Privacy Policy

1. Information We Collect

To run a full-featured social network, we only collect what is necessary:

• Account Data: Your username, email address, and password when you sign up.
• Your Activity: The posts, comments, likes, messages, and connections you actively make on the platform.
• Technical Data: Device and usage information, including IP address, device and browser identifiers, app version, crash and performance logs, approximate location derived from your IP address, and cookie identifiers, used to keep the app functional, stable, and secure.
• Cookies and Similar Technologies: As described in Section 7.
• Inferences: Broad interest categories we derive from your activity on Trystle, only if you opt in to personalized ads under Section 3.

We do not collect precise geolocation, biometric identifiers, government identification numbers, or payment card data. We automatically remove location and device metadata from photos, videos, and audio uploaded in the common phone formats before we store them. Some less common file formats are not processed this way, and in rare cases the original file is stored unchanged.

2. Legal Basis for Processing (EU/UK Users)

• Contract necessity: Account Data and Your Activity are processed as necessary to provide the service you signed up for.
• Legitimate interest: Technical Data is processed to maintain platform security, stability, and prevent abuse.
• Consent: Optional cookies and any advertising-related processing described in Section 7 are processed based on your consent, where required.

3. How We Handle Ad Revenue & Tracking

• We do not use cross-site tracking to build behavioral advertising profiles about you across other websites and apps.
• By default, we host advertisements to help generate revenue for our charitable mission (see our transparency page). These ads are served based on contextual content or broad, generalized preferences, not by tracking your activity across other websites or apps.
• We use third party service providers to serve and measure ads. Those providers receive limited technical information, such as IP address and device or browser identifiers, strictly to deliver the ad, measure delivery, and prevent fraud. We contract with them as service providers or processors, restrict their use of that information to those purposes, and prohibit them from using it to build profiles about you or to advertise to you elsewhere.
• Opt-in personalized ads: If you choose to, you can opt in to ad targeting based on your activity on Trystle. This typically increases ad revenue, which increases the surplus we are able to donate to charity. We use that activity to select which ads you see. We do not sell it, and we do not disclose it to advertisers or ad networks for their own purposes or to target you on other sites or apps (see Section 4). You can turn this setting on or off at any time in your account settings, and it is off by default.
• Personalized ad targeting is only available to users 18 and older. Users under 18 will only ever be shown contextual, non-personalized ads, regardless of any other setting.
• Opt-out preference signals: We treat a Global Privacy Control or similar browser signal as a request to opt out of the sale or sharing of personal information for the browser that sends it.

4. How Your Data is Shared

• We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising, as those terms are defined by California law. This includes the data used for the opt-in personalized ads described in Section 3.
• Service providers: We disclose personal information to vendors that host our servers, deliver email, serve and measure ads, and provide security and analytics, under written contracts that limit their use of it to performing services for us.
• Legal and safety: We may disclose information to comply with law or valid legal process, to enforce our terms of service and community guidelines, to protect the rights or safety of any person, and to report child sexual exploitation as required by 18 U.S.C. 2258A.
• Corporate transactions: If we are acquired, merge, or sell assets, personal information may transfer as part of that transaction, subject to this policy or a successor policy with notice to you.
• Other users: Anything you post publicly, along with your username and profile image, is visible to other users and may be copied or reshared by them.
• Aggregated impact metrics: We publish anonymized, aggregated financial data showing where our ad revenue and charitable contributions go (see our transparency page). Your individual personal information is never included in these reports.

5. Data Retention & Deletion

Your data is retained only as long as your account is active and necessary to provide the service. We maintain a written retention schedule that sets a retention period for each category of personal information we collect, including any information collected from a user under 13, and we do not retain personal information indefinitely.

• Account deletion: If you delete your account, we will remove your personal data from our active systems within 30 days.
• Ad targeting opt-out: If you opt out of personalized ads, any inferred ad-interest data we hold is deleted within 30 days.
• Under-13 accounts: If an account is confirmed to belong to a child under 13, it is deleted within 30 days of that determination.
• Security logs: Access and security activity logs are purged after 12 months.

If you delete your account, we remove your personal data from our active systems within 30 days. Copies in our backups are overwritten as our backup cycle advances and are fully cleared within 30 days after that. We do not retain personal information indefinitely, except where retention is required for:

• Legal or regulatory compliance;
• Active fraud, safety, or abuse investigations;
• Content that has already been shared, reported, or saved by other users (see terms of service, Section 4).

6. Your Rights

Regardless of your location, we extend meaningful privacy rights to all users, including the right to access, correct, delete, and obtain a portable copy of your personal data, and the right to opt out of targeted advertising. Contact us at privacy@trystle.com to exercise these rights. We will verify your identity using the email address on your account before acting, and we will respond within 45 days, or one month if you are in the EU or UK, which we may extend once where the law allows. An authorized agent may submit a request on your behalf with written proof of authority. We will not deny you service, charge you a different price, or give you a different level of service because you exercised these rights.

Appeals: If we decline a request, we will tell you why and how to appeal. You may appeal by replying to our response or writing to privacy@trystle.com, and we will respond in writing within 45 days. If we deny the appeal, we will give you a method to complain to your state attorney general.

7. Cookies & Tracking Technologies

We use cookies and similar technologies to keep you logged in, remember your preferences (like light or dark mode), understand basic site performance, and serve and measure advertising. Cookies that are not strictly necessary are set only with your consent where the law requires it, and users in the EU, the UK, and other jurisdictions requiring consent are shown a banner allowing them to accept or reject non-essential cookies. Advertising cookies rely on contextual signals unless you opt in under Section 3. You can also control cookies through your browser settings, though some features of Trystle may not work properly if you disable them.

8. Children's Privacy

Trystle is not intended for anyone under 13. We use a neutral age screen at sign-up and do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly and close the account. If you believe a child has provided us with personal information, contact us at privacy@trystle.com.

For users between 13 and 17, we set all privacy settings to the most protective option by default. We do not sell or share the personal information of a user we know to be under 18, we do not use it for targeted advertising or for profiling in furtherance of advertising, and we do not use automated decision-making that produces a legal or similarly significant effect on that user. We do use automated systems to rank and recommend content and to detect abuse and safety risks. Where the law of your state or country requires verifiable parental consent for a minor's account or for particular features, we will seek that consent before providing them.

9. Your Rights Under GDPR (EU/UK Users)

If you are located in the European Union or the United Kingdom, you have additional rights under the General Data Protection Regulation and the UK GDPR, including the rights to access, correct, delete, restrict, export, and object to processing, and the right to withdraw consent at any time without affecting processing carried out before you withdrew it. To exercise these rights, contact us at privacy@trystle.com. You also have the right to lodge a complaint with your local supervisory authority and the right to an effective judicial remedy before the courts of your habitual residence under Article 79 of the GDPR. Neither right is affected by the arbitration terms in our terms of service.

Data protection inquiries for EU and UK residents are handled by our privacy team at privacy@trystle.com.

10. Your Rights Under U.S. State Privacy Laws

If you are a resident of a U.S. state with a comprehensive consumer privacy law (including California, Texas, Virginia, Colorado, Connecticut, Florida, and others), you have specific statutory rights, including the rights to know what personal information we collect, to correct it, to request deletion, to obtain a portable copy, to opt out of the sale or sharing of your personal information and of targeted advertising and profiling, and to appeal a denial of a request as described in Section 6. As stated above, we do not sell your personal data. To exercise these rights, contact us at privacy@trystle.com or use the "Do Not Sell or Share My Personal Information" link in our footer and in your account settings.

11. Data Breach Notification

If a data breach occurs that affects your personal information, we will notify affected users and the relevant authorities as required by applicable law, without undue delay and, where the GDPR applies, within 72 hours of becoming aware of the breach.

12. Where Your Data Is Stored

Your account data is stored on servers located in the United States (AWS US West, Oregon). Certain functionality is additionally processed at edge locations closer to you, which may be outside your home country. Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, or another lawful transfer mechanism, and we carry out a transfer impact assessment.

13. How We Protect Your Data

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information we hold, including encryption in transit, access controls, and logging. We maintain a written information security program, and because we may receive information from a user under 13 before we detect their age, that program covers children's personal information as required by the COPPA Rule. No system is perfectly secure, and we cannot guarantee absolute security.

14. Changes to This Policy

We may update this policy. If we make a material change, we will post the updated policy with a new effective date and notify you by email and in-app notice at least 14 days before it takes effect. Where a change requires your consent, we will ask for it before applying the change to information we already hold.

15. Contact Us

If you have questions about your privacy, reach out to us at privacy@trystle.com.