govno.world Privacy Policy
π Not legal advice. Operator details filled in; review by qualified counsel (Republic of Kazakhstan + GDPR/EU) is still required before publication. Canonical URL: https://govno.world/en/legal/privacy-policy
Version: 0.2 Β· Date: 09.09.2026
β οΈ Still to be completed: EU representative (GDPR Art. 27) and the person responsible for personal data β the Operator details have been filled in.
App: Grumzo (App Store / Google Play, bundle identifier app.grumzo) Β· Service: govno.world Β· Operator: SOWITA LLP (Republic of Kazakhstan).
1. Who processes your data (Operator / controller)
Operator (controller of personal data): SOWITA LLP, BIN 231040004646, registered address: 7 Pavlodarskaya Street, Zhetysu District, Almaty 050016, Republic of Kazakhstan (the "Operator", "we").
- Data-related enquiries: [email protected]
- Person responsible for personal data: Aleksandr Aleksandrovich Babiichuk, Director β [email protected]
- EU representative (GDPR Art. 27):
[name, EU address]β appointed because we offer the Service to users in the EU and monitor their behaviour.
Applicable law: Republic of Kazakhstan (the Personal Data Protection Law of the Republic of Kazakhstan); for users in the EU/EEA, additionally β GDPR (Regulation (EU) 2016/679). Where these conflict, the stricter protection applies.
2. What data we process
| Category | Data | Source |
|---|---|---|
| Account | email (stored as an HMAC hash + encrypted; never stored in plaintext), username, password hash (argon2id) | you, at registration |
| Content (UGC) | posts and comments (β€365 characters), reactions, complaints. Photos and files are not accepted β the Service is text-only | you |
| Pseudonymous identity | internal author_id (for moderation/appeals/legal purposes), anonymity flag | system |
| Device/technical | push token (APNs/FCM), platform/version, language, IP address, diagnostics/logs | device |
| Donations | the Service has no purchases and no subscriptions. A donation is made on an external page at a payment processor; card and payment data never reach the app or our servers | payment processor |
| Moderation | auto-moderation verdicts and scores, texts for calibration (including rejected ones), security events | system |
| Language and translations | the detected language of a post and a machine translation of its text into another language (stored alongside the original) | system |
| Place tag | the place name you type into a complaint. We do not determine your location: neither GPS nor IP-based geolocation is used | you |
We do not intentionally collect special categories of data, but UGC may contain them β you are responsible for what you publish.
3. Purposes and legal bases (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Creating/operating the account, providing the Service | performance of a contract (Art. 6(1)(b)) |
| Email verification | performance of a contract / legitimate interest |
| Content moderation, anti-abuse, security | legitimate interest (Art. 6(1)(f)) + legal obligation (CSAM, Art. 6(1)(c)) |
| Mandatory CSAM reporting (NCMEC and others) | legal obligation / public interest |
| Machine translation of posts (so a complaint reaches speakers of another language) | legitimate interest (Art. 6(1)(f)) β making the feed readable in the reader's language |
| Push notifications | consent / performance of a contract |
| Processing a donation | handled by the payment processor on its own legal basis; we receive no personal data about donors |
| Marketing communications (if any) | consent (Art. 6(1)(a)), withdrawable at any time |
4. Automated decision-making and profiling (GDPR Art. 22)
Content undergoes automated moderation (an AI classifier, see Β§5 β provider OpenAI) and may be automatically blocked/hidden before publication. This is an automated decision that affects you. Your rights: to obtain human intervention, to express your point of view, and to contest the decision β via an in-app appeal or [email protected]. Serious/ repeated violations may lead to account suspension (with a right of appeal).
The text of a published post is additionally put through machine translation by the same provider (see Β§5). That is automated processing, but not a decision producing legal effects under Art. 22: it neither restricts your access to the Service nor affects your account status. The translation is shown next to the original, and the original always remains available.
5. Who we share data with (processors/recipients)
We do not sell personal data. We engage processors under contract (DPA):
| Recipient | Purpose | Where | Safeguards |
|---|---|---|---|
| OpenAI (OpenAI Ireland Ltd) | two purposes: (1) automated text moderation (Moderation API); (2) machine translation of post text (Chat Completions API) | USA | DPA; content is not used for training; for /v1/moderations, retention for abuse-monitoring = none; transfer under SCC |
| Apple | push notification delivery (APNs) | global | Apple's terms |
| push notification delivery (FCM) β once the Android version ships | global | Google's terms | |
Mailgun (Sinch, EU region api.eu.mailgun.net) | transactional email: address verification, password reset | EU | DPA; receives the email address and the message body |
| Cloudflare | reverse proxy and protection in front of our server: TLS, filtering, real client IP | global (edge) | DPA; processes the IP address and request metadata |
| Hosting β our own server rented from PS Internet Company | hosting the application, database and file storage | Republic of Kazakhstan, Almaty | contract with the provider; data does not leave our server |
| Law enforcement authorities / NCMEC | for CSAM and lawful requests | β | as required by law |
Web analytics. The govno.world website carries no third-party counters and no advertising trackers. We are preparing our own analytics (self-hosted Umami on our own domain, cookieless and without personal data), but as of this version it is not deployed and collects nothing about visits. This Policy will be updated before any counter appears on the pages.
6. International transfers
Primary storage is on our server in the Republic of Kazakhstan (Almaty). Data may be transferred outside Kazakhstan and the EEA: to the USA β post and comment text for moderation and translation (OpenAI); to the EU β the email address for sending mail (Mailgun); globally β the IP address and request metadata through Cloudflare's network, and push tokens through Apple APNs. Such transfers are subject to appropriate safeguards: the EU Standard Contractual Clauses (SCC) and/or adequacy decisions; for Kazakhstan β the requirements of legislation on cross-border transfers. A copy of the safeguards can be requested at: [email protected].
β οΈ Personal data localisation (Kazakhstan). The Personal Data Protection Law of the Republic of Kazakhstan imposes requirements on storing the personal data of Kazakhstani citizens within the territory of Kazakhstan. This requires review by Kazakhstani counsel and may affect database placement β a flag for infrastructure (see
docs/vps-requirements.md). We will update the Policy accordingly.
7. Retention periods
- Account and content β while the account is active; upon deletion β deleted (see Β§9), except for data that must be retained by law.
- Auto-moderation logs β limited (reference point β up to 90 days for calibration), then deleted/anonymised.
- CSAM cases β retained for as long as the law requires (including the preservation period, see
csae-runbook.md). - Technical logs β kept for a short period for security/diagnostics.
8. Your rights
Under GDPR (and similarly under Kazakhstani law) you have the right to: access, rectification, erasure ("right to be forgotten"), restriction of processing, portability, objection to processing based on legitimate interest, withdrawal of consent, and not to be subject to solely automated decisions (Β§4). To exercise them β in the app or via [email protected] (we will respond within the statutory time limits). You have the right to lodge a complaint with a supervisory authority: in Kazakhstan β [the authorised personal data protection authority]; in the EU β the supervisory authority of your country.
9. Account and data deletion
You can delete your account and associated data in the app (Settings β Delete Account) or via https://govno.world/legal/account-deletion. For details, see Account Deletion. Some data may be retained where required by law (for example, CSAM cases).
10. Children
The Service is intended for persons 18+ and is not intended for children. We do not knowingly collect children's data. We have zero tolerance for child sexual exploitation material (see the CSAE Standard).
11. Security
Email is stored as an HMAC hash and encrypted (we do not store it in plaintext); passwords use argon2id; access to data follows the principle of least privilege; transmission is over TLS. No absolute guarantee of security on the internet is possible.
12. Changes
We may update this Policy; we will notify you of material changes in the app and/or by email. The date of the last change is shown at the top.
13. Contacts
Data-related questions and requests: [email protected]. Support: [email protected]. Operator details β see Β§1.