Privacy Policy.

Operator and contact

PANIC ROOM is operated solely by Marko Panić as an individual, based in Belgrade, Serbia. PANIC ROOM is not currently a registered company or legal entity.

For privacy requests, account closure, legal questions or moderation appeals, use the privacy and legal email contact on the Contact page.

Accounts and authentication

Supabase provides account authentication and sessions. Existing members can sign in. Public registration and email-based password recovery are currently disabled. When enabled, registration and login send your email and password through the application to Supabase Auth. PANIC ROOM does not maintain its own password database or intentionally log passwords.

Your email is used for account access and authentication messages. It is shown in your own account experience, but is not included in public profiles.

Public profiles and avatars

Your username, display name, bio, optional location, interests, member-since information, profile roles and avatar can be public. Your contributions can appear on your public profile. Avoid sharing information you do not want to make public.

Avatars are uploaded to Supabase Storage with public image URLs. An older image may remain accessible after replacement. Uploads accept JPEG, PNG or WebP up to 2 MB.

Discussions and replies

Posts include your title, body, space, tags, public author association and creation/update times. Replies can refer to other replies. Discussions may reference a set, event or article.

Public posts can be read without signing in. Members can edit or remove their own posts. Removal replaces the visible content with a deleted state; it does not automatically erase every database record or backup.

Reports and moderation

Reports contain the reporting member’s profile association, reported content or user, reason and submission/resolution times. Reports are not a public feed. Authorized PANIC ROOM owner moderators can review reports and related content.

Moderator membership, participation restrictions and action logs are separated from public profiles. Logs contain the moderator, action, target, reason and time. These support Community safety and access controls.

Technical information and providers

Supabase supplies authentication, database and avatar storage. The application and service infrastructure process requests needed to authenticate accounts, serve content and enforce access controls and posting limits.

Infrastructure may process connection information such as IP addresses and request/authentication logs. Netlify hosts the website; Supabase provides authentication, the database and avatar storage. These providers may process information outside Serbia. Provider terms and data-processing arrangements govern their service processing; details of applicable transfer safeguards can be requested through the privacy contact. Access controls are safeguards, not a guarantee against all security risks.

YouTube and external links

Set thumbnails load from YouTube image servers, which receive the image requests. A player loads only when you select play, using the youtube-nocookie.com embed domain.

Playing connects your browser to YouTube, which may process technical and viewing information and use its own cookies or storage. Privacy-enhanced playback does not mean no information is processed. External YouTube and Instagram links take you to those services and their privacy practices.

Services not currently active

No site analytics, advertising tracker, marketing mailing list, payment processing or private messaging is integrated into the current application. The general contact form is unavailable and does not accept, deliver or store messages. Community reports are a separate working feature.

Events, News and Merch are prepared for future content. Additional services or data uses will need a policy review before activation.

Purposes and processing grounds

Account and profile information is used to provide the account and Community features you request. Necessary processing for those services is based on providing the service under these terms. Providing account information is optional, but the required fields are needed to use member features; public sets can be browsed without an account.

Security checks, posting limits, moderation and related technical records support the legitimate interests of keeping the platform secure, preventing abuse and protecting members. Information may also be retained where required by applicable law. Optional profile details and public contributions are supplied by you; do not include sensitive personal information.

The application does not use advertising profiling or automated decisions with legal or similarly significant effects. Participation restrictions are applied by authorized moderators.

Retention and privacy requests

Account and profile records are retained while needed to provide the account. Public contributions remain until removed or a privacy request requires other action. Deleted states and administrative records may remain where needed for security, moderation, dispute handling or legal obligations. Provider logs and backups follow the providers’ retention settings; deletion from the active service does not immediately erase backup copies.

There is no self-service account deletion or export interface. Contact the operator to request access, correction, deletion, restriction, objection or portability where applicable, or to withdraw consent where processing relies on consent. Requests are handled manually; reasonable identity verification may be necessary. Do not send passwords or unnecessary identity documents.

Privacy requests will be addressed without undue delay and within the time limits required by applicable law, generally 30 days under Serbian personal-data law, with any permitted extension explained. You may lodge a complaint with Serbia’s Commissioner for Information of Public Importance and Personal Data Protection.