English only for now.
OpenFeed is a Dutch/EU microblogging service with chronological feeds and no advertising. That has concrete consequences for your privacy:
This statement describes which personal data we process, why, on what legal basis, for how long, and who we share it with.
The controller within the meaning of the General Data Protection Regulation (GDPR / AVG) is the operator of OpenFeed:
OpenFeed has not appointed a Data Protection Officer. This is not legally required for an organisation of this size and processing profile. Privacy questions reach the controller at privacy@openfeed.eu.
Until the KVK number and registered address are available, you can still contact us at the addresses above. Location of the service as shown in the product: Almere, the Netherlands.
| Category | Examples | Required? |
|---|---|---|
| Account | Email address; password (stored only as a modern salted hash, Argon2id when available, otherwise bcrypt; never in readable form, never in export); language; appearance (light, dark, or system); Home timeline view (chronological, spread, or yesterday); default post retention (24 hours, 30 days, or keep); email-notification preferences | Yes (for an account) |
| Extra sign-in security | Optional authenticator-app secret (stored encrypted) and hashed one-time recovery codes when you turn two-factor authentication on | No |
| Identity / profile | Handle, display name, biography, avatar colour, header colour, optional avatar photo, optional header photo, optional online-status preference | Handle and display name for an identity; the rest optional |
| Content and graph | Posts (including a sensitive mark and optional cover warning), replies, quotes, attached photos with optional ALT text, poll options and your votes, likes, reposts, bookmarks, profile pins, lists, follows and follow requests, people you ignore or block; optional who invited whom via a referral invite link | Follows from use |
| Spaces | Memberships (including a last-read time used only for an unread mark), spaces you create (name, visibility, optional photos, retention cap, optional event window, close state), space pins you set as an admin | Follows from use |
| Direct messages | Messages you exchange with other identities | Follows from use |
| Reports | Category and written reason when you report a post or a profile | No |
| Correspondence | Emails you send us (for example to privacy@openfeed.eu, hello@openfeed.eu, security@openfeed.eu, or dsa@openfeed.eu); see §3 purpose 14 | No |
| Category | Examples |
|---|---|
| Sessions | Hashed session identifier, coarse browser/OS label, timestamps, whether you chose “Stay signed in”; not an IP address in the session record |
| Rate limiting | Short-lived buckets keyed by hashed IP or subject; never raw IP or email in those buckets |
| Moderation | Classification scores and categories on posts; hide or flag events; image-review queue rows for posts with photos; a moderation penalty counter used by operators (not for ranking, and not an automatic account suspension) |
| Notifications | In-app notifications (who acted, which post, timestamps, and a short explanation when one of your posts is hidden); optional engagement emails when you enable them |
| Link previews | When you post an http(s) link, our servers in the EEA fetch that public page to store a title, description, and image for the preview card; we do not send your account to the linked site (see §3 purpose 13) |
| Visitor analytics | Aggregate pageviews via Simple Analytics (see §5). Public page paths they collect may include handles (for example /@name) and, if present in the URL, search terms |
| Access logs | Web-server access logs may briefly include IP address, requested path (without the query string), user agent, and timestamps. Kept for 14 days, then deleted |
We do not ask for data about health, religion, political opinion, ethnicity, or sexual orientation. You can put such data in a post yourself. For content you make public, Article 9(2)(e) GDPR may apply: you have manifestly made the data public yourself.
Think before you put sensitive information in a public post. Public posts are visible to anyone on the internet, including people without an account. Posts in a private space stay in that space: they are not on the open timeline and cannot be reposted out.
Members can share an opaque invite link from Settings (not based on handle). When someone opens that link and registers, we remember who invited them until they confirm their email (including a later magic-link sign-in on another device). After that confirm we may:
invited_by on their identity; cleared if you are erased);The raw invite token is a capability secret: it is not included in data export. You can rotate the link in Settings so old URLs stop working. Invite links do not bypass the published account limit. This is not the former invite-code programme (which ended).
For each purpose: the data we use, the legal basis under Art. 6 GDPR, and how long we keep it.
Where we rely on legitimate interest (1f), including rate limiting, access logs, automated text classification, and handling reports, our interest is keeping the platform running and safe for everyone who uses it. We limit impact through short retention where we control it, hashed rate-limit keys, Zero Data Retention at Mistral for moderation API input, and by not using this data for advertising or ranking.
If you delete your account in Settings, it is hidden immediately. You have 14 days to cancel (sign-in still requires your authenticator if two-factor authentication was on). After that we erase your personal data:
Moderation records (classification scores and hide events, closed reports, the operator penalty counter) follow the retention set out above. Terms describe a limited right to keep those records for legal defence and DSA or law-enforcement purposes for those same periods.
We make daily full-platform backups and keep them for 30 days. Those backups exist only to restore large parts of the platform in an emergency (outage or data loss). We do not make per-post backups, and we do not use backup copies to bring back individual posts or accounts that were deleted in the live service. After the 30-day window, backup copies are rotated away.
We store space memberships and spaces you create as described above. Unread marks are not a separate export category; they end with the membership. If a public space is closed and then deleted, remaining posts move to Public under the same authors. If a private space is deleted, remaining posts in it are erased. Space admins are a community role, not a separate controller.
OpenFeed assesses posted content partly automatically. This is how it works today:
When a post is hidden, whether after an automated check, a report, or an operator review, the author receives an in-app explanation: category labels and/or a short operator reason; for a report-driven hide, also the report category. The author can still open the permalink.
Automated classification may hide an individual post without a person reviewing that post first. Account-level measures (such as suspending or terminating an account) are not taken automatically from the moderation penalty counter or from classification scores; any such measure always involves human review. The Terms reserve that right for serious cases; the product has no public ban UI today.
More about community norms: House rules and Terms.
We engage a small number of external parties. A data processing agreement (Art. 28 GDPR) applies with each party below, or an equivalent processor clause from that party’s terms. We do not add parties that process personal data without updating this list.
api.eu.mistral.ai). Billing or control plane may sit outside the EEAhttps://eu-api.smtp2go.com/v3. The provider is established in New Zealand (see §6)What is absent is absent deliberately. We use no Google Analytics, no Meta pixels, no advertising networks, and no advertising trackers.
Domain registration and DNS for openfeed.eu are ordinary infrastructure for running the website; they are not used to build profiles of users.
Application data, sessions, and backups that process personal data stay on Hetzner in the EEA (Helsinki, Nuremberg, Falkenstein).
https://eu-api.smtp2go.com/v3) so mail handling for our account is tied to their EU-hosted environment. Mail does not include private-space post bodies.If a public post is viewed by someone outside the EEA, that is a consequence of you posting it publicly, not a transfer of your account database to a third country on our behalf.
We take appropriate technical and organisational measures, including:
No system is completely secure. We do not promise absolute safety. We do take security seriously and will be honest if something goes wrong.
Data breaches. In the event of a personal-data breach posing a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of it where required, and we will inform affected people when the risk is high.
Security reports. Email security@openfeed.eu.
Under the GDPR you have the following rights:
| Right | What it means |
|---|---|
| Access (Art. 15) | Request a copy of the personal data we process about you |
| Rectification (Art. 16) | Have inaccurate data corrected |
| Erasure (Art. 17) | Have your account and data deleted |
| Restriction (Art. 18) | Have processing temporarily suspended, for example during a dispute |
| Portability (Art. 20) | Receive your data in a machine-readable format |
| Objection (Art. 21) | Object to processing based on legitimate interest |
| Withdraw consent | Where processing is based on consent (online-status marker), you can withdraw it at any time in Settings |
Where we rely on legitimate interest, including automated text classification of your posts (§3 purpose 5), you may object by emailing privacy@openfeed.eu; we will stop or adjust that processing unless we demonstrate compelling legitimate grounds that override your interests, or we need the data for legal claims.
Choosing Yesterday on Home is not an Article 22 decision with legal or similarly significant effect. It is an optional overlay you turn on; chronological remains the default; the rule is explained in “Why am I seeing this?”.
We respond within one month. For a complex request we may extend that period by two months; we will tell you within the first month if we do. Requests are free of charge.
Where we have reasonable doubt about your identity, we may ask for additional verification. We will never ask for a copy of an identity document.
When hard erasure runs after the 14-day window:
Derived per-identity cache files used only to render your signed-in chrome are removed on erasure. They are not a separate export category.
OpenFeed sets no cookies, and Simple Analytics sets no cookies either. There is no cookie banner because none is needed: the values below are strictly necessary for the app, or remember a choice you made.
The app keeps these values in your browser’s local storage or session storage, on your device only. Of these, only the sign-in tokens are sent to OpenFeed, to show that you are signed in.
| Name | Where | Purpose | Retention |
|---|---|---|---|
openfeed-auth | Local storage | Your access and refresh token, so you stay signed in | Removed when you sign out. The sign-in itself ends after 24 hours, or after 90 days with “Stay signed in” |
openfeed-pkce | Session storage | The PKCE verifier and state while a sign-in is in progress, so the app can check that the sign-in that returns is the one you started | Removed as soon as the sign-in returns |
openfeed-seen | Session storage | Which accounts and spaces you have already seen in this tab | Cleared when you sign out and when you close the tab |
of-ui-themeof-gif-autoplayopenfeed-lang | Local storage | Your choices for appearance, GIF autoplay and language. Appearance is also kept for guests | GIF autoplay and language are removed when you sign out. Appearance is kept after you sign out |
When you are signed in, appearance, Home timeline view and default post retention are also stored on your account (see §2).
OpenFeed is not directed at people under 16. You must confirm you are 16 or older when you register. We do not carry out age verification with identity documents or biometrics.
Are you a parent or guardian and do you believe a child under 16 has an account? Email privacy@openfeed.eu. We will delete the account and the associated data.
We can only clean up what sits on our own systems.
We may amend this statement. For substantive changes, such as a new processor or a new processing purpose, we will inform you in a clear way (for example an in-app notice or email) with reasonable notice where appropriate. Every published version will be listed in the version history below.
If you disagree with how we handle your data, contact us first at privacy@openfeed.eu. We would rather resolve it ourselves.
If we cannot reach a resolution, you can lodge a complaint with the supervisory authority: Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Postbus 93374, 2509 AJ The Hague, Netherlands, autoriteitpersoonsgegevens.nl.
If you live in another EU member state, you can also approach the supervisory authority in your own country.
| Version | Date | Change |
|---|---|---|
| 0.25 | 17 October 2026 | No cookies: §9 lists the browser storage the app uses; sign-in lasts up to 90 days with Stay signed in; the Kwetter session cookie is gone |
| 0.24 | 22 September 2026 | Authors may edit own posts (body, photos, ALT) with a visible edited marker; re-moderation on edit; §3 purposes 2 and 5; Art. 16 exercise path |
| 0.23 | 17 September 2026 | Referral invite: pending inviter stored at register so auto-follow/attribution still run when email is confirmed later (other device / delayed magic link); §2.5 wording |
| 0.22 | 17 September 2026 | Referral invite links: opaque per-identity token (rotatable), invited-by attribution after email confirm, auto-follow rules, invite notification + email preference; §2.5 rewritten (invite-code programme remains ended) |
| 0.21 | 16 September 2026 | Incomplete registration: reminder at 24h, warning at 48h, hard erase at 72h if the email is never confirmed; no 14-day grace for those rows. §5 SMTP2GO role names those reminder/warning mails |
| 0.20 | 15 September 2026 | Default post retention is an account preference (24 hours, 30 days, or keep); compose prefill only; space caps still apply; erased with the user |
| 0.19 | 10 September 2026 | Payments: none in this beta, statement will update before any payment data; Terms cross-link for moderation-record retention and reserved manual suspend/terminate |
| 0.18 | 10 September 2026 | Home timeline view: default chronological; optional Spread and Yesterday (unique likes/replies in a closed window, not a behavioural profile; Art. 22: user-chosen, explainable, no legal/similar effect) |
| 0.17 | 9 September 2026 | §4: dropped the public Moderation page; community norms link to House rules and Terms |
| 0.16 | 9 September 2026 | §0: three processors outside the Hetzner/EEA hosting picture (not two) |
| 0.15 | 9 September 2026 | SMTP2GO retention disclosed in §5 (~30d activity / ~35d metadata); purpose 4 distinguishes our 7-day outbox |
| 0.14 | 9 September 2026 | Art. 21: how objections to 1f processing (incl. purpose 5 automated classification) are handled |
| 0.13 | 9 September 2026 | §7 security reports security@openfeed.eu; mailbox listed in §1 / correspondence |
| 0.12 | 9 September 2026 | Access logs: path only (query strings stripped at nginx) |
| 0.11 | 9 September 2026 | §0 summary points to §5 for processors outside the Hetzner/EEA hosting picture |
| 0.10 | 9 September 2026 | Art. 22 clarity: penalty/scores do not auto-suspend; account-level measures always involve human review |
| 0.9 | 9 September 2026 | Split former purpose 5 into single-basis rows: automated text classification (1f), user reports (1f), operator penalty counter (1b) |
| 0.8 | 9 September 2026 | §3 rows for link previews (purpose 11) and inbound correspondence (purpose 12); authorities renumbered to 13 |
| 0.7 | 9 September 2026 | Mistral Zero Data Retention enabled: removed ~30-day API-input retention caveat; stated ZDR in §3 to §6 |
| 0.6 | 9 September 2026 | Removed self-declared DSA notice-and-action disclaimer; §4 describes reporting and author notice as implemented |
| 0.5 | 9 September 2026 | Mistral DPA link; access-log retention fixed at 14 days (matches nginx logrotate) |
| 0.4 | 9 September 2026 | Hetzner and Simple Analytics DPA links; SMTP2GO as Sand Dune Mail Ltd (NZ adequacy) with EU API eu-api.smtp2go.com; daily backups retained 30 days for emergency full-platform restore only |
| 0.3 | 9 September 2026 | First product-aligned draft: reflects live processing only; Hetzner FI/DE sites; Simple Analytics; Mistral text moderation; SMTP2GO mail; business registration pending; contacts privacy@ / dsa@ / hello@ |