← Back to proxi.zoneEN⌄

Privacy Policy

Revised on 24 October 2026 · project for a local stand

This translation was generated automatically. The Russian version is the project’s source text.

Data controller and processor: RMX Tec Ltd, a company registered in Bulgaria. Contact for personal data enquiries: info@proxi.zone.

This document describes data processing within proxi.zone. The service is currently operating as a local test environment. Prior to the public launch, this document will be updated to reflect the actual hosting arrangements, service providers, retention periods and available features.

1. Access without an account

You can search for chats, join them and chat without registering. An account is required to create and manage your own chats, as well as to receive optional notifications about new chats nearby. Guests choose a name; private chats require the owner’s approval of the request, whilst chats with a limited radius require verification of the device’s coordinates. Guest access does not imply technical anonymity: the server has access to the network data of requests.

2. What data is used

• Account: email address, chosen name, optional avatar, bio and links to social media, password hash, time of registration and email confirmation. Your real name and a personal photo are not required. Passwords are not stored in plain text in the database.
• Sign-in via Google: this is an optional method of creating an account and logging in, available once the service is enabled. Only when you click the button will your browser be redirected to Google; Google processes data in accordance with its privacy policy. We request a verified email address, a name and a permanent Google ID. The name is used for your new profile and can be changed. The Google ID is stored alongside your account for future logins. No Google photos are downloaded; access to Gmail, contacts or files is not requested. Google access and refresh tokens are not stored. A one-off login attempt is session-based and valid for 10 minutes; it is deleted when you log out of Google or end the session, and expired attempts are cleared the next time you start the login process. An existing account with a password is not automatically linked: Google is linked from your profile after logging in with a password and must have the same email address.
• Avatar: when registering or editing your profile, you can upload a JPG/PNG file up to 5 MB in size or take a selfie. Camera access is only requested after you click ‘Take a selfie’ and grant browser permission; no audio is recorded. The preview and image are processed on your device, and the photo is only sent when you save your account details. The camera switches off after the photo is taken, the window is closed, or you leave the page. The server crops the image to a square centred on the subject and saves a re-encoded version no larger than 1024×1024 pixels without the original EXIF metadata; the original is not stored separately. Once your account is verified, your avatar will appear on your profile and next to your messages. Participants who can view your message can open a card showing your name in this chat, your avatar and the total number of active chats you have created, including private ones. The card does not show your email address, a list of these chats, or links to them. This image is accessible via a separate, random link that the recipient can forward, so please do not upload any confidential images. You can replace or delete it in your profile; the old link will no longer display the image. This does not delete any copies that other people may have saved previously.
• Bio and social media: when registering or editing your profile, you can provide up to 500 characters about yourself and links to Instagram, Facebook, TikTok and Telegram. These fields are optional; you can edit or clear them. This information is saved with your account and is visible to participants who can view your message in the chat. You enter the links yourself; we do not verify ownership of the accounts specified, do not link them, and do not request access to them. There are no built-in widgets for these services in your profile. Clicking on a link opens a third-party website with its own data processing policies.
• Sessions and security: session ID hash, account ID, CSRF token, expiry times, one-off link hashes and attempt counters associated with a hashed IP address or email address. Hashing such identifiers does not automatically render them anonymous.
• Search location: coordinates obtained from your device following your action and browser permission, or selected on the map or entered manually. The location is transmitted to the server to calculate distances. A standard search does not save this in your account settings, but the query parameters may be present in technical logs. Separate location storage for notifications about new chats is described below.
• Notifications about new nearby chats: this feature is available to accounts; it is disabled by default and must be enabled separately. For this feature, the server stores the selected channels, radius, settings status, up to 20 named areas with coordinates and radius, and—when location services are enabled—only the device’s most recent coordinates, accuracy and time of detection. A new position replaces the previous one; no movement history is created. Coordinates, including precise ones, and saved areas are personal data associated with your account; a selected area may indicate a place of interest to you, rather than your actual presence. The radius of each area and device is limited to 5 km. This data is used for matching with new chats from other users and is not displayed to chat owners or other users.
• Radius verification: when applying for or joining a local chat, the server receives the device’s coordinates, the declared accuracy and the time the position was determined. These are used to verify access and are not stored as location history in the chat tables. A search pin is not used for this verification. For global chats, coordinates are not required; moving outside the radius after joining does not terminate membership.
• Participation and messaging: chosen name, membership status, applications and the owner’s decisions, message text and timestamps, the author’s name at the time of sending, links to messages for replies, reactions and technical resend keys. Attachments are stored in the database along with the original file name, type and size. A file may contain original metadata, including location information: automatic metadata removal and antivirus scanning have not yet been implemented.
• Created chats: name, description, coordinates, radius, access and communication type, welcome message, owner ID and public chat ID. The name, description and location are available on the map and in the chat card, including for private chats; the private welcome message is not visible to visitors. The QR code contains only the chat’s public URL and is generated in the browser without being sent to a third-party generator.
• Technical logs: IP address, time, address of the requested resource, browser details, response codes and diagnostic messages.
• Emails and enquiries: recipient’s address, the content of the service email and any information you provide to support. On the local server, emails are stored by Mailpit; external delivery is not enabled.

A separate visitor identifier is used for members and subscribers: either a logged-in account or a random guest cookie. The server stores the last time the user was active, membership status and aggregated counters. ‘Online’ means activity on an open page within the last 5 minutes; the act of refreshing the page does not count as activity. The map shows numbers rather than individual participants. For guests, different browsers are counted as different visitors; guest data is not automatically merged with an account.

Subscriptions are activated by your action. Selected chats, events and channels, as well as the history of notifications and delivery attempts, are stored. Accessing an available chat card may generate a visit event; repeat visits are aggregated within a 30-minute window. If you link an email address, the verified address is saved; for Telegram, the personal chat ID with the bot is saved; for push notifications, the browser’s delivery address and subscription keys are saved. Confirming a channel does not in itself activate a subscription. Email and push notifications do not contain the text of the conversation. The following information may be transmitted to a voluntarily connected Telegram bot: the chat name, the author’s name, a snippet of the message available to you (up to 500 characters), a link, and buttons to reply and unsubscribe.

New messages and replies trigger events for active subscriptions. Individual messages may only notify the owner and a participant in the relevant conversation; emails and push notifications contain a general description of the event and a link, without the message text or attachments. In Telegram, previews are only available to recipients authorised to read the relevant conversation; files are not automatically forwarded in Telegram. The current version does not collect payment details.

Notifications about new nearby chats use information available on the map regarding new public and private chats created by other users. They do not reveal the chat history, private greetings or the list of participants; they do not grant membership and do not subscribe you to future messages. Existing chats do not trigger notifications when the setting is enabled or changed; overlapping areas do not result in multiple notifications for a single chat. The coordinates of the device and saved areas are not included in external notifications.

On your first visit, the language is selected from the browser’s language list; a saved manual selection takes precedence. The welcome window only records the fact and the option you selected, without any location data. A request for geolocation permission appears after you press the button. You can continue with a point on the map. If you have separately enabled location access for notifications about new chats and have already granted permission to the browser, the visible page may update the latest position without you having to click again. A hidden or closed page does not track movement; without a connection to the site, the matching function uses the last saved position, which may be out of date. Permission can be revoked in your browser settings; this does not, in itself, delete any previously saved position from the server.

3. Purposes and legal bases

• Creating an account and a chat, logging in, restoring access and carrying out requested actions — performance of a contract or taking steps at your request prior to entering into a contract (Article 6(1)(b) of the GDPR).
• Obtaining the device’s location for the optional ‘Find Nearby’ feature — your consent (Article 6(1)(a)). You may refuse, withdraw permission in your browser, or select a location manually. Browser permission alone does not constitute consent for other purposes.
• Optional delivery of notifications via selected external channels — your consent (Article 6(1)(a)). You can disable a channel or unsubscribe in the subscription settings. Opting out does not prevent you from viewing the map.
• Protection against misuse, diagnostics and security — the operator’s legitimate interest in the reliable operation of the service, whilst respecting your rights (Article 6(1)(f)).
• Compliance with legal requirements and fulfilment of data protection obligations — a legal obligation (Article 6(1)(c)).

A password is required only for your account. Your email address is used for your account or for opt-in email notifications; opting out does not prevent you from viewing the map. We do not use marketing mailings, advertising profiling or decision-making with legal or similarly significant consequences.

4. Recipients and external data

Access to local data is restricted to those administering the test environment. Data is not sold. Disclosure to public authorities is possible where there is an applicable legal basis.

Messages, authors’ names, replies, reactions and attachments in a group chat are accessible to its active participants. In a private chat, they are accessible to the owner and the participant in the relevant conversation. The owner can see the names of applicants for the purpose of reviewing applications. A public profile or subscription does not, in itself, grant access to correspondence. The recipient may save or copy the content available to them; end-to-end encryption is not applied.

Map images are loaded by the browser directly from tile.openstreetmap.org. The OpenStreetMap Foundation and the delivery infrastructure receive the IP address and details of the requested tiles, enabling them to determine the area being viewed. Map requests also occur when a point is selected manually. The tile infrastructure is distributed across various countries; further details can be found in the OpenStreetMap Foundation’s policy. The proxi.zone account email address and password are not shared with the map provider.

Google Analytics, Meta Pixel, Microsoft Clarity, external AI moderation, OAuth and payment providers are not currently integrated here. Before any such integration takes place, the legal basis, contracts and measures for international data transfers will be established, and this notice will be updated. We do not claim that contracts or transfer mechanisms exist that have not yet been formalised.

When Telegram is enabled voluntarily, delivery data is processed by Telegram; for push notifications, it is processed by your browser’s push service provider, such as Google, Mozilla, Apple or Microsoft. The provider receives technical delivery data and the content of the notification; for Telegram, this may include the message preview described above. These providers may process data outside the EEA. Before a public launch, the applicable terms and conditions of the providers and the legal basis for international data transfers must be checked. On the local demo site, emails remain within Mailpit; Telegram only works once a separate bot has been set up, whilst push notifications only work once authorised by the browser.

5. Storage and deletion

Disabling location access in the settings for new chat notifications deletes the device’s last known location from the operational database. Saved areas are deleted separately. A general pause on new chat notifications stops their delivery but retains the configuration, areas and last known location, provided that location access remains enabled. Before sending a pending notification, the server re-checks the current settings and whether they match the last known location or zones; movement may cause a previous match to be invalidated. Changing or deleting settings does not recall notifications that have already been delivered. Clearing cookies and logging out of your account do not delete these settings from the server.

Messages, attachments, reactions, membership and applications are stored on the server; automatic deletion times have not yet been configured. The owner can delete a message in their chat: the text is cleared, attachments and reactions are removed from the database, whilst the ID, author, time and deletion timestamp remain for the history and reply links. Other participants do not have a delete button, not even for their own messages; a request to delete data can be sent to the administrator. Deleting a message does not remove past notification events, previously delivered notifications or copies held by recipients. Changing a username does not alter the author’s name in messages that have already been sent.

An account is retained until it is deleted. On the local server, deletion and data export are carried out by an administrator upon request; there is currently no dedicated delete button. A guest session lasts up to 2 hours, an account session up to 7 days; email verification lasts 24 hours, and a password reset link lasts 1 hour. Logging out terminates the current session; resetting the password terminates all sessions for that account.

The guest ID cookie remains valid for up to one year. The email verification code for notifications is valid for 20 minutes, whilst the Telegram linking link is valid for 15 minutes. Unsubscribing stops future deliveries for that subscription, but does not automatically delete the verified contact or past events from the database. To have data deleted, please contact the administrator; the timeframes for the automatic deletion of this data still need to be configured before the public launch. Push notifications can also be disabled in your browser.

Expiry does not equate to the physical deletion of a database record: automatic deletion of expired records has not yet been implemented. Test data, emails and logs are deleted during system maintenance; Mailpit is limited to 500 emails. A fixed schedule for clearing logs and backups has not yet been set. Specific deletion times and procedures, including data from incomplete registrations, will be introduced and published prior to the public launch.

6. Your rights

Where applicable, you may request access to, rectification of, erasure of, restriction of processing, data portability, object to processing on the grounds of legitimate interest, and withdraw your consent. Withdrawal does not affect the lawfulness of prior processing. Please email info@proxi.zone; we may request reasonable proof of identity. Do not send your password. A response is usually provided within one month; in the event of a legally permissible extension, we will inform you of the reasons and the timeframe.

You may contact the Bulgarian Commission for Personal Data Protection (CPDP) or the competent authority in your country of habitual residence, place of work or where the alleged infringement occurred. Until the proxi.zone email system is set up, testers may contact the stand administrator directly.

7. Security, Age and Changes

Password and token hashing, attempt limits, session validation and CSRF protection are in place. The local instance is accessible only via HTTP loopback; HTTPS is required prior to publication. End-to-end message encryption is not claimed. In the event of an incident, the operator will assess the obligations to notify the relevant authority and affected individuals under the GDPR.

The service is intended for users aged 18 and over, as is QRChat. If you believe that a child’s data has been provided to the service, please contact us. Significant changes to the policy will be accompanied by a notification; new optional purposes requiring consent will not be included automatically.

Telegram bot

The bot’s commands and buttons are only available in a private chat after connecting via a one-time link from the website. One Telegram private chat is linked to one proxi.zone account or guest profile; establishing a new connection will disconnect the previous link. We use your Telegram ID, interface language, event settings and the temporal context of the reply or chat creation. The location draft contains the coordinates you have sent; this is not necessarily your actual location. Drafts remain active for 10 minutes, buttons for up to 24 hours; expired entries are cleared by the running processor. Replies from Telegram are saved as standard proxi.zone messages. IDs of processed updates are stored to prevent duplication; full incoming updates are not saved. The contents of the outbound queue are deleted after a delivery attempt or cancellation; unsent entries older than one day are cancelled by the handler. The /stop command suspends Telegram notifications, whilst /unlink disables the link. This does not delete messages already delivered in Telegram, proxi.zone messages or records on the server; for enquiries regarding data deletion, please contact info@proxi.zone. Telegram processes messages, commands and shared locations in accordance with its own rules.