SLAP privacy policy

This policy covers SLAP, the retro instant messenger and desktop at slap.cool. SLAP is published by HOLLINGSWORKS LLC (“Hollingsworks”, “we”, “us”), a small software studio in Michigan. SLAP is an independent fan project. It isn’t affiliated with AOL or Microsoft.

What we collect

Your account

To sign up you choose a screen name and a password. Firebase Authentication checks your password; we never see it. If you set a recovery code or a security question, we store only a salted one-way hash of the code and of your answer, never the answer itself.

Your profile holds your screen name, profile text, avatar, away message, warning level, buddy list (with categories, alerts and top 8), blocked list, message style and when you joined.

Messages and calls

• Instant messages between you and another screen name, with the time and your message style, and typing indicators while you type.
• Chat rooms: messages you post in a room, and who’s in the room.
• Mail: subject, body, sender and recipient, and whether it’s been read.
• Voice messages: recordings you choose to send, stored as audio files.
• Buddy pings, nudges and warnings you send.
• Games you play with other users, and their state.
• Voice calls: to connect a call, SLAP briefly stores call set-up details, including your network addresses (IP addresses), and deletes them when the call ends. The call itself goes directly between browsers and isn’t recorded.

Presence

Whether you’re online, idle or away, when you were last active, and a random ID for each device you’re signed in on.

Usage statistics

SLAP uses Google Analytics (through Firebase), which sets first-party cookies and records pages, sessions, device and browser type, and approximate location from your IP address. We use it to see how SLAP is used.

In your browser

SLAP saves your last screen name, auto sign-in preference, a device ID, weather settings and other preferences in your browser’s local storage. If you tick “Save password”, your password is saved in this browser’s local storage so SLAP can sign you in. Don’t use that option on a shared or public computer.

Permissions

• Microphone: only when you make a voice call or record a voice message.
• Location: only if you choose “current location” in the Weather app. The coordinates are sent to OpenStreetMap’s Nominatim and Open-Meteo to look up the place and forecast, and saved in your browser, not on our servers.
• Notifications: to alert you to new messages while SLAP is open.

Who can see what

• Everyone signed in can see your screen name, profile, avatar, away message and online status, and can message you unless you block them.
• The person you message or call sees what you send them. A voice call shares your IP address with the person you’re calling.
• Everyone in a chat room sees the messages posted there.

Other services the desktop uses

Some desktop apps load content from other services, which receive your IP address and the request: Google and Cloudflare (for connecting voice calls), Open-Meteo and OpenStreetMap (weather), TradingView (stock ticker), YouTube (videos, in privacy-enhanced mode), the Internet Archive’s Wayback Machine (the web browser app and a game), Wikipedia, a text-to-speech service at tetyys.com (for the desktop assistant’s voice) and an embedded pinball game.

Sharing

We don’t sell your personal information and there are no ads. We share data only with the service providers above (Google Firebase hosts the service and stores its data in the United States), or when the law requires it.

How long we keep it

Your account, profile, messages, chat-room posts, mail and voice messages are kept until they or your account are deleted. Typing indicators, pings and call set-up details are deleted once they’re delivered or the call ends. Google Analytics keeps event data for no longer than 14 months.

Deleting your account

You can delete mail from your mailbox. To delete your account and everything stored with it, email us from the address below with your screen name, and we’ll confirm within 30 days. Messages you sent to others are deleted along with your account.

Children

SLAP isn’t directed at children under 13, and you must be 13 or older to create an account. We don’t knowingly collect personal information from children under 13. If you think a child is using SLAP, email us and we’ll delete the account.

Your rights

Depending on where you live (for example California, other U.S. states with privacy laws, the EEA or the UK), you may have the right to access, correct or delete your personal information, to object to processing, and to complain to your local data protection authority. Email us and we’ll answer within 30 days. We won’t treat you differently for using these rights.

Changes

If this policy changes, we’ll update this page and the date at the top.

Contact

HOLLINGSWORKS LLC, a Michigan limited liability company
Email: hello@hollingsworks.com