Privacy Notice
We collect the minimum: the name and avatar you pick, your voice during games, the packs you make and, if you sign in with Discord or Google, your account id there. No ads, no profiling, no selling data. You can download or delete everything from Settings.
Bu belgeler İtalyanca ve İngilizce yazılmıştır: burada İngilizce sürümü görüyorsun. İkisi arasında fark olursa İtalyanca sürüm esas alınır.
1. Controller
Dub With Your Friends ("the site" or "the service"), at https://dubwfriends.com, is run by Matteo Campo, Via Valle Ponzema 23/3, Campo Ligure, GE. In these documents "we" means the operator and the site's admins acting on its behalf.
Single point of contact for users and authorities (including under Articles 11 and 12 of Regulation (EU) 2022/2065, the "DSA"): [email protected]. You can write to us in English or Italian.
Under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") this notice explains what data we process, where it comes from, why, and your rights. We have not appointed a Data Protection Officer, as one isn't required for a service of this size: for any request write to [email protected].
2. What data we process and where it comes from
As a guest: the name and avatar you pick and a random id. We don't create a profile in our database: they travel in a signed cookie in your browser, and the server keeps them in memory while you are in a room. If you play with someone who has an account, your name, avatar, recordings and votes stay in the replay of that game (see "Your voice").
If you sign in with Discord or Google: when you sign in, the service you choose gives us your account id there, your display name (for Google your full name, which only you and the admins see) and the address of your profile picture. We never receive your email or password and we don't keep sign-in tokens. Your profile's starting name is the one you use on Discord or your first name on Google: it's public, and you can change it whenever you like. We then keep the name and avatar you use in the game, when you joined and last visited, game statistics, badges, the packs you make, replays of games you play, notifications, your interface language, the history of any bans, and proof you accepted the Terms (version, date and language).
Your public profile: for accounts we show everyone the name, avatar, badges, join date, statistics, published packs and objectives, with a preview image when someone shares the link. The profile is listed on the Community page, where it can be searched by name, and search engines may index it.
Friends: if you add friends we keep your list of friendships and requests, when they started and how many rounds you played together (with the Golden Mics won). Anyone with an account can search for you by name and send you a request, unless you turned requests off. While you have the game open your friends see whether you're online, in a lobby or playing, and when they last saw you: you can hide it on the Friends page. Invites and parties aren't stored: they only live in the server's memory.
Your voice: during a game the lines you record are sent to the server and played to the other players in the room (and, if the host turned audience mode on, to spectators with the code). If at least one player in the round has an account, the game is saved as a replay with the recordings it uses, guests' included, and kept for up to 7 days (up to 30 if a player saves it to their profile or shares its link) before it's deleted; otherwise the recordings are deleted when the round ends. We don't derive voiceprints or other biometric data from your voice and we don't use it to train AI systems.
Packs you make: the video, images and texts you upload, the review outcome and your statement that you hold the rights, with its date. When a pack is approved our servers separate each scene's voice from its music. The automatic scene analysis you can use in the Pack Creator, instead, runs only in your browser: the audio isn't sent to us or anyone else.
Technical and security data: your IP address is used on the spot, in memory, to limit abuse (for example too many requests or rooms from one network); on your first visit the country Cloudflare derives from it is used only to pick the language, and isn't kept. For accounts we keep a keyed hash of the networks and browsers used lately, plus a random browser id stored in a cookie: they are only used to enforce bans. The hashes can't be turned back into addresses without the key, but they are still personal data. Cloudflare's anti-bot checks look at technical signals from your browser (see "Who sees your data").
Reports: if you report content we process what you write and, if you give them, your name and email, to handle the report and tell you the outcome.
"How did you find us?": when you make an account we ask you, once and optionally, where you heard about the game (friends, Google, TikTok, Instagram… or in your own words). The answer stays on your account and we only look at the totals, to learn where to let more people know about the game. You can skip the question, and change or remove your answer whenever you like in Settings → Account.
Activity log and statistics: to run the service and keep it safe, for 90 days we keep a log of what happens on the site, seen only by admins: sign-ups and sign-ins (with which service), rooms opened and closed, rounds played (naming the players who have an account; guests are only counted), packs sent to review or published, reports received. We also keep daily statistics that name nobody, such as how many people were online and how many rooms and rounds there were. While you have the site open, the page tells the server once a minute that you are still there: the server counts who is online (account, guest or just visiting) in its memory only and keeps only the totals, not who you are. The same totals also count, once a day per person, the kind of device, the browser and the system (from your browser), its language, the country of the network you connect from (when the site runs behind Cloudflare, which reports it) and which parts of the site you open and for how many minutes: none of this is stored with you or your account. If you arrive through one of our campaign links (with "utm_source" or "ref" in the address) we count the visit under the campaign's name, with no cookie and without keeping your IP address.
Visit statistics (our own, no cookies): to learn which channels bring people who go on to play (a Discord post, a Reddit thread, a friend's invite…), every page you open sends our own server a short note: the page's address (without its parameters, with room codes and share links hidden) and its language; on arrival, also the campaign of the link you followed (the "utm_…" tags, which then leave the address bar) and the domain of the site you came from, never its full address. A note also goes when you do something in the game: create or join a room, open it to everyone, wait alone for someone to come, start, finish or leave a round, record, vote, share, export a clip, make a pack, or when the browser refuses the microphone; when you sign up or link another service, our server writes the note (only which service). These notes never carry your name, your account or any identifier. To tell one visitor's pages from another's on the same day, the server computes a code from your IP address and your browser's identification together with a random key that changes every day and is deleted when the day ends: the IP address and the browser identification are used for this only and never stored. Of your browser we keep only whether it's a phone, a tablet or a computer and, when the link doesn't say where you came from, whether the page opened inside an app (TikTok, Instagram…); the country only when the provider hosting the site already reports it. To leave out link previews and automated programs, the page also tells us, once, that you actually used it (it stayed on screen a few seconds, or you tapped, scrolled or typed), never what you did. Codes from different days can't be linked to each other, and once the day's key is deleted nobody (us included) can work out whose a code was. These statistics use no cookies, no browser storage and no device "fingerprint"; if your browser sends Do Not Track or Global Privacy Control, we count nothing. If you host a room with an audience and copy its link for viewers, the link carries your in-game name as the campaign's name, so we can count who comes from your stream. Visits and notes are kept for 13 months; after that only daily totals that name nobody remain.
The blog: reading and reactions: when you read a post, the page tells our server that you opened it, how far you got (a quarter, half, three quarters, the end), how long it stayed on screen, where you came from (another page of the site, or the visit's channel, as above) and whether you shared it. On the same terms as the visit statistics (the day's code, never stored; nothing if your browser sends Do Not Track or Global Privacy Control; the team's own reading doesn't count), only daily numbers per post that name nobody remain. If you leave a reaction on a post (heart, fire, laugh, clap, wow), we keep which reactions you left on which post, linked to your account or guest card or, when you have neither yet, to a code made from the device cookie (never the cookie itself): that way each reaction counts once and you can take it back. Others only see how many reactions a post has, never who left them.
3. Why (purposes and legal bases)
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Running the game and your account: rooms, recordings, votes, replays, profile, packs (voice/music separation included), notifications, friends, parties and invites | Performance of the contract (Terms of Service) – (b) |
| Showing your public profile on the Community page and in link previews, and letting search engines index it | Performance of the contract – (b); for indexing, legitimate interest in making the community known – (f) (you can object) |
| Reviewing packs, handling reports, explaining moderation decisions | Legal obligation (DSA Arts. 16 and 17) – (c), and legitimate interest – (f) |
| Security, anti-abuse limits and anti-bot checks; detecting suspicious activity and suspending, banning or deleting the accounts responsible, blocking their network and browser too | Legitimate interest in protecting the service and other players – (f) |
| Keeping proof that the Terms were accepted | Legitimate interest in evidencing the relationship – (f) |
| Making a replay watchable by anyone with the link (at a participant's request) | Contract for whoever shares it; legitimate interest for the other participants' voices, who can object |
| Defending our rights in disputes and answering requests from authorities | Legitimate interest – (f), and legal obligation – (c) |
| Activity log and usage statistics (people online, rooms, rounds), to run, improve and protect the service | Legitimate interest – (f) (the daily statistics name nobody; you can object by writing to us) |
| Reactions on blog posts and the posts' reading numbers (reads, how far, shares), to learn what the community cares about | Legitimate interest – (f) (you leave reactions yourself and can take them back; reading numbers name nobody and count nothing with Do Not Track or Global Privacy Control) |
| Visit statistics: which channels and campaigns bring people who play, with no cookies or identifiers | Legitimate interest in learning how to make the service known – (f) (you can object by turning on Do Not Track or Global Privacy Control in your browser: we then count nothing) |
| Learning how people find the game (the optional "How did you find us?") and which campaigns work, in totals only | Legitimate interest in making the service known – (f); answering is optional and you can remove your answer at any time |
4. Do you have to give us this data?
No law requires you to give us this data, but some of it is needed to use the service: without a name and an avatar you can't join a room, without recording your voice you can't dub, and without signing in with Discord or Google you can't create packs, have a profile or add friends. The microphone is only used while you record, and you can always play as a guest, without an account. Technical and security data is needed for the site to work safely.
5. Who sees your data
Other players in the room (and spectators, if the host turned audience mode on) see your name and avatar and hear your recordings. Everyone can see published packs, account holders' public profiles, the names and avatars of players seated in a public room, and replays a participant chose to share with a link (with the players' voices and names, in the link preview too); profiles may appear in search results.
The site's admins access data when running the service needs it: reviewing packs, reports, moderation, security and support requests. Their actions are logged.
Technical providers hosting the site, the database and the files process data on our behalf as processors (Art. 28 GDPR): Hetzner Online GmbH (database/backups in Germany), OVH Groupe SA (servers in Germany), Cloudflare Inc (worldwide CDN).
Cloudflare (Cloudflare, Inc.) protects the site from bots with Turnstile and, if the site runs through its network, filters its traffic: it processes your IP address and technical signals from your browser on our behalf, without using them to profile you.
Discord and Google handle sign-in as independent controllers, under their own privacy policies. When the site shows your Discord or Google profile picture, your browser loads it from their servers.
The Pack Creator's analysis tools: if you use the automatic scene analysis, your browser downloads the library from jsDelivr (cdn.jsdelivr.net) and the models from Hugging Face (huggingface.co), which see your IP address as with any download. The audio stays on your device.
Authorities, public and judicial, only when the law requires it (for example for serious offences, Art. 18 DSA) or to defend our rights.
We don't sell data, show ads, or use third-party analytics or profiling tools.
6. Transfers outside the European Union
Discord, Google, Cloudflare and the services your browser downloads the analysis tools from are based in the United States or may transfer data there. Transfers rely on the European Commission's adequacy decision for companies certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) or on the standard contractual clauses approved by the Commission (Art. 46 GDPR). To find out which safeguards apply, write to [email protected].
7. How long
| Data | Kept for |
|---|---|
| Guest profile | Only in your browser, while you keep the session cookie (up to 180 days from the last update) |
| Account, statistics, packs, proof of acceptance | Until you delete the account or an admin deletes it |
| Recordings of rounds with no account holders | Deleted when the round ends |
| Replays (with the recordings they use) | Up to 7 days after the game; up to 30 if saved to a profile or shared with a link; deleting an account also removes its recordings from other participants' replays |
| Uploads no pack uses | 24 hours |
| Videos of rejected packs | Deleted on rejection |
| Network and browser hashes (accounts) | Deleted after 90 days without a visit; those blocked by a ban stay while the ban lasts, even if the account is deleted |
| Notifications | 180 days |
| Friendships and rounds played together | Until either of you removes the friendship or deletes the account |
| Unanswered friend requests | 30 days |
| The account's ban history (reason, duration, who decided) | While the account exists |
| Reports | Until they are closed, then 24 months |
| Moderation log | 24 months, even after the account is deleted |
| Closed rooms | 3 days |
| Activity log (sign-ups, sign-ins, rooms, rounds, packs, reports) | 90 days; if the account is deleted its entries go (in rounds played with others it stays as "former player") |
| Your answer to "How did you find us?" | While the account exists, or until you remove it in Settings |
| Who has the site open right now | In the server's memory only, for a few minutes: only the totals stay |
| Daily statistics that name nobody (campaign link visits included) | Up to 2 years |
| Blog posts' reading numbers (daily, naming nobody) | Up to 2 years, or as long as the post exists |
| Reactions on blog posts | Until you take them back, the post is deleted or you delete your account |
| Visit statistics (pages, actions in the game, channel and campaign; daily visitor codes) | 13 months, then only daily totals that name nobody |
| The day's key for visitor codes | Deleted when the day ends (UTC) |
| Published packs of an account deleted by an admin | They may stay published if they follow the rules; we remove them if the author asks |
8. Your rights
You have the right to access your data and get a copy, rectify it, erase it, restrict processing, receive it in a portable format and pass it on and, if you gave consent, withdraw it at any time without affecting processing already done (Arts. 7 and 15–20 GDPR).
Right to object (Art. 21 GDPR): you can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest, for example to your profile being indexed or to your voice being used in replays others share. We stop, unless there are compelling legitimate grounds or we need it to defend a legal claim.
Much of this is self-service in Settings → Privacy & data: Download my data gives you a JSON file with your account data and your activity in the game; Delete my account erases your profile, packs, uploads, recordings, votes, friendships and notifications. You can change your name and avatar whenever you like. For anything else — for example a copy of the reports you sent, or if you played as a guest and want your voice removed from a replay — write to [email protected]: we answer within one month, and we may ask you to confirm from the site that the account is yours.
If you believe the processing breaches the GDPR you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, email [email protected], PEC [email protected], tel. +39 06 696771, www.garanteprivacy.it, or to the authority where you live.
9. Minors
The service is for people aged 14 and over. We don't ask for documents, but if we find out an account belongs to someone younger we close it and delete its data. A parent or guardian can ask us to delete a minor's data at any time by writing to [email protected].
10. Security, suspicious activity and automated decisions
Sessions are signed with secret keys, security hashes use a separate key, admin actions are logged, and connections to the site are encrypted (HTTPS).
To protect the service we detect suspicious activity (for example automated use, several accounts to get around a ban, ad abuse or attempts to break into the site) by combining automatic limits, anti-bot checks and reviews by the admins, as described in the Content Rules.
We make no decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). Automatic anti-abuse limits only block temporarily (from a few minutes to a day); badges and objectives are awarded automatically from game statistics. Suspensions, bans, account deletions and pack rejections are decided by a person. The only automatic effect concerns a ban already decided: if an account banned together with its network comes back from a new network or browser, the block extends to those too.
11. Changes to this notice
The site's admins may update this notice at any time, for example when the site's features, the providers we use or the law change. The version in force is always the one published on this site, with its date at the top of the page: please check back periodically. If we change how we handle your data in an important way — for example new purposes, new kinds of data or new recipients — we tell you on the site before the change applies, and if your consent is needed we ask for it again. The list of versions is on the Legal documents page.