Where your data lives

Where Debaty runs, and under which law

Debaty runs on one server in Lelystad, at a Dutch provider. The database, the email, the translation and the moderation AI all sit on that same machine. There is one party at the door, though, since 7 August 2026: Cloudflare takes the traffic to debaty.com before it reaches us.

One part is different, and it is exactly the part we are not going to gloss over: your photos and videos are stored with Cloudflare. That storage is restricted to the European Union, but Cloudflare is a US company, and legally those are not the same thing. Further down you can read what that means and which data it affects.

Last checked against the running system on July 27, 2026.

What we run ourselves

One machine in the Netherlands. Everything below sits on it, and nobody else manages it.

The server
The machine Debaty runs on. It sits in Lelystad, in a Dutch data centre, and belongs to a Dutch company.
Run by
Onworx BV
Country
Netherlands
Law
Dutch law
The website
The pages you are reading now. They run on the server above.
Run by
JGHP B.V.
Country
Netherlands
Law
Dutch law
The back end
The part that stores your posts and hands them back. Runs on the same machine as the website.
Run by
JGHP B.V.
Country
Netherlands
Law
Dutch law
The database
Your account, your posts, your conversations: everything Debaty keeps about you. On the same machine, not with a cloud service.
Run by
JGHP B.V.
Country
Netherlands
Law
Dutch law
Memory and queues
Temporary storage for things still needed in a moment, such as notifications waiting to be sent.
Run by
JGHP B.V.
Country
Netherlands
Law
Dutch law
Email
Our own mail server, on the same machine. There is no American mail provider in between.
Run by
JGHP B.V.
Country
Netherlands
Law
Dutch law
The reverse proxy on our own machine
Distributes incoming traffic across the components above. Runs on the same server in Lelystad. For next.debaty.com and status.debaty.com this is the outermost layer; for debaty.com Cloudflare sits in front of it.
Run by
JGHP B.V.
Country
Netherlands
Law
Dutch law
The security layer in front of the site
Takes all traffic to debaty.com before it reaches our server, and keeps attacks and abuse out. Your request arrives at the Cloudflare data centre nearest to you — for the Netherlands that is Amsterdam. Cloudflare terminates the secure connection there, so it sees your traffic and your IP address, and it places no cookie on your device. next.debaty.com and status.debaty.com deliberately do not pass through it.
Run by
Cloudflare
Country
Varies per visitor
Law
Outside the European Union
There is a caveat to this one — see below
The domain name
debaty.com is registered through a German company. The name servers are in the Netherlands.
Run by
Key-Systems GmbH
Country
Germany
Law
European law, with possible US access
There is a caveat to this one — see below

What takes part while you use Debaty

Some things we do not do ourselves. Here is who does, and what they get to see.

Photos and videos
What you upload yourself is stored with Cloudflare, restricted to the European Union. The storage is shielded: your browser fetches the files through Debaty, never straight from Cloudflare.
Run by
Cloudflare
Country
European Union
Law
European law, with possible US access
There is a caveat to this one — see below
Payments
If you take Debaty+, your payment goes through Mollie. Your bank details end up with them and not with us.
Run by
Mollie
Country
Netherlands
Law
Dutch law
Identity check
Only if you start one yourself. Veriff checks your document; we get the outcome, never a copy.
Run by
Veriff
Country
Estonia
Law
European law
Second opinion on moderation
If our own moderation AI is unsure about a post, Debaty asks Mistral in France for a second opinion. Only those borderline cases, and it is recorded in the moderation log.
Run by
Mistral AI
Country
France
Law
European law
Searching for GIFs
Type a search term in the GIF picker and that term goes to KLIPY. Nothing about who you are goes along, and the images reach you through Debaty.
Run by
KLIPY
Country
Georgia
Law
Outside the European Union
There is a caveat to this one — see below
Push notifications
A notification on your phone or computer travels through your browser's push service — Google for Chrome, Apple for Safari, Mozilla for Firefox. You pick that party by picking a browser; we cannot route around it.
Run by
JGHP B.V.
Country
Varies per visitor
Law
Varies by browser
There is a caveat to this one — see below
Visitor counts
We count how often a page is viewed using software on our own server. Without cookies, and not tied to your account.
Run by
JGHP B.V.
Country
Netherlands
Law
Dutch law
Translating posts
The "translate this post" button runs on our own server. The text does not go to a translation service.
Run by
JGHP B.V.
Country
Netherlands
Law
Dutch law
Detecting the language
Working out which language a post is in, so we show it to the right readers. Also on our own server.
Run by
JGHP B.V.
Country
Netherlands
Law
Dutch law
Moderation AI
The model that assesses posts runs on our own hardware. What you write does not go to an American service for that.
Run by
JGHP B.V.
Country
Netherlands
Law
Dutch law

What we use while building

This does not run inside Debaty and never meets your data. It is here because otherwise you read somewhere else that we use it, and wonder why it was missing here.

The question of the day and the translations
We have an AI tool from Anthropic propose the question of the day, and we use the same tool for translating the buttons and texts. Both happen by hand, separately from the running site. No member data goes into it: only the instruction and the calendar.
Run by
Anthropic
Country
United States
Law
Outside the European Union
There is a caveat to this one — see below

Where it is not perfect

A page like this is worthless if it only carries the good news. These are the places where "European" earns an asterisk — and why they are still here.

The security layer in front of the site
Since 7 August 2026 all traffic to debaty.com passes through Cloudflare first, and the secure connection is terminated there. That makes this the party that sees the most of your use: every page you request, every post you write, every login attempt, and your IP address. Unlike the storage of your media there is no jurisdictional boundary set — which data centre handles your request depends on where you are. And Cloudflare is an American company, so the CLOUD Act applies here too. Why that layer is there: without it, one server in Lelystad is the only thing standing between Debaty and an attack. What we do not use it for: following visitors, setting cookies or buying in statistics.
The domain name
debaty.com ends in .com, and that registry is run by an American company. In practice that means a US court could in theory say something about the domain name — not about your data, which sits separately. The registration itself runs through a German company.
Photos and videos
Your photos and videos are stored with Cloudflare. A setting pins that storage to the European Union, so the files physically sit in Europe. But Cloudflare is a US company, which means the American CLOUD Act applies: it can compel the company to hand over data, even data held in Europe. What this affects: the images and video you publish yourself. What it does not affect: your account, your posts, your conversations, your payments — those are in the Netherlands. We are currently weighing up whether to move to a European provider.
Searching for GIFs
The GIFs come from KLIPY, a company in Georgia with an office in the United States. What goes over there is your search term and our server's address, nothing more — we deliberately send no marker that would identify you. Do not use the GIF picker and nothing goes at all.
Push notifications
A push notification can only arrive through your browser's push service, which is Google for Chrome, Apple for Safari and Mozilla for Firefox. The text of the notification passes through it. That is not something we can build around; it is how the web standard works. Turn push notifications off and it does not happen.
The question of the day and the translations
For the question of the day and for translating the texts in the app we use an AI tool from Anthropic, a US company. It does not run inside Debaty but by hand, while building. No member data goes into it — the difference between "we use an American AI service" and "we send your data to an American AI service" is exactly the point here, and we do not do the second.

If something here looks wrong to you, or we are missing something, let us know — this page exists to be checked.

What does not happen

We do not sell your data and we do not trade it. There is no data trade in how we make money. Read the privacy statement
Ads are not targeted at you personally. There is no profile of you that advertisers can buy. How we make money
We do not follow you across other websites. There are no third-party trackers in Debaty. What we do place
We use no cookies for visitor counts. That is also why there is no cookie banner to click away. Our cookie policy
The moderation AI runs on our own hardware, so your posts do not leave the building for it by default. Our moderation policy

Check it yourself

Nothing on this page has to be taken on our word. Here is where you check it:

Your data passport — everything we hold about you, with who gets to see each kind. You do need to be signed in: it is about you.
The privacy statement — what we keep, for how long, and on what grounds.
The list of processors — the parties we have a processing agreement with, and their role.
How the timeline works — which signals order your timeline, and which ones we deliberately do not use.
The status page — whether the parts on this page are running right now, measured rather than promised.