PLOXX
FRENESDEITNL
← Back to home

Privacy policy

Last updated: 2026-09-24

Who we are

PLOXX (ploxx.tv) is an online random video chat service. We take data protection seriously.

Data controller: Rémi Beaumont, sole trader (entrepreneur individuel, France, SIRET 52095974300037), publisher of PLOXX on the website ploxx.tv and in the PLOXX Android app. This policy covers both. Contact: contact@ploxx.tv

Data we collect

  • Anonymous identifier: a ploxx_uid cookie (32 hex characters) generated on first visit. Used to link your wallet, friends and stats across sessions.
  • Email address (optional): if you give it for your account (sign-in link or code), the waiting list or the Founders program. It is used to sign you in, recover your account and send you reminders. Every reminder has an unsubscribe link.
  • Age bracket: you declare your age, we only keep the bracket (under 15, 15-17, 18 and over), never your date of birth. So that nobody can switch bracket by clearing cookies, we also keep a hashed fingerprint of your device, never its identifier in clear.
  • IP address: our server sees it on every connection. It appears in the web server's technical logs, kept 14 days. For bans and reports, we only keep a hashed version (and a masked one in reports).
  • Nickname: chosen when you arrive (we suggest one), visible to other players, editable anytime.
  • Country: worked out once from your connection (the country given by our network or your browser language, never a precise location). It shows as a flag on your profile.
  • Friend code: auto-generated, used for adding friends.
  • Gameplay data: level, XP, badges, missions, Arena games, match and message stats.
  • Messages: private messages (DMs) between friends are stored on our servers, capped at the latest 500 per conversation. World chat messages are stored and visible to everyone.
  • 1v1 and 2v2 chat messages: never stored. Exception: the latest messages of the conversation (up to 20, from the last 10 minutes) are attached to a report, for moderation.
  • Webcam videos: never stored, sent directly from one device to the other, or through a relay on our server (always for minors, so your IP address stays hidden from the other person). They are encrypted: the relay cannot see them. The video safety check runs on your device. Exception: a screenshot may be sent to moderation upon report.
  • Push notifications (if you turn them on): the subscription address given by your browser or phone.
  • Purchases: GLOW are paid through PayPal on the website or Google Play in the Android app. We never see your bank details. We keep the product, amount, date and transaction reference.
  • Feedback and crashes: if you write to us with « Send feedback », we keep your message, any attached image, your nickname and your friend code, so we can reply. When the app crashes, an anonymous technical report (error message, screen, browser) reaches us, with no identifier, email or IP address.

Our service providers

  • Hosting: OVH, in France (see the legal notice).
  • Emails: sent by our email provider, Brevo.
  • Text moderation: your texts (chat, DMs, world chat, HQ, Duo, bio, status, profile answers and music, game clues, squad motto) always go through an automatic filter on our server. If OpenAI moderation is turned on, they are also sent to OpenAI's moderation API (United States), without your nickname or identifier, only to check that they follow the charter.
  • Payments: PayPal (website) and Google Play (Android app).
  • Push notifications: delivered through your browser's or phone's notification service (for example Google, Mozilla or Apple).
  • Watch together: when you start a YouTube or Twitch video with others, the YouTube (Google) or Twitch player loads in your browser.
  • YouTube Shorts on our pages: a page that features a Short shows its thumbnail, loaded from YouTube's (Google) servers without you clicking; the video only starts when you click. On the /video/… watch pages, the YouTube player (youtube-nocookie.com) loads with the page. In both cases, Google receives your IP address and your browser information.
  • Chat translation: LibreTranslate, installed on our own server. No text is sent to an outside translation service.
  • Audience measurement: Umami, installed on our own server (see Cookies).

Legal basis (GDPR)

  • Contract performance (art. 6.1.b GDPR) for service operation, your account and your purchases.
  • Legitimate interest (art. 6.1.f) for moderation (including automated) and security.
  • Consent (art. 6.1.a) for non-essential cookies.

Retention

  • Wallet, profile, email, age bracket and notification subscriptions: while the account exists. Deleted when you delete your account or on request.
  • Inactive accounts: deleted automatically after 24 months without a connection. Accounts never used (no avatar, nickname, friend, match or purchase): after 90 days.
  • Sign-in links and codes sent by email: 48 hours.
  • Web server technical logs (with IP address): 14 days.
  • Reports (hashed and masked IP, possible screenshot, copy of the reported drawing): 12 months.
  • DMs: latest 500 messages per conversation (auto-rotation).
  • World chat: until the message is deleted (by you or by moderation) or your account is deleted.
  • Arena duels, guessing drawings and cards: 14 days.
  • Drawings entered in the weekly contest: 60 days. A week's winning drawing stays in the hall of fame for as long as its author's account exists.
  • Feedback you send: as long as it takes to handle it; you can ask for its deletion at any time. Crash reports: only the most recent errors are kept.
  • Your purchase records (product, amount, date, transaction reference): kept after the account is deleted, detached from your profile, for the legal accounting retention period (10 years).
  • Hashed device fingerprint and its age bracket: not deleted with the account, to prevent getting around the age check.

Minors

PLOXX is for people aged 15 and over. If you declare you are under 15, matches, friends and private messages are closed to you, and your bracket stays locked. The age bracket is used to apply these rules and the protections designed for minors.

Delete your account

In the app or on the website: open your profile, My profile tab, then at the very bottom Delete my account. If an email address is linked to the account, a confirmation code is sent to it. You can also ask by email at contact@ploxx.tv, giving your friend code.

Deleted right away: your profile, nickname, email, GLOW and Plox, items, progress, friends, private and world chat messages, notification subscriptions and Arena games. Kept: reports (12 months), active bans, purchase records (see above) and the hashed device fingerprint with its age bracket.

Your rights (GDPR)

  • Right to access, rectify, erase, port, object.

To exercise: contact@ploxx.tv

Cookies

  • Essential (always on): ploxx_uid, csrf_token (protects your actions against requests sent without your knowledge, 1 year), ploxx_acct (links a sign-in link or code received by email to your browser while it is valid, 49 hours at most), admin_session, lang, cookie_consent_v1.
  • Origin: ploxx_src remembers where you came from (a search engine, a shared link, an ad…) for 6 hours, to record it on your account if you create one right away. It holds nothing else and is only read by our server.
  • Ad measurement pixels (optional, ONLY with your explicit consent): TikTok pixel and Meta pixel, used to measure our ads (page views, sign-ups). They never load without your consent, and never for an account declared as a minor (15-17, or under 15 and refused): as soon as that is declared, they are switched off and their cookies deleted on your device. To withdraw: clear this site's data in your browser or contact us.
  • Cookieless audience measurement: we measure site traffic with Umami, a tool we self-host in Europe. It sets no cookies and does no cross-site tracking. To link the events of one visit, our server passes it your IP address and browser; Umami turns them into a hashed visit identifier (with a salt changed every month), and we only see aggregated statistics. Under CNIL guidance, this measurement is exempt from consent.

Security

All connections to the website and the app are encrypted (HTTPS). IP addresses kept for moderation are hashed, admin access is restricted and protected, and we sell no data.

Transfers outside the EU

Some providers may process data outside the European Union (notably in the United States), under their own safeguards (for example standard contractual clauses or the EU-US Data Privacy Framework): OpenAI if OpenAI moderation is turned on, PayPal and Google for payments, push notification services, YouTube (videos watched together, Short thumbnails and player on our pages), Twitch when you start one of its videos with others, and TikTok and Meta only if you accept the measurement pixels.

Complaints

You can file a complaint with the CNIL (France) or your country's data protection authority.