Who is responsible
GaleWeave is self-hosted software. The service at galeweave.com is operated by Felisora, an Ontario-registered sole proprietorship owned by Brady Gibb. Felisora is accountable for personal information under its control, including information processed by service providers. Privacy questions and requests may be sent to privacy@galeweave.com. Service support is available at support@galeweave.com. The open-source project and unrelated GaleWeave operators do not receive your information merely because you use this server.
Information collected
- Account: email address, first and last name, profile name, password verifier, role, confirmation state, preferences, and account recovery state.
- Service: session identifiers, sign-in and activity timestamps, device/browser information, permissions, favorites, queues, playback progress, watch status, and library visibility.
- Messaging: conversation membership and requests, message timing and delivery metadata, reactions, friendships, profile images, attachments, custom emojis, notification preferences, and encrypted-device records.
- Network and operations: IP address, request details, security events, diagnostics, bandwidth counters, and media access activity.
- Personal Node: node and household identifiers, owner, connection details, library names, catalog metadata, sharing rules, and availability. Media bytes remain on the node except when streamed, downloaded, or explicitly uploaded.
Purposes and legal basis
Information is processed to create and secure accounts, provide requested media and messaging features, enforce permissions, synchronize devices, operate Personal Nodes, send transactional email, prevent abuse, diagnose failures, protect the service, and meet legal obligations. Where applicable, processing relies on your consent, performance of the service you request, the operator’s legitimate security and operational interests, or legal requirements. GaleWeave does not use personal information for behavioural advertising.
Messages, attachments, and encryption
The server stores messages and attachment files so authorized participants can retrieve and synchronize them. Administrators are not provided an attachment inventory, preview, export, or moderation-download function. In conversations visibly marked End-to-end encrypted, message and attachment payloads are stored as ciphertext intended to be readable only by enrolled conversation devices. The server still processes routing metadata such as participants, timestamps, size, delivery state, and encrypted-device records. Legacy or unencrypted conversations remain technically readable by the server; do not treat them as end-to-end encrypted.
Cookies and device storage
GaleWeave uses essential session cookies and local device storage for authentication, preferences, playback state, encrypted-device material, and offline continuity. These technologies are necessary for requested features and are not used for cross-site advertising. Clearing application data may sign you out or remove locally held encryption keys, causing encrypted history to become unavailable on that device.
Service providers and transfers
Depending on configuration, limited information may be processed by infrastructure and service providers such as DigitalOcean and Cloudflare for hosting, networking, TLS, registration security, and traffic protection; an SMTP provider for account email; TMDB for optional metadata queries; and YouTube or another provider for optional trailers. A Personal Node or shared library may be operated by another household member. Providers process information under their own terms and may process it outside your province or country, where foreign laws may apply.
Retention and deletion
Account and service records are retained while an account is active and only as long afterward as needed for an identified purpose. Operational activity entries are normally limited to 30 days. GaleWeave keeps records of every security-safeguard breach for at least 24 months after the breach is determined to have occurred. Closed privacy-request records and non-identifying account-deletion receipts are normally retained for two years under the operator's accountability policy; that policy does not create a general right to retain a deleted account's identity. An unresolved accuracy challenge, legal hold, or other specific legal requirement may require a narrowly limited record for longer. Messages or attachments already delivered to other participants may remain in their conversation copies, but the deleted sender is de-identified. Account deletion removes the profile, credentials, sessions, device registrations, Personal Nodes, relationships, avatars, and conversation membership; it does not delete the Server Operator's underlying media files. Backup copies may persist only for the documented recovery cycle and must not be restored as an active account.
Security and beta limitations
Safeguards include password hashing, access controls, session expiry, HTTPS for the public service, protected local storage, and optional OpenMLS end-to-end encryption. GaleWeave remains beta software; defects, compatibility failures, and data loss are possible. Keep devices updated, use unique passwords, verify encryption indicators and safety codes, remove lost devices, and maintain protected backups. No system can guarantee absolute security.
Your choices, requests, and complaints
Subject to applicable law, you may download an account-level privacy export, request access to or correction of personal information, ask how it has been used or disclosed, withdraw consent where permitted, or request account deletion. Requests may be submitted through Profile settings or to privacy@galeweave.com. Identity will be verified before disclosure. Requests are logged, reviewed, and normally targeted for a response within 30 days. If you are dissatisfied, send a complaint to the privacy address with enough detail to investigate; the operator will document the review and outcome. Some information may be retained where legally required or necessary to protect other users and the service. You may also complain to the Office of the Privacy Commissioner of Canada or another regulator with jurisdiction.
Children
The public beta is not directed to children under 13. A Server Operator providing household access to a minor is responsible for obtaining valid parental or guardian authorization and applying age-appropriate privacy protections required by local law.
Breaches and changes
The Server Operator will assess security incidents and provide notices or reports when required by applicable law. Material changes to the purposes, disclosures, or encryption practices will be highlighted and consent obtained where required. The effective date above identifies the current version.
Contact
Ontario Server Operator and privacy officer: Felisora (owned by Brady Gibb)
Privacy requests and complaints: privacy@galeweave.com
Service support: support@galeweave.com
Service: https://galeweave.com
