Privacy Policy

GOONMASTER is an adult-utility web app: a smart metronome, modular audio overlays, and a bring-your-own-content media player that runs entirely in your browser. We do not host any visual adult content; any video you load stays on your device. This policy explains what we DO collect, why, how long we keep it, and how you can exercise your rights.

Data Controller: Dopateq Kamil Lach (sole proprietorship registered in Poland), NIP 9581765529, REGON 544949243

Mailing address: al. Solidarności 68/121, 00-240 Warszawa, Poland

Privacy / support contact: support@goonmaster.io

If you have privacy questions, want to exercise your rights, or require assistance deleting your account, contact us at the address or email above. We aim to respond to verified requests as required by applicable law (typically within one month).

Note: we have not designated a separate Data Protection Officer (DPO). Use the email above for privacy inquiries.

We collect information that is necessary to operate the service and to keep the platform secure. One thing we can never collect, by design: any media you play. The video player is 100% client-side — files you load (and anything you watch in Companion mode) stay on your device and are never uploaded, stored, scanned, or visible to us.

Lawful Bases for Processing (GDPR Article 6)

For users in the EU/UK, every processing activity rests on one of the following lawful bases:

• Performance of a contract (Art. 6(1)(b)) — account data (email, hashed password via Supabase), gameplay/progress data, and subscription/billing status: all needed to deliver the service you signed up for.
• Legal obligation (Art. 6(1)(c)) — payment transaction records and age-verification records retained for tax, accounting, and regulatory compliance.
• Legitimate interests (Art. 6(1)(f)) — security logs, fraud and abuse prevention, and aggregated, non-identifiable product metrics. We balance these interests against your rights and use the minimum data necessary.
• Consent (Art. 6(1)(a)) — anything optional, such as non-essential communications. Our cookieless analytics (Plausible) relies on legitimate interests rather than consent (see above); any future technology that DID require consent would be gated behind a clear consent mechanism first. Consent, where used, can be withdrawn at any time.

Age Verification

We require users to confirm they are 18+. At present we rely primarily on self-certification with timestamp recording. If we later implement stronger age verification (ID or third-party verification), we will disclose the method and legal basis and provide explicit notice and options to users in affected jurisdictions.

We use data to operate the platform, protect users, and improve the service:

What We Don't Do

• No targeted advertising: We do not engage in ad profiling or behavioral advertising.
• No access to your media: GOONMASTER does not host visual adult content. The media player loads files from your device and plays them in your browser only — we never receive, store, scan, or analyze any media you load.
• No sale of personal data: We do not sell or rent personal information to third parties.

We use a small set of cookies and local storage for essential functionality. Below is a summary.

Depending on where you live, you have certain rights regarding your personal data. Below is a summary of commonly applicable rights and how to exercise them.

Data subject rights (GDPR / UK GDPR)

• Right of access — request a copy of personal data
• Right to rectification — correct inaccurate data
• Right to deletion — request erasure of personal data
• Right to restriction — request limits on processing
• Right to data portability — get your data in a structured format
• Right to object — challenge processing based on legitimate interests
• Right to withdraw consent — where processing relies on consent

California residents (CCPA/CPRA)

• Right to know what personal data is collected and why
• Right to delete personal data (subject to verification)
• Right to opt-out of sale/sharing (we do not sell personal information)
• Right to non-discrimination for exercising privacy rights

How to submit a request

To exercise any of the rights above, contact us at . For account-level actions such as deletion, you may also use the in-app Settings → Delete Account. Requests that affect personal data will require verification to protect user privacy (we may ask for proof of account ownership).support@goonmaster.io. For account-level actions such as deletion, you may also use the in-app Settings → Delete Account. Requests that affect personal data will require verification to protect user privacy (we may ask for proof of account ownership).

We will respond to verified requests in accordance with applicable law (commonly within one month). If we need more time, we will notify you.

You also have the right to lodge a complaint with your local supervisory authority (for EU/UK users) or the California Attorney General (for California users).

We retain personal data only as long as necessary for the purposes described and as required by law. Specific retention practices:

• Account & profile data: deleted immediately when you delete your account — a hard delete, with no soft-delete or recovery window; residual copies in encrypted backups are purged within the backup-retention cycle
• Gameplay data (XP, progress): removed on account deletion or when user removes the data
• Payment transaction records: retained for 7 years (tax/legal compliance)
• Security logs: retained up to 90 days (longer only for ongoing investigations or legal obligations)
• Aggregated analytics: retained as needed for product improvement (non-identifiable)

When you delete an account we run a secure deletion process; some backups or logs may persist in encrypted form for a short period for disaster recovery or legal compliance, but access is restricted and removed as soon as practical.

We do not sell personal information. We share data only in limited circumstances:

Security

We apply industry-standard technical and organizational measures: TLS for transport, encryption at rest, access controls, monitoring, patching, and regular security audits. Administrative access is limited and logged. Payment card data is never stored on our servers—it is processed directly by PCI-DSS compliant payment processors.

Compliance

We aim to comply with EU/UK GDPR, the ePrivacy rules, and U.S. laws such as CCPA/CPRA where applicable. This policy will be updated to reflect material legal or product changes.

Updates to this Policy

We may update this policy to reflect legal or product changes. For material changes that reduce privacy protections, we will provide advance notice to users (at least 60 days) and obtain consent where required.

Version & Last Updated

Last updated: June 8, 2026