Privacy Policy

Effective Date: November 19, 2025

Introduction

Timeside, LLC ("we," "us," "our") operates Told Ya. This Privacy Policy explains how we collect, use, and protect your information.

By using Told Ya, you agree to this policy. If you don't agree, don't use the Service.

1. Information We Collect

Account Info (via Google OAuth):

Name, email, profile photo
Display name (1-30 characters)
Avatar color

Challenge Content:

Questions, responses, guesses
Photos/videos you upload
Comments, votes, reactions
Stakes descriptions (non-monetary)

Device & Usage:

Device type, OS version
Device ID (automatically collected by analytics)
User ID (your account identifier)
Features used, screen views, time spent
Crashes, errors, performance data
Session activity

Support & Feedback (Optional):

Name and email (only when you contact us or submit feedback)
This is used solely to respond to your inquiry

                        What We DON'T Collect:
                        Precise or general location
Contacts
Microphone/audio (except in videos you choose to upload)
Health or financial data
Browsing or search history

                    

2. How We Use Your Info

Provide Service: Accounts, challenges, results, notifications
Social Features: Show your name/avatar to challenge participants
Payments: Process PRO subscriptions via RevenueCat/Apple/Google
Analytics: Amplitude tracks feature usage, user behavior, and app interactions to help us improve the app
Error Tracking: Sentry monitors crashes, bugs, and performance issues
Safety: Fraud prevention, content moderation, security
Communication: Service updates, support responses, optional marketing

Tracking:

We track your activity WITHIN Told Ya to improve your experience. We do NOT track you across other apps or websites.

Specifically:

Amplitude tracks feature usage and user behavior within Told Ya
This helps us understand which features are popular and how to improve
Sentry monitors app sessions to measure stability and performance
You can limit tracking by disabling "Allow Apps to Request to Track" in iOS Settings > Privacy & Security > Tracking

3. How We Share Your Info

With Challenge Participants (Semi-Private Model):

When you join a challenge, other participants see:

Your display name & avatar
Join timestamp & participation status
Your responses (based on creator's visibility settings: hidden/reveal after submit/real-time)
Photos/videos you submit
Your votes & comments

Challenges are NOT publicly searchable. Only invited people or those with the join code can see challenge details.

With Service Providers:

Supabase: Database storage & authentication
Cloudflare Workers/R2: Backend APIs & file storage
RevenueCat: Subscription management
Apple/Google: Payment processing
Google OAuth: Authentication
Amplitude: Product analytics (feature usage, user behavior)
Sentry: Error tracking, crash reports, performance monitoring
Expo: Push notifications

                        We do NOT:
                        Sell your data
Share with advertisers
Make challenges public
Show your email to others

                    

For Legal Reasons:

Court orders, subpoenas
Protect rights/safety
Fraud prevention

4. Account Deletion & Data Retention

When You Delete Your Account:

Immediate (happens instantly):

Account deactivated permanently (no reactivation)
Email & OAuth credentials disconnected
Profile inaccessible
Personal identifiers removed
Device tokens deleted

Anonymized (happens instantly):

Display name → "Deleted User"
Avatar → Generic placeholder
Your responses preserved (anonymized)
Challenges you created remain active (anonymized)

Why anonymization? Other participants rely on challenge data. We remove your identity immediately but keep anonymized records so their challenges aren't disrupted.

Database backups: Purged after 90 days.

5. Your Rights

All Users:

Access: View your data anytime
Export: Settings > Data Management > Export (JSON/CSV, emailed within 24 hours)
Delete: Settings > Account > Delete Account (permanent, no undo)
Correct: Update display name/avatar in Settings
Opt-Out: Disable notifications, unsubscribe from marketing emails

California Residents (CCPA):

Right to know what data we collect
Right to delete (anonymization process above)
Right to opt-out of sale: We do NOT sell your data
Right to non-discrimination

EU/UK Residents (GDPR):

All CCPA rights, plus:
Right to restrict processing
Right to data portability
Right to object
Right to lodge complaint with data protection authority

Legal basis (EU): Contract performance, legitimate interests, consent, legal obligation.

Contact: contact@itoldya.app with subject "[State] Privacy Rights Request"

Response time: 30-45 days

6. Security

We protect your data with:

TLS/SSL encryption in transit
Database encryption at rest
OAuth 2.0 authentication
Role-based access controls
Regular security audits

Data breach notification: We'll notify you within 72 hours if your data is compromised.

No system is 100% secure. Use a strong Google password and enable 2FA.

7. Children's Privacy (COPPA)

Age requirement: 13+

We don't knowingly collect data from under-13s
Age verified via Google OAuth (requires 13+)
If under-13 discovered, account immediately deleted
Parents of 13-17 year olds: monitor your child's use

8. International Users

Data processed in: United States & Canada (Cloudflare global edge network)

EU/UK Users:

Standard Contractual Clauses protect transfers
GDPR rights apply (see Section 5)
Contact your data protection authority with complaints

9. California Disclosures

                        "DO NOT SELL MY PERSONAL INFORMATION"

                        WE DO NOT SELL YOUR PERSONAL INFORMATION.

In the past 12 months:

We have NOT sold personal information
We have NOT sold information of minors under 16

CCPA Rights: See Section 5. Email contact@itoldya.app with "CCPA Request"

10. Updates to This Policy

We may update this policy. You'll be notified via:

Email
In-app notice
Updated "Effective Date" at top

Material changes: 30 days' advance notice. Continued use = acceptance. If you disagree, delete your account before changes take effect.

11. Contact Us

Email: contact@itoldya.app

Company: Timeside, LLC

Address: 730 I St. #200, Sacramento, CA 95814

Response time: 48 hours (general), 30-45 days (legal requests)

12. Acknowledgment

By using Told Ya, you confirm:

✓ You've read this Privacy Policy
✓ You're 13+ years old
✓ You understand challenges are semi-private (visible to participants)
✓ You understand account deletion is permanent
✓ You can exercise your privacy rights anytime

IF YOU DON'T AGREE, DON'T USE THE SERVICE.