Privacy Policy

Relatably is a daily one-question app. We try to collect as little as possible while still running the daily drop, the wordcloud, the leaderboard, and push notifications. This page explains exactly what data we touch and why.

Recommendations for our other apps

In Settings, the app can fetch up to three recommendations for our other apps. The choices depend on the app you are using, App Store availability and iOS compatibility, not on your personal data or activity inside the app. App icons load from Apple’s image servers. Opening a recommendation takes you to the App Store with a campaign label identifying the source app and placement, never a person.

We count qualified views and successful opens in aggregate. Our service stores daily counts with the source app, recommended app, placement, configuration revision and optional presentation variant. It does not store an account, advertising identifier, device identifier, persistent visitor identifier or personal profile, and it does not receive the app’s private content. These counts cannot tell us who installed an app.

The recommendation service is hosted by Supabase. Network requests necessarily expose an IP address to the hosting provider for delivery and security; our aggregate counter does not store it. See Supabase’s privacy policy. Apple processes icon requests and App Store visits under Apple’s privacy policy.

1. What we collect

• Anonymous device ID — a random ID generated on first launch and stored locally on your device (Expo SecureStore). The server only ever sees a SHA-256 hash of this ID. It is used to deduplicate submissions and gate the daily reveal.
• Your free-text answer — what you type into today's question. We aggregate it into the wordcloud and store it in our database (Firestore).
• Submission timestamp + dwell time — when you submitted and how long you spent before tapping submit. Used for anti-cheat scoring.
• IP address (hashed) — used only to rate-limit submissions per IP. We never store your raw IP.
• Push token (FCM) — if you grant notification permission, we store the token so the daily drop can ping you. You can revoke this in iOS settings at any time.
• Apple ID (only if you sign in) — if you tap "Sign in with Apple" we receive a stable user identifier from Apple and an opaque email (Apple may relay it). We use this to score the leaderboard and link the friend graph. You can use Relatably entirely without signing in.
• Friend graph (only if you sign in) — the user IDs of accounts you friend, plus pending friend requests.

2. What we do NOT collect

• No name, address, phone number, or birthday.
• No location.
• No contacts.
• No camera, microphone, or photo-library access.
• No third-party analytics SDK on the iOS client (no PostHog, no Mixpanel, no Firebase Analytics).

3. Third parties that process your data

• Google Firebase (Firestore, Auth, Cloud Messaging, Remote Config) — stores submissions, the wordcloud, the friend graph, and routes push notifications. Subprocessor agreement: firebase.google.com/support/privacy.
• Vercel — hosts our backend; receives request metadata (URL, hashed IP, anonymous device ID hash). vercel.com/legal/privacy-policy.
• Sentry (server-side only) — receives stack traces from our backend if it crashes. No PII attached. sentry.io/privacy.
• Google Perspective API — your submitted answer text is sent to Google for toxicity scoring. Google's policy: policies.google.com/privacy.
• Google AdMob — when ads are enabled, AdMob shows display ads using Apple's SKAdNetwork (privacy-preserving attribution). We do not pass user identifiers. policies.google.com/technologies/ads.
• Branch.io — used for install attribution when you tap a referral link. Branch may collect anonymous device fingerprints. branch.io/policies.

4. Data retention

Submissions, hashed device IDs, and aggregated wordclouds are retained indefinitely so that the public archive of past questions stays readable. If you delete your account (see §6) we delete your signed-in identity and friend graph; we do not retroactively scrub your anonymized historical answers from the wordcloud, because they are already aggregated and not tied to you in any retrievable way.

5. Children

Relatably is rated 12+. We do not knowingly collect data from children under 13. Parents who believe their child has used Relatably can email the address above and we will delete any associated identifier.

6. Your rights (GDPR / CCPA)

You can request access to, rectification of, or erasure of your personal data by emailing levin.schwab@gmx.de. Account deletion: if you signed in with Apple, you can revoke Relatably in Settings → Apple ID → Sign in with Apple on your iPhone, OR email us. We will permanently delete your signed-in identity, friend graph, and leaderboard entries within 30 days.

7. Changes to this policy

We will post any changes to this URL. Material changes will be announced in-app at next launch.

8. Contact

Levin Schwab
levin.schwab@gmx.de
Germany