Privacy policy

1.Who we are

Phantom is a desktop app for Animal Jam Classic, sold and run by the people behind phantm.site. This policy covers the app, this website and the Phantom API. Questions? Email privacy@phantm.site.

Phantom isn’t affiliated with Animal Jam or WildWorks. What Animal Jam does with your data is between you and them, and their own privacy policy covers it, not this one.

2.What stays on your computer

Most of Phantom never leaves your computer. None of this is sent to Phantom’s servers, and we can’t read any of it:

• Your Animal Jam username and password. They go into the desktop app, get saved in your operating system’s keychain, and are sent from your computer to Animal Jam’s own sign in, the same way the game sends them.
• What your game does. That means the rooms you visit, what you say, what you own, what you trade, and all the packets between the game and Animal Jam. Phantom’s proxy runs on your computer, and the traffic goes from there to Animal Jam and back. The one exception is the Phantom community, below, if you use it.
• The scripts you write, and what they print.
• The plugins you install, the settings you give them, and anything they store.
• Your app settings and your theme.

3.Your Phantom account

So we can sell you a plan and let you use the app, Phantom’s API keeps your email address, a hash of your password (never the password itself), whether and when you confirmed the address, and when you made the account.

It also keeps your sessions, as hashes of the session and refresh tokens with their expiry, so a session can be checked and ended. If you ask for a password reset link, it keeps a hash of that until it’s used or runs out.

4.The Animal Jam players you link

When the desktop app signs in to Animal Jam, it shows the API the sign in token it got, once, so the API can ask Animal Jam whose it is. The token isn’t kept.

What we do keep is Animal Jam’s own id for that player, its screen name, which Phantom account it belongs to, and when it was last played through Phantom. That’s how a plan is tied to the accounts playing, and how we stop one plan being shared by lots of people.

You can unlink a player from your dashboard at any time, and that deletes the record.

5.Your plan

Phantom keeps which plan you’re on, the state of its subscription, when the paid period ends and whether it’s set to renew, along with Stripe’s ids for your customer and subscription.

Stripe takes the payments, not us. Your card never touches Phantom’s servers, and we never see its number. Stripe is a processor in its own right, and what it keeps is covered by Stripe’s privacy policy.

6.Crash reports

When the app crashes, it offers to send a report. The report has the error’s name and message, the stack frames, where in the app it happened, the app version, and your operating system and its version. Before sending, the app strips out credentials, Animal Jam account names and file paths on your computer.

If you’re signed in, the report is linked to your account so we can tell you when it’s fixed. If you’re not, it’s sent without an account, because a crash during sign in is exactly the kind we want to hear about.

7.The Phantom community

Phantom doesn’t have its own chat. You meet other Phantom users through plugins, in shared rooms and through plugins’ real-time channels (below). A shared room is a plugin’s own room that several Phantom users can be in at once. Both go through Phantom’s server over one connection, which your app only opens while a plugin is using it. Your app tells the server which of your linked players is playing, and the server checks that player is linked to your account before anyone sees you as them.

In a shared room, your app sends what your avatar looks like (its animal, colours and clothes), where you walk, and what you say, so the others in the room can see you. What you say is passed on to the Phantom users in that room and nobody else. The server masks slurs and removes links, and your app masks swearing before it shows anyone’s words. Animal Jam is never told the room exists.

What’s said in shared rooms is passed on, not stored. The server holds the last half hour in memory so it can be reported, then forgets it. Reports are kept. A report records what was said, who said it and under which screen name, where, when, who reported it and why, so our moderators can decide what to do.

A plugin can list the shared rooms that have people in them. It’s told each room’s name, which plugin it’s from and how many people are in it, but never who.

You can hide someone you meet through a plugin. After that, neither of you sees or hears the other in any shared room or real-time channel, and they aren’t told. The people you’ve hidden are kept with your account, as ids, until you unhide them.

The connection between your app and Phantom’s server is encrypted, but it isn’t end to end. The server reads what’s said in shared rooms so it can mask slurs, remove links and be moderated. Phantom’s moderators can watch the community live while moderating. They can see who’s connected (by Animal Jam screen name only), which shared rooms they’re in, and what’s said there as it’s passed on. The live view never shows which Phantom account is behind a screen name. Watching doesn’t store anything else, but the fact that a moderator watched, and for how long, goes in our audit log. A moderator can disconnect someone, or ban the account behind them from the community. Both go in our audit log with the account they applied to.

8.Plugins’ real-time channels

If you allow a plugin to use real-time channels, it can talk live to other people running the same plugin. That might be people in your Animal Jam room, everyone online, or a group the plugin picks. What it sends goes through Phantom’s server, over the same encrypted connection as the Phantom community, to the other players in that channel running the same plugin, and nobody else. What a plugin sends is up to the plugin. The server doesn’t change or filter it.

The other players’ copies of the plugin see who’s in the channel by your Animal Jam screen name and an id made just for that plugin. The id stays the same whenever you come back to that plugin and is different for each other plugin. It can’t be turned back into your Phantom account, your username, your email or Animal Jam’s id for you, and a plugin is never sent any of those.

For safety and security, Phantom’s moderators can watch real-time plugin messages live. They see which plugin, which channel, who sent each message and to whom (by in-game screen name only), and what it contained. To make that possible, the server holds the last half hour of messages in memory, then forgets them, and forgets all of them when it restarts. Nothing a plugin sends is stored. Moderators never see which Phantom account is behind a screen name, and the fact that a moderator watched goes in our audit log, the same as for the rest of the community.

Moderators can turn off a plugin’s real-time channels. We keep a record of that, with who did it and why, until they turn them back on. Anyone banned from the community can’t use them, and anyone you hide is left out of your channels, and you out of theirs. You can report a plugin for what it does with its live messages, and the report is kept like any other plugin report.

9.The plugin store

Anyone can browse the store without an account, and we don’t keep anything about people who do.

If you publish a plugin, we keep what you published. That’s its id, name, title, description, the author name you publish under, its links, each version with its manifest, README, permissions and package, and how many times it’s been downloaded. All of that is public, because it’s a listing.

Downloads are counted once per person (or per address) per plugin per day, using a keyed hash of the account id or address, so the count can’t be traced back to who downloaded what.

If you report a plugin, we keep the report. It includes your account, the plugin and the version you named, the reason you picked, what you wrote, and what Phantom’s staff decided. Staff read it. The plugin’s author is never told who reported it and never sees the report.

10.This website

The site keeps your session and your theme in your browser’s own storage. It doesn’t set any cookies of its own, doesn’t run analytics, and has no ads or third-party trackers.

Our servers log basic request information (the address asked for, the time, the status and the requesting IP address) for a short time, to keep the service running and to apply rate limits.

11.Email

We email you about your account. That means the link to confirm your address when you sign up, which you need to open before you can sign in, the link to choose a new password, and notices about your plan or a plugin you published. We don’t send marketing emails.

12.Who else is involved

Phantom uses a small number of services, each doing one job:

• Stripe, for payments and subscriptions.
• Our hosting and database providers, who store what’s described above.
• Our email provider, for the account emails above.

We don’t sell your data, and we don’t share it with anyone for advertising.

13.How long we keep it

Your account and its linked players are kept while the account exists. Sessions and password reset links are deleted when they expire. Crash reports are kept while they’re useful for fixing the problem. Plugin reports are kept while your account exists, as the record of what was decided. Records we need for tax and accounting, mainly invoices, are kept for as long as the law requires, which is usually six years.

14.Deleting your account

Email support@phantm.site from the address on the account. We’ll delete the account, its sessions, the Animal Jam players linked to it, its crash reports and any plugin reports it made. Cancel your plan in Stripe first, or it’ll keep renewing. Any plugin you published is unlisted. Copies other people have already downloaded are on their computers and out of our reach.

15.Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email privacy@phantm.site. If you’re in the UK or the EU, you can also complain to your data protection authority.

16.Security

Passwords are hashed, never stored as they are. Session and reset tokens are stored as hashes too, so a copy of the database wouldn’t let anyone sign in as you. All traffic between the apps and the API goes over HTTPS.

17.Children

Phantom isn’t for children. We don’t knowingly make accounts for anyone under 18. If you think we have, tell us at privacy@phantm.site and we’ll delete it.

18.Changes to this policy

When we change this policy, we update the date at the top of this page. For changes that matter, we’ll tell you before they take effect.