Last updated: 15 October 2026.
klaklak is run by Hertge VOF, President Kennedylaan 154, 2343 GV Oegstgeest, the Netherlands. Chamber of Commerce 88251918, VAT NL864554187B01. For anything in this statement, write to info@hertge.com.
Using klaklak needs no account at all. There is no signup, we do not ask for an e-mail address, a phone number or a password, and there is no profile. The only thing you provide is a nickname, which you choose again each time you arrive.
In an invite-only room people sign in with an e-mail address and a six-digit code that we send them. For that we store the e-mail addresses of the owner and the guests, the names they chose and the guest list, and we send the code and invitation e-mails through our mail provider, Brevo. A sign-in keeps you signed in with a cookie for thirty days. These rooms are stored in the EU. When a room closes, it is removed with its guest list thirty days later.
For a paying customer - a paid embed or an invite-only room - we also keep the name or company name, the contact address and the website it is for, because we need them to send the invoice and to keep the room running. If you want your address removed, write to info@hertge.com and we will delete it.
Messages are stored so they stay visible in the room. Alongside each message we keep the time, the nickname and a short code for the browser it was written in. That code is made from a random number your browser keeps for klaklak; it is not your IP address and it means nothing outside klaklak. It is there for one reason: so that somebody can block the writer (see below).
Your IP address is not stored with your messages. While you are connected it is held in memory, to check you are not banned from that room and for the human check at the door. It is written down in one case only: if somebody is banned from a room, that room keeps the address so the ban can be enforced. Nothing links a stored message back to an address.
How long they stay depends on the room. A free room and a Basic room hold the last fifty messages and clear themselves after a day with nobody in it. A Pro room holds the last five hundred and removes messages once they are older than thirty days.
One thing we want to be exact about: when a room clears itself, a copy of its recent messages is kept for seven days in a place only the operator can read. It exists so that abuse reported after the fact can still be looked into. After those seven days it is gone.
In a room you can switch on "Notifications for this room". Your browser then gives us an address at its own push service (Apple, Google, Mozilla or Microsoft, depending on the browser) and two keys, and we store those with that room, together with the random id this browser uses in the chat. Nothing else: no name, no e-mail address, no phone number.
When somebody writes in that room while you are not in it, we send a short encrypted notice to that address, at most once every five minutes. If somebody writes @ followed by your nickname, the notice says you were mentioned and may come sooner, at most once every thirty seconds. To recognise that, the room compares new messages with the nickname you last used there. You can also choose to be told only about mentions. The notice contains only the name of the room and whether you were mentioned: never the message and never who wrote it, so nothing that was said passes through the push service.
The address is removed when you switch it off, when the room clears itself after a day of quiet, or when the push service tells us it is no longer valid. In a paid room that does not clear itself, it stays until you switch it off or the plan ends.
In the iPhone app the same switch works through Apple's push service instead: your
iPhone gives the app a device token, and we store that token the way we store a browser's
address above, with the same rules for what the notice says and when the token is removed.
The notice text is written in the language you last used in that room. In the app the switch
is on by default for every room you open, once you have allowed klaklak to send notifications
on your iPhone; you can switch it off per room, and leaving a room switches it off there.
The app opens in your iPhone's language. If you pick another language in the app, that choice
is kept in one small cookie (kk_lang) holding only the language code, so the app
opens in it next time. The website itself sets no such cookie.
The app also counts, per day, how many phones opened it for the first time, how many used it
and how often it was started. It does that without any identifier: each phone only remembers
by itself whether it has already been counted that day, and sends nothing but "count me".
Views and clicks of the line under the message box are counted the same way as on the website,
with the app counted apart. Google Analytics and Clicky, which the website uses, do not run
in the app.
A private message between two people in a room passes through our server, because that is how it reaches the other browser. It is not stored: it is not written to the room's history, it is not in the seven-day copy above, and once it is delivered it is gone. It is not end-to-end encrypted, so treat it as private from other people in the room, not as a secure channel.
Reporting. If you report a message, a copy of it - with the room, the nickname, the time and the browser code of the writer - goes to a list that only the operator can read, and is kept there for thirty days, also when the room itself has cleared. The writer is not told that they were reported, and nobody, the operator included, sees who reported it; we only count how many different people did.
If a reported message breaks our rules, we remove it and may remove its writer from klaklak. In that case the writer's browser code is kept on a list for as long as the removal lasts, so that no room lets that browser back in. Nothing else about the writer is on it.
Blocking. If you block somebody, we keep a list of the browser codes you blocked, stored under your own browser code, so that their messages stop reaching you in every room and on your next visit too. Nothing else is in it: no names, no messages. Each entry is kept for ninety days after you set it, at most fifty entries, and removed when you unblock. The person you blocked is not told.
We will not pretend otherwise: the operator of klaklak has an administration page that can show the messages in a room, including invite-only rooms, and the seven-day copies described above. It is used to deal with abuse reports and to keep the service running, not to read along for fun. If confidentiality from us is what you need, klaklak is the wrong tool.
Under the message box of a free room there is one line of text, marked Ad when it is a paying sponsor. It is not there in invite-only rooms and not in a room embedded on somebody else's website.
It is worth being precise about what that line is, because most advertising is not like this. There is no advertising network involved: no third-party script runs on the page, no cookie is set, no pixel is loaded, and nothing about you is sent anywhere to decide which line you see. The text and the link are written by hand in our own page. A sponsor can ask to be shown only in certain countries, and for that we use the country that Cloudflare already tells us on every request; we do not store your address to work it out.
We count how often each line was shown and how often it was clicked. That counting happens on our own server, records only the line's name, the numbers, and the country, and is never linked to you or to your messages. Sponsors are given those totals, never anything about a person. If you click the line you go to the sponsor's own site, and from that moment their privacy statement applies, not ours.
We do not take card payments and there is no checkout on this site. An invite-only room or an advertisement is agreed by e-mail and paid by bank transfer against an invoice from Hertge VOF, so no payment details ever reach us. Invoices are kept for as long as Dutch tax law requires.
If you choose to support klaklak through Ko-fi, that happens entirely on Ko-fi's own site and through their payment provider. We see only what Ko-fi shows us: an amount, and a name or message if you left one. We never see your card or account details. Ko-fi has its own privacy statement.
We are not sending any e-mail at the moment. When the sign-in above was running, messages went through Brevo (Sendinblue SAS, France), without tracking pixels or click tracking. We do not send newsletters and never have.
Rooms, accounts and messages are stored by Cloudflare in data centres in the European Union. Cloudflare also delivers the site and therefore processes the technical details of your connection, and runs the Turnstile check that keeps automated traffic out of rooms.
We use two analytics tools to see how many people visit and roughly where they come from: Clicky and Google Analytics. Between them they record the page visited, the referring page, the country, and the browser and device type. Google Analytics stores an identifier in your browser so it can tell a returning visit from a new one, and sends this data to Google, which may process it outside the European Union. We do not use any of it to build advertising profiles and we do not sell data. There is one line of sponsored text under the message box of the free rooms, described under Advertising below; it is chosen by us by hand and knows nothing about you.
You can stop this entirely by turning on Do Not Track or a tracking blocker in your browser, or by using the browser's private mode.
For a paid plan we process your data to carry out the agreement with you. For sign-in codes, spam protection, abuse handling and keeping the service running we rely on our legitimate interest in a service that works and is not abused. Where the law requires it, we respond to requests from the authorities.
Messages: as described above, with the seven-day operator copy. Reported messages: thirty days. Block lists: ninety days per entry. Invite-only rooms - the guest list, the room settings and the e-mail addresses - are kept while the room is paid for and removed thirty days after it closes, or earlier on request. Paying customer details are kept while you are a customer and then for as long as Dutch tax law requires us to keep the invoices.
You can ask to see your data, to have it corrected, or to have it deleted, at info@hertge.com. If you are a business customer and need a data processing agreement, ask and you will get one. If you think we are handling your data badly, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Most of klaklak is available in several languages. This statement is not: it exists only in English, and this English wording is the version that applies. If your browser offers to translate this page, that translation is there to help you read it. It is not a version of this statement and nothing in it can be relied on against the English above.
This text describes what the service actually does. It has not been reviewed by a lawyer.