Privacy Policy

1. Who we are

Compromise is a group-decision tool. We are the operator of the personal data described here within the meaning of Russian Federal Law No. 152-FZ "On Personal Data", and its controller within the meaning of the EU General Data Protection Regulation (GDPR).

You can reach us about anything in this policy at arthur.vafin.post@gmail.com.

2. What a room stores

A room stores its questions, its options, the answers each participant submits, the availability people paint on a schedule, and the display name someone types when joining. Access to a room is proven with a random token kept in a cookie in your browser, not with an email or password — you can use Compromise without an account.

A host may add email addresses to a private room's guest list or invite someone to close a room on their behalf; we store those addresses so the invitation can be delivered and answered. If you ask to join a private room, we store your request until the host approves or declines it. A recurring room stores its saved template and its schedule.

If you join a room while signed in, the room's owner can see the email address of your account next to the name you gave, so they know who answered. Joining without signing in shares no address.

Other participants and the host of a room can see the display name you gave. If you type someone else's email address into a guest list or an invitation, you confirm that you may share it for that purpose.

3. Account data

Signing in is optional and goes through Google, Yandex ID or VK ID, via an identity server we operate. From it we receive and store an account identifier, the email addresses the provider vouches for, your name, the address of your profile photo and, for VK, your numeric VK user ID so that we can message you there. We never receive your password and we store no token or account identifier belonging to the provider itself.

In your settings you may add a first and last name, upload a profile photo (it is resized in your browser and stored at up to 512 KB), choose which of your own verified addresses receives notifications, and choose a time zone. We also keep your notification preferences and an inbox of the notifications we have shown you.

4. Payments

If you subscribe to Pro, payment is taken by YooKassa (in roubles) or lava.top (in US dollars, or in roubles where YooKassa is not available). We store the plan, amount, currency, payment status and dates, the email address for the receipt, and the payment's identifier at the provider. For automatic renewal through YooKassa we also store the identifier of the saved payment method.

Your card details are entered on the provider's own page and never reach us.

New accounts may start one free month of Pro without any payment details. So that it is given only once, we keep a one-way hash of each email address and VK user ID the account had when the free month started, separately from the account; the hash cannot be turned back into the address. We write to you a few days before the free month ends and once when it has ended.

5. Technical data

Like any web service, our servers see your IP address, browser type and the time of each request, and keep them in operational logs for security, abuse prevention and troubleshooting. Your IP address is also looked up in a MaxMind GeoLite2 database stored on our own server to estimate your country — used only to choose which sign-in buttons and which payment currency to offer first. The address is never sent to MaxMind or anyone else for that lookup.

We also keep aggregate, anonymous statistics about how the service is used — for example how many rooms are created and closed — on our own servers. They contain no names, email addresses or room codes.

6. Why we use it, and on what basis

Room data and account data are processed to provide the service you asked for: scoring a room, showing its result to its participants and host, and letting you find your rooms on any device. Payment data is processed to perform the subscription and to meet our accounting obligations.

Notifications are sent only because you turned them on or took part in a room, and you can turn them off at any time. Technical logs and the country estimate rely on our legitimate interest in running a secure service. Functional cookies are set only with your consent. Where Russian law requires your consent to processing, you give it by using the features described here, and you may withdraw it at any time by contacting us.

7. Messages we send

Every message follows from something you or someone in your room did: an answer arrived in a room you own, a room you took part in closed, someone invited you, someone asked to join your room, or a recurring room of yours was paused. Messages go by email and, if you linked VK and allowed messages from our community, by VK message. We send no marketing of any kind.

Each kind of message has its own switch in your notification settings, and every email carries a one-click unsubscribe link. When an address unsubscribes, we keep it on a suppression list so we can honour that choice.

8. Who else receives data

Google, Yandex or VK learn that you signed in to Compromise and send us the details listed above. Resend delivers our emails and receives the recipient address and the message. VK delivers VK messages. YooKassa and lava.top process payments under their own terms. Each of them handles the data under its own privacy policy.

Some of these providers, including Google and Resend, process data outside Russia and outside the EU, including in the United States. By signing in with such a provider or turning on email notifications you are informed that your data is transferred to them for that purpose.

The film, game and city details used to fill in options come from public datasets loaded onto our own servers; those searches never leave them. Searching for a place to eat is the exception, where it is switched on: our server — never your browser — sends the text you type and, only if you press “Use my location”, your position rounded to about a kilometre to the OpenStreetMap geocoding and map-data services Photon (run by komoot) and Overpass. Your IP address is not passed on to them, and we do not store the position. We use no advertising network, no analytics provider and no third-party tracking.

We may disclose data if the law or a competent authority requires it, and if the service is ever transferred to another operator, your data moves with it under the same commitments as in this policy.

9. Cookies

We use strictly necessary cookies, and functional cookies only if you allow them. The Cookie Policy lists every cookie, and you can change your choice at any time through "Cookie settings" at the bottom of every page.

10. What we don't do

We do not sell personal data, we do not build advertising profiles, and we do not use your answers for any purpose beyond scoring the room you submitted them to.

11. How long we keep it

Room data is kept for as long as the room exists; a closed room keeps its result frozen at the moment it closed. Invitations and join requests are kept until they are answered or withdrawn. Account data is kept until you ask us to delete the account.

Payment records are kept for as long as tax and accounting law requires. Operational logs are kept only for as long as needed to investigate problems. An address on the suppression list is kept for as long as it is needed to keep that address from being emailed.

12. Your rights

You may ask what data we hold about you, have it corrected, restricted or deleted, object to its processing, receive a copy of it, and withdraw any consent you gave — withdrawal does not affect processing that happened before it. We answer within ten working days, or within the shorter period the law applicable to you sets.

If you believe we have mishandled your data, you may complain to Roskomnadzor or to the data protection authority of your country.

You are not subject to decisions made solely by automated means that have legal or similarly significant effects on you. Compromise only calculates a recommendation for a group; the group decides.

To exercise any of these rights, email arthur.vafin.post@gmail.com.

13. Security

Room and host tokens are stored only as one-way hashes, sign-in cookies are encrypted and cannot be read by page scripts, and access to data is limited to what running the service requires.

No system is perfectly secure. If a breach affecting your personal data occurs, we will notify you and the competent authority within the time the applicable law requires.

14. Children

Compromise is not directed at children under 14. If you are younger than the age at which you may consent to data processing in your country, use it only with a parent's or guardian's permission.

15. Changes to this policy

If this policy changes materially, the "Last updated" date above will change, and where a change affects cookies you have agreed to, we will ask again.