Legal Document

Privacy Policy

Welcome to Pypox ("we," "our," or "us"). Pypox is an emotion-aware short-video social platform designed to promote mindful emotional connection. Your privacy is paramount to us. This Privacy Policy outlines our transparent data practices in compliance with Google Play Developer Policies, Apple App Store Guidelines, the General Data Protection Regulation (GDPR), and the Children's Online Privacy Protection Act (COPPA).

1. Age Requirement & Child Privacy (Strict 13+ Rule)

Pypox is strictly intended for individuals aged 13 years and older. During registration, all users must verify their date of birth through our enforced age verification gate. We do not knowingly collect, maintain, or process personal data from children under the age of 13. Any account discovered to belong to an individual under 13 is promptly and permanently deleted along with all associated media and records.

2. Information We Collect

• Account Registration Data: Date of birth (for age verification), username, full name, email address, and hashed authentication credentials.
• User-Generated Content: Videos (.mp4), photos, captions, hashtags, mentions, audio selections, and user-selected mood tags (Happy 💛, Sad 💙, Love 💖, Focus 💚, Relax 💜).
• Emotional Mindful Analytics: Current active profile mood and an aggregated 7-day rolling mood footprint percentage.
• Direct Communications: Private chat messages sent between mutual connections.
• Device & Push Notification Tokens: Firebase Cloud Messaging (FCM) / Apple Push Notification Service (APNs) device tokens exclusively used to notify you of likes, comments, mentions, and incoming messages.

What We DO NOT Collect: We strictly do NOT collect your device contact address book, precise continuous background GPS location, or biometric facial recognition data.

3. Media Storage & Zero-Egress Encryption

All videos, images, and audio tracks are stored in private, encrypted cloud storage buckets (Cloudflare R2 and Supabase). Media is transmitted solely over TLS/HTTPS encrypted connections using time-limited Pre-Signed URLs. Temporary uploads abandoned during creation are automatically purged from storage within 24 hours.

4. Privacy Controls & Account Modes

Users maintain full sovereignty over their content visibility:

• Public Accounts: Uploaded videos are discoverable in public mood streams and search.
• Private Accounts: Post grids and videos are strictly locked to approved followers only. Follow requests must be explicitly approved.
• 1-Message Request Guard: Non-mutual direct messages are filtered into a separate Requests inbox; recipients must accept before unlimited conversation is allowed.

5. Data Retention, Account Deletion & Right to be Forgotten

You have full ownership of your data. You may request immediate deletion of your account at any time directly inside the Pypox app (navigate to Settings & Privacy → Account → Delete Account) or via our web portal at pypox.com/delete-account.

Upon confirming deletion, your account enters a 30-day grace period during which it is immediately hidden from all public feeds and searches. Following the 30-day window, all database records, chat logs, and associated media files are permanently and irreversibly purged from our servers.

6. Third-Party Service Providers

To provide high-performance social infrastructure, we partner exclusively with compliant enterprise cloud providers:

• Supabase: Encrypted PostgreSQL database and authentication infrastructure.
• Cloudflare: CDN edge delivery, DDoS prevention, and secure zero-egress media storage.
• Google Firebase: Cloud Messaging (FCM) for push notifications.
• Google Gemini Flash: Real-time on-demand in-chat translation (transient processing without saving chat logs).

7. Contact & Privacy Officer

For any privacy inquiries, data subject access requests (DSAR), or regulatory questions, please contact our Data Protection Team at:

Email: privacy@pypox.com • support@pypox.com