Network Privacy Notice

1. Controller and scope

The data controller is Mediaware, s.r.o., Horná 54, 974 01 Banská Bystrica, Slovakia, company ID (IČO) 44 397 402, registered in the Commercial Register of the District Court Banská Bystrica, Section Sro, Insert 15371/S. Contact us at [email protected] for privacy matters or [email protected] for network-safety matters.

This notice applies to the Mango IRC Network at irc.mangoirc.chat, the Mango Account used to access it, and the network’s authentication and push services. The Mango client Privacy Policy applies separately to the app. Other IRC networks are operated by their own controllers.

2. Data we process

Account, passkey, and entitlement data

• Your IRC identity account names and display names, internal account and identity IDs, account status, and creation and update times.
• Passkey public-key material, credential ID, authenticator metadata, a label you choose, and creation and last-used times. We never receive the passkey’s private key or your biometric data.
• Proof that the Mango app was legitimately acquired, including a stable Apple app-transaction identifier, purchase date, platform, and environment. We do not receive your payment-card details or Apple Account password.
• Device-session labels, expiry and revocation times, and hashed refresh-token material. Refresh tokens are not stored in readable form.

Connection and network data

• IP address, connection times, IRC account and nickname, user and host information, channels joined, and network settings needed to run the service.
• Security events, rate-limit records, bans, moderation actions, and enough context to investigate abuse or service failures.
• Short-lived WebAuthn challenges and authentication-session data while you create an account or sign in.

Messages and history

IRC necessarily distributes messages and related metadata to their intended recipients. The network can also retain message contents, sender, destination, timestamp, message ID, edits, reactions, and reply metadata as history:

• Registered channels: history is retained for up to one year.
• Direct messages: authenticated users receive persistent history by default and can opt out through supported IRC history settings.
• Unregistered channels: history may exist briefly in memory for delivery but is not stored persistently.

Channel operators and message recipients may independently keep logs or copies. Removing network history cannot remove copies already received or made by other users.

Optional push notifications and reports

If you enable push notifications, we process the Apple Push Notification service endpoint and subscription data needed for delivery. If you contact support or report abuse, we process the email address, evidence, and other information you provide.

3. Why we process it

• Providing the service and account (Article 6(1)(b) GDPR): authentication, IRC delivery, history, device sessions, requested push notifications, and support.
• Legitimate interests (Article 6(1)(f) GDPR): securing the service, preventing fraud and abuse, applying rate limits, moderating the network, diagnosing failures, and maintaining recoverable backups. We balance these interests against users’ rights and limit the data and retention involved.
• Legal obligations (Article 6(1)(c) GDPR): responding to valid legal process and fulfilling duties imposed by applicable law.

Providing account and connection data is necessary to use the authenticated network. You do not have to enable push notifications or send us an abuse report.

4. Who receives data

• Other IRC users: channel messages and identity information are delivered to channel members; direct messages are delivered to their recipients. Public channels should be treated as public conversations.
• Mediaware operators: authorised operators can access data when needed to maintain, secure, or moderate the service.
• Cloudflare: the encrypted WebSocket endpoint is delivered through Cloudflare, which processes connection metadata such as IP addresses and request headers on our behalf.
• Apple: when push notifications are enabled, Apple processes the device token and notification payload through APNs.
• Authorities: we may disclose information when required by valid law or when necessary to address an immediate threat to safety.

We do not sell network data, use it for targeted advertising, or disclose it to data brokers.

5. Retention

• Account, passkey, and app-entitlement records are kept while the account exists and then deleted or anonymised when no longer needed for legal, fraud-prevention, or dispute purposes.
• Registered-channel and opted-in direct-message history expires after no more than one year. Users may delete individual history items where supported.
• Device sessions normally expire after 90 days. Push subscriptions expire after 30 days unless renewed.
• WebAuthn registration challenges expire after five minutes; sign-in challenges expire after two minutes. Rate-limit records normally expire within 24 hours.
• Operational container logs rotate at a maximum of approximately 50 MB per container. Their time span depends on activity and old entries are overwritten.
• Daily local backups are retained for seven days. Encrypted or access-controlled off-host backups are retained for up to 30 days, so deleted data can remain in a backup until that backup expires. Restored data is again subject to the deletion request.
• Abuse and support correspondence is kept only as long as needed to handle the report, defend against claims, document moderation, or meet legal obligations.

6. Location and international transfers

The network’s origin services, primary databases, and backups are operated in Slovakia or elsewhere in the European Economic Area. Cloudflare and Apple are global providers and may process limited data outside the EEA. Where required, transfers rely on an adequacy decision, the EU Standard Contractual Clauses, or another lawful safeguard. See Cloudflare’s Privacy Policy, Cloudflare’s Data Processing Addendum, and Apple’s Privacy Policy.

7. Your rights

Subject to the GDPR’s conditions and exceptions, you can request access, correction, erasure, restriction, and portability of your data, and object to processing based on our legitimate interests. Email [email protected]. We may need to verify that you control the relevant account before acting on a request.

You may also complain to the Office for Personal Data Protection of the Slovak Republic or the supervisory authority where you live or work.

8. Automated controls

Automated flood protection, connection limits, and abuse-prevention controls may temporarily reject or restrict activity. They do not make decisions that produce legal or similarly significant effects. Network moderation decisions can be appealed through the process in our Abuse and Legal Contact page.

9. Security and changes

Connections use encrypted WebSockets; account access uses passkeys; service credentials are short-lived; and administrative access is restricted. No service can guarantee absolute security, so do not use IRC for secrets or safety-critical communication.

We will update the date above when this notice changes. Material changes will be announced on the website or through an appropriate in-service notice before they take effect where required.