Privacy Notice — SomniTalk
Effective date: 29 August 2026
This notice covers SomniTalk, the community forum at somnitalk.com. It does not cover the SomniCharts application: the app has its own privacy policy, its own database and its own login, and the two systems do not exchange your data. If you are looking for what happens to your uploaded CPAP data, that is the SomniCharts privacy policy, not this page.
1. Who is responsible
SomniCharts Inc., registered in Canada, operates SomniTalk and is the data controller for everything described here.
Contact: [email protected] (delivered to [email protected]).
2. What the forum collects
When you register
- Username — public, and shown on everything you post.
- Email address — not public. Used to verify the account, to send password resets, and to send the notifications you switch on.
- Password — stored only as a salted hash. We never see it.
When you use the forum
- Everything you post — topics, replies, edits, reactions, votes, tags, uploaded images and anything you type into your public profile. All of it is public and indexed by search engines.
- IP addresses, recorded with account registration and with sessions. They are used for spam and abuse control, for banning, and for security investigation.
- Technical logs — request logs and error logs from the web server, which contain IP addresses, timestamps, browser user-agent strings and the pages requested.
- Session cookies — a login session cookie, a CSRF token, and the small preference cookies the forum software uses (theme, unread markers). No advertising cookies. No third-party analytics or tracking pixels are embedded in forum pages.
What we deliberately do not collect
- No CPAP or sleep data. Nothing you upload to SomniCharts is visible to this forum, and this forum has no access to it.
- No payment information. The forum takes no payments.
- No advertising profile, and no sale or rental of your data to anyone, ever.
2A. Usernames, identity, and what may not appear here
These rules exist because everything you post is public and permanent, and because patient forums are read by people whose interest in you is not friendly.
- One continuous handle, not a name. Your username must be a single continuous handle — letters, digits, underscores or dashes, no spaces — and must not be, or look like, a real person's first and/or last name. Not yours, not anyone else's.
- Real-name usernames are suspended. If we identify a username as a real name, the account is banned until the member writes to [email protected] asking for it to be changed to a non-name handle; the ban is lifted when the change is made. Offensive, profane, hateful or impersonating usernames are treated the same way.
- No other personal identifiers — anywhere. Phone numbers, driver's licence or other government ID numbers, vehicle registrations, dates of birth, addresses, insurance or policy numbers, clinic account numbers, and therapy-device serial numbers — yours or anyone else's — are not tolerated in usernames, profiles, posts, or images. We redact or remove them when we see them; posting them repeatedly is a breach of the Code of Conduct.
- A separate account, on purpose. SomniCharts users must create a separate SomniTalk account. The forum and the app share no login, no database and no data — and because some SomniCharts usernames are real names, reusing your SomniCharts username here is not allowed. Choose a fresh handle.
3. Why we process it
- To run the forum — showing your posts to other people is the entire purpose of a public board (contract / legitimate interests).
- To keep it usable — spam prevention, abuse handling, moderation and security (legitimate interests).
- To contact you about your account — verification and password resets (contract), and optional notifications (consent, withdrawable in your settings).
- To comply with law where we are required to.
4. Who can see it
- Anyone on the internet sees your username, your posts, your public profile and when you were last active.
- Staff and moderators additionally see your email address, your registration and session IP addresses, and moderation history.
- Service providers who host the forum on our behalf and deliver our email process data under contract and only on our instructions.
- Law enforcement or a court, where we are legally obliged to disclose.
We do not share your email address or your IP address with other members, and we never sell any of it.
5. Where it is processed
The forum runs on infrastructure operated by SomniCharts Inc. Data may be processed in Canada and, for email delivery, in the United States, with appropriate safeguards including standard contractual clauses where required.
6. How long we keep it
- Posts stay up as long as the forum does. They are part of a conversation other people contributed to — removing one post can make a whole thread meaningless — so deleting your account does not automatically delete your posts (see below).
- Email address and account record — for the life of the account, then removed when the account is deleted.
- IP addresses and session records — retained for spam, abuse and security purposes, and routinely purged after 90 days, except where they are attached to an ongoing abuse or security matter, or to a ban.
- Web server and error logs — rotated and deleted on a rolling window of no more than 14 days.
- Backups — encrypted, held off-site, and rotated. A deletion may persist in a backup for up to 35 days before it ages out.
7. Your rights
Depending on where you live (PIPEDA in Canada, the GDPR in the EU/UK, and various US state laws), you can ask us to:
- give you a copy of what we hold about you,
- correct anything inaccurate,
- delete your account,
- restrict or object to processing,
- withdraw consent for optional emails at any time.
How to ask: write to [email protected] (delivered to [email protected]) from the address on the account, or post in the Site Feedback category. We answer within 30 days.
What deletion actually does. We remove your account, your email address, and the association between you and your posts. By default the posts themselves remain, attributed to a deleted user, because other members' replies depend on them. If you want the content removed as well, say so — tell us which posts, and we will remove them unless we are legally required to keep them. We will not silently gut a long thread without telling you what that does to it.
If you are unhappy with our answer you may complain to your data protection authority — in Canada, the Office of the Privacy Commissioner.
8. Children
SomniTalk is not intended for anyone under 13, and we do not knowingly hold accounts or data belonging to them. If you believe a child under 13 has registered, write to [email protected] and we will delete the account and its data.
9. Security
Traffic is encrypted in transit (HTTPS/TLS). Passwords are salted and hashed. Administrative access is restricted to named staff, protected by an identity gate and audited. Backups are encrypted. No system is perfect; if we discover a breach affecting your data we will notify you and the relevant authority as the law requires.
10. Changes to this notice
We will post material changes as an announcement on the forum and update the date at the top of this page. Continuing to use SomniTalk after a change means you accept the updated notice.
Related: Terms of Use · Code of Conduct · Medical Disclaimer
Nothing on SomniTalk is medical advice. Talk to your own clinician before changing therapy.