Last updated 17 October 2026
Privacy Notice
This notice explains what personal data we collect when you use Quadmegle, why we collect it, how long we keep it, who we share it with, and the rights you have. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and, for people in the European Economic Area, the EU General Data Protection Regulation (EU GDPR).
1. Who is responsible for your data
The data controller is Tropical Hosting Ltd, a company registered in England and Wales (company number 17519779), registered office 182-184 High Street North, Office 21743, East Ham, London, E6 2JA, United Kingdom. Tropical Hosting Ltd operates Quadmegle.
To ask about this notice or use your rights, email [email protected] with "Quadmegle privacy" in the subject line, or write to the address above. Please do not post personal information or report details in our public Discord.
2. The short version
- You do not need an account, and we do not ask for your name, email address or phone number.
- In video rooms, your browser sends audio and video to Quadmegle's media server, which forwards it to the other people in your room. The WebRTC connection to that server is encrypted. We do not routinely record or review the forwarded stream. Separately, while you are in a video room, we hold about the last 30 seconds of your own camera and microphone in memory for safety reports; we keep it only if someone reports you.
- We use your IP address and a few necessary cookies to run the service, stop bots, and enforce bans.
- We do not sell your data, we do not use it for advertising, and we do not use facial recognition.
3. What we collect, why, and our legal basis
Data protection law requires us to have a lawful basis for each use of your data. Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for details of that assessment.
Connection and technical data
What: your IP address, browser and device information, the time of your connection, temporary session and room identifiers, and the WebRTC signalling (network addresses and connection details) needed to connect you to other participants.
Why: to provide the service, match you into rooms, forward live media through our media server, keep the service secure, and stop people who have been banned from coming back.
Legal basis: performance of our contract with you (our Terms of Service), and our legitimate interests in running a secure service.
Your chats
What: your video, audio and text messages, and any interests you enter for matching.
Why: to deliver live conversations. Video and audio pass through our media server, which forwards each stream to the other participants. The browser-to-server WebRTC connections are encrypted, but this is not end-to-end encryption between participants. We do not routinely record or review the forwarded stream. Text messages and interests pass through our server to reach your room. We do not keep them once the room ends unless you are reported.
Legal basis: performance of our contract with you.
The 30-second safety buffer
What: while you are in a video room with other people, your browser sends a copy of your own camera and microphone to our server. We hold only about the most recent 30 seconds in memory and constantly overwrite it. If nobody reports you, it is deleted within a few minutes of your session ending, and nobody looks at it.
Why: conversations between strangers happen live and disappear, so without this we would have no reliable evidence of serious abuse such as sexual exploitation, threats or harassment. You are told about this, and asked to confirm it, before you join a video room.
Legal basis: our legitimate interests, and those of other users, in preventing and investigating abuse; and our legal duties under the UK Online Safety Act 2023 and the EU Digital Services Act to protect users from illegal content.
Safety reports and moderation
What: when someone reports a participant, we store the reason, any description the reporter writes, the room details, the date and time, the IP addresses and visitor identifiers of the reporter and the reported person, and the reported person's saved video clip (up to about 30 seconds) or text messages. We also keep records of moderation decisions and bans.
Why: to investigate reports, decide on and enforce action, handle appeals, and report serious crime to the authorities.
Legal basis: our legitimate interests in keeping the service safe; compliance with legal obligations (including the Online Safety Act 2023, the Digital Services Act, and reporting child sexual abuse material); and, in an emergency, protecting someone's vital interests.
Sensitive information
Video can reveal things about you such as your ethnicity, religion or health, and reports may relate to suspected crimes. We do not try to analyse or infer any of this. We use video only as described above and do not process it to identify you biometrically. Where a report involves sensitive or criminal-offence information, we rely on the conditions in the Data Protection Act 2018 for preventing or detecting unlawful acts, protecting the public, and safeguarding.
Anti-bot and anti-VPN checks
What: when you use some features, such as submitting a report, Cloudflare Turnstile checks that you are not a bot. When you connect, we look up which network your IP address belongs to so we can spot VPNs, proxies and hosting networks, which are often used to get around bans. We cache the result for 30 days.
Why: to prevent spam, automated abuse and ban evasion.
Legal basis: our legitimate interests in protecting the service and its users.
If the network check flags your connection, you may not be able to join until you turn off your VPN or proxy. This is an automated check, but it does not have a legal or similarly significant effect on you. If you think it has got it wrong, email us and a person will look at it.
Usage statistics
What: we use Umami, a privacy-focused analytics tool that does not use cookies, to count page views and see things like which pages are visited and which country or device type visits come from. It does not store your IP address or build a profile of you.
Legal basis: our legitimate interests in understanding how the site is used so we can improve it.
Contacting us
If you email us, we use your email address and what you send us to reply, handle complaints and appeals, and keep a record of what happened. Legal basis: our legitimate interests, and our legal obligations where your message is a data-protection, Online Safety Act or Digital Services Act request.
4. Cookies and browser storage
We use only cookies and storage that are strictly necessary to provide the service you ask for or to keep it secure, so we do not need your consent for them. We do not use advertising or tracking cookies.
- quadmegle_uid: a random, signed visitor identifier so we can recognise your browser across reconnects and enforce moderation decisions. It lasts 1 year.
- quadmegle_ban: set only if you are banned, to enforce the ban. It lasts until the ban is lifted, up to a maximum of 10 years.
- quadmegle_admin: used only for signed-in moderators. It lasts 8 hours.
- quadmegle-theme (local storage): remembers whether you chose light or dark mode until you clear it.
- Cloudflare Turnstile may set or read data needed to tell humans from bots. See Cloudflare's privacy policy.
5. Who we share data with
- Other participants in your room receive your video, audio, messages and the network details needed to connect to you. They can see you, so be careful what you show and say.
- Our moderators see reports and the evidence attached to them.
- Service providers who process data for us under contract: our server hosting and network providers in the United Kingdom and the United States; Cloudflare, Inc. (bot protection); Umami Software, Inc. (cookieless analytics); and Amazon Web Services (email delivery and DNS). Network lookups are sent to Team Cymru's IP-to-ASN service, which receives the IP address being checked.
- Police, regulators and child-protection bodies, such as the UK National Crime Agency, Ofcom, or law enforcement in another country, where the law requires it, to report child sexual abuse material, or where it is needed to prevent serious harm or a crime that threatens someone's life or safety.
- Professional advisers, such as lawyers, and anyone we need to share with to establish, exercise or defend legal claims.
- A buyer or successor, if the service or our company is sold or reorganised. They would have to use your data in line with this notice.
We do not sell or rent your personal data.
6. International transfers
We are based in the United Kingdom and our media server is in London. Our separate TURN relay servers may route network traffic through the United States when a browser cannot connect directly to the media server. Some of our providers are based in, or process data in, the United States. Other participants in your room may be anywhere in the world.
When we transfer personal data outside the UK or EEA to a provider, we make sure it is protected, for example by relying on UK or EU adequacy decisions (including the UK–US Data Bridge and EU–US Data Privacy Framework where the provider is certified), or on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses. Contact us if you want a copy of these safeguards. Sending your video and messages to other participants is part of the service you ask for, so it is necessary to perform our contract with you.
7. How long we keep data
- Safety buffer: overwritten continuously and deleted within a few minutes of your session ending, unless you are reported.
- Live room data (session identifiers, signalling, text messages in transit): deleted within a few minutes of the session ending.
- Reports and evidence clips: up to 90 days, then deleted automatically.
- Bans, IP blocks and moderation tags: for as long as the ban or restriction is in force, and removed when it is lifted.
- VPN network lookups: cached for 30 days.
- Server logs (IP address, time, page requested): 14 days.
- Emails with us: up to 2 years after the matter is closed.
We may keep particular data for longer if it is needed to investigate serious abuse, if the police or a court ask us to keep it, or if we need it for a legal claim. We keep it only as long as that need lasts.
8. Your rights
You have the right to:
- access the personal data we hold about you and get a copy of it;
- ask us to correct data that is wrong or incomplete;
- ask us to erase your data;
- ask us to restrict how we use your data;
- object to us using your data on the basis of legitimate interests;
- data portability: receive data you gave us in a commonly used format, where we use it under our contract with you; and
- ask for a person to review any decision made about you by automated means.
These rights have limits. For example, we may refuse to delete a report or evidence while it is needed to investigate abuse or to meet a legal obligation, and we cannot give you another person's data. Because Quadmegle has no accounts, we may need details to find your data, such as the date and time you used the service, your IP address at the time, or your visitor identifier, and we may need to check that the data is really yours. We will respond within one month. In some cases the law lets us extend this by up to two more months, and we will tell you if so. Using your rights is free.
9. Complaints
If you have concerns about how we use your data, please contact us first so we can try to put things right. You also have the right to complain to a data protection regulator:
- in the UK, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, phone 0303 123 1113;
- in the EEA, the data protection authority in the country where you live or work, or where you think a breach happened. A list is available from the European Data Protection Board.
10. Age
Quadmegle is only for people aged 18 and over. We do not knowingly collect data from children. If we learn a user is under 18, we will remove them and delete their data unless we need to keep it to protect them or others, for example in a report. If you believe a child is using Quadmegle, contact us.
11. Security
We protect your data with encrypted connections (HTTPS and encrypted WebRTC media), restricted access to moderation tools, strong passwords for moderator accounts, file permissions that limit who can read report evidence, and automatic deletion as set out above. No system is completely secure. If a breach puts your rights at high risk, we will tell you and the regulator where the law requires it.
12. Changes to this notice
We will update this notice if how we use data changes. The date at the top shows the latest version. If we make an important change, we will show a notice on the website.