thebutton Privacy Policy

thebutton is a private photo-sharing app for close groups of 3–10 friends, operated by independent developer uranashel (Vietnam). This policy describes what data we collect, how it is protected, and how you can remove it.

1. Minimum Age

thebutton is intended only for people aged 16 and older. We collect your birth date during onboarding to verify age eligibility; your birth date is encrypted at rest and never shown to other users.

2. Data We Collect

• Account details: your chosen display name and verified birth date.
• Sign-in credentials:
  • Sign in with Apple or Google: we verify your provider ID token and store only a cryptographic hash of the provider subject identifier. We do not store passwords or read your contacts.
  • Start on this device: your device stores a random secret in Keychain/Keystore and the server stores only its hash. Without linking Apple or Google, device accounts cannot be recovered if you wipe or lose the device.
  • Phone number (when enabled): stored only as a hash, along with bounded anti-abuse challenge records.
• Group content: photos, captions, replies, reactions, Pulse vibration patterns, pair pattern dictionaries, and report reasons. Uploaded photos are re-encoded as JPEG to strip EXIF and GPS location metadata before encrypted storage.
• Notifications & sessions: your APNs/FCM push token if you opt in to notifications, quiet-hour/language preferences, and a client platform hint (ios/android) with session renewal timestamps so you can view or revoke active sessions.
• Technical & access logs: IP addresses are used briefly in memory for rate limiting. Proxy access logs strip query strings and auth headers (Authorization, Cookie, Idempotency-Key) and rotate off within about 14 days.

3. What We Do Not Do

• We never sell or rent your personal data.
• We do not show ads or embed third-party advertising trackers.
• We do not publish a public social feed or contact-based friend suggestions.

4. Who Can See Your Data

• Current group members: only active members of a group can read its photos, captions, reactions, and replies. Access ends immediately on the server if you leave or the group closes.
• Safety moderators: authorized moderation staff may inspect reported content and associated context solely to handle safety reports and appeals.
• Infrastructure & platform providers: our API and database run on servers rented from Hostinger. If you use Apple/Google sign-in or enable push notifications, Apple and Google process authentication or push delivery under their respective privacy policies.

5. Retention & Deletion

• Account deletion: open Settings → Delete account in the app. This revokes active sessions and push tokens, and removes your account, posted photos, submitted reports, and Apple/Google/device identity links from the live database.
• Leaving a group: you choose whether to keep or delete the photos you posted in that group. If you are the last active member and close the group, the group key is retired and remaining group content is queued for removal.
• Ended groups: in Normal mode, once a group ends after its recovery window, members have 7 days (168 hours) of read-only access to export photos before access locks and content is retired and deleted from the live database.
• Deletion boundaries: encrypted GPG database backups are retained for up to about 30 days (14 days on server, up to 30 days in off-box encrypted archives) before rotating out. Copies that another group member has already downloaded or saved outside the app cannot be recalled remotely.

6. Changes to This Policy

We may update this Privacy Policy as the service evolves. We will update the revision date at the top of this page and keep the in-app links current.

7. Contact

Use the in-app Safety section to report content or check your report history. For privacy questions or data requests (including after uninstalling), contact: uralab95@gmail.com.