Skip to content
poolsbeta
Contents

GDPR & CCPA

Your rights over your data under the GDPR and the CCPA, what pools stores and why, and how to use these rights.

Last updated

This page explains your rights over your personal data under the GDPR (EU and UK) and the CCPA (California, as amended by the CPRA), and how to use them. Privacy has the full picture of what pools stores.

Who's responsible

#

haruhime.moe, which runs pools.haruhime.moe, is the controller of your personal data.

What we hold and why

#

What we store

  • Your haruhime account's user ID, next to the pools you own and the API key you make. Showing who owns or edits a pool (the account itself, with your osu! name and sessions, lives on haruhime.moe)
  • Your API key, if you make one: a hash of it, its first characters and when it was made and last used. So the API knows the key is yours
  • The pools you make: their name, details, notes, maps, owner and editors. The pool builder you asked for
  • A pool's candidates, activity log (its last 200 changes, each kept at most 180 days) and saved version history. Letting its owner and editors review and restore its past
  • Short-lived rate-limit counters, keyed by IP address or account. Stopping floods and abuse; deleted automatically within minutes or hours
  • What the osu! API says about a beatmapset, kept for 24 hours. Making the content rules check faster on the next request

Cookies

  • haruhime.moe's session cookie (on .haruhime.moe) keeps you signed in; pools only reads it. It's HttpOnly, so page scripts can't read it.
  • haruhime-signed-in, also set by haruhime.moe, which pages can read. It only says this browser may be signed in; pages ask who you are only when it's there.

Your rights

#

Your rights under the GDPR

  • Access and portability. Get a copy of your data in a machine-readable file.
  • Rectification. Have wrong data corrected.
  • Erasure. Have your data deleted.
  • Restriction. Ask us to pause using your data while a question about it is sorted out.
  • Objection. Object to anything we do on the basis of legitimate interest.
  • Complaint. Complain to your data protection supervisory authority.

Your rights under the CCPA

  • Know, delete and correct. Ask what we hold about you, ask us to delete it, and ask us to correct it.
  • Selling and sharing. We don't sell or share personal information.
  • Opting out. We honor Global Privacy Control signals.

To use any of these rights, email haruhime@haruhime.moe.

How to use them

#

Your pools and their candidates, activity log and history follow the rules Privacy sets out. "Delete my pools data" on your pools settings page deletes your API key and every pool you own and takes you off the pools you edit, all at once. Your haruhime account (the osu! link and sessions) is deleted on haruhime.moe/account.

Your name and avatar come from your osu! profile. Change them on osu!, and haruhime.moe copies the new ones the next time you sign in.

pools is small and free, and may fall below the thresholds where the CCPA applies. We give these rights to everyone anyway, wherever you live.

Changes

We may update this page. It was last updated on 2026-10-06.

Contact

haruhime.moe runs pools.haruhime.moe. For anything on this page, write to haruhime@haruhime.moe.