Privacy Policy

Last updated 2026-11-08

This explains what information Squire collects, why, who it's shared with and what you can do about it. Rodega (Pty) Ltd, trading as Rodega Studios runs Squire and is responsible for your information under South Africa's Protection of Personal Information Act (POPIA). The short version: we collect what we need to run a chat app, we don't sell it, we don't show ads, and your direct messages are end-to-end encrypted so we can't read them.

What we collect

  • Account details: your email address, username, display name, password (stored scrambled, never in plain text) and two-factor or passkey details if you turn them on.
  • Signing in with Google: Google tells us your email address and name, and that the email is confirmed. We don't use your Google picture or anything else from your Google account.
  • Your date of birth: to check you're old enough to use Squire, whether a parent or guardian needs to agree, and whether you can join 18+ servers. Nobody else on Squire sees it.
  • Profile: what you choose to add, like a picture, banner, pronouns, about text and badges.
  • What you post in servers: messages, files, images, reactions and voice messages, kept so the people in those channels can see them.
  • Direct messages: these are end-to-end encrypted on your device. We store the encrypted version so it can be delivered, but we can't read it. We do see who talks to whom, when, and how big messages are.
  • Calls: voice, video and screen sharing go through our media server so they can reach the others in the call. We don't record calls. We count how long calls and streams run, per server, to plan our hosting.
  • Devices and security: the sessions you're signed in on, IP addresses and browser or app details, used to keep your account secure and to stop abuse.
  • Where and when you use Squire: the country you last used it from (worked out from your IP address; we keep only the country) and when you were last active, so we know how many people use Squire and where.
  • What you do in Squire: the servers you join and your roles in them, friends and people you block, moderation actions you take or that are taken against you, the apps you use, and what you've bought (the plan and its status, never your card number).
  • Reports: if you report something, the report and the content you reported.
  • From other people: reports about you, and things others post that include you, like a mention or a picture.
  • Support: what you send us when you ask for help or report a bug.
  • Error reports: if the app crashes, a technical report of what went wrong, with your user id but not your messages.

Encryption, and what we can see

  • Direct messages and group DMs: messages, edits, reactions and files are encrypted on your device before they're sent, using MLS (an open standard for end-to-end encryption), and only the devices of the people in the conversation can open them. The keys stay on your devices, so we can't read your DMs, and nor can anyone who gets into our servers. We can see who's in a DM, when messages are sent and how big they are.
  • If you sign out of every device and lose your recovery key, older DMs can't be opened again, by you or by us.
  • If you report a DM, your device sends us the message you're reporting, with proof that it really was sent, so we can act on it.
  • Servers: messages and files in servers aren't end-to-end encrypted. They're encrypted on the way to and from our servers and stored there, so that the people in the channel can read them, moderators and AutoMod can act on them, and our team can look into reports and meet legal duties. We don't read them otherwise. We do it this way so servers can't be used to hide illegal activity.
  • Calls: voice, video and screen sharing are encrypted on the way to and from our media server, but not end to end. We don't record them.
  • Notifications: push notifications reach your phone or browser through Apple, Google, Mozilla or Microsoft. What's in them is encrypted on the way, so those companies can't read it.
  • Link previews: when a message has a link, our server fetches the page to show a preview, so the website sees our server, not you.

Automated checks, and no AI training

Some checks run automatically: AutoMod filters messages in servers by the rules each server sets, Cloudflare compares uploaded images against known child abuse material, and we watch for spam and attacks. Closing an account or taking a server off Discover is always decided by a person.

We don't use your messages, files or calls to train AI models, and we don't let anyone else do that either.

Squire's own apps

We also make some of the apps in Squire: Chess, Boards, Tickets, Squire HQ and Ember Hill. They're run by us and covered by this policy. They keep what they need to work, like your chess games, the cards and comments on a board, the tickets you open (including bug reports), and for Ember Hill the Minecraft accounts you link and their stats. Your Squire name shows on your main Minecraft account; which other accounts are yours is only shown to you.

Why we use it

  • To run Squire: show your messages and profile to the people you choose, deliver notifications, connect calls.
  • To keep Squire safe: check people's age, stop spam and abuse, review reports, and meet our legal duties.
  • To keep your account secure: sign-ins, two-factor, and emails about your account.
  • To email you about your account, purchases and changes to our policies. News about Squire only if you turned it on (at sign-up or in Settings → Notifications), and you can turn it off any time.
  • To fix and improve Squire: error reports and overall usage numbers.

We use your information because you've asked us to provide Squire to you, because we have a legitimate interest in keeping it safe and working, or because the law requires it. We don't sell your information, use it for advertising, or let others use it to advertise to you.

We may share totals that can't identify anyone, like how many servers Squire has.

Children

Squire is for people aged 13 and older. People under 18 need a parent or guardian's agreement, which they confirm when they sign up. We don't knowingly keep information about anyone under 13. If you believe a child under 13 has an account, email us and we'll delete it.

Parents and guardians can ask us to see, correct or delete their child's information.

Who we share it with

Other people on Squire see what you share with them: your profile, and what you post in servers and DMs you're part of.

We use a few companies to run Squire. They only use your information to provide their service to us:

  • Hetzner (servers in Germany and Finland): where Squire runs, its database is kept, and voice, video and screen sharing in calls pass through.
  • Cloudflare (worldwide): protects Squire from attacks, delivers it quickly, stores uploaded files and backups, and scans images for known child abuse material.
  • Whop (United States): processes payments for subscriptions such as Squire Plus and works out tax. Whop gets your email address and payment details; we never see your card number. If you buy a gift, the friend you give it to sees that it came from you.
  • Resend: sends our emails, like password resets.
  • GIPHY: provides GIF search. Searches go through our server, so GIPHY doesn't see who searched. GIFs you see load from GIPHY.
  • Sentry: receives error reports. These go through our server, so Sentry doesn't see your IP address.

Apps you use: when you open an app or let it sign you in with Squire, it gets what the permission screen lists, such as your username and picture. What it does with that is covered by its maker's privacy policy.

Connections: when you link Twitch, YouTube, Spotify or Steam, that service tells us your account on it, and you choose whether it shows on your profile. "Connected accounts" below has the details.

Squire's servers and database are in the European Union (Germany and Finland), and our team in South Africa looks after them. For people in the EU and the UK, we protect information that leaves there with the European Commission's standard contract clauses or another safeguard the law accepts.

Some of these companies store information outside South Africa. When they do, we rely on their contracts and the privacy laws they follow (such as the European Union's GDPR), which give protection similar to POPIA.

If Squire is sold or another company takes over running it, your information goes with it, under this policy. We'll tell you first.

We share information with the police or other authorities only when the law requires it, or to protect someone from serious harm. We report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), which passes reports to the police in the country involved, and to the South African Police Service as South African law requires.

Connected accounts

When you verify an account from another service in Settings → Profile → Connections, you sign in to that service and it tells Squire about that account. This is what we get and what we do with it:

  • YouTube (Google): we ask Google for read-only access to your YouTube account (the youtube.readonly permission) and use it once, to read your channel's ID and handle so we can show it as verified. We don't keep Google's access token. To show when you're live, Squire checks your channel's public videos with its own key.
  • Spotify: we read your Spotify account ID to show it as verified. With your permission (Spotify asks), we also see the song you're playing, to show it on your profile while you're online. We keep Spotify's sign-in token encrypted so we can keep asking, and the song only in memory while it plays: it isn't saved. Turn it off in Settings → Profile → Connections.
  • Twitch: we read your Twitch user ID and name to show it as verified and to show when you're live. We don't keep Twitch's token.
  • Steam: Steam tells us your Steam ID when you sign in. We may look up your public profile address.

We use this information only to show your verified connections, when you're live and what you're listening to. We don't sell it, use it for ads, use it to train AI, or let people at Squire read it except when needed for security, to deal with abuse or as the law requires.

Squire's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Removing a connection deletes what we got from that service, including any token we kept. You can also take Squire's access away at the service itself: for Google at myaccount.google.com/permissions, for Spotify at spotify.com/account/apps, and for Twitch under Connections in your Twitch settings.

How long we keep it

  • Your account and profile: until you delete your account.
  • Messages and files in servers: until the server is deleted or you delete your account. When you or a moderator delete a message, it and its files are kept hidden for 30 days, so reports about it can still be checked, then deleted for good.
  • Copies of your data you asked for: 7 days.
  • Backups: kept for about 14 days, then deleted.
  • Sign-in sessions: until you sign out or they expire.
  • Reports and moderation records: as long as needed to keep Squire safe and meet legal duties.
  • Usage numbers: kept per server and per day, with no per-person details.

When you delete your account, we delete your information within 30 days, except what we must keep by law or to deal with abuse, and what's in backups until they expire.

Keeping it safe

Squire uses HTTPS everywhere, scrambles passwords, offers two-factor sign-in and passkeys, and encrypts direct messages end to end. Only a few people at Squire can reach the servers, and every login is protected by keys rather than passwords. No system is perfect: if something goes wrong that affects your information, we'll tell you and the Information Regulator as POPIA requires.

Cookies and storage on your device

We use one cookie to keep you signed in. Squire also stores your settings (like text size) and your encryption keys on your device. We don't use advertising or tracking cookies.

Your rights

You can ask us:

  • what information we have about you, and for a copy of it
  • to correct it, if it's wrong
  • to delete it
  • to stop using it, or object to how we use it

Many of these you can do yourself in Settings: correct your profile, delete your account, or get a copy of your data.

To get a copy, go to Settings → Privacy and safety → Download your data. We put together a file with your account, profile, messages you posted in servers, your servers and friends, settings, purchases and more, and email you when it's ready. Download it from the same place within 7 days; after that it's deleted. Your DMs aren't in it, because we can't read them: they stay on your devices.

For anything else, email our Information Officer at the address below. We'll answer within 30 days. Before we hand over or delete information, we may ask you to show it's really you.

If you're in the European Union or the United Kingdom, the GDPR or UK GDPR gives you these rights too, including taking your data elsewhere, and you can complain to the data protection authority where you live.

If you're unhappy with how we handle your information, you can complain to South Africa's Information Regulator (inforegulator.org.za). We'd appreciate the chance to sort it out with you first.

Changes to this policy

If we change this policy in a way that matters, we'll tell you in Squire, and by email if it's a big change, before it takes effect. The date at the top shows when it last changed.

Contact

Rodega (Pty) Ltd, trading as Rodega Studios is responsible for your information. Questions, requests and complaints about privacy go to our Information Officer at support@rodega.com.

Rodega (Pty) Ltd, trading as Rodega Studios (registration number 2026/495078/07), 2 Fouriesburg Street, Centurion, Gauteng, 0157, South Africa. Email: support@rodega.com.