Updated: October 16, 2026
Effective: October 16, 2026

1. Getting Started

This Privacy Policy explains what personal information Cactusian collects, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. We have tried to write it in plain language. If something is unclear, please contact us using the details in Section 13.

By using our services you acknowledge that your information will be handled as described in this policy. Where the law requires your consent for a specific use (for example, certain analytics cookies), we will ask for it separately.

Defining Words & Phrases

"Cactusian", "We", "Us", "Our" refers to Cactusian, the operator of the services and the party responsible (the "controller") for your personal information.
"Services" refers to the websites operated under the cactusian.com domain and its subdomains, the Cactusian mobile applications, and any other product or feature that links to this policy.
"Account" refers to a registered Cactusian account.
"Personal Information" refers to any information that identifies you or could reasonably be linked to you.
"Terms of Service" refers to the Cactusian Terms of Service.
"Community Guidelines" refers to the Cactusian Community Guidelines.

Where this Privacy Policy applies

This policy applies to the Services. It does not apply to websites, apps or services operated by other companies, even if you reach them through a link on Cactusian or connect them to your Account (for example Discord, Roblox, X or Epic Games). Those companies have their own privacy policies, and we encourage you to read them.

2. Children

The Services are not intended for children under the age of 13, and we do not knowingly collect personal information from children under 13. In some countries a higher minimum age applies (see the Terms of Service); in those countries the Services are not intended for anyone under that age.

We ask for your date of birth when you sign up so we can confirm you meet the minimum age. To help protect younger users, Chat only lets you message people you are friends with on Cactusian (see Section 5). If we learn that we have collected personal information from a child under the minimum age, we will delete the Account and the associated information. If you believe a child has provided us with personal information, please contact us at privacy@cactusian.com.

3. Information we Collect

Information you provide to us

Account information: when you sign up we collect your email address, your username, your profile name and your date of birth. You can change your email address and date of birth later in your settings; to change your email address, we send a one-time code to confirm the change. We do not use passwords; instead you log in with a one-time code we send to your email address, or with a passkey.
Passkeys: if you add a passkey, your device or password manager creates it and keeps its private part; it never leaves your device and we never receive your fingerprint, face or device PIN. We store the passkey's public key and credential ID, the name you give it, technical details your device shares about it (such as the type of authenticator and whether it is backed up), and when it was created and last used.
Profile information: you can choose to add a profile picture, an "about me" text, a location, a region and a featured song. Your username, profile name, profile picture, about me text, location, featured song and join date are shown on your public profile.
Social connections: the users you add as friends, the friend requests you send and receive, the users you follow and the users who follow you.
Settings and preferences: such as your privacy preferences and your language.
Messages and Chat: when you use Chat, we collect and store the messages you send, including text, photos, videos, voice messages, files, songs, reactions, replies and edits, together with information about them such as when they were sent, their size and type, and the dimensions or length of photos, videos and recordings. We also store the conversations and groups you are in, group names and pictures, who added or removed members, and how far you have read in each conversation. While you type, we briefly record that you are typing so the other members can see it.
Reports: if you report another user, we collect the reason you selected and any note you wrote.
Communications: if you contact us, we collect the content of your message and your contact details so we can reply.

Information from connected accounts

You can choose to connect accounts you hold on other platforms to your Cactusian Account. Currently these are Roblox, Discord, X and Epic Games. When you connect an account, that platform shares information with us according to the permissions you approve on its authorization screen. This typically includes your account identifier, username, display name and avatar, and may include other basic profile information. We store an access credential (a "token") so the connection keeps working, and a temporary copy of your public profile details from that platform so we can display them, including on your public profile unless you choose to hide them. You can disconnect an account at any time in your settings, and you can also remove our access from the other platform's own settings.

Information collected automatically

IP address and approximate location: when you use the Services, your device sends us its IP address. We use it, together with location information provided by our network provider and an IP geolocation service, to estimate your country, region and city. We do not collect your precise (GPS) location.
Device and browser information: such as your device type, device model, operating system, browser and app version, which we read from the information your browser or app sends.
Session and security records: when you log in we record the date, IP address, approximate location and device for that session, so that you can see where your Account is signed in (in the Active Sessions part of your Security settings, where you can also log sessions out) and so we can detect suspicious activity. We also keep counts of recent actions, such as messages sent and files uploaded, to enforce limits that protect the Services from spam and abuse.
Usage information: such as the pages you visit, the features you use, how you arrived at the Services and how long you stay. Some of this is collected through cookies and similar technologies (see Section 9).

Information from other sources

We may receive information about you from other users (for example, when someone reports your Account) and from service providers that help us protect the Services (for example, our CAPTCHA provider telling us whether a request looks automated).

Payments

We do not currently sell anything through the Services. If we introduce paid features in the future, payments will be handled by third-party payment processors and we will update this policy before doing so. We will not store your full card number.

4. How we Use your Information

We only use personal information where we have a valid reason (a "legal basis") to do so. The main purposes, and the legal bases we rely on under laws such as the EU and UK General Data Protection Regulation (GDPR), are:

To provide the Services and your Account — creating and maintaining your Account, logging you in with a login code or passkey, displaying your profile, showing your friends and followers, connecting your external accounts, and storing and delivering your messages to the people in your conversations. Legal basis: performance of our contract with you (the Terms of Service).
To verify your age — checking that you meet the minimum age to use the Services. Legal basis: legal obligation and legitimate interests (keeping children safe).
To keep the Services and our community safe — preventing spam, fraud and abuse (including by limiting how many messages and files can be sent), protecting Accounts, reviewing reports, enforcing our Terms of Service and Community Guidelines, and taking action against users who break them. We do not routinely read your messages, but we may review messages and files when they are reported to us, when we need to investigate a safety, security or legal concern, or when the law requires it. Legal basis: legitimate interests (keeping our users and the Services safe) and, where applicable, legal obligation.
To communicate with you — sending login codes, security alerts and important notices about your Account or changes to our policies, and replying when you contact us. Legal basis: performance of contract and legitimate interests.
To understand and improve the Services — measuring which features are used and fixing problems. Legal basis: legitimate interests and, where required by law, your consent (for analytics cookies).
To comply with the law — responding to valid legal requests, keeping records we are required to keep, and establishing, exercising or defending legal claims. Legal basis: legal obligation and legitimate interests.

Where we rely on legitimate interests, we have balanced those interests against your rights. You can object to this processing (see Section 10). Where we rely on consent, you can withdraw it at any time, without affecting processing that already took place.

We do not use the content of your messages for advertising or to build profiles about you. We do not sell your personal information, we do not use it for targeted (cross-context behavioral) advertising, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

5. What Other Users Can See

Cactusian is a social platform, so some information is visible to others:

Your public profile (username, profile name, profile picture, join date and user ID) can be seen by anyone, including people who are not logged in. Your about me, location and featured song are also shown to everyone by default, but you can limit them to your followers and friends, to your friends only, or to just you, using the "Profile Details Visibility" setting in your privacy settings.
Your friends list, the people following you and the people you follow, and the number of each, are shown on your profile.
Your connected accounts (such as your username or display name on Roblox, Discord, X or Epic Games) are shown on your public profile by default. You can hide each connection at any time using the "Show on Profile" option in your connection settings.

In Chat

Only the members of a conversation can see its messages. A direct conversation is between you and one friend; a group can have up to 10 members. Anyone added to a group later only sees the messages sent after they joined. If you and a friend stop being friends, neither of you can send new messages in your direct conversation, but its history stays.
The other members of a conversation can see your username, profile name and profile picture, the messages, reactions and replies you send, when you sent them, whether a message was edited or deleted, how far you have read, and when you are typing.
In a group, members can also see who is in the group, the group's name and picture, and notices such as who added or removed someone, who left and who changed the group's details.
Photos, videos, voice messages and files you send are stored on our content delivery network under long, hard-to-guess links. Anyone who has the link to a file can open it until it is deleted, so members of a conversation could share a file outside of Cactusian.
People you message can copy, screenshot or forward what you send them. Deleting a message removes it from the Services, but not any copies they have already made.

You can change most of the information on your profile in your settings at any time. Please think carefully before sharing personal information, such as your real name or exact location, in public parts of your profile. Other users may copy or share information you make public, and we cannot control what they do with it.

6. Information we Share

We share personal information only in the situations described below.

With service providers

We use trusted companies to help us run the Services. They may only use your information to provide their services to us, and must protect it. They currently include:

Cloudflare, Inc. — hosting, databases, file storage (including profile pictures), content delivery, network security and approximate location from IP address.
Vercel Inc. — website hosting.
Amazon Web Services, Inc. — sending emails (such as login codes).
Google LLC — website analytics (Google Analytics).
Intuitive Machines (hCaptcha) — CAPTCHA and bot protection on sign up, login and reports.
Free IP API (freeipapi.com) — estimating your country and region from your IP address when you sign up. If an estimate isn't available, your region is set to the United States, and you can change it in your settings at any time.
Discord Inc. — delivering user reports to our moderation team.

With platforms you choose to use

Connected accounts: when you connect Roblox, Discord, X or Epic Games, we exchange information with that platform so the connection works.
Songs: if you add a featured song to your profile or send a song in Chat, the song is loaded from Apple Music in an embedded player, and Apple may receive information about the people who view your profile or the conversation (such as their IP address). Searching for a song sends your search terms to Apple's iTunes Search service.

For legal reasons and to protect people

We may share information if we believe in good faith that it is necessary to: comply with a law, regulation, court order or other legal process; respond to lawful requests from public authorities, including to meet national security or law enforcement requirements; protect the safety of any person or prevent serious harm, fraud or crime; protect the security of the Services; or enforce our Terms of Service and protect our rights.

In a business transfer

If Cactusian is involved in a merger, acquisition, reorganization, sale of assets or similar transaction, personal information may be transferred as part of that transaction. We will make sure the receiving party is bound to respect your personal information in line with this policy, and we will notify you where the law requires it.

Aggregated or de-identified information

We may share information that has been aggregated or de-identified so that it can no longer reasonably be used to identify you, for example overall user statistics.

7. International Transfers

Cactusian is based in the United States, and our service providers may process information in the United States and other countries. These countries may have data protection laws that differ from those in your country. When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to other countries, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and their UK and Swiss equivalents) or the recipient's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, where applicable. You can contact us for more information about these safeguards.

8. How Long we Keep your Information

We keep personal information only for as long as we need it for the purposes described in this policy:

Account and profile information is kept for as long as your Account exists. When you delete your Account, we delete or de-identify this information within 30 days, except for information we need to keep as described below. Messages you sent in conversations with others may remain visible to the other members, shown as sent by a "Deleted Account" without your username, profile name or profile picture, unless you delete them before deleting your Account.
Friend and follow relationships are deleted when you remove them, or when either Account is deleted.
Connected account data is deleted when you disconnect the account or delete your Cactusian Account.
Login codes, email change codes and pending sign-ups expire after 15 minutes and are deleted once they have been used or have expired.
Passkeys are kept until you remove them in your Security settings or your Account is deleted.
Messages are kept until you delete them, or until we remove them (for example, because they break our rules). When you delete a message, its text and any photo, video, voice message or file are removed from our systems, and the other members see that a message was deleted. When you edit a message, we only keep the new text. If you leave a group or are removed from it, the messages you sent stay in the group for its other members.
Typing indicators last only a few seconds, and records used to limit sending are deleted once their time window has passed (at most one day).
Session records (including IP address, approximate location and device) are kept while the session is active and are deleted when you log out of that session or when your Account is deleted.
Reports and moderation records may be kept for up to 2 years after the case is closed, or longer if needed to prevent repeated abuse or to comply with the law.
Analytics data is kept by Google Analytics according to the retention settings we configure, which is no longer than 14 months.

We may keep certain information for longer where we are legally required to, or where it is needed to establish, exercise or defend legal claims.

9. Cookies and Similar Technologies

We use cookies and similar technologies (such as your browser's local storage) for the following purposes:

Strictly necessary: keeping you logged in and secure (the "CACTUSIAN_ACCOUNT_SECURITY" cookie and our session cookie), remembering your language (the "CACTUSIAN_LANGUAGE" cookie) and storing copies of recently viewed profiles, your conversations, your most recent messages, your active sessions and your passkey list on your device so pages load faster. The copies of your own account's information are removed from the device when you log out. These are needed for the Services to work and cannot be turned off. Login and language cookies last up to 12 months.
Mobile apps: the Cactusian iOS app does not use cookies to keep you logged in. Instead, it stores your login credentials in your device's secure Keychain and keeps a copy of your account details on your device so the app can open while you are offline. These are removed when you log out.
Security: hCaptcha may set cookies or read device information to tell people and bots apart.
Analytics: Google Analytics sets cookies (such as "_ga") that help us understand how the Services are used. Where the law requires your consent for analytics cookies, we will only use them after you have given it.

You can block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the Services (such as logging in) will not work. You can also opt out of Google Analytics using Google's browser add-on at tools.google.com/dlpage/gaoptout. Our Services do not currently respond to "Do Not Track" browser signals, but we do honor the Global Privacy Control (GPC) signal as an opt-out of any sale or sharing of personal information, where applicable law requires it.

10. Your Rights and Choices

Choices available to everyone

Access and update: you can view and change most of your account and profile information in your settings.
Connections: you can choose whether each connected account is shown on your profile, and you can disconnect external accounts in your settings at any time.
Profile details: you can choose who can see your about me, location and featured song.
Messages: you can edit or delete messages you have sent, leave groups at any time, and only people you are friends with can start a conversation with you or add you to a group.
Security: you can see your active sessions and log them out, and add, rename or remove passkeys, in your Security settings.
Account deletion: you can ask us to delete your Account by emailing privacy@cactusian.com from the email address on your Account.
Copy of your data: you can ask us for a copy of the personal information we hold about you.
Emails: we only send emails that are needed to operate your Account (such as login codes and security alerts). If we ever send marketing emails, you will be able to unsubscribe from them at any time.

Additional rights depending on where you live

Depending on where you live, the law may give you some or all of the following rights:

To know what personal information we hold about you and how we use it, and to receive a copy of it.
To correct inaccurate personal information.
To delete your personal information.
To receive your personal information in a portable format and to have it transferred to another company (portability).
To object to, or ask us to restrict, certain processing, including processing based on our legitimate interests.
To withdraw your consent at any time, where we rely on consent.
To opt out of the sale or sharing of personal information, or of targeted advertising. (We do not sell or share personal information for these purposes.)
To not be discriminated against for exercising your rights.
To appeal our decision if we decline to act on your request.
To complain to your local data protection authority. If you are in the EEA or UK, you can find your supervisory authority on the website of the European Data Protection Board or the UK Information Commissioner's Office. In Brazil, you can contact the Autoridade Nacional de Proteção de Dados (ANPD).

To exercise any of these rights, email us using the details in Section 13. We will respond within the time required by law (usually within one month, or 45 days for residents of U.S. states). To protect your Account, we may need to verify your identity, normally by confirming the request from the email address on your Account. You may use an authorized agent to make a request on your behalf where the law allows it; we may ask the agent for proof that you authorized them. We will not charge you for making a request unless it is clearly unfounded or excessive.

Information for California residents

In the last 12 months we collected the following categories of personal information, as defined by the California Consumer Privacy Act: identifiers (such as your email address, username, IP address and user ID); personal information described in Cal. Civ. Code § 1798.80 (such as your email address); characteristics of protected classifications (your date of birth / age); internet or other electronic network activity (such as usage and device information); approximate geolocation; audio, electronic and visual information (such as the photos, videos and voice messages you send in Chat); and inferences limited to your approximate location. We also collect sensitive personal information in the form of your account login (your email address together with the one-time codes we send you, and your passkeys) and the contents of the messages you send in Chat, which we use only to provide and secure the Services, as permitted by law.

We collect this information from the sources and for the purposes described in Sections 3 and 4, disclose it to the categories of recipients described in Section 6, and keep it for the periods described in Section 8. We have not sold or shared (for cross-context behavioral advertising) personal information in the last 12 months, and we have no actual knowledge of selling or sharing personal information of consumers under 16.

11. Data Security

We use technical and organizational measures designed to protect your personal information, including encryption of data in transit (HTTPS), passwordless logins with one-time codes or passkeys, CAPTCHA protection against automated attacks, limits on how often actions can be repeated, secure cookies, and access controls that limit who can access personal information.

Messages are encrypted in transit between your device and our servers, but they are not end-to-end encrypted, which means they are stored on our systems in a form that we can access when needed for the reasons described in Section 4. Please do not use Chat to share highly sensitive information such as passwords, login codes or financial details.

No system is completely secure, and we cannot guarantee the security of your information. If a security incident affects your personal information, we will notify you and the relevant authorities where the law requires it. You can help protect your Account by keeping your email account secure, using a passkey, logging out sessions you don't recognize, and never sharing your login codes or the "CACTUSIAN_ACCOUNT_SECURITY" cookie with anyone.

12. Changes to this Privacy Policy

We may update this policy from time to time, for example when we add new features or when the law changes. The "Updated" date at the top shows when it was last changed. If we make material changes, we will notify you in advance through the Services or by email. Where the law requires your consent to a change, we will ask for it.

13. Contact

If you have any questions about this policy, or want to exercise your rights, please contact us:

Privacy Contact:

Email: privacy@cactusian.com

Depending on where you live, you can also use the following dedicated contacts:

If your region is not listed, please use the general privacy contact above.

Updated: October 16, 2026
Effective: October 16, 2026

1. Getting Started

Defining Words & Phrases

"Cactusian", "We", "Us", "Our" refers to Cactusian, the operator of the services and the party responsible (the "controller") for your personal information.
"Services" refers to the websites operated under the cactusian.com domain and its subdomains, the Cactusian mobile applications, and any other product or feature that links to this policy.
"Account" refers to a registered Cactusian account.
"Personal Information" refers to any information that identifies you or could reasonably be linked to you.
"Terms of Service" refers to the Cactusian Terms of Service.
"Community Guidelines" refers to the Cactusian Community Guidelines.

Where this Privacy Policy applies

2. Children

3. Information we Collect

Information you provide to us

Account information: when you sign up we collect your email address, your username, your profile name and your date of birth. You can change your email address and date of birth later in your settings; to change your email address, we send a one-time code to confirm the change. We do not use passwords; instead you log in with a one-time code we send to your email address, or with a passkey.
Passkeys: if you add a passkey, your device or password manager creates it and keeps its private part; it never leaves your device and we never receive your fingerprint, face or device PIN. We store the passkey's public key and credential ID, the name you give it, technical details your device shares about it (such as the type of authenticator and whether it is backed up), and when it was created and last used.
Profile information: you can choose to add a profile picture, an "about me" text, a location, a region and a featured song. Your username, profile name, profile picture, about me text, location, featured song and join date are shown on your public profile.
Social connections: the users you add as friends, the friend requests you send and receive, the users you follow and the users who follow you.
Settings and preferences: such as your privacy preferences and your language.
Messages and Chat: when you use Chat, we collect and store the messages you send, including text, photos, videos, voice messages, files, songs, reactions, replies and edits, together with information about them such as when they were sent, their size and type, and the dimensions or length of photos, videos and recordings. We also store the conversations and groups you are in, group names and pictures, who added or removed members, and how far you have read in each conversation. While you type, we briefly record that you are typing so the other members can see it.
Reports: if you report another user, we collect the reason you selected and any note you wrote.
Communications: if you contact us, we collect the content of your message and your contact details so we can reply.

Information from connected accounts

Information collected automatically

IP address and approximate location: when you use the Services, your device sends us its IP address. We use it, together with location information provided by our network provider and an IP geolocation service, to estimate your country, region and city. We do not collect your precise (GPS) location.
Device and browser information: such as your device type, device model, operating system, browser and app version, which we read from the information your browser or app sends.
Session and security records: when you log in we record the date, IP address, approximate location and device for that session, so that you can see where your Account is signed in (in the Active Sessions part of your Security settings, where you can also log sessions out) and so we can detect suspicious activity. We also keep counts of recent actions, such as messages sent and files uploaded, to enforce limits that protect the Services from spam and abuse.
Usage information: such as the pages you visit, the features you use, how you arrived at the Services and how long you stay. Some of this is collected through cookies and similar technologies (see Section 9).

Information from other sources

Payments

4. How we Use your Information

To provide the Services and your Account — creating and maintaining your Account, logging you in with a login code or passkey, displaying your profile, showing your friends and followers, connecting your external accounts, and storing and delivering your messages to the people in your conversations. Legal basis: performance of our contract with you (the Terms of Service).
To verify your age — checking that you meet the minimum age to use the Services. Legal basis: legal obligation and legitimate interests (keeping children safe).
To keep the Services and our community safe — preventing spam, fraud and abuse (including by limiting how many messages and files can be sent), protecting Accounts, reviewing reports, enforcing our Terms of Service and Community Guidelines, and taking action against users who break them. We do not routinely read your messages, but we may review messages and files when they are reported to us, when we need to investigate a safety, security or legal concern, or when the law requires it. Legal basis: legitimate interests (keeping our users and the Services safe) and, where applicable, legal obligation.
To communicate with you — sending login codes, security alerts and important notices about your Account or changes to our policies, and replying when you contact us. Legal basis: performance of contract and legitimate interests.
To understand and improve the Services — measuring which features are used and fixing problems. Legal basis: legitimate interests and, where required by law, your consent (for analytics cookies).
To comply with the law — responding to valid legal requests, keeping records we are required to keep, and establishing, exercising or defending legal claims. Legal basis: legal obligation and legitimate interests.

5. What Other Users Can See

Cactusian is a social platform, so some information is visible to others:

Your public profile (username, profile name, profile picture, join date and user ID) can be seen by anyone, including people who are not logged in. Your about me, location and featured song are also shown to everyone by default, but you can limit them to your followers and friends, to your friends only, or to just you, using the "Profile Details Visibility" setting in your privacy settings.
Your friends list, the people following you and the people you follow, and the number of each, are shown on your profile.
Your connected accounts (such as your username or display name on Roblox, Discord, X or Epic Games) are shown on your public profile by default. You can hide each connection at any time using the "Show on Profile" option in your connection settings.

In Chat

Only the members of a conversation can see its messages. A direct conversation is between you and one friend; a group can have up to 10 members. Anyone added to a group later only sees the messages sent after they joined. If you and a friend stop being friends, neither of you can send new messages in your direct conversation, but its history stays.
The other members of a conversation can see your username, profile name and profile picture, the messages, reactions and replies you send, when you sent them, whether a message was edited or deleted, how far you have read, and when you are typing.
In a group, members can also see who is in the group, the group's name and picture, and notices such as who added or removed someone, who left and who changed the group's details.
Photos, videos, voice messages and files you send are stored on our content delivery network under long, hard-to-guess links. Anyone who has the link to a file can open it until it is deleted, so members of a conversation could share a file outside of Cactusian.
People you message can copy, screenshot or forward what you send them. Deleting a message removes it from the Services, but not any copies they have already made.

6. Information we Share

We share personal information only in the situations described below.

With service providers

We use trusted companies to help us run the Services. They may only use your information to provide their services to us, and must protect it. They currently include:

Cloudflare, Inc. — hosting, databases, file storage (including profile pictures), content delivery, network security and approximate location from IP address.
Vercel Inc. — website hosting.
Amazon Web Services, Inc. — sending emails (such as login codes).
Google LLC — website analytics (Google Analytics).
Intuitive Machines (hCaptcha) — CAPTCHA and bot protection on sign up, login and reports.
Free IP API (freeipapi.com) — estimating your country and region from your IP address when you sign up. If an estimate isn't available, your region is set to the United States, and you can change it in your settings at any time.
Discord Inc. — delivering user reports to our moderation team.

With platforms you choose to use

Connected accounts: when you connect Roblox, Discord, X or Epic Games, we exchange information with that platform so the connection works.
Songs: if you add a featured song to your profile or send a song in Chat, the song is loaded from Apple Music in an embedded player, and Apple may receive information about the people who view your profile or the conversation (such as their IP address). Searching for a song sends your search terms to Apple's iTunes Search service.

For legal reasons and to protect people

In a business transfer

Aggregated or de-identified information

We may share information that has been aggregated or de-identified so that it can no longer reasonably be used to identify you, for example overall user statistics.

7. International Transfers

8. How Long we Keep your Information

We keep personal information only for as long as we need it for the purposes described in this policy:

Account and profile information is kept for as long as your Account exists. When you delete your Account, we delete or de-identify this information within 30 days, except for information we need to keep as described below. Messages you sent in conversations with others may remain visible to the other members, shown as sent by a "Deleted Account" without your username, profile name or profile picture, unless you delete them before deleting your Account.
Friend and follow relationships are deleted when you remove them, or when either Account is deleted.
Connected account data is deleted when you disconnect the account or delete your Cactusian Account.
Login codes, email change codes and pending sign-ups expire after 15 minutes and are deleted once they have been used or have expired.
Passkeys are kept until you remove them in your Security settings or your Account is deleted.
Messages are kept until you delete them, or until we remove them (for example, because they break our rules). When you delete a message, its text and any photo, video, voice message or file are removed from our systems, and the other members see that a message was deleted. When you edit a message, we only keep the new text. If you leave a group or are removed from it, the messages you sent stay in the group for its other members.
Typing indicators last only a few seconds, and records used to limit sending are deleted once their time window has passed (at most one day).
Session records (including IP address, approximate location and device) are kept while the session is active and are deleted when you log out of that session or when your Account is deleted.
Reports and moderation records may be kept for up to 2 years after the case is closed, or longer if needed to prevent repeated abuse or to comply with the law.
Analytics data is kept by Google Analytics according to the retention settings we configure, which is no longer than 14 months.

We may keep certain information for longer where we are legally required to, or where it is needed to establish, exercise or defend legal claims.

9. Cookies and Similar Technologies

We use cookies and similar technologies (such as your browser's local storage) for the following purposes:

Strictly necessary: keeping you logged in and secure (the "CACTUSIAN_ACCOUNT_SECURITY" cookie and our session cookie), remembering your language (the "CACTUSIAN_LANGUAGE" cookie) and storing copies of recently viewed profiles, your conversations, your most recent messages, your active sessions and your passkey list on your device so pages load faster. The copies of your own account's information are removed from the device when you log out. These are needed for the Services to work and cannot be turned off. Login and language cookies last up to 12 months.
Mobile apps: the Cactusian iOS app does not use cookies to keep you logged in. Instead, it stores your login credentials in your device's secure Keychain and keeps a copy of your account details on your device so the app can open while you are offline. These are removed when you log out.
Security: hCaptcha may set cookies or read device information to tell people and bots apart.
Analytics: Google Analytics sets cookies (such as "_ga") that help us understand how the Services are used. Where the law requires your consent for analytics cookies, we will only use them after you have given it.

10. Your Rights and Choices

Choices available to everyone

Access and update: you can view and change most of your account and profile information in your settings.
Connections: you can choose whether each connected account is shown on your profile, and you can disconnect external accounts in your settings at any time.
Profile details: you can choose who can see your about me, location and featured song.
Messages: you can edit or delete messages you have sent, leave groups at any time, and only people you are friends with can start a conversation with you or add you to a group.
Security: you can see your active sessions and log them out, and add, rename or remove passkeys, in your Security settings.
Account deletion: you can ask us to delete your Account by emailing privacy@cactusian.com from the email address on your Account.
Copy of your data: you can ask us for a copy of the personal information we hold about you.
Emails: we only send emails that are needed to operate your Account (such as login codes and security alerts). If we ever send marketing emails, you will be able to unsubscribe from them at any time.

Additional rights depending on where you live

Depending on where you live, the law may give you some or all of the following rights:

To know what personal information we hold about you and how we use it, and to receive a copy of it.
To correct inaccurate personal information.
To delete your personal information.
To receive your personal information in a portable format and to have it transferred to another company (portability).
To object to, or ask us to restrict, certain processing, including processing based on our legitimate interests.
To withdraw your consent at any time, where we rely on consent.
To opt out of the sale or sharing of personal information, or of targeted advertising. (We do not sell or share personal information for these purposes.)
To not be discriminated against for exercising your rights.
To appeal our decision if we decline to act on your request.
To complain to your local data protection authority. If you are in the EEA or UK, you can find your supervisory authority on the website of the European Data Protection Board or the UK Information Commissioner's Office. In Brazil, you can contact the Autoridade Nacional de Proteção de Dados (ANPD).

Information for California residents

11. Data Security

12. Changes to this Privacy Policy

13. Contact

If you have any questions about this policy, or want to exercise your rights, please contact us:

Privacy Contact:

Email: privacy@cactusian.com

Depending on where you live, you can also use the following dedicated contacts:

Residents of California and other U.S. states:

Email: privacy.california@cactusian.com

Residents of the EEA, Switzerland and UK:

Email: privacy.europe@cactusian.com

Residents of Brazil:

Email: privacy.brazil@cactusian.com

If your region is not listed, please use the general privacy contact above.

Page Title

Page Title

1. Getting Started

Defining Words & Phrases

Where this Privacy Policy applies

2. Children

3. Information we Collect

Information you provide to us

Information from connected accounts

Information collected automatically

Information from other sources

Payments

4. How we Use your Information

5. What Other Users Can See

In Chat

6. Information we Share

With service providers

With platforms you choose to use

For legal reasons and to protect people

In a business transfer

Aggregated or de-identified information

7. International Transfers

8. How Long we Keep your Information

9. Cookies and Similar Technologies

10. Your Rights and Choices

Choices available to everyone

Additional rights depending on where you live

Information for California residents

11. Data Security

12. Changes to this Privacy Policy

13. Contact

Privacy Contact:

Residents of California and other U.S. states:

Residents of the EEA, Switzerland and UK:

Residents of Brazil:

1. Getting Started

Defining Words & Phrases

Where this Privacy Policy applies

2. Children

3. Information we Collect

Information you provide to us

Information from connected accounts

Information collected automatically

Information from other sources

Payments

4. How we Use your Information

5. What Other Users Can See

In Chat

6. Information we Share

With service providers

With platforms you choose to use

For legal reasons and to protect people

In a business transfer

Aggregated or de-identified information

7. International Transfers

8. How Long we Keep your Information

9. Cookies and Similar Technologies

10. Your Rights and Choices

Choices available to everyone

Additional rights depending on where you live

Information for California residents

11. Data Security

12. Changes to this Privacy Policy

13. Contact

Privacy Contact:

Residents of California and other U.S. states:

Residents of the EEA, Switzerland and UK:

Residents of Brazil: