peekabooPeekaboo – Privacy Policy
Effective date: 4 November 2026
Who is responsible for your data ("data controller"): 2865113 Ontario Inc. (Ontario, Canada), rbaig18@z2automation.net
This policy explains what Peekaboo collects, why, where it goes, and what you can do about it. It is written to match what the app really does. If we change how the app works, we update this policy and tell you in the app.
1. The short version
- We collect what you give us (account, profile, photos, videos, messages, location if you turn it on) so the app can work.
- We do not sell your data, show ads, or use advertising trackers.
- Your content is shown only to the people you choose (friends, close friends, a group), except Guess Who posts and Discover, which the app explains when you post.
- You can delete your account in Settings at any time; that deletes your data.
- Data is stored on Supabase servers in the United States (AWS, us-east-1).
2. What we collect and why
| What | Examples | Why (purpose) | Legal basis (where one is required) |
|---|---|---|---|
| Account | New accounts are made with Sign in with Apple (iPhone) or Sign in with Google (Android). From Apple or Google we receive an account ID, your email address (with Apple you can choose "Hide My Email", and then we only get a stand-in address that forwards to you) and, if you allow it, your name. We never see your Apple or Google password. Older accounts made before this may have an email address or just a username, and a password (stored only as a cryptographic hash by our login provider). We also keep your account creation date and your confirmation that you are 13 or older. To stop people guessing passwords, we briefly keep failed username log-ins and the internet address of username sign-ups (deleted after a day). | To create and secure your account and contact you about it. | Contract |
| Profile | Username, display name, bio, profile photo, profile song choice (song name/ID from Apple's catalogue), theme and notification settings. | To show who you are to other users and run the app the way you set it. | Contract |
| Content you post | Photos, videos (up to 30 s), captions, stickers/filters applied, stories (24 h), Peekaboo drops and whether they were on time, dares you did, Guess Who posts (shown without your name until guessed), group posts, comments, replies, likes, story reactions, dare ideas and votes. | To deliver your content to the people you chose and run those features. | Contract |
| Messages | Text messages, peeks (photos/videos sent in chat), voice notes, when a message was opened, whether a peek was replayed or saved, and screenshot notices (we record that a screenshot of a chat or peek happened, not the screenshot itself). | To deliver chats and the features inside them. | Contract |
| Friends and safety | Friend requests and friendships, close-friends list, groups, blocks, reports you make or that are made about you, forfeits given and received, dare chains and streaks. | To run the social features and keep people safe. | Contract; legitimate interest (safety) |
| Location | Precise GPS position only while you have the friend map's location sharing turned on. Turning on ghost mode deletes your stored position. | Friend map. | Consent (phone permission + in-app switch) |
| Birthday and hit ups | Your birthday (only you see it); who you hit up and who hit you up, the optional message, whether it was answered or ignored, and your "who can hit me up" setting. | To keep hit ups for adults only (18+), limit them to 10 a day, and run the feature. | Contract; legitimate interest (safety) |
| Device and technical data | Push-notification token for your device, device type and app version, the IP address and timestamps of requests to our servers (kept in server logs), crash-free operation data from Expo's update service (device platform, app runtime version, when the app checked for updates). | To send notifications, keep the app updated, secure the service and fix problems. | Legitimate interest |
| Support | Anything you send us by email. | To help you. | Legitimate interest |
We do not collect: contacts/address book, health data, financial information, advertising identifiers, or precise location when sharing is off. We do not use analytics or ad SDKs.
Photos of other people. If you post a photo or video with other people in it, you are responsible for having their permission. Anyone who finds themselves in content on Peekaboo without consent can email rbaig18@z2automation.net and we will remove it.
3. Who can see what (inside the app)
- Posts, stories, drops, dares: your friends (or only close friends, or one group, when you choose that). Discover shows posts from friends first, then from everyone who posted publicly.
- Guess Who posts: shown to friends without your name until they guess.
- Peeks and messages: only the person you sent them to.
- Profile: your username, display name, photo, bio, song and friend count are visible to other users who find you.
- Location: friends only, only while sharing is on.
- Hit ups: the person you hit up sees your profile and your message. If they ignore it, you are not told. Your birthday is never shown to anyone.
- Who Peeked: the owner of a drop can see which friends revealed it or scrolled past.
4. Who we share data with (service providers)
We share data only with companies that help run Peekaboo, under contracts that limit what they can do with it:
| Provider | What they do | Where |
|---|---|---|
| Supabase, Inc. | Database, file storage, login/authentication, server functions and server logs. | United States (AWS us-east-1) |
| Expo (650 Industries, Inc.) | Delivers app updates and routes push notifications to Apple and Google. | United States |
| Apple Inc. | App Store, Sign in with Apple, push notifications on iPhone, iTunes Search for profile-song previews (your search words are sent to Apple). | United States and worldwide |
| Google LLC | Google Play, Sign in with Google, push notifications on Android, Google Maps for the Android friend map (the map requests reveal your approximate position to Google). | United States and worldwide |
We also disclose data when the law requires it, to respond to a valid legal request, to protect someone's safety, to enforce our Terms, or as part of a sale or transfer of Peekaboo (we would tell you).
We never sell personal information and we do not share it for advertising.
5. International transfers
Peekaboo is operated from Canada and stores data in the United States. If you live in the European Economic Area, the United Kingdom or Switzerland, your data is transferred outside those areas; our providers rely on standard contractual clauses or the EU-U.S. Data Privacy Framework for those transfers. Contact us for details.
6. How long we keep data
| Data | Kept until |
|---|---|
| Stories | Deleted automatically 24 hours after posting. |
| Posts, peeks, messages, voice notes, comments, likes | Until you delete them, or your account. |
| Location | Replaced each time it updates; deleted when you turn on ghost mode or stop sharing; deleted with your account. |
| Reports and blocks | For as long as needed to keep people safe, then deleted with the account. |
| Birthday and hit ups | Kept while your account exists (so the 18+ rule and the daily limit keep working). |
| Server logs | Up to 90 days. |
| Everything else | Deleted when you delete your account (see below). |
Deleting your account (Settings → Delete account) permanently deletes your profile, posts, stories, chats, friends, likes, comments, hit ups and all your files right away. If you made your account with Apple, we also disconnect Peekaboo from your Apple ID. Copies that other users already received (for example a saved peek or a screenshot), and backups, which are overwritten in the normal course of business within 30 days, are the only things that can outlive the deletion.
7. Your rights
Wherever you live, you can: see the data we hold about you; correct it (most of it from Edit profile); delete it (Delete account, or email us); withdraw consent for location and notifications (phone settings / in-app switches); and ask us questions. Email rbaig18@z2automation.net; we answer within 30 days and may ask you to confirm it is your account.
- Canada (PIPEDA and provincial laws): you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) if you are not satisfied with our answer.
- European Economic Area / United Kingdom (GDPR / UK GDPR): you also have the rights to restrict or object to processing, to data portability, and to complain to your local data-protection authority. Our legal bases are listed in section 2.
- California (CCPA/CPRA): you have the right to know, delete and correct, and to opt out of sale or sharing – we do not sell or share personal information. We do not discriminate against you for using your rights.
- Other places: the rights above are available to you too; contact us.
8. Children
Peekaboo is not for children under 13 and we do not knowingly collect their data. If you believe a child under 13 has an account, email rbaig18@z2automation.net and we will delete it. Users aged 13–17 need a parent's or guardian's permission, and hit ups are not available to them: hit ups are only for people 18 and over.
9. Security
Data travels encrypted (HTTPS) and is stored on providers with industry-standard protections; passwords are hashed; database rules make sure each person can only read what they are allowed to see; access to the production database is limited to the operator. No system is perfectly secure, so please use a strong, unique password. If we learn of a breach that puts you at risk, we will tell you and the authorities as the law requires.
10. Screenshots and disappearing content
Stories expire and peeks are meant to be viewed once, but the people you send content to can screenshot or record it. We try to notify you when a chat or peek is screenshotted; this is best-effort and can be missed. Please post accordingly.
11. Changes
We will post changes here and, for significant changes, show a notice in the app or email you before they take effect.
12. Contact
2865113 Ontario Inc. (Ontario, Canada)
rbaig18@z2automation.net