apps/web/README.md.
privacy policy
This explains what Pardy collects, why, who it goes to, how long it stays, and what you can do about it. It applies to the Pardy app and to this site.
The controller of your personal data is [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Contact email us. [DPO OR PRIVACY CONTACT: name and address, or a statement that no DPO is required] [EU / UK REPRESENTATIVE: required under GDPR art 27 and UK GDPR if the controller is outside those territories]
contents
1. what we collect, and why
Grouped by the part of the app that collects it.
signing up
| data | why |
|---|---|
| Your Apple or Google account identifier | To sign you in and to recognise you when you come back. We store the identifier the provider gives us, never your password. |
| Date of birth | To check you are 13 or over, and for nothing else. It is never shown to anyone in a circle. |
| Country | To apply the right age of consent rule for where you are. Country only. We do not collect a precise location, and the app never asks for location permission. |
| Declared age range, on newer iPhones only | If your device offers it and you agree, Apple tells us which age band you fall into. It is an extra check on the date of birth. If you decline, nothing changes. |
| Display name | So your circle knows who you are. |
Apple's and Google's sign in can return an email address. Pardy does not store one. [ENGINEERING: confirm at submission that no email column is populated, and keep the nutrition label consistent with it.]
playing and posting
| data | why |
|---|---|
| Photos, videos up to 30 seconds, voice notes and stickers you post | To show them to your circle, which is the product. Videos and voice notes recorded in the app carry a signed capture time so a deadline can be checked. |
| Messages, questions, dares and truth answers you write | To show them to your circle. |
| Where you dragged an item on the canvas | So everyone in the circle sees the thread laid out the same way. |
| Circle membership, who created a circle, join date | To run the circle and its rounds. |
| Rounds, votes, taps, commits, outcomes, reactions, streaks | To run the game and keep the history the circle can scroll back through. Votes stay sealed until the drop. |
| Your private topic settings | To filter out questions and dares you do not want to be asked. Never visible to your circle. |
| Your device time zone, through the circle | To fire a scheduled round at the right local time for the circle. |
safety
| data | why |
|---|---|
| The content of everything you post, scanned automatically before it goes live | To keep prohibited content off the app. See section 3 for who does the scanning. |
| Reports you make, and reports about you | To act on them. The reporter's identity is not shown to the author unless the reporter chooses to show it. |
| Strikes, restrictions, bans and appeals | To apply the ladder in the terms and to hear an appeal. |
| Blocks | To keep blocked members apart. |
subscription and notifications
| data | why |
|---|---|
| Whether you have Pardy Premium, and streak repairs you used | To unlock what you paid for. Apple and Google process the payment. We never see your card. |
| A push notification token, if you allow notifications | To tell you a round started, the wheel landed on you, or the drop is here. You can turn notifications off in your device settings at any time. |
2. legal bases
Under the UK GDPR and the EU GDPR we need a legal basis for each thing we do with your data. Ours are:
| what we do | basis |
|---|---|
| Running your account, your circles, the rounds, and storing and showing what you post | Contract, article 6(1)(b). This is the service you asked for, and it cannot work without this data. |
| Checking your age, and keeping under 13s off Pardy | Legal obligation, article 6(1)(c), and our legitimate interest in a safe product, article 6(1)(f). |
| Automated moderation, reports, strikes, bans, and reporting child sexual abuse material | Legal obligation, article 6(1)(c), and legitimate interest, article 6(1)(f), in protecting members and other people. We have balanced this against your interests and concluded it is necessary and proportionate. |
| Handling your subscription | Contract, article 6(1)(b). |
| Push notifications | Consent, article 6(1)(a). You give it at the system prompt and can withdraw it in your device settings. |
| Optional processing, if we ever add any | Consent, article 6(1)(a), asked for separately, and refusable without losing the game. |
Special category data, article 9. We do not ask for it. But a photo, a video or an answer can reveal something sensitive about you because of what you chose to put in it. Where that happens the basis is your own explicit act of making it public to your circle, article 9(2)(e), together with the substantial public interest in child protection for our safety scanning, article 9(2)(g). [COUNSEL: confirm the article 9 analysis, in particular the 9(2)(g) reliance and the domestic condition it rests on.]
Automated decision making, article 22. Moderation is automated. A restriction or a ban has a real effect on you, so you have the right to a human review: appeal from inside the app, or write to email us. A person reads every appeal.
3. who processes it for us
These are our processors. They act on our instructions and cannot use your data for their own purposes. We do not sell your data and we do not share it with advertisers.
| who | what they do | what they see |
|---|---|---|
| Cloudflare | Runs the whole service: the servers, the database, the media storage, the real time connection, and the safety classifiers that run inside our own Cloudflare account. | Everything you post and everything in your account. |
| OpenAI | Its moderation endpoint checks text at the moment you submit it. | The text of a message, question, dare or answer, and the transcript of a voice note. No name, no account identifier, no other account data. |
| Microsoft, PhotoDNA | Checks uploaded images and video frames against known child sexual abuse material by comparing a mathematical hash. | A hash of the image. On a match, the image and the account, which are then reported. |
| Apple and Google | Sign you in, take subscription payments, and deliver push notifications. | What their own privacy policies describe. They are independent controllers for the payment, not our processors. |
| TelemetryDeck | Anonymous product analytics, if and when we switch it on. | Anonymous, aggregated signals with no account identifier. [ENGINEERING: this is not in the shipped app today. Remove this row, or add the SDK, before the store privacy labels are filed. Do not do one without the other.] |
We also disclose data where the law requires it: to the National Center for Missing and Exploited Children and to law enforcement in child safety cases, and in response to a valid legal request.
4. how long we keep it
Pardy does not expire content. What you post to a circle stays there until you delete your account or ask us to remove it. That is deliberate: the point of a circle is that a year later you can scroll back to the first round.
Your account data is kept while your account exists. When you delete it, section 5 applies. Moderation records, strikes and bans are kept for as long as needed to enforce them: strikes decay after 90 days, and a record of a permanent ban is kept so that a banned person cannot simply come back.
5. your rights, and how to use them
If you are in the UK, the EU, or somewhere with similar law, you have the right to access your data, correct it, delete it, take it elsewhere, object to processing based on legitimate interest, restrict processing, and withdraw a consent. You can exercise most of them yourself, immediately, without asking us.
see and take your data
In the app, open Settings and choose the data export. You get a JSON file with your profile, your settings, your circles, the items you posted, the media you own, and your block list, downloadable on a private link. It contains your own data only: nobody else's messages, and never the identity of anyone who reported you.
delete your account
In the app, open Settings and choose to delete your account. It is immediate and cannot be undone. If you cannot sign in, use the deletion page.
Deletion removes:
- every photo, video, voice note and sticker you own, and any sticker cut from your captures, wherever it appears
- your profile picture, display name, date of birth, country, declared age range, settings, block list and any export you generated
- your link to Apple and Google, so signing in again creates a new empty account
- your membership of every circle
Deletion leaves behind:
- the text messages you wrote in a circle, shown as written by a former member, with no name and no picture, and a placeholder where your rounds were. This is other people's conversation as much as yours, and removing your half would break their history. Nothing in it identifies you.
- the fact that an account with your Apple or Google identifier was deleted, so that a person we banned cannot come straight back
- records we are legally required to keep, such as a child safety report already filed
get a photo or a sticker of your face removed
Members can cut stickers from photos and videos, including ones with your face in them, without asking you first. If you want something with your face in it taken down, use the support address shown on the support page or the support form and pick the face removal request. We handle these by hand. You do not need to delete your account to do this, and you do not need to be in the circle where it appears.
everything else
For access in another format, correction, restriction, objection or anything the in app tools do not cover, write to email us. We answer within one month, as the GDPR requires, and we do not charge for it.
6. young people's data
Pardy is for 13 and up. It is not for children under 13, and we do not knowingly collect their data. The date of birth gate runs before anything else is collected, and a date under 13 closes the account immediately and signs out every session. If you believe a child under 13 has an account, tell us at email us and we will remove it.
Several countries set the age at which a young person can agree to their own data processing above 13. Across our launch markets: 13 in the United Kingdom, Portugal and Sweden; 14 in Italy and Spain; 15 in France; 16 in the Netherlands, Germany, Poland and Japan; guardian consent up to 17 in Taiwan; parental consent under 12 in Brazil. Where you are below your country's age, a parent or guardian must agree on your behalf and we rely on that agreement.
We store your date of birth and country so that a parent consent flow can be switched on per country. [COUNSEL: this flow is not built yet. Confirm the position for each launch market, and whether any storefront should be held back until it is.]
A parent or guardian can ask to see, correct or delete their child's data at email us.
7. international transfers
Our processors operate globally, so your data may be processed outside the country you live in, including in the United States. Where data leaves the UK or the European Economic Area we rely on the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses, with a transfer risk assessment on file, or on an adequacy decision where one covers the destination. Cloudflare stores media in [R2 JURISDICTION: set the bucket location, and state it here]. [COUNSEL: confirm the transfer mechanism for each processor and attach the assessments.]
8. security
Everything is encrypted in transit. Media lives at unguessable addresses, and anything hidden or reported can only be reached through a short lived signed link. Access to production data is limited to the people who need it. No system is perfect, and if a breach affects you we will tell you and the regulator as the law requires.
9. what we do not do
- We do not track you across other apps or websites. There is no advertising identifier, no App Tracking Transparency prompt, and no ad network in the app.
- We do not sell or rent your personal data.
- We do not build advertising profiles.
- We do not train machine learning models on your content. Our safety classifiers read your content to make a decision about it, then that decision is what we keep.
- We do not ask for your location, your contacts, your calendar, or your photo library as a whole. Picking a photo uses the system picker, which hands us the one picture you chose.
10. this website
This site sets no cookies and runs no analytics. Nothing here tracks you. If you send the support form, we store what you typed, your email address, and the time you sent it, so we can reply to you and keep a record of the request. Those records are kept for [SUPPORT RETENTION: set a period, 24 months is typical] and then deleted. The site is served by Cloudflare, which keeps standard request logs.
11. our impact assessment
Pardy processes the personal data of young people at scale and uses automated decision making, so we have carried out a Data Protection Impact Assessment under article 35, covering the age gate, automated moderation, indefinite media retention, and the sticker practice described in section 5. We review it before each significant change. To ask about it, write to email us. [OWNER: the DPIA must actually be written and signed off before launch. This paragraph is not true until it is.]
12. changes
We will post any change here and update the date at the top. If a change matters we will tell you in the app before it takes effect.
13. complaints
Write to us first at email us. If we do not resolve it you can complain to your data protection authority. In the UK that is the Information Commissioner's Office. In the EU it is the authority in the country where you live. [LEAD SUPERVISORY AUTHORITY: name it once the establishment is settled]