, or delivery address.

2. What We Collect

• 2.1 Account & Identity
  • Bluesky handle
  • Public DID
  • Email address
  • Date of birth (to confirm you are 18+)
• 2.2 Profile Content
  • Profile photos
  • Bio or information you choose to publish
• 2.3 Private Media
  • Images and videos you send to other users through our private media feature
    (Note: private messages themselves are currently handled by Bluesky, not us)
• 2.4 Session Information
  • Session tokens used to keep you logged in
  • No third-party advertising trackers
• 2.5 Store & Orders
  When you buy from our online store, we collect:
  • Your name
  • Delivery address
  • Billing address
  • Email address
  • Phone number (optional, used for delivery updates)
  • Order details (items purchased, order value, order history)
  • Payment is processed by Stripe. We do not receive or store your full card details.
• 2.6 Operational Logs
  Used only for reliability and security:
  • Error/request logs → kept 90 days
  • Security logs → kept 1 year
• 2.7 Sources of Data
  We collect data from:
  • You directly
  • Your ATProto/Bluesky provider (for authentication)
  • Automatic app interactions (session info, technical logs)
    We never buy data or use data brokers.

3. Why We Use Your Data

• 3.1 To Run the Service
  • Logging you in
  • Displaying your profile
  • Sending and receiving private media
  • Maintaining your session
• 3.2 To Fulfil Store Orders
  • Processing your order and payment
  • Arranging delivery
  • Sending order and delivery updates
  • Handling returns, refunds, and customer support
• 3.3 To Keep the Platform Safe
  • Detecting suspicious or abusive activity
  • Preventing misuse
  • Debugging and improving stability
• 3.4 To Communicate Important Information
  • Account, order, or service-related notifications
• 3.5 To Meet Legal Requirements
  • Keeping order and transaction records required by tax and accounting law
  • Complying with valid legal processes or requests

If we show advertising, it will be limited and served entirely through our own in-house system. We select and vet the advertisers we work with; it is not an open marketplace. We may use your general location (such as your country or region) to decide which ads to show, but only where you have given consent, and you can opt out at any time.

We never share your personal data with advertisers. We do not carry out behavioural profiling or cross-site tracking, and we do not use third-party ad networks. If you opt in to marketing emails, you can unsubscribe at any time.

4. Legal Bases (UK/EU GDPR)

We process your data under:

• Contractual necessity: To provide the features and services you request, and to process and deliver store orders.
• Legal obligation: To keep order and transaction records required by tax and accounting law.
• Legitimate interests: Security, abuse prevention, platform reliability, debugging.
• Consent: For optional features, for marketing emails, and for location-based advertising.

You may withdraw consent at any time.

5. Data Retention

Data Type	Retention Period
Profile data (photos, bio, date of birth)	Until you request deletion
Private media you send	Until you request deletion
Bluesky handle & DID	Until you request deletion
Email address	Until you request deletion
Order & transaction records	6 years (required by UK tax law)
Error/request log	90 days
Security logs	1 year

You can request deletion of your personal data at any time, and we will complete it within 24 hours.

The one exception is order and transaction records. Tax and accounting law requires us to keep these for 6 years, so we cannot delete them on request. We keep only what the law requires, we do not use it for any other purpose, and we delete it once the retention period ends.

6. How We Protect Your Data

We use strong technical and organisational safeguards:

• Data stored on EU servers
• Encryption at rest (media encryption coming soon)
• HTTPS/TLS for all communication
• Strict, logged internal access controls
• Regular security reviews and updates

As with any digital service, no system is absolutely foolproof, but we work hard to protect your information at every stage.

7. International Transfers Through Social Interactions

Chunky Guys is a social network, and you control who you connect with.

When you choose to send private media or interact with another user:

• Your content is delivered directly to that user, wherever they are in the world.
• This may involve a transfer outside the UK/EU.
• Such transfers are considered user-directed under GDPR, meaning you choose the recipient.
• We do not forward, sell, or transmit your private media to any other destination.

All media remains stored on EU servers unless you choose to delete it or request deletion.

8. Deliveries and International Shipping

When you buy from our store, we share the delivery details you provide with our fulfilment and shipping providers so your order can reach you.

• We share only what is needed to deliver your order (such as name, delivery address, and contact details).
• If you ask us to ship to an address outside the UK/EU, that transfer is directed by you.
• We do not use your delivery details for any purpose other than fulfilling and supporting your order.

9. Other International Transfers

Most processing happens in the UK and EU.

Some limited technical data (never private media or profile photos) may be sent to Bitdrift (US) for performance monitoring. Payment processing through Stripe may also involve transfers outside the UK/EU. When this occurs, we use:

• Standard Contractual Clauses (SCCs)
• Supplementary safeguards
• Minimal, non-sensitive data sharing

All other processors (Brevo, Scaleway services, Sentry EU) operate within the UK/EU.

10. Third-Party Processors

We work with trusted providers who meet GDPR standards. Each processes only what we instruct, and only for essential functionality.

• Brevo (EU): Email delivery for account and order communications.
• Scaleway (EU): Compute, Database, Object Storage.
• Sentry (EU Region): Error reporting and crash diagnostics. Does not process private media.
• Bitdrift (US): Performance monitoring and debugging. Receives only minimal technical data.
• Stripe: Payment processing for store orders. Receives the payment and billing details needed to take payment. We do not receive or store your full card details.
• ShipStation: Order fulfilment and shipping label management. Receives the order and delivery details needed to dispatch your order.
• Shipping carriers: The courier or postal service delivering your order receives your name, delivery address, and contact details.

We do not share your data with advertisers, data brokers, or marketing networks.

11. Aggregated & Anonymised Data

We may use anonymised information (e.g., performance statistics) to improve our service.

This data cannot identify you.

12. Business Transfers

If Chunky Guys is ever involved in a merger, acquisition, or restructuring:

• Your data will remain protected under this policy or an equivalent one.
• We will notify you before any changes take effect.

13. Your Rights

Under UK GDPR and EU GDPR, you have the right to:

• Access your data
• Correct inaccurate information
• Delete your data (completed within 24 hours, except records we must keep by law, see Section 5)
• Object to certain processing
• Restrict certain processing
• Port your data to another service
• Withdraw consent
• Complain to a data protection authority

EU supervisory authorities:

https://edpb.europa.eu/about-edpb/board/members

14. Adults Only

Chunky Guys is strictly for users aged 18 and over.

If we discover data from anyone under 18, we delete it immediately.

15. Cookies & Tracking

• We do not use third-party advertising trackers.
• In the app, we use only essential session tokens.
• On the website and store, we use essential cookies needed to run the site, keep your session active, and process your order.

If we ever introduce non-essential cookies, we will ask for your consent first.

16. Changes to This Policy

If we update this policy, we will notify you through the app or email before changes take effect.

17. Contact Us

For any privacy questions or requests: sayhello@chunkyguys.com

We aim to respond quickly, and deletion requests are completed within 24 hours (except records we must keep by law).