Privacy Policy

Last updated: April 6, 2026

Effective Date: April 6, 2026. This Privacy Policy constitutes a legally binding agreement between you ("User," "you," or "your") and Anonity ("we," "us," "our," or the "Company").

1. Acceptance of This Policy

By accessing, browsing, or using the Anonity platform (the "Service"), including by creating an account, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy in its entirety. If you do not agree to this Privacy Policy, you must immediately cease all use of the Service. Your continued use of the Service following any modifications to this Privacy Policy constitutes your acceptance of such modifications.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your email address, username, and a cryptographically hashed version of your password. We cannot access or retrieve your plaintext password.

2.2 Profile Information (Voluntary)

You may optionally provide a display name, biography, date of birth, geographic location, social media handles, personal interests, a favorite quote, and a profile avatar image. All such information is provided at your sole discretion and risk. You are solely responsible for any personal information you choose to disclose.

2.3 User-Generated Content

We store content that you create, upload, or transmit through the Service, including but not limited to: moments (posts), comments, text, images, GIFs, videos, links, files, and any other media or materials ("User Content"). You acknowledge and agree that you are solely and exclusively responsible for all User Content that you upload, post, transmit, or otherwise make available through the Service. We do not pre-screen, monitor, review, or endorse any User Content.

2.4 Direct Messages

We store direct messages exchanged between users. While we implement industry-standard security measures, we cannot guarantee the absolute confidentiality of messages in transit or at rest. You acknowledge that any information shared through direct messages is shared at your own risk.

2.5 Usage and Activity Data

We collect data about how you interact with the Service, including: trees viewed, online presence status, votes, bookmarks, streaks, feature interactions, and session analytics. This data is used solely to operate and improve the Service.

2.6 Technical and Device Data

We may collect push notification tokens (if you opt in), timezone, IP address, browser type, operating system, device identifiers, and basic device information for service delivery, debugging, abuse prevention, and security purposes.

2.7 Cookies and Local Storage

We use essential cookies and browser local storage to maintain your authenticated session, store your preferences, and ensure the Service functions properly. We do not use third-party tracking cookies or advertising cookies. Anonymous performance analytics (Vercel Analytics) may use minimal cookies solely for measuring page load performance.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • To provide, operate, maintain, and improve the Service
  • To authenticate your identity and manage your account
  • To display your content to other authorized users according to tree-based visibility rules
  • To facilitate real-time collaboration features, including presence indicators
  • To send push notifications and communications you have opted into
  • To track activity, streaks, experience points, and gamification features
  • To detect, prevent, and address fraud, abuse, security incidents, and technical issues
  • To comply with applicable legal obligations and law enforcement requests
  • To enforce our Terms of Service and protect our legal rights
  • To produce anonymous, aggregated analytics to improve performance

4. Data Sharing and Third Parties

4.1 Other Users

Your profile information and User Content are visible to other users who share a tree with you or have access to the trees where your content is posted. You acknowledge that once content is shared, recipients may copy, save, or redistribute it beyond our control.

4.2 Service Providers

We use third-party service providers to host and operate the Service, including but not limited to: Supabase (database, authentication, and file storage), Vercel (hosting and analytics), and Stripe (payment processing). These providers have access to data only as necessary to perform their functions and are bound by their own privacy policies and contractual obligations. We are not responsible for the privacy practices, security measures, or data handling of any third-party service provider.

4.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to: (a) comply with a legal obligation; (b) protect the safety of any person; (c) address fraud, security, or technical issues; (d) protect our rights, property, or safety; or (e) cooperate with law enforcement investigations, including investigations of child sexual abuse material (CSAM) or other illegal content.

4.4 No Sale of Data

We do not sell, rent, trade, or otherwise commercially transfer your personal information to third parties for their marketing or advertising purposes.

5. Data Security

We implement industry-standard technical and organizational security measures, including but not limited to:

  • TLS/HTTPS encryption for all data in transit
  • Cryptographic password hashing (passwords are never stored in plaintext)
  • Row-level security (RLS) policies on all database tables
  • Role-based access controls and principle of least privilege
  • Regular security audits and vulnerability assessments

HOWEVER, NO METHOD OF ELECTRONIC TRANSMISSION OR STORAGE IS 100% SECURE. WHILE WE STRIVE TO USE COMMERCIALLY REASONABLE MEANS TO PROTECT YOUR PERSONAL INFORMATION, WE CANNOT AND DO NOT GUARANTEE ABSOLUTE SECURITY. YOU ACKNOWLEDGE AND AGREE THAT YOU TRANSMIT AND STORE DATA AT YOUR OWN RISK. IN THE EVENT OF A DATA BREACH OR UNAUTHORIZED ACCESS, OUR LIABILITY SHALL BE STRICTLY LIMITED AS SET FORTH IN SECTION 8 OF THIS POLICY AND IN OUR TERMS OF SERVICE.

6. Your Rights

Subject to applicable law, you have the right to:

  • Access and review your personal data through your profile settings
  • Rectify or update inaccurate or incomplete personal data
  • Delete your account and associated data (certain data may be retained as required by law)
  • Delete or edit your individual moments, comments, messages, and uploaded media
  • Withdraw consent for optional data processing (e.g., push notifications)
  • Request a copy of your personal data in a portable format (subject to technical feasibility)
  • Object to processing of your personal data under certain circumstances
  • Lodge a complaint with a supervisory authority (for EU/EEA residents, the Portuguese Data Protection Authority — CNPD)

7. Data Retention and Deletion

We retain your personal data for as long as your account is active or as needed to provide the Service. When you delete specific content, it is removed from our active databases. When you delete your account, we delete your profile, content, and associated data. Certain data may be retained in automated backups for a limited period or as required by applicable law, legal proceedings, or regulatory obligations. Anonymous, aggregated data that does not identify you may be retained indefinitely.

8. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL ANONITY, ITS OWNERS, OFFICERS, DIRECTORS, EMPLOYEES, SHAREHOLDERS, AGENTS, AFFILIATES, SUCCESSORS, OR ASSIGNS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES ARISING OUT OF OR IN CONNECTION WITH: (A) ANY UNAUTHORIZED ACCESS TO, USE OF, OR ALTERATION OF YOUR DATA OR CONTENT; (B) ANY DATA BREACH, SECURITY INCIDENT, OR UNAUTHORIZED DISCLOSURE OF PERSONAL INFORMATION; (C) ANY USER CONTENT UPLOADED, POSTED, OR TRANSMITTED THROUGH THE SERVICE BY ANY USER; (D) ANY THIRD-PARTY CONDUCT, INCLUDING BUT NOT LIMITED TO HARASSMENT, DEFAMATION, OR ILLEGAL ACTIVITY BY OTHER USERS; (E) ANY INTERRUPTION, SUSPENSION, OR TERMINATION OF THE SERVICE; OR (F) ANY MATTER RELATED TO THE SERVICE, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL THEORY. OUR TOTAL CUMULATIVE LIABILITY SHALL NOT EXCEED THE GREATER OF (I) THE AMOUNTS PAID BY YOU TO US IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (II) FIFTY EUROS (€50).

9. Children's Privacy

The Service is not intended for children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children under these ages. If we discover that a child under the applicable minimum age has provided us with personal information, we will take immediate steps to delete such information. If you believe a child has provided us with personal information in violation of this section, please contact us immediately at privacy@anonity.app.

10. International Data Transfers

Your data may be processed and stored in data centers located outside your country of residence, including in the European Union and the United States. By using the Service, you consent to the transfer, processing, and storage of your data in jurisdictions that may have different data protection laws than your jurisdiction of residence. We implement appropriate safeguards for international data transfers in compliance with applicable data protection laws.

11. Changes to This Policy

We reserve the right to modify this Privacy Policy at any time. Material changes will be communicated through prominent notice on the Service or via email notification at least thirty (30) days before the changes take effect. Your continued use of the Service after the effective date of any modifications constitutes your binding acceptance of the modified Privacy Policy. We encourage you to periodically review this page for the latest information.

12. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the Portuguese Republic, without regard to its conflict of laws principles, and in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") where applicable.

13. Contact Information

For questions, complaints, or data protection inquiries regarding this Privacy Policy, please contact our Data Protection team at: privacy@anonity.app