Legal

Privacy Policy

Effective date: The date this policy is first published at gukkit.com/privacy.

The short version

Gukkit is built to know as little about you as possible. You get a random anonymous number, not a username you pick. We never ask for your location. We run no analytics or tracking SDKs. We strip identifying metadata from media you upload. We do not sell your data, we do not share it for advertising, and we never will.

What we do store is what makes Gukkit work: your posts, your comments, your stars, your direct messages, your rooms, and your ceremony activity. This policy explains all of it in plain language.

Who we are

Gukkit is developed and published by Granary ("we," "us"). Contact: granary.usa@gmail.com. Business address: 6881 W Charleston Blvd, Ste A, Las Vegas, NV 89117. Website: gukkit.com.

We are the data controller for information processed through the Service.

How Gukkit accounts work

When you create an account, you do not give us your name, email address, or phone number. The app assigns you a random, permanent, non-sequential anonymous number (for example, anon-4821). You cannot choose your number; a name can only be earned through a community naming ceremony.

Your account is tied to your device and to a 12-word recovery phrase generated on your device. The phrase itself never leaves your device in readable form: our servers store only a verifier derived from it, which lets a new device prove it holds the phrase without us ever seeing the phrase. If you lose your device and your phrase, we cannot verify who you are and cannot recover the account. There is no email-based reset, because we do not have your email. Guard your device and your phrase.

What we collect

Your account record. Your anon number, whether you are anonymous or named, your Ceremony Name if you have earned one, your Critter colorway, your settings (theme, text size, word filters, DM preferences, notification preferences), your ceremony progress, and your account tokens.

Content you create. Text posts (up to 200 characters), comments, quote posts, any media you attach, stars and Super Stars you give and receive, gift Super Star chains you take part in, accounts you follow, blocks and mutes you set, ceremony proposals and votes, and reports you file.

Rooms and venues. Room names and topics, venue names and topics, pinned welcome lines, and room messages are stored so the rooms work. When you are in a room, the Service processes presence information (a heartbeat from your app) so the room can show how many people are around and who is speaking. Presence records are operational, short-lived, and are not kept as a history of where you have been.

Direct messages. DMs are stored on our servers so they can be delivered and so you can read your history. An honest note: DMs are not end-to-end encrypted. Treat DMs like a postcard, not a sealed letter. We may access DMs in connection with a report, a safety investigation, enforcement of our Terms, or legal process.

Media metadata. When you upload media, we strip EXIF and other identifying metadata, including any embedded location data, before it is stored or shown to anyone.

Reports. When you report a post, comment, message, room, or account, we keep the report, the reported content, and related account information so we can review it, act on it, and meet our legal duties. Reported content may be kept after the original is deleted where needed for an investigation or a legal obligation.

Security data. We process IP addresses and connection data to operate the Service, prevent abuse, and investigate attacks. This data is kept only as long as needed for security, then discarded or aggregated.

Notifications. Notifications about stars, mentions, DMs, and ceremonies are delivered inside the app. We do not use a third-party push notification service and do not collect push tokens.

What we never collect

• Location. The app never requests your location and never stores it.
• Analytics and tracking. No analytics SDKs, no advertising SDKs, no cross-app tracking, no behavioral profiles built for advertisers.
• Advertising identifiers. We do not read or use your device advertising ID.
• Contacts and other device data. We do not ask for them.

Permissions the app requests

• Photos and media: only when you choose to attach media. The app accesses only files you explicitly select.
• Notifications: optional, for in-app alert preferences. Turning them off stops the alerts; nothing else changes.

Why we process your data (lawful bases)

• Contract: operating the Service you asked for (your account, posts, DMs, rooms, ceremonies, notifications). GDPR Article 6(1)(b).
• Legitimate interests: keeping the Service safe and functional (abuse prevention, moderation, security logging). GDPR Article 6(1)(f). We balance these interests against your privacy and collect the minimum needed.
• Legal obligation: complying with lawful orders and safety reporting duties. GDPR Article 6(1)(c).

We do not rely on consent as a basis for core processing, because the Service cannot function without it; where we ask for optional consent, you may withdraw it at any time.

Sharing

We do not sell your personal information. We do not share it for cross-context behavioral advertising. There is nothing to opt out of.

We disclose limited data only to processors needed to run Gukkit:

• Hosting and delivery: our Service runs on Cloudflare, which hosts, stores, and delivers data on our behalf under its data processing terms and may not use it for its own purposes.
• Email: if you write to us, your message is handled by our email provider so we can read and answer it.
• GIF search: when you search for a GIF in the app, your search words are sent to GIPHY, which provides the GIF search and its results. No Gukkit account data is sent. GIPHY receives only what you type into GIF search.

If required by law to disclose information (for example, a valid court order), we disclose only what is legally required and, where the law permits and does not forbid it, we will tell you first.

Retention and deletion

Your content remains while your account is active. When you delete a post, comment, DM, or other content in the app, it leaves public view immediately and is deleted from our systems within 30 days, except for minimal records we must keep for safety or legal reasons, such as reports, records connected to an open investigation, and material we are required by law to preserve or report.

You can delete your account in Settings, or request deletion by email as described in our Account Deletion Terms. Account deletion removes your posts, comments, DMs, stars, follows, rooms, venue, and ceremony activity, and completes within 30 days including backups. Anonymized, aggregated statistics that cannot be linked to you may remain.

Security

We encrypt data in transit (TLS), limit production access, and log access. No system is perfect; because accounts are anonymous, we cannot always verify that a requester is the account holder, so device security matters.

If we discover a personal data breach that risks your rights, we will notify the competent supervisory authority within 72 hours where the law requires and notify affected users without undue delay where required by law.

Blocking

When you block someone, every path between you is severed: stars, quotes, comments, ceremony proposals and votes, follows, room contact, and DMs. They cannot see your content and cannot contact you.

Children

Gukkit is not directed at children under 13, and you must be at least 13 to use it. We do not knowingly collect information from children under 13. If we learn that an account belongs to a child under 13, we terminate the account and delete its data.

Your rights

Everyone. You may access, correct, export, and delete your information. The app includes export (Settings) and account deletion; for anything else, email granary.usa@gmail.com. Because accounts are anonymous, we act on requests made from within the authenticated app, or on email requests that include your anonymous account number where we can match the request to the account. Where we cannot match a request to an account, we will say so.

European users (GDPR). You have the rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20), and objection (Article 21). We respond within one month. You may lodge a complaint with your national data protection authority.

California users (CCPA/CPRA). You have the right to know what we collect, to access it in a portable form, to correct it, to delete it, and to not be discriminated against for exercising these rights. We do not sell personal information and do not share it for cross-context behavioral advertising. We respond within 45 days. You or your authorized agent may exercise these rights at granary.usa@gmail.com.

Other U.S. states. If your state grants similar privacy rights, we honor them on the same terms; contact us and we will tell you what applies.

Data minimization

Minimization is an engineering practice here, not a slogan: anonymous accounts, no location, no analytics SDKs, metadata stripping, purpose-limited collection, and defined retention. If we do not need it to run Gukkit safely, we do not collect it.

Changes to this policy

For material changes, we will post the new policy at gukkit.com/privacy and give in-app notice at least 30 days before it takes effect, except changes required earlier by law or for safety, which take effect on posting. Continued use after the effective date constitutes acceptance.

Contact

Privacy questions, rights requests, and deletion requests: granary.usa@gmail.com. Business address: 6881 W Charleston Blvd, Ste A, Las Vegas, NV 89117.