Privacy Policy

1. Introduction

Welcome to Lagoon. We respect your privacy and are committed to protecting your personal data. This privacy policy will inform you about how we look after your personal data when you visit our website and use our services, and tell you about your privacy rights and how the law protects you.

2. Data We Collect

We may collect, use, store and transfer different kinds of personal data about you:

For Registered Users (Optional)

Creating an account is optional. You can use Lagoon as a guest without registration. If you choose to create an account, we collect:

• Technical Data: Browser type and device information
• Username: your chosen display name
• Email Address: for account management and authentication
• Avatar: profile picture you upload
• TOTP Code: time-based one-time password generated server-side for passwordless authentication

Note: We use a passwordless authentication system. Your account is secured exclusively with TOTP (time-based one-time passwords), providing enhanced security without the need to remember passwords.

For All Users (Including Guests)

• Usage Data: Information about how you use our website and services
• Communication Data: Audio/video data during sessions (transmitted in real-time only, never stored)
• Temporary Logs: IP addresses may appear in server logs for security purposes, but these logs are automatically cleared periodically and IPs are not permanently stored

3. How We Use Your Data

We will only use your personal data when the law allows us to. Most commonly, we use it to:

• Provide and maintain our services
• Manage your account and registration (for registered users)
• Authenticate users securely with passwordless TOTP authentication
• Enable real-time communication features
• Display your username and avatar in rooms (for registered users)
• Improve and optimize our website and services
• Communicate with you about updates and changes (via email for registered users)
• Ensure security and prevent fraud

Guest Mode: If you use Lagoon without an account, we only process the minimum technical data necessary to provide the service.

4. Data Sharing

We do not sell your personal data. We may share your data with service providers who assist us in operating our website and services, subject to strict confidentiality obligations.

5. Data Security

We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way. Audio and video streams are encrypted during transmission using WebRTC (via Mediasoup) and are never recorded or stored on our servers. All communications are transmitted in real-time only through our server infrastructure, which routes the streams between participants without storing them.

IP Address Privacy: We do not permanently store IP addresses. They may temporarily appear in server logs for security and debugging purposes, but these logs are automatically cleared on a regular basis.

6. Data Retention

We retain your personal data according to the following policies:

• Registered Accounts: Your account data (username, email, avatar, TOTP code) is retained indefinitely until you delete your account
• Browser Information: For logged-in users, we store your browser type to optimize your experience
• Guest Usage: Technical data is retained only for the duration of your session
• Communication Data: Audio, video, and messages are transmitted in real-time only and are never stored or recorded
• Server Logs: Temporary server logs containing IP addresses are retained only for security purposes and are automatically cleared periodically. We do not permanently store IP addresses

You can request deletion of your account and all associated data at any time through your account settings or by contacting us at contact@under-scape.com.

7. Your Legal Rights

Under GDPR and other data protection laws, you have the following rights:

• Right to access: Request a copy of your personal data stored in your account
• Right to rectification: Update your username, email, or avatar through account settings
• Right to erasure ("Right to be forgotten"): Delete your account and all associated data at any time
• Right to restrict processing: Request limitation on use of your data
• Right to data portability: Request an export of your account data
• Right to object: Object to processing of your data
• Right to withdraw consent: Delete your account or stop using the service at any time

To exercise any of these rights, please contact us at contact@under-scape.com or use the account management features in your settings.

8. Cookies

Lagoon uses minimal cookies to provide essential functionality. We use cookies for:

• Authentication: Session cookies to keep you logged in (registered users only)
• Preferences: Remembering your language and display settings
• Security: Preventing unauthorized access and fraud

We do NOT use: Analytics cookies, advertising cookies, or third-party tracking cookies. Your browsing activity is not monitored or shared with third parties.

You can manage cookies through your browser settings. Note that blocking essential cookies may prevent certain features from working properly.

9. Third-Party Links

Our website may include links to third-party websites. We are not responsible for the privacy practices of these external sites.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date.

11. Contact Us

If you have any questions about this privacy policy or our privacy practices, please contact us at:

Email: contact@under-scape.com

Project: Lagoon by UnderScape