Privacy Policy – Aham (up.aham.ro)

Last updated: October 18, 2026

Romanian version: Politica de confidențialitate.

1. Who is responsible for your data

Aham (up.aham.ro) is operated by Cosmin Albulescu, an individual in Romania acting in a personal capacity, who is the data controller under the EU General Data Protection Regulation (GDPR). Contact for any privacy question or request: admin@aham.ro.

This policy explains what personal data Aham handles, why, and what choices you have. It goes with our Terms of Service and Community Guidelines.

2. What data we handle

We do not ask you for your password: sign-in is handled by Aham ID. We do not knowingly collect special categories of data, and we ask you not to post sensitive personal data about yourself or others.

3. Why we use it and on what legal basis

• Run the Service (create your profile, show your posts and comments, count votes and karma, keep you signed in): performance of a contract with you (Art. 6(1)(b) GDPR).
• Keep the Service safe and fair (prevent spam, vote manipulation, abuse and attacks; receive and review post reports; moderate content; fix errors): our legitimate interests (Art. 6(1)(f)).
• Remember your preferences (language, theme, accent colour): our legitimate interest in a usable service; strictly necessary cookies need no consent.
• Optional analytics and advertising: only where permitted by your consent choices (Art. 6(1)(a)), which you can withdraw at any time. When Google AdSense is enabled, Google and other advertising vendors may use cookies to serve or personalise ads based on this site's or other sites' prior visits.
• Meet legal duties (for example, handling illegal-content notices under the Digital Services Act, or responding to authorities): legal obligation (Art. 6(1)(c)).

3.1 Sign-in with Aham ID

Sign-in is provided by the Aham identity service at id.aham.ro, using OpenID Connect and OAuth 2.0. When you sign in, it sends us the account details needed to verify you. Aham ID has its own Terms and Conditions and Privacy Policy, which cover the data it holds, including your credentials and any Google Sign-In you use there.

4. Public information

Your username or display name, avatar, posts, comments, karma and the time you posted are visible to other people, and may be indexed by search engines. Votes, saved posts and hidden posts are not shown publicly. Do not post anything you do not want to be public.

Reports and their optional details are not public. They are available to moderators and administrators for review.

5. Cookies and local storage

• Session cookie (signed): keeps you signed in. Strictly necessary.
• Preference cookies: store your language, theme and accent colour.
• Browser storage: stores notification preferences and short links on your device.
• Analytics and advertising cookies or scripts: loaded only if your consent allows them. When Google AdSense is enabled, Google may use cookies to show ads based on your previous visits to this site or other sites.

Change or withdraw consent any time with "Cookie settings" in the footer. You can also clear cookies and storage in your browser, but you may be signed out and lose your preferences.

You can manage Google's use of advertising cookies and personalised advertising at Google Ads Settings. You can also opt out of personalised advertising from participating companies through YourAdChoices. These controls are provided by third parties and may not stop non-personalised ads or all cookie use.

6. Who we share data with

We do not sell your personal data. We share it only with:

• Aham ID (id.aham.ro): for authentication.
• Hosting, database and infrastructure providers: to run the Service, under their own data-protection terms.
• Third-party analytics and advertising vendors, including Google: only where permitted by your consent choices; they may receive technical information from your browser and use cookies or similar technologies. Google AdSense may use information about your prior visits to this or other websites to select and personalise ads. See Google's advertising privacy information and use Google Ads Settings or YourAdChoices to manage personalised ads.
• Authorities or other parties: when the law requires it, or to protect rights, safety and the Service.

Links to external websites and embedded advertising are governed by those third parties' own privacy policies.

7. Transfers outside the EEA

Some providers may process data outside the European Economic Area. Where that happens, we rely on safeguards recognised by GDPR, such as an adequacy decision or standard contractual clauses.

8. How long we keep it

• Account and contributions: while your account exists.
• Post reports: until the report, its post, or the reporter's account is deleted, unless a longer period is required to handle a legal claim or comply with law.
• After deletion: when you delete your Aham ID account, we delete or anonymize your account data. Public posts and comments may be removed or anonymized, so threads still make sense.
• Technical logs: kept for a limited period needed for security and troubleshooting, then deleted or anonymized.
• Legal obligations and disputes: longer, where the law requires it or a claim needs to be defended.

9. Your rights

Under GDPR you can ask us to:

• give you access to your data and a copy of it;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• restrict how we use it;
• hand it over in a portable format;
• stop processing based on our legitimate interests (right to object);
• withdraw your consent at any time, without affecting earlier processing.

Write to admin@aham.ro; we will reply within one month. We may ask you to confirm your identity. You can delete your account through your Aham ID account settings (id.aham.ro).

You also have the right to complain to the Romanian data protection authority, ANSPDCP (dataprivacy.ro), or to the authority in your EU country of residence.

10. Children

The Service is for people aged 16 or over. If you believe a child under 16 has provided data to us, contact admin@aham.ro and we will delete it.

11. Security

We use reasonable technical and organizational measures to protect your data, including signed session cookies and access controls. No online service is completely secure, so we cannot guarantee absolute security. Tell us at admin@aham.ro if you find a vulnerability.

12. Changes to this policy

We may update this policy. We will change the "Last updated" date and, for material changes, give notice on the Service or by other reasonable means.

13. Contact

admin@aham.ro