Toskr Privacy Policy

Last updated: August 23, 2026 Provider: Toskr L.L.C., a Wyoming limited liability company

This Privacy Policy explains what information Toskr L.L.C. ("Toskr," "we," "us") processes, why, how long we keep it, and the choices you have. It covers toskr.io, the Toskr account portal, and the hosted Matrix service we operate for our customers.

Toskr is offered to customers in the United States who are at least 18 years old. This Policy is written for U.S. law.

1. Our two roles

Toskr hosts a Matrix server for each customer. That means data falls into two buckets:

• Community content — the customer is in charge. When a customer runs a community on Toskr, the customer decides who joins, what is posted, and how the community is governed. For that content and the member data inside it, Toskr acts on the customer's behalf (a "processor" / "service provider"). If you are a member of someone's Toskr-hosted community, your relationship for that content is with the community operator; direct your privacy requests to them. Toskr helps operators meet those requests but is not the primary decision-maker for community content.
• Toskr's own records — Toskr is in charge. For the account, billing, security, abuse, and legal records Toskr keeps to run its business, Toskr decides the purpose and retention. This Policy describes those directly.

2. What we process

Account & billing

• Name and email you provide at signup; a securely hashed password (we never store it in plain text).
• Subscription, plan, invite code, and payment status. Card details are handled by our payment processor (Stripe) — Toskr does not store full card numbers.

The hosted Matrix service

• Account identifiers, display names, and avatars on the customer's server.
• Room membership; the fact, timing, size, and routing of messages and calls.
• Room names, topics, and other room state that is not end-to-end encrypted.
• Device identifiers and public/device key material; encrypted key-backup material.
• The contents of any room where end-to-end encryption is disabled or was never enabled.
• End-to-end encrypted rooms: for encrypted rooms, encryption and decryption happen on member devices. Toskr does not hold the keys needed to read that content and cannot decrypt it. See our Terms §6.

Technical & security

• Client IP addresses and "last seen" information, retained for a limited period (see §5).
• Server, reverse-proxy, and call-signaling logs; storage usage and operational/security telemetry.

Analytics

• On our marketing pages (toskr.io home and public pages) we use Google Analytics, and only after you accept the cookie banner. It never loads in your dashboard or on your chat server.
• Our product analytics use Umami, a self-hosted, cookieless tool. It does not set advertising cookies.

Support, abuse & legal

• Records of support requests, abuse reports, copyright (DMCA) notices, and legal or government requests.

3. Why we process it

To provide, operate, secure, and improve the Service; to authenticate accounts; to bill and prevent fraud; to provide support; to investigate and act on abuse; to comply with law and respond to lawful requests; and to keep minimal records the law requires. We process only what is reasonably needed for these purposes.

4. What we do NOT do

We do not sell your information. We do not use community content to build advertising profiles, serve targeted ads against it, or train general-purpose machine-learning models on it. Toskr personnel do not intentionally access plaintext community content except as described in our Terms §6 and §15 (e.g., you ask us to for support, it is necessary to operate or secure the Service, we investigate reported abuse, or the law requires it).

5. How long we keep it

A legal-preservation duty (for example a valid government preservation request) can require us to keep specific data beyond these periods; see Terms §12.5 and §15.

6. Who we share it with

We use a small set of service providers ("subprocessors") to run Toskr, each only for its function:

• Stripe — payment processing.
• OVHcloud — infrastructure hosting (United States region).
• Cloudflare R2 — encrypted off-site backup storage.
• Purelymail — transactional email.
• Google Analytics — marketing-page analytics (only with your consent).
• Umami — self-hosted product analytics.

We also disclose information when required by valid legal process, to protect rights and safety, or in connection with a merger or sale of the business (subject to this Policy). See Terms §15 for how we handle legal and emergency requests, and our Transparency page.

7. Security

Community messages can be end-to-end encrypted by member devices (keys we do not hold). Traffic to Toskr is encrypted in transit (TLS). Each customer's server runs in its own isolated environment. Off-site backups are encrypted with a key the backup system cannot itself decrypt. Access to production systems is restricted. No system is perfectly secure, and we cannot guarantee absolute security.

8. Your choices and rights

• Account data: you can view and update your account details in the portal, and you can cancel or request deletion of your server and backup set (see Terms §12).
• Analytics: decline the marketing cookie banner, or use browser controls; product analytics are already cookieless.
• Community members: if you are a member of a customer's community, send access/correction/deletion requests to that community's operator, who controls that data. We will reasonably assist the operator.
• Depending on your state, you may have additional rights over the personal information Toskr controls (account/billing/security records). Contact us at privacy@toskr.io and we will respond as required by applicable law. We will not discriminate against you for exercising a right.

9. Children

Toskr is intended for people 18 and older and is not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact privacy@toskr.io.

10. Where we operate

Toskr is a U.S. business and currently serves U.S. customers, with infrastructure in the United States. We do not target the Service to people outside the United States. If that changes, we will update this Policy and add the notices those regions require.

11. Changes

We may update this Policy; each version carries an effective date. For material changes we will provide reasonable notice through the Service or by email.

12. Contact

Privacy questions: privacy@toskr.io Mailing address: Toskr L.L.C., 30 N Gould St Ste N, Sheridan, WY 82801, United States