Privacy Policy

kwyd is built on a simple principle: what you share with your friends is your business, not ours. This policy explains what we collect, why, and how we handle it. We collect only what's necessary to run the app and we don't sell your data to anyone.

1. Information We Collect

1.1 What you give us

When you create an account:

• Email address — for authentication and account recovery
• Password — stored hashed via Supabase Auth; we never see the plaintext
• Date of birth — to verify you're 13+ and for display to friends on your profile
• Username and display name — your identity in the app

When you use the app, you may also provide an optional bio, profile photo, kwyds (up to 32 characters), location attached to a kwyd, and direct messages to friends.

1.2 What we collect automatically

• Last active timestamp — approximately when you were last in the app, shown as a presence indicator to your friends. Not used for tracking.
• Last post date — the calendar date of your last kwyd, used only to calculate your posting streak.
• Push token — your APNs device token, if you enable notifications.

We don't collect device identifiers, advertising IDs, IP addresses beyond standard server communication, browser fingerprints, or behavioral analytics. We don't use any third-party analytics SDKs.

1.3 What we don't do

• We don't sell your information
• We don't share it with advertisers
• We don't track you across other websites or apps
• We don't use your data to train AI or machine learning models
• We don't expose your like counts or friend counts to other users
• We don't create public profiles — your content is visible only to accepted friends

2. How We Use Your Information

We use what we collect to create and manage your account, operate core app features, calculate your posting streak, deliver push notifications you've enabled, show your presence indicator to friends, respond to support requests, and comply with legal obligations. That's it.

3. How We Share Your Information

3.1 With your friends

When you post a kwyd, your username, display name, profile photo, kwyd text, and any optional mood or location are visible to your accepted friends for 24 hours. Your birthday is visible on your profile to friends. Your email, streak count, and message content are never shared beyond the direct participants.

Like counts are visible only to you. Friend counts are visible only to you.

3.2 With service providers

We use Supabase (Supabase, Inc.) for our database, authentication, file storage, and backend infrastructure. Supabase processes data on our behalf under a data processing agreement and does not use your data for its own purposes. We use Apple Push Notification service (APNs) to deliver notifications to your device. We have no other third-party data processors for the core Service.

3.3 Legal requirements

We may disclose your information if required by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of kwyd, our users, or the public.

3.4 Business transfers

In the event of a merger or acquisition, your information may be transferred. We'll notify you via the app or email before it becomes subject to a different privacy policy.

4. Data Retention

We retain your account information for as long as your account is active. Expired kwyds are removed from feeds after 24 hours but may be retained in an archived, non-visible state for aggregate tracking. Deleting your account initiates deletion of your personal information within 30 days, except where retention is required by law.

If you need messages deleted before account deletion, contact us at hello@kwyd.app.

5. Your Choices

You can delete your account at any time in the app's Settings. You can manage notification preferences in Settings and disable any type at any time. Location is always optional. You can update your profile information at any time.

California residents (CCPA)

You have the right to request access to, deletion of, and information about your personal information. We don't sell personal information. Email hello@kwyd.app to exercise your rights.

EEA and UK residents

You may have rights under applicable data protection law, including access, correction, deletion, and portability. Our legal basis for processing is the performance of our contract with you and our legitimate interest in security and fraud prevention. Contact us at hello@kwyd.app, or contact your local data protection authority.

6. Security

We use encrypted data transmission (TLS), hashed password storage, and row-level security policies that enforce access controls at the database level, with strict separation between public and private user data. No method of transmission or storage is completely secure, but we take it seriously.

7. Children's Privacy

kwyd is not directed at children under 13. We don't knowingly collect information from anyone under 13. If we discover we have, we'll delete the account immediately. If you believe a child under 13 has an account, email hello@kwyd.app.

8. Changes

We may update this policy from time to time. When we make material changes, we'll notify you through the app or by email at least 7 days before they take effect. Continued use after that date means you accept the updated policy.

9. Contact

kwyd
1449 S Michigan Avenue, Suite 13266
Chicago, IL 60605
hello@kwyd.app

We aim to respond to privacy-related requests within 30 days.