Last updated: 2026-05-11

This Privacy Policy describes the categories of personal data that Classic Habbo (the "Service") processes, the purposes of the processing, the retention periods applied and the rights available to data subjects.

Data controller

The Service is operated as a non-commercial fan project. Operator identification and contact details are set out in the Impressum.

Categories of data processed

In connection with the registration and use of an account, the Service stores the following information: the username chosen by the user, the email address provided at registration, a salted hash of the password (Argon2id; the plain password is never stored), an in-game avatar configuration, a motto, a randomly generated machine identifier transmitted by the game client, the IP address recorded at website login and at game-server connection, in-game activity records (room visits and credit transactions), public chat messages, and friend and messenger relationships. No payment data is collected, since the Service is provided free of charge.

Purposes of the processing

The data listed above is processed for the following purposes: authentication of users, operation of the in-game economy and social features, enforcement of the rules of conduct against spam and abuse, and investigation of incidents reported by other users.

Retention periods

Account data is retained for the duration of the account. IP login records, public chat logs and credit transactions are automatically deleted after 30 days. Server log files and access logs are retained for 14 days. Upon deletion of an account, all related personal data is removed within 30 days, save where retention is required by applicable law.

Disclosure to third parties

Personal data is not sold, rented or otherwise disclosed to third parties. The Service does not use third-party analytics, advertising trackers or social media plug-ins. All traffic is served from a reverse proxy located on the operator's own server in Europe; no traffic is forwarded to external services.

Cookies

The Service uses only strictly necessary cookies: a session cookie that maintains the authenticated state, a CSRF token that protects form submissions, and a machine identifier set by the game client. No tracking or profiling cookies are used. Since these cookies are essential to the operation of the Service, no consent banner is required under applicable Swiss and European Union law.

Rights of data subjects

Pursuant to the Swiss Federal Act on Data Protection (nFADP) and to the EU General Data Protection Regulation, data subjects have the right to obtain information regarding the data processed about them, to receive a copy thereof, to request rectification or erasure, and to lodge a complaint with the competent supervisory authority. Requests are to be addressed to the contact set out in the Impressum and will receive a response within 30 days.

Security measures

Passwords are stored using the Argon2id key-derivation function. The Service is delivered exclusively over HTTPS (TLS 1.2 and 1.3). Two-factor authentication is available for accounts with elevated permissions. Security-relevant events are logged for the purpose of investigating any abuse.

Automated moderation

The Service applies automated rules-based moderation to messages sent in public chat, shout, whisper and direct messages, in order to detect prohibited content (insults, hate speech, attempts at fraud or solicitation, repeated flooding) and to apply temporary restrictions, mutes or account suspensions where appropriate. The processing is carried out on the basis of legitimate interest in maintaining a safe environment for users; no third-party service receives the message content, and all checks run on the operator's own server. The categories of automated decisions and the right to request human review are available by writing to the contact set out in the Impressum.

Animated accounts and automated chat

In order to keep public rooms lively, the Service operates a small number of automated accounts that participate in chat in the same rooms as real users. To generate the text of their messages, the contents of public chat lines and the persona of the automated account are transmitted to a third-party AI provider, currently Groq, Inc. (United States), via its developer API. According to Groq's published terms, content sent on the developer free tier is not used to train Groq's models. Whisper messages, private messages, account data and email addresses are NEVER sent to the AI provider. Users who do not wish to have their public-chat content transmitted in this way should avoid the rooms in which automated accounts are present; these are identified in the in-game motto of the affected rooms.

Contact

Enquiries relating to the processing of personal data may be addressed to info@classichabbo.ch.