Your handle. Your data.

Effective 25 October 2026. This notice describes what the Tiny Chaos Inc. operator, tinychaosinc, processes when you use this website. Our contact is @tinychaosinc.

What we collect and why

Account: your Instagram-style handle, an internal member number, joining time and group, starter appearance, optional verification and Board status. These run your account and place your character in the shared office. We store a salted scrypt hash of your Tiny Chaos password once you set one, and hashes of recovery keys, session tokens and verification codes. We do not ask for your Instagram password or an email address.

Follower imports: the operator imports Instagram follower handles from the account's data export. We store each handle, first and latest import times, and active or suppression status to place matching accounts and represent followers who have not joined. The import is manual; it does not connect to your Instagram account. Being in an imported list does not prove that a website visitor owns that handle.

Game activity: your character’s last position and facing direction are saved. Current online presence, walking and short emotes are relayed to other visitors in real time. Emotes and movement inputs are held temporarily in server memory, not as a movement history. We store only the most recent position.

Polls: we store the choice you cast, its poll, account number and time to count one vote per account. Public results show totals, not a list of voters. Your own vote is visible to your signed-in account. Deleting the account removes its link to the ballot while keeping the anonymous vote in the total.

Optional requests: an Instagram verification code lasts 48 hours; an owner-issued reset link lasts 30 minutes. If you request account deletion, we save a reference and request time until you cancel or we complete it. The operator may review messages you send to @tinychaosinc and public Instagram comments submitted for community decisions. Reviewed comments and decision records can include a username, comment ID, text and like count.

Security: requests pass through our hosting server, which sees your IP address and basic HTTP connection information. Application rate limits use hashed identifiers and counters; expired counters and credentials are cleared during routine maintenance. The hosting and reverse-proxy services may process technical security and error logs. We use this information to protect accounts and keep the game working.

What other people can see

Visitors can see and search your handle, member number, character, joining group and optional public verification/Board status. They can see your position, online status and actions. Recent joiners are displayed publicly. Public game scenes can appear in Tiny Chaos social posts and videos. Passwords, recovery keys, deletion requests and private verification codes are not public.

Interviewees and followers without a website account appear as ghost characters with shortened handle labels and public counts. The full imported follower list stays in the private owner console. Your own signed-in browser can display your full interview handle.

Cookies and device storage

An essential HttpOnly session cookie keeps you signed in for up to 14 days; owner sessions last up to 8 hours. Signing out invalidates that session. Local storage saves music preferences. You can clear cookies and local storage in your browser; this signs you out or resets preferences. This version includes no advertising cookies, tracking pixels or third-party analytics.

Who processes information

The project operator and hosting/infrastructure providers process information needed to operate this service. Cloudflare processes web traffic for DNS, HTTPS delivery and security. We do not sell personal data. The website does not automatically import Instagram followers or read your Instagram account. Opening an Instagram link or sending a DM is covered separately by Meta’s policies. We may disclose information when legally required or necessary to address abuse or protect people’s rights.

Retention and deletion

Account details and the last saved position remain while your account exists. Expired sessions, reset links, verification codes and rate-limit counters are cleared on the next routine maintenance pass, normally within an hour while the service is active. Private account audit records remain until deletion. A pending deletion request remains until cancelled or fulfilled.

Completing deletion removes the live account, password and recovery hashes, sessions, saved position, verification data, request and account-linked audit records. Imported comments associated with that handle are removed and authorship is removed from recorded decisions. A shared office change may remain without your name. A retired Board seat retains only its seat number, not your public identity.

Follower import records remain between imports to reconcile follower changes. A restricted follower-handle suppression record remains after account deletion so later imports do not show that handle as a ghost. This is separate from the temporary account-deletion ledger below. Contact @tinychaosinc to request removal of follower-only information.

Restricted recovery backups may contain older data for up to 30 days. They are not used for normal operation. If a backup is restored, completed deletions must be reapplied before the office reopens. Deleting a website account does not delete Instagram comments, DMs, posts, or copies held by other people; contact us about Tiny Chaos-controlled posts containing your identity.

A restricted deletion ledger keeps your internal member number, completion time and retired Board number for 30 days to prevent a restored backup from reopening a deleted account.

Your choices and requests

Request account deletion in My account → Delete account. You can cancel while it is pending. We aim to complete requests within 28 days. If you cannot sign in, send a DM from your matching Instagram handle to @tinychaosinc; never send a password. See full deletion instructions.

You can also ask @tinychaosinc for access to your information, correction, removal from project-controlled media, or restrictions or objections to processing. We may need proportionate proof that you control the account. Depending on your location, you may have additional rights and the right to complain to your local data protection regulator. We process account data to provide the service, security data to protect it, and information required by law; where applicable, these correspond to contract, legitimate interests and legal obligations.

Children and updates

This service is not intended for children under 13 or below their local minimum age. Contact us if an ineligible child’s information has been collected. We will update this notice when processing changes and announce material changes on the website. Privacy questions go to @tinychaosinc.