Privacy Policy

Squixr Privacy Policy

Last updated: 27 October 2026

This Privacy Policy explains how Antiluna AB processes personal data when you use Squixr, including squixr.com, related domains, apps and services (the "Service"). It should be read together with our Terms of Service.

1. Controller and contact

The controller responsible for your personal data is:

Antiluna AB Company registration number: 559585-5403 Södra Aspövägen 9C, 549 60 Skövde, Sweden Email: hello@antiluna.com

For any question about privacy or to exercise your rights, contact us at hello@antiluna.com.

2. Personal data we process

Account and sign-up data

• Email address, username, display name and sign-in method (email and password, Google or Apple). Passwords are handled by our authentication provider and are never visible to us in plain text.
• Date of birth and the result of our age check, used to confirm that you meet the minimum age.
• Records of the legal documents and versions you accepted, and when.
• Referral code used at sign-up, if any.

Profile data

• Profile picture, bio, status, interests, website, expertise, social media links, gender (optional) and other information you choose to add.
• Privacy and messaging settings, language and other preferences.

Content and communications

• Posts, images, videos, comments, forum topics and replies, Space content, events, stickers, gifts, reactions and other content you create.
• Messages in direct and group chats. Message content is end-to-end encrypted in supported clients, so we cannot read it. We process metadata such as participants, timestamps and delivery status, as well as encryption keys, device identifiers and a cryptographic commitment for each message ("message franking") needed for encrypted messaging. If a participant reports a message, their device sends us that message's content so that we can verify it against the commitment and review it. Other messages in the chat stay encrypted.
• Messages in World Chat and other public rooms, which are not end-to-end encrypted.
• Feedback, reports, appeals and messages you send to us.

Activity and social data

• Who you follow, your friends, friend requests, Spaces you join, create or moderate, blocks and connections.
• Likes, votes, views, saves, shares, searches, games played and scores, badges, XP, levels, login streaks and other interactions.
• Signals used for recommendations and ranking, such as engagement and interests.

Purchases and virtual items

• Gems, Nuggets and other virtual item balances and transactions.
• Purchase records from Stripe, such as order number, session identifier, amount, currency, payment and refund status. We do not receive or store your full card details.

Technical and security data

• IP address, device and browser information, operating system, language, approximate location derived from IP address, and log data such as timestamps, requests and errors.
• Session cookies and authentication tokens, App Check and reCAPTCHA signals used to protect the Service against abuse.
• Rate-limit records, which store a one-way hash of your IP address and account.
• Perceptual fingerprints (hashes) of uploaded images and videos used to detect re-uploads and duplicates.

Safety and moderation data

• Reports about you or your content, moderation decisions, warnings, restrictions, suspensions, bans and related notes.
• Results of automated checks, such as filters and AI-based analysis of content.

AI interactions

• When you mention or interact with the AI agent Zelda, or post content that Zelda responds to, the relevant text, images and context are processed to generate a response.

3. Why we process your data and our legal bases

• To create and manage your account and provide the Service, including publishing your content, delivering messages, running Spaces, games, the economy and AI features. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
• To process purchases, deliver virtual items and keep accounting records. Legal basis: performance of contract and compliance with legal obligations, such as the Swedish Bookkeeping Act (Article 6(1)(b) and (c)).
• To verify age and protect minors. Legal basis: legal obligation and our legitimate interest in keeping the Service safe (Article 6(1)(c) and (f)).
• To keep the Service safe and secure, prevent fraud, spam, abuse and illegal content, moderate content, enforce our Terms, handle reports and appeals, and defend legal claims. Legal basis: legitimate interests and legal obligations, including under the EU Digital Services Act (Article 6(1)(c) and (f)).
• To personalise feeds, rankings, suggestions and recommendations. Legal basis: performance of contract and our legitimate interest in providing relevant content (Article 6(1)(b) and (f)).
• To analyse, maintain, debug and improve the Service. Legal basis: legitimate interests (Article 6(1)(f)).
• To show advertising using third-party advertising cookies, and to use optional error monitoring in your browser. Legal basis: your consent, which you can withdraw at any time (Article 6(1)(a)).
• To communicate with you about the Service, including service messages, security alerts and changes to our terms. Legal basis: performance of contract and legitimate interests (Article 6(1)(b) and (f)).
• To comply with legal obligations and requests from authorities. Legal basis: legal obligation (Article 6(1)(c)).

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can object to such processing at any time (see section 8).

4. Automated processing and AI

• We use automated systems to rank and recommend content, detect spam, abuse and re-uploads, and filter content that may break our rules. Automated decisions can, for example, hide or limit content. You can ask for a human review of a moderation decision by contacting us or appealing the decision.
• We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, other than as necessary to enforce our Terms and keep the Service safe, and in those cases you can request human intervention.
• AI features use models provided by OpenAI. Content sent to OpenAI is processed to generate responses for the Service. Under our agreement and OpenAI's API terms, data sent through the API is not used to train OpenAI's models.

5. Who we share data with

We do not sell your personal data. We share personal data only as described here.

Other users

Your profile, posts, comments and other content are visible to others according to your settings and the settings of the Spaces you use. World Chat and other public content is visible to other users. Your username and basic profile may be visible to everyone.

Service providers (processors)

These providers process data on our behalf under data processing agreements:

• Google (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Firebase App Hosting, App Check and reCAPTCHA Enterprise) for hosting, databases, authentication and security.
• Cloudflare (R2 object storage and content delivery) for storing and delivering images, videos and files.
• OpenAI for AI features.
• Sentry for error monitoring, where enabled and, in your browser, only with your consent.

Independent controllers

• Stripe processes payment and fraud-prevention data as an independent controller under its own privacy policy.
• Google AdSense may set cookies and process data for advertising, only if you have given consent.
• If you sign in with Google or Apple, those providers process data under their own privacy policies, and we receive information from them according to your settings with them.

Authorities and business transfers

• Where required by law, court order or authority request, or where necessary to protect the rights, property or safety of Antiluna, our users or the public, including when reporting illegal content.
• In connection with a merger, acquisition, reorganisation or sale of assets, subject to confidentiality and this Privacy Policy.

6. Where your data is processed

Our main database is located in the EU (Stockholm, Sweden). Some of our providers process data outside the EU/EEA, in particular in the United States (for example application hosting, cloud functions, payment processing, AI processing and content delivery). When personal data is transferred outside the EU/EEA, we ensure an adequate level of protection, by relying on the EU-U.S. Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses together with supplementary measures where needed. You can contact us for more information.

7. How long we keep data

• Account and profile data: for as long as your account exists. When you delete your account, we delete or anonymise your personal data without undue delay, normally within 30 days, subject to the exceptions below.
• Content: until you delete it or your account is deleted. Copies may remain for a limited period in backups and caches.
• Chat messages: messages remain available to the other participants of a conversation after you delete your account, because they form part of those participants' conversation history. Files shared in chat may be deleted automatically after about 7 days.
• Purchase and accounting records: 7 years from the end of the financial year, as required by the Swedish Bookkeeping Act.
• Moderation, ban and safety records: as long as necessary to protect the Service and its users and to prevent banned users from returning, and for no longer than necessary for that purpose.
• Logs and security data: for a limited period, normally no longer than 12 months, unless needed to investigate an incident.
• Data needed to establish, exercise or defend legal claims, or that we must keep by law or authority order: for as long as required.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• restrict our processing;
• receive your data in a portable format;
• object to processing based on legitimate interests, including profiling;
• withdraw consent at any time, without affecting earlier processing;
• not be subject to solely automated decisions with legal or similarly significant effects, as described in section 4.

You can update much of your information in your account settings and delete your account there. To exercise your other rights, email hello@antiluna.com. We may need to verify your identity. We respond within one month, which may be extended in certain cases as permitted by law.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se, or with the supervisory authority in your country of residence.

9. Cookies and local storage

• Strictly necessary: we use a session cookie to keep you signed in, a language cookie (NEXT_LOCALE) to remember your language, local storage to remember your cookie choice and settings, and security technologies such as App Check and reCAPTCHA to protect the Service. These do not require consent.
• Optional: advertising cookies from Google AdSense and browser error monitoring are only activated if you accept them in the cookie banner. You can change your choice at any time through the cookie settings link in the Service.

10. Children

The Service is not intended for anyone under 16. We do not knowingly collect personal data from children under 16. If we learn that we have done so, we will delete the data and the account. If you believe a child under 16 uses the Service, contact us at hello@antiluna.com.

11. Security

We use technical and organisational measures to protect personal data, including encryption in transit, end-to-end encryption of private chat content, access controls, security rules, App Check, rate limiting and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a high risk to you, we will notify you as required by law.

12. Changes to this Privacy Policy

We may update this Privacy Policy. We will publish the updated version with a new date and, for material changes, notify you in the Service or by email.

13. Contact

Antiluna AB, Södra Aspövägen 9C, 549 60 Skövde, Sweden Email: hello@antiluna.com