Privacy policy.Plain words, no tricks.

1. Who we are

mysociale.net is the website of Sociale, a community chat room on xat.com (xat.com/Sociale) run by a volunteer staff team born from an Italian community. Sociale is not operated by, or affiliated with, the xat company.

The data controller is mysociale.net. You can reach us for anything about your data through the contact form — choose any topic and write “Privacy” in your message.

In short

• You decide who sees each part of your profile: everyone, members, your followers, your friends or only you. Change it at any time in My account → Privacy.
• Search engines can show your profile only if your profile is public and you turn on “Show my profile on search engines”. Accounts created before 2 October 2026 start with it off.
• Private messages are encrypted and the staff does not read them. Your email and password are never public.
• No ads, no selling of data, no advertising profiles. Servers in the EU.
• You can download all your data or delete your account yourself, in Settings → My data.

2. What data we collect

• Account (only if you register): username, email address, password (stored only as an irreversible argon2id hash — we never see it), and optionally your xat ID, display name, a short bio and a profile picture. We record when you accepted the room rules and this policy, and whether you want event news by email.
• Log in with Google or Discord (if you choose it): your account ID at that service, your email address and public name.
• Sessions: when you log in we store a session with its creation and expiry time, your IP address and browser type, to keep you logged in and spot abuse.
• Log-in history and security: for each log-in attempt to your account we record date, IP address, browser and whether it succeeded, so you can check it in “My account → Login & security” and we can stop attacks. If you turn on two-step verification we store the secret key (encrypted) and your backup codes (only as irreversible hashes).
• Privacy choices, followers and blocks: who can see your profile (public, members only, private), which details you show, the members you follow, who follows you, follow requests and the members you blocked.
• Notifications, Respect, achievements and birthday: the notifications we show you on the site and whether you saw or opened them, so the staff can see how many members read an announcement (they are deleted with your account), the Respect you give and receive (one a day, the count is public on your profile), the achievements you unlock, and — only if you add it — your birthday as day and month (no year), used to show a badge and give you a gift on that day.
• Sociale Coins and shop: your coin balance and the history of coins earned and spent (with the action and date), and your shop orders: draw tickets, looks unlocked, XP packs and prizes, with their status. Draw winners are picked at random by the site; to deliver a prize the staff may use your xat name and ID.
• Profile page (all optional): page theme, motto, mood of the day (shown for 24 hours), the friends you feature, a pinned wall post and your own cover photo (re-encoded without location data and checked by the staff before it is shown). Guestbook: messages other members leave on your profile, with author and date; they are shown only if you approve them, and you can hide them at any time. Profile visits: we count one visit per person per day to show “visits this week”. For logged-in members we store their account; for visitors without an account only an anonymous code of the day (a one-way hash of IP address and browser, which cannot be turned back into them); visits are deleted after 30 days, and you can hide the counter from others.
• Wall, private messages and support: your wall posts (text, an optional photo re-encoded without location data, and who can see each post: everyone, only members, or only friends who follow you back) and your comments on posts are checked before they are shown, in the feed and on your profile: the files are first checked by our antivirus on our own server, then each new post is checked automatically by an AI moderator (Claude, by Anthropic) that approves it or refuses it with a reason, and when it is not sure a member of the staff decides; the staff can always change the decision. For this check we send to Anthropic only the content of the post (the text, the photos, a few still frames of the video and PDF documents), never your name, email or other account data, and we keep the result of the check (decision, reason, a short note) with the post; your profile privacy and blocks always apply too. When you like a post we store it, and the author and the people who can see the post see the number of likes. The author of a post can remove comments from it. Time in the chat: if you have an active Sociale Card and keep the chat open on a page of our site, the page tells our server once a minute that the chat is open and visible (never what you write in the chat); we keep only the number of minutes of the day, for two days, to give the XP of each full hour. Automatic messages: after a purchase, a swap or a gift, the site puts a message in your private messages (signed “Sociale”, or by the friend who sent the gift, with their note). Feed activities: when you take part in a poll, quiz, challenge or activity of the staff we store your answer (and photo, for challenges) and whether you got the reward; poll and quiz results are shown only as totals, approved challenge answers are shown with your name. XP exchanges: if you ask to turn XP into coins or to send XP to another member, we store the request (XP, coins, the platform fee, the other member, your message, the look of a gift you customise — effect, colours, title and an optional photo or GIF re-encoded without location data — and the staff’s decision) and send your xat ID and the XP to MewBots when an admin approves it; the other member sees who sent the gift. Private messages can be exchanged only between members who follow each other; they are stored encrypted and the staff does not read them, unless you report a message: then its text is copied into your support request. Support requests (what you write and the staff’s answers) are visible only to you and to the staff who handle them. All of this is deleted with your account and included in your data download.
• Consents: your choices about emails (events and giveaways, reminders, news from Sociale), with the date and IP address of each change, so we can prove your consent.
• Sociale Card: if you request the card, we store the xat name and ID you give us (checked by the staff) and your request, the actions that earn XP (check-ins, quiz answers, poll votes, comments, events joined or attended, news read, approved ideas, friends invited, XP given by the staff) with date and result, and the rewards you request. Your level, XP and Super Powers are read from MewBots. If you ask to move your XP to a new xat account, we store the request (old and new xat name and ID, your reason, the staff’s decision) and send the two IDs to MewBots, which moves the XP only after an admin approves. Card design (optional): the photo, background image, phrase, back text, colours and font you choose for your card. Images are re-encoded without location data; every design is checked by the staff before it is shown, and the card (with a QR code that opens your public profile) is visible to anyone at mysociale.net/c/your-name, with the same visibility as your profile. You can remove the design at any time; it is deleted with your account and included in your data download.
• Daily missions: your answer to the quiz of the day and your vote in the poll of the day. Poll results are shown only as totals, never with names.
• Comments: the comments you write under news and events, with date and time. They are public, with your username and picture. The staff can hide or delete comments that break the room rules.
• Ideas: the ideas, votes and comments you send on the ideas page. When the staff publishes an idea, its title, text and your username become public on the board; who voted is visible only to the staff.
• Invite a friend: your personal invite code and, if someone signs up with it, which account invited them (to give the XP to the right person). The person who invited you can see your username, whether your profile basics are complete (photo, bio, country, language) and whether they received the XP. To stop fake accounts we compare the IP address used at sign-up with the inviter’s recent log-in addresses; if they match, a staff member checks the invite before any XP is given.
• Profile customisation (all optional): headline, country, languages, interests, links to your social profiles, background, colour, photo frame and the looks you unlock (title, name colour, card design, showcase and favourite event). They are public on your profile, like your badges (calculated from your activity: events, ideas, invites, streak) and, if you leave the option on, your Sociale Card level and tier.
• Events: the events you join with “I’m in!”. Your username and profile picture appear in the event’s public list of participants.
• Contact form: the name and email you enter, the topic and message, your IP address and browser type (to fight spam) and, if you are logged in, your account.
• Public profile: your profile page is at mysociale.net/u/your-username. Your username, display name and picture are always shown, so people can recognise you; everything else follows your privacy choices (see “Your profile: who sees what” below). If you are part of the room staff, your rank is shown too. Your email is never public.
• Your files: photos and images you upload (profile picture, cover, gallery, wall, card design, gifts, studio backgrounds) are re-encoded without location data and kept in a folder that belongs to your account. We record who uploaded each file, when and for which part of the site, so we can delete all of them with your account and the staff can moderate them.
• Technical data: like every website, our servers log requests (IP address, date and time, page, browser) for security and troubleshooting.
• Statistics: only if you allow them in the cookie banner (see the cookie policy).

We do not sell your data, we do not show ads and we do not build advertising profiles.

2a. Your profile: who sees what

First you choose who can open your profile at all:

• Public: anyone, also without an account.
• Members only: only people logged in on mysociale.net.
• Private: people must send a follow request; only those you accept see your full profile.

Then, for each part of your profile, you choose an audience: Everyone, Members, Followers (people who follow you), Friends (you follow each other) or Only me. The parts are: followers and following lists, top friends, wall, photos, guestbook, xat name and ID, social links, country, languages, interests, birthday badge, badges and achievements, Super Powers, activity numbers, events you joined and the last time you were on the site. Separate switches control the green “in the chat now” dot, your Sociale Card and your presence in leaderboards.

Each wall post also keeps the audience you chose when you wrote it; the stricter of the two always wins. Who cannot see your guestbook cannot write in it. Members you block cannot see your profile at all. The staff who moderates (moderators and admins) can see your whole profile, to handle reports and keep the community safe.

2b. Search engines and your profile

You choose if your profile can appear on Google, Bing and other search engines, with the switch “Show my profile on search engines” in My account → Privacy.

• It works only when your profile is public. Members-only and private profiles are never shown to search engines.
• When it is on, your page is listed in our sitemap and carries information that helps search engines understand it (structured data with your name, username, picture, headline and the parts you show to everyone). Parts you limit to members, followers, friends or only you are never included.
• When it is off, your page tells search engines not to show it (“noindex”) and it is removed from our sitemap. Results that were already shown can take from a few days to a few weeks to disappear, depending on the search engine; you can also ask Google to remove an outdated result with its own tools.
• New accounts start with it on; accounts created before 2 October 2026 start with it off, so nobody appears on search engines without having chosen it. The pages with the lists of followers and following are never shown to search engines.
• When someone shares the link of a public profile in a chat or social network, a small preview (name, picture and headline) can be shown, whatever this switch says.

2c. Games, Arena and stickers

• Games of the room (quiz, 2048, match-3, solitaire and the others opened from the chat with !play): the chat bot MewBots gives you a one-time link. When you play on our pages, our server and MewBots exchange your xat ID, the game, your moves needed to check the result, your score and the XP won or lost. The one-time code in the link is removed from our server logs.
• Who is in the chat room: every 30 seconds MewBots tells our server who is in the Sociale room on xat (xat ID, chat name, rank, avatar, when you came in, and whether your account is linked to our site) and when people come in or leave; for members linked to the site also level ups and chat activity (XP of the day and week, days in a row, number of messages and the time of the last one, never their text). Nobody’s messages or IP addresses are ever sent. While you are logged in and use a page of the site, the page tells our server once a minute that you are on the site (kept 2–3 minutes). We use this to show which members are on the site and in the chat at the same time (on the home page only to members who are logged in, and only members whose profile is visible and who allow the “in the chat now” dot; people without an account on the site are never shown) and for statistics seen only by the admins: the number of people every 5 minutes (numbers only), and the visits to the room (xat ID, chat name, rank, time in and out) to count different and new people, how long visits last and the hours of the staff. Room events are kept 48 hours, visits 90 days, and the list of xat IDs seen in the room 180 days after the last time in the chat. Chat widgets (optional, off until you turn them on in Account → Profile → Chat widgets): they show on your profile your xat level, streak, room rank, Super Powers, milestones, the hours you are usually in the chat and a chat passport, each with the audience you choose. For them we keep your XP of each day for 120 days and your level ups and badges for 365 days.
• Wheel of fortune, duels and Sociale Arena: we store the matches (players, date, moves, result, any XP put at stake, the platform fee and the payout). To link your account to MewBots we send your xat ID; before a match with XP at stake we ask MewBots if both players have enough XP, and at the end we tell MewBots who won. Your opponent sees your name, picture and the moves of the match. Challenges arrive as private messages and notifications.
• Mew Pop (sticker collection): we store your stickers, packs, the series you completed and the coins from recycled stickers. To give packs for time spent on the site, while a page is open, visible and you are using it, your browser tells our server about once a minute that you are active; we keep only the number of active seconds of each day and your streak of days, never which pages you read. If you leave the tab or stop using the page, nothing is sent.
• xat powers and gifts: the xat card, the xat powers pages and the profile boxes “My xat powers” and “Gifts on xat” use public xat data from two community services, illuxat.com and xatBlog. Our server sends them only the xat name or ID being looked up, never your Sociale account, and keeps their answers in a cache for up to 7 days. The two boxes appear on your profile only if you turn them on, and only for the people you choose. The xat tools page sends the code, name or ID you type, without your account.
• All of this is deleted with your account and included in your data download. Leaderboards show your name only if “Show me in the leaderboards” is on.

2d. Welcome steps and personalization

• Welcome steps: once, every member answers a few questions: year of birth (day and month only if you want, or if the year alone cannot show that you are 14), country, languages, time zone, what you want to do on Sociale, your interests, your favourite games, the topics you like for questions, how many notifications you want and where. Nothing is filled in for you: you choose every answer.
• Why the year of birth: Sociale is only for people aged 14 or older. If you tell us you are younger, the account is closed straight away. The year is not shown on your profile, and once saved only the staff can change it.
• Personalization: if you say yes, we use what you do on Sociale (games played and won or lost, answers and how fast you give them, reactions, comments, which notifications you open) together with your welcome answers to choose what to show you first, which games and questions to suggest and when to notify you. We never read your private messages or chat texts for this, and we never guess sensitive things such as health, religion, politics or sexual orientation.
• If you say no, the feed shows everything in order of time and we do not build a personal profile for suggestions. You can change your choice at any time; every change is recorded with its date.
• Everything is deleted with your account and included in your data download.

3. Why we use it (legal bases)

4. The xat chat and xat passwords

The chat room on our pages is an embedded widget served by xat.com. When it loads (only with your consent, or when you click “Load the chat room”), xat receives your IP address and browser data and may set its own cookies. What you write in the chat is processed by xat as an independent controller under xat’s own privacy policy and terms (published on xat.com), not by us.

Your mysociale.net account is separate from your xat account. We never ask for your xat password: never use it on mysociale.net or anywhere outside xat.com. The xat ID you may add to your profile is a public number used for giveaways.

5. Who else handles the data

We use a small number of providers that process data on our behalf, under their data-processing terms:

• Hetzner Online GmbH (Germany) — hosts our servers and database in its Helsinki, Finland data centre (EU).
• Cloudflare, Inc. — delivers the site and protects it from attacks (DNS, CDN, firewall, bot protection); every request passes through its network. On the log in, sign-up, comment, event idea and contact forms, Cloudflare Turnstile checks that you are human by looking at technical signals from your browser (no tracking cookies, no ads).
• MewBots (the bot of the Sociale room) — if your Sociale Card is active, or when you play the games of the room, the wheel, duels or the Arena: our server sends it your xat user ID, the XP to credit or put at stake and the results of games, and reads your level, XP and Super Powers.
• Anthropic, PBC (United States) — its AI model Claude checks new wall posts against the room rules (text, photos, still frames of videos and PDF documents of the post, without your name or account data). Under Anthropic’s commercial terms this data is not used to train its models and is kept only for a limited time for safety and legal reasons.
• Google and Discord — only if you choose to log in with them, and Google Analytics / Google Tag Manager only if you allow statistics.

Staff members see account data only as needed to run the community: moderators and editors check wall posts, comments and ideas; admins answer support requests and contact messages. Nobody on the staff reads private messages, except a message you report, which is copied into your support request. We may disclose data to authorities when required by law.

6. Transfers outside the EU

Our servers are in the EU. Cloudflare, Anthropic, Google, Discord and xat may process data in the United States or other countries. Where that happens, transfers rely on the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

7. How long we keep it

• Account and profile: until you delete your account (“My account” → Delete my account), which erases your profile, sessions and event sign-ups immediately. Accounts inactive for 3 years may be deleted.
• Comments, ideas, quiz answers and poll votes: until you delete them or your account (deleting the account deletes them too; approved ideas stay public without your name).
• Log-in history: 12 months, then deleted. Consent records: as long as the account exists and up to 24 months after a consent is withdrawn.
• Sessions: 24 hours, or 30 days with “Remember me”; expired sessions are deleted automatically.
• Contact messages: up to 24 months, then deleted. Support requests: until you delete your account; closed requests are deleted 24 months after the last message.
• Wall posts: until you delete them or your account; posts and comments that were not approved are deleted after 90 days. Private messages: until you or the other person delete the account.
• Active time for sticker packs: the daily count of active seconds is kept for 90 days. Games and Arena matches: until you delete your account.
• Notifications: until you delete your account. Profile visits: 30 days. Guestbook messages: until the owner or the author deletes the account. Announcement statistics for visitors are anonymous totals, with no personal data.
• Server logs: rotated automatically when they reach a fixed size, so older entries are overwritten — at current traffic, after a few weeks to a few months.
• Backups: database backups, stored on our EU server, are kept for up to 6 months, then overwritten; deleted data disappears from them within that time.

8. Security

The site uses HTTPS everywhere, passwords are hashed with argon2id, the database is not reachable from the internet, and access to the servers is restricted to the administrators. No system is perfect: if a breach affecting your data happens, we will inform you and the authority as the GDPR requires.

9. Your rights

Under the GDPR (articles 15–22) you can ask to access your data, correct it, delete it, restrict or object to its use, receive it in a portable format, and withdraw consent at any time (without affecting what happened before). Most of this you can do yourself in Settings (for example “My data” lets you download everything in one file, and “Privacy” lets you change each consent); for everything else use the contact form. We reply within one month.

You can also lodge a complaint with a data protection authority — in Italy the Garante per la protezione dei dati personali, or the authority where you live.

10. Minors

You must be at least 14 years old (or the minimum age for digital consent in your country, if higher) to create an account. If you are younger, ask a parent or guardian. Every member gives the year of birth in the welcome steps: if it shows an age below 14, the account is closed straight away. If we learn in another way that an account belongs to a child below that age, we close it and delete it.

11. Changes

We update this policy when the site changes. The date at the top shows the latest version; if a change is important, we will tell registered users.