hahaboo, a private company at Kathmandu, Bagmati Province, Nepal, is the data controller for personal data processed through hahaboo. This policy covers our website, applications and related services.
It does not cover third-party websites you reach through links posted on the Service. Those sites have their own policies.
Summary
- We collect the account details you give us, the content you post, and technical data about how you use the Service.
- We use it to run the Service, keep it safe, and improve it.
- We do not sell your personal data, and we do not run advertising.
- You can access, correct, export and delete your data from Settings or by writing to us.
Data you give us
| Category | Examples |
|---|---|
| Account data | Email address, username, display name, hashed password, date you joined. |
| Profile data | Avatar, cover image, biography, location text, website link, privacy preferences. |
| Content | Posts, reels, stories, captions, comments, reactions, saved items, and any media you upload. |
| Communications | Direct messages, group conversations, reports you submit, and emails you send us. |
| Support data | Anything you tell us when you contact support or appeal an enforcement decision. |
Data we collect automatically
| Category | Examples |
|---|---|
| Device and session data | Browser and operating system parsed from your user agent, the raw user-agent string, and your IP address at the time of sign-in. |
| Usage data | Which content you view, react to, comment on or save; view counts on reels; time of last activity. |
| Security data | Sign-in attempts, rate-limit events, and records of enforcement actions on your account. |
Data we receive from others
- Reports about you submitted by other users.
- Content posted by other users in which you appear or are mentioned.
- Information from our processors that is necessary to deliver the Service, such as a delivery failure from our email provider.
We do not knowingly collect special-category data such as health, religious belief, political opinion or biometric data. If you choose to publish such information in your content, you are making it public yourself and you are responsible for that decision.
Where the UK GDPR or EU GDPR applies to you, we rely on the following legal bases.
| Purpose | Legal basis |
|---|---|
| Creating and maintaining your account, and delivering the features you use | Performance of a contract with you |
| Sending verification and password-reset codes | Performance of a contract with you |
| Showing your content to the audience you chose | Performance of a contract with you |
| Preventing fraud, abuse and unauthorised access; enforcing our Terms | Our legitimate interest in a safe service |
| Ranking and recommending content, and measuring which features are used | Our legitimate interest in improving the service |
| Responding to reports and moderating content | Legitimate interest, and compliance with a legal obligation |
| Responding to legal requests and retaining records where required | Compliance with a legal obligation |
| Optional activity emails, where enabled | Your consent, which you can withdraw at any time |
Where we rely on legitimate interests, we have assessed that our interest does not override your rights and freedoms. You can object to that processing at any time using the contact details below.
- We do not run advertising on the Service, and we do not share personal data with advertising networks or data brokers.
- We do not sell personal data, and we have not sold or shared personal data in the past twelve months as those terms are defined by California law.
- We rank content using signals such as recency, reactions, comments and shares. This ranking does not produce legal effects or similarly significant effects on you.
- Enforcement decisions that restrict or remove an account are reviewed by a person before they are final, and you can appeal them.
We are based in Nepal, and our processors may store or process data in other countries. Where we transfer personal data out of the UK or European Economic Area, we rely on an adequacy decision where one exists, or on Standard Contractual Clauses together with any additional safeguards the transfer requires.
You can request a copy of the safeguards we rely on by writing to privacy@hahaboo.com.
| Data | Retention period |
|---|---|
| Account and profile data | While your account is open, then deleted 30 days after you request deletion. |
| Posts, reels and comments | Until you delete them, or 30 days after account deletion. |
| Stories | Deleted automatically 24 hours after posting. |
| Direct messages | Until deleted by all participants, or 30 days after account deletion. Other participants keep their copy. |
| Verification and reset codes | 30 minutes. |
| Session and device records | Until you revoke the device, or the session expires after 30 days. |
| Moderation records and reports | Up to 2 years, so we can apply our repeat-infringer policy consistently. |
| Backups | Rolling backups are overwritten within 35 days. |
We keep data for longer only where we must, for example to comply with a legal obligation, to establish or defend a legal claim, or to enforce a ban on an account we have terminated.
Depending on where you live, you have some or all of the following rights over your personal data.
| Right | How to use it |
|---|---|
| Access a copy of your data | Settings, or write to privacy@hahaboo.com. |
| Correct inaccurate data | Settings, Profile. |
| Delete your account and data | Settings, Delete account. A 30-day grace period applies. |
| Export your data | Write to privacy@hahaboo.com and we will provide a machine-readable copy. |
| Object to or restrict processing | Write to privacy@hahaboo.com explaining what you object to. |
| Withdraw consent | Turn off activity emails in Settings, Privacy. |
| Complain to a regulator | You may complain to your local data protection authority at any time. |
- We respond to rights requests within 30 days. Complex requests may take up to 60 days, and we will tell you if that applies.
- We may ask you to verify your identity before we act on a request, to make sure we are not disclosing your data to someone else.
- We will not discriminate against you for exercising any of these rights.
California residents
If you live in California, you have the right to know what personal information we collect, use and disclose; the right to delete it; the right to correct it; and the right not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA, so there is nothing to opt out of.
The Service is not directed at children under 13, and we do not knowingly collect personal data from them. In the EEA and the UK, the minimum age is 16 unless a parent or guardian consents.
If you believe a child has provided us with personal data, write to privacy@hahaboo.com and we will delete the account and its data promptly.
- Passwords are hashed with scrypt and a unique salt. They are never stored in a form anyone can read, including us.
- Sessions are held in an HttpOnly, SameSite cookie that page scripts cannot read, and every signed-in device can be revoked individually.
- Traffic is served over HTTPS with HSTS, and we set clickjacking, MIME-sniffing and referrer protections on every response.
- Sign-in, signup, password reset and other sensitive endpoints are rate limited.
- Access to production data is limited to the people who need it to operate the Service.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant regulator where the law requires it, normally within 72 hours of becoming aware.
We update this policy when our practices change or when the law requires it. The "last updated" date at the top of the page always reflects the current version.
For material changes we will notify you by email or through an in-product notice at least 30 days before the change takes effect, so you have time to review it or delete your account.
For any privacy question, or to exercise a right, write to privacy@hahaboo.com or to hahaboo, Kathmandu, Bagmati Province, Nepal.
If you are not satisfied with our response, you have the right to complain to the data protection authority in your country of residence.