Data Protection Statement

Kaleidoscope Writers Community · Last reviewed: April 2026

We built Kaleidoscope on a simple principle: your writing belongs to you. This statement explains what data we collect, why, how long we keep it, and what rights you have over it. We have written it to be read, not to be ignored.

We are governed by Swiss data protection law (DSG) and, where applicable, the European General Data Protection Regulation (GDPR).

What we collect and why

Account information

Your name and email address — to identify your account and communicate with you about it.
A secure record of your password — stored in a form that cannot be reversed. We cannot recover your password.
Your agreement acceptance — a timestamp recording when you accepted our Confidentiality Agreement. This is a legal record.

Encrypted content

Your writing, titles, and any other content you create — stored on our servers in encrypted form. We cannot read this content. No one can without your key.

Invitation records

Who invited you, and who you have invited — to maintain the integrity of our invite-only community and accountability within it.

Session data

Your IP address and browser information — recorded when you sign in, for security purposes only (detecting unauthorised access). Retained for 30 days.

What we do not collect

We do not use analytics services or tracking pixels.
We do not serve advertising.
We do not use third-party services that have access to your data.
We do not sell, share, or license your data to any third party, ever.

Cookies

We use a single, strictly necessary session cookie to keep you signed in. It contains no personal information and is not used for tracking or advertising. No cookie consent banner is required because we use no non-essential cookies.

Where your data is stored

All data is stored on servers hosted in Switzerland by Infomaniak. Swiss law — including the Federal Act on Data Protection (DSG) — provides some of the strongest privacy protections in the world. Your data does not leave Swiss servers.

How long we keep your data

Data	Retention
Account information	Until you delete your account
Encrypted content	Until you delete it, or destroy your key
Agreement acceptance record	Indefinitely (legal record)
Invitation records	Indefinitely (community accountability)
Session data	30 days

When you delete your account, your encryption key is destroyed. Your encrypted content becomes permanently unrecoverable — not archived, not retained. This is by design.

Your rights

You have the right to:

Access the personal data we hold about you
Correct inaccurate personal data
Delete your account and associated data
Object to any processing of your data
Receive a copy of your data in a portable format

To exercise any of these rights, contact us directly. We will respond within 30 days.

Security

Your content is protected by end-to-end encryption — locked on your device before it reaches us. The server stores only ciphertext; it is technically impossible for us to read your writing.

Breach notification

In the event of a data breach affecting your personal information, we will notify you within 72 hours of becoming aware of it, in accordance with our legal obligations.

Contact

Verein für freie Sprache
c/o Markus Leutwyler
Rainstrasse 14
8307 Effretikon
Switzerland

Changes to this statement

We will notify members of any material changes before they take effect. The current version is always available on the platform.

This statement should be reviewed by a qualified legal professional before publication.