Peekaboo – Privacy Policy

Effective date: 6 November 2026
Who is responsible for your data ("data controller"): 2865113 Ontario Inc. (Ontario, Canada), rbaig18@z2automation.net

This policy explains what Peekaboo collects, why, where it goes, and what you can do about it. It is written to match what the app really does. If we change how the app works, we update this policy and tell you in the app.

1. The short version

We collect what you give us (account, profile, photos, videos, messages, location if you turn it on) so the app can work.
We do not sell your data, show ads, or use advertising trackers.
Your content goes to the people you choose (friends, close friends, a group). If your account is public (the default), posts you share with everyone can also appear on Home for other Peekaboo users. Guess Who posts are shown without your name to your friends, or to the members of the group chat you post one in. The app explains this when you post.
Peekaboo+: if you subscribe, Apple takes the payment and we never see your card details. A company called RevenueCat tells us whether your subscription is active.
Who saw what: Peekaboo+ members can see who viewed their profile and who rewatched or screenshotted their stories and posts – so they may see that it was you. Everyone logged in can see who has Peekaboo+ (the ⭐ badge).
Face filters work on your phone only. We never store or send face data.
You can delete your account in Settings at any time; that deletes your data (section 6 lists the few things that can outlive it).
Data is stored on Supabase servers in the United States (AWS, us-east-1).

2. What we collect and why

What	Examples	Why (purpose)	Legal basis (where one is required)
Account	New accounts are made with Sign in with Apple (iPhone) or Sign in with Google (Android). From Apple or Google we receive an account ID, your email address (with Apple you can choose "Hide My Email", and then we only get a stand-in address that forwards to you) and, if you allow it, your name. We never see your Apple or Google password. Older accounts made before this may have an email address or just a username, and a password (stored only as a cryptographic hash by our login provider). We also keep your account creation date, your confirmation that you are 13 or older, and which version of the Terms and the Dare Safety Rules you agreed to, and when. To stop people guessing passwords, we briefly keep failed username log-ins and the internet address of username sign-ups (deleted after a day).	To create and secure your account and contact you about it.	Contract
Profile	Username, display name, bio, profile photo, profile song choice (song name/ID from Apple's catalogue), notification settings, and your "Private account" and "Show me in Profile views" settings.	To show who you are to other users and run the app the way you set it.	Contract
Content you post	Photos, videos (up to 30 s, or 60 s with Peekaboo+), captions, stickers/filters applied, stories (24 h), Peekaboo drops and whether they were on time, dares you did, Guess Who posts (shown without your name until guessed), group posts, Keeps (photos and videos you save to your own private library), comments, replies, likes, story reactions, dare ideas and votes.	To deliver your content to the people you chose and run those features.	Contract
Messages	Text messages, peeks (photos/videos sent in chat), voice notes, group chat messages, when a message was opened, whether a peek was replayed or saved, and screenshot notices (we record that a screenshot of a chat or peek happened, not the screenshot itself).	To deliver chats and the features inside them.	Contract
Views, visits and screenshots	Who viewed each of your stories ("Seen by"), how many times each friend opened each story, which friends revealed or scrolled past your drop ("Who Peeked"), when you open someone else's profile (not saved if you turn off "Show me in Profile views"), and when you take a screenshot while looking at someone else's story or post (we record that it happened and who took it, not the screenshot itself).	To show people who saw their content, to send the "Someone screenshotted your story/post" alert, and to run the Peekaboo+ insights (section 3).	Contract; legitimate interest (letting people know who saw what they shared)
Peekaboo+ (purchases)	Whether you have Peekaboo+, until when, and which plan. The messages RevenueCat sends us when you buy, renew, cancel, get a refund or move Peekaboo+ to another account: the plan, the dates, the price and currency, your App Store country or region, and Apple's transaction number. We never see your card or bank details or your Apple Account password – Apple handles the payment.	To switch Peekaboo+ on and off, show the ⭐ badge, and answer billing questions.	Contract
Friends and safety	Friend requests and friendships, close-friends list, groups, blocks, reports you make or that are made about you, forfeits given and received, dare chains and streaks (and any Peek-a-Save used on them), your invite code, and whose invite links you used and when (to stop misuse). When a friendship or friend request is removed (unfriend, decline, cancel or block), we keep a note that the two accounts were linked and when, so that person can't use an invite link to add you straight away. Each time someone uses an invite link we log whether they were 18 or over, and the Peekaboo team is alerted when several under-18s use one adult's link in a day.	To run the social features and keep people safe.	Contract; legitimate interest (safety)
Location	Precise GPS position only while you have the friend map's location sharing turned on. Turning on ghost mode deletes your stored position.	Friend map.	Consent (phone permission + in-app switch)
Birthday and hit ups	Your birthday (only you see it); who you hit up and who hit you up, the optional message, whether it was answered or ignored, and your "who can hit me up" setting.	To keep hit ups for adults only (18+), limit them to 10 a day, and run the feature. Also, so that people under 18 always get a friend request instead of being added straight away (section 3).	Contract; legitimate interest (safety)
Device and technical data	Push-notification token for your device, device type and app version, your time zone (so drop alerts come at your local time), when your phone last checked in with us (so we can send a drop reminder if you haven't opened Peekaboo for a while), the IP address and timestamps of requests to our servers (kept in server logs), and data from Expo's update service (device platform, app runtime version, when the app checked for updates).	To send notifications, keep the app updated, secure the service and fix problems.	Legitimate interest
Support	Anything you send us by email.	To help you.	Legitimate interest

Face filters. The googly-eyes lens and the Soft Glow and Golden Hour filters use Google's ML Kit and MediaPipe tools, which run on your phone. They find the points of faces in the live camera picture (where the eyes, nose and mouth are) so the filter can follow a face. This happens on your phone only: we never store face points, never send them to our servers, and never use them to recognise who someone is. Only the photo or video you choose to post or send is saved, like any other post. Google's ML Kit tool may send Google basic technical information (such as device and app details, a random code for this install, error codes and how fast it ran) so Google can keep it working and see how it is used. The random code only belongs to this install of the app: it is not your name, your Peekaboo account or an advertising ID. ML Kit never sends pictures or face data.

We do not collect: contacts/address book, health data, payment card or bank details (Apple handles payments), advertising identifiers, or precise location when sharing is off. We do not show ads, and we do not use advertising or tracking tools. The only outside tools in the app that send data to their makers are Expo (app updates), RevenueCat (subscriptions – it also gives us summary charts, such as how many people subscribe) and Google ML Kit (basic technical data and a random code for this install, as above). See section 4.

Photos of other people. If you post a photo or video with other people in it, you are responsible for having their permission. Anyone who finds themselves in content on Peekaboo without consent can email rbaig18@z2automation.net and we will remove it.

3. Who can see what (inside the app)

Posts, stories, drops, dares: your friends (or only close friends, or one group, when you choose that). If your account is public (the default), posts you share with everyone can also appear on Home for other Peekaboo users. Turn on Private account (Settings → Privacy & safety) so only friends see your posts. Home shows posts from friends first, then from public accounts.
Friends: if your account is public and you are 18 or over, anyone can add you as a friend straight away. If you are under 18 (or haven't saved your birthday), or your account is private, people send a request that you can accept or decline. Friends can chat with you, see your stories and, while your sharing is on, your place on the friend map. You can block anyone at any time.
Invite links: you can share your own invite link (Settings → Invite friends). The invite web page only shows the invite code – never your name or photo. People who open your link in the app while logged in see your name, username and profile photo, and can add you, but never more easily than by your username: straight away only if your account is public and you are 18 or over, otherwise with a friend request. You can get a new link at any time, and the old one stops working.
Guess Who posts: shown without your name to your friends, or to the members of the group chat you post one in. Each person sees who posted it only after they make their guess, and nobody is told who guessed what.
Peeks and messages: only the person you sent them to, or the members of the group chat.
Profile: your username, display name, photo, bio, song, friend count and whether you have Peekaboo+ are visible to other users who find you.
Location: friends only, only while sharing is on.
Hit ups: the person you hit up sees your profile and your message. If they ignore it, you are not told. Your birthday is never shown to anyone.
Who saw your content (free for everyone): you see who viewed your stories ("Seen by") and which friends revealed or scrolled past your drop ("Who Peeked"). You are told when someone takes a screenshot of your chat or peek, or of your story or post (the alert for stories and posts doesn't say who). You also see counts: how many people visited your profile in the last 30 days, and how many rewatched or screenshotted a story or screenshotted a post.
Peekaboo+ insights (members only): a Peekaboo+ member can also see who: who visited their profile in the last 30 days, who rewatched their stories (and how many times), and who took screenshots of their stories and posts. So when you do these things, the person may see that it was you. People who have blocked each other are never shown.
"Show me in Profile views" (Settings → Privacy & safety, on unless you turn it off): when it's off, your visits to other profiles are not saved and nobody sees them – but you can't see who visited you either. This switch only covers profile visits; story rewatches and screenshots are always recorded.
Who has Peekaboo+: every logged-in user can see whether you have Peekaboo+ (the ⭐ badge next to your name). Behind the badge, the app can also read when your current Peekaboo+ period ends and which plan it is – never any payment details.

4. Who we share data with (service providers)

We share data only with companies that help run Peekaboo, under contracts or terms that limit what they can do with it. We only use providers that protect your data at least as well as this policy does:

Provider	What they do	Where
Supabase, Inc.	Database, file storage, login/authentication, server functions and server logs.	United States (AWS us-east-1)
Expo (650 Industries, Inc.)	Delivers app updates and routes push notifications to Apple and Google.	United States
RevenueCat, Inc.	Keeps track of Peekaboo+ subscriptions for us. It gets your Peekaboo user ID (a random code, not your name or email), your purchase history from Apple (plan, dates, price, store country) and basic phone details (such as the iOS and app version), and tells our server when your subscription starts, renews or ends. It also gives us summary charts about subscriptions.	United States
Apple Inc.	App Store and in-app payments for Peekaboo+ (Apple handles your payment details; we never see them), Sign in with Apple, push notifications on iPhone, iTunes Search for profile-song previews (your search words are sent to Apple).	United States and worldwide
Google LLC	Google Play, Sign in with Google, push notifications on Android, Google Maps for the Android friend map (the map requests reveal your approximate position to Google), and the ML Kit and MediaPipe face tools inside the app (they run on your phone; ML Kit may send Google basic technical data and a random code for this install, never pictures or face data).	United States and worldwide

We also disclose data when the law requires it, to respond to a valid legal request, to protect someone's safety, to enforce our Terms, or as part of a sale or transfer of Peekaboo (we would tell you).

We never sell personal information and we do not share it for advertising.

5. International transfers

Peekaboo is operated from Canada and stores data in the United States. If you live in the European Economic Area, the United Kingdom or Switzerland, your data is transferred outside those areas; our providers rely on standard contractual clauses or the EU-U.S. Data Privacy Framework for those transfers. Contact us for details.

6. How long we keep data

Data	Kept until
Stories	They disappear from the app 24 hours after posting. The photo or video file is deleted about 7 days later (unless the story was reported, or the same photo or video is also in your Keeps). A small record of the story (when it was posted, and who saw, rewatched or screenshotted it) stays until you delete your account.
Guess Who posts	They disappear when they end. The photo or video file is deleted about 7 days later (unless the post was reported).
Opened peeks	The photo or video file is deleted about 7 days after it was opened, unless someone saved it in the chat (or it was reported). The chat keeps a note that a peek was sent.
Posts, saved peeks, messages, voice notes, Keeps, comments, likes	Until you delete them, or your account.
Profile visits	Shown for 30 days. Older visits are cleared away over time (the next time someone visits that profile), and all of them are deleted when either account is deleted.
Story rewatches and screenshot records	Kept with the story or post they belong to; deleted with that post, or when either account is deleted.
Location	Replaced each time it updates; deleted when you turn on ghost mode or stop sharing; deleted with your account.
Reports and blocks	For as long as needed to keep people safe, then deleted with the account.
Birthday and hit ups	Kept while your account exists (so the 18+ rule and the daily limit keep working).
Notes of removed friendships and friend requests, and invite logs	Kept until either account is deleted (so the invite and child-safety rules keep working).
Peekaboo+ status	Kept while your account exists; deleted with it.
Peekaboo+ purchase log (the messages RevenueCat sent us)	Kept so we can answer billing and refund questions. Email us and we will delete it.
Server logs	Up to 90 days.
Everything else	Deleted when you delete your account (see below).

Deleting your account (Settings → Delete account) permanently deletes your profile, posts, stories, chats, friends, likes, comments, hit ups, your Peekaboo+ status and all your files right away. If you made your account with Apple, we also ask Apple to disconnect Peekaboo from your Apple Account (you can check this yourself on your iPhone: Settings → your name → Sign-In & Security → Sign in with Apple). Copies that other users already received (for example a saved peek or a screenshot), and backups, which are overwritten in the normal course of business within 30 days, are the only things in our app that can outlive the deletion.

Peekaboo+ and deleting your account. Deleting your account does not cancel Peekaboo+ – Apple keeps billing you until you cancel it on your iPhone (Settings → your name → Subscriptions). Please cancel first. Apple keeps its own record of your purchase, and RevenueCat keeps the purchase history linked to your Peekaboo user ID, each under its own privacy policy. We keep our purchase log until you ask us to delete it. Email us and we will delete our log and ask RevenueCat to delete its record of you.

7. Your rights

Wherever you live, you can: see the data we hold about you; correct it (most of it from Edit profile); delete it (Delete account, or email us); withdraw consent for location and notifications (phone settings / in-app switches); stop your profile visits being saved ("Show me in Profile views"); and ask us questions. Email rbaig18@z2automation.net; we answer within 30 days and may ask you to confirm it is your account.

Canada (PIPEDA and provincial laws): you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) if you are not satisfied with our answer.
European Economic Area / United Kingdom (GDPR / UK GDPR): you also have the rights to restrict or object to processing, to data portability, and to complain to your local data-protection authority. Our legal bases are listed in section 2.
California (CCPA/CPRA): you have the right to know, delete and correct, and to opt out of sale or sharing – we do not sell or share personal information. We do not discriminate against you for using your rights.
Other places: the rights above are available to you too; contact us.

8. Children

Peekaboo is not for children under 13 and we do not knowingly collect their data. If you believe a child under 13 has an account, email rbaig18@z2automation.net and we will delete it. Users aged 13–17 need a parent's or guardian's permission (also before buying Peekaboo+), and hit ups are not available to them: hit ups are only for people 18 and over. Nobody can add someone under 18 as a friend straight away: they always get a friend request that they can accept or decline.

9. Security

Data travels encrypted (HTTPS) and is stored on providers with industry-standard protections; passwords are hashed; database rules make sure each person can only read what they are allowed to see; access to the production database is limited to the operator. No system is perfectly secure, so if your account has a password, please make it strong and unique. If we learn of a breach that puts you at risk, we will tell you and the authorities as the law requires.

10. Screenshots and disappearing content

Stories expire and peeks are meant to be viewed once, but the people you send content to can screenshot or record it. We try to notify you when a chat, peek, story or post is screenshotted; this is best-effort and can be missed. Please post accordingly.

11. Changes

We will post changes here and, for significant changes, show a notice in the app or email you before they take effect.

12. Contact

2865113 Ontario Inc. (Ontario, Canada)
rbaig18@z2automation.net