Privacy Policy

1. About this policy

This policy explains how TideWhisper handles information when you use the app, visit tidewhisper.com or contact support. OxO Illusion Pty Ltd operates TideWhisper and is responsible for the personal information described here. “We”, “us” and “our” refer to that company. For privacy questions or requests, contact Support.

You do not need your real name, email address, phone number or social sign-in to create an app account. We still process account, device and service records, which may be linked to you.

2. Information you provide

• Profile and preferences: your nickname, profile photo, selected gender, chat preference and language. Gender and chat preferences may reveal or allow inferences about sensitive characteristics, including sexual orientation.
• Messages and media: messages submitted to the discovery pool, encrypted conversation messages, photos and voice notes. The different encryption rules are explained in section 4.
• Reports and feedback: report categories, descriptions you submit, ratings and written feedback. Reports may contain information about you and another user.
• Support correspondence: information you choose to send when asking for help or making a privacy request, including contact details and any attachments.

Please avoid sharing information that is unnecessary for the feature or request, particularly sensitive information about yourself or other people.

The app needs a device-linked account and the records in section 3 to work. Without them, you cannot use it. Gender, chat preference, profile photo, reports, feedback and support messages are optional.

3. Information generated by using the service

• Account and device records: identifiers used to recognize your account and device, verify access, remember settings and record acceptance of terms.
• Messaging records: conversation participants, message types and times, delivery and read status, public encryption keys, follow relationships and notification settings for each conversation. Conversation encryption does not hide these records.
• Usage and safety records: daily usage counts; blocks and reports, including those that other users make about you; moderation decisions and restrictions; and automated safety-check results and related identifiers for messages and nicknames.
• Purchase records: Apple-provided identifiers, subscription details, prices, currencies, purchase regions and billing history. We do not receive your full payment-card details.
• Technical information: IP addresses, requests, app and operating-system versions, device details, installation identifiers, push-notification tokens, diagnostics and crash information.

Firebase Crashlytics collects crash and device information, which may be linked to your TideWhisper account to investigate faults. See Firebase’s privacy information.

4. What encryption protects

Discovery messages are not end-to-end encrypted. A message you place in the shared pool is processed by our server and can be delivered to other users when they pick up bottles.

Conversation content is end-to-end encrypted from the first reply onward. Text, photos and voice notes are encrypted and decrypted on the participants’ devices. We store or relay encrypted content without the private keys needed to decrypt it.

Profiles, avatars, reports and support messages are different. They are not protected by the conversation’s end-to-end encryption and may be readable by us and the providers processing them.

Requested translation can expose text to our translation service. When you select Translate, the app tries on-device translation first. If it cannot complete, the selected text is sent in readable form through our server to the cloud translation provider named in section 6. Results may be stored on your device.

Another participant can save, copy or share information they receive. Removing a server copy does not remove copies already held by recipients.

5. Why we use information

We use information to:

• Create and maintain your device-linked account, deliver messages and media, and apply your preferences.
• Provide requested translation, notifications and other features.
• Verify purchases, restore subscriptions, apply benefits and maintain transaction records.
• Count daily usage and enforce limits, including after account deletion or switching.
• Investigate reports, maintain blocks and restrictions, prevent fraud and abuse, and protect the service.
• Apply restrictions automatically. If enough different users report the same device within a short period, our systems can suspend it, and repeated suspensions can lead to a permanent ban. No person reviews these decisions first, and AI checks alone never suspend or ban an account. You can ask Support to have a person review a restriction, explain your view and contest it.
• Use automated checks, including AI, to assess discovery messages and nicknames against our Community Rules. The AI receives the submitted text. Checks may reject content or flag messages with warnings, and can make mistakes. You can ask Support to review a rejection. We retain safety-check results and related identifiers to support future content checks and prevent abuse.
• Diagnose faults, understand usage and improve the service. Daily usage records are used for analytics as well as abuse prevention.
• Respond to support and privacy requests and meet legal obligations.

We do not sell your private messages or use their content for advertising. We do process information you send for support, reports or translation, but only for those purposes.

Where applicable data-protection law requires a legal basis, the grounds for these purposes are:

• Contract: processing necessary to create and maintain your account, deliver messages and requested features, verify purchases, apply plan benefits and provide support necessary to perform our agreement with you.
• Legitimate interests: processing necessary to prevent fraud and abuse, enforce usage limits, protect users and service security, diagnose faults, improve the service and respond to enquiries. These interests apply only where the processing is necessary and is not overridden by your rights and interests, and do not replace consent where it is required.
• Legal obligations: processing necessary to keep records required by law, respond to binding legal requests or meet other applicable legal duties.
• Consent: where consent is required for optional processing, or an additional condition is required for sensitive information, the relevant consent or condition is needed before that processing. A contract or legitimate interest alone does not authorise processing of sensitive information where the law requires an additional condition.

Accepting the Terms of Use or reading this policy does not provide any separately required consent. Where processing relies on consent, you may withdraw it through Support, without affecting the lawfulness of earlier processing. Withdrawal may prevent a feature that needs that processing from working; it does not automatically require deletion of records kept on another lawful basis. Section 10 explains other choices, including your right to object where applicable.

6. Who receives information

Other users receive the profile information and messages needed for the interactions you initiate. People who pick up your bottle see a warning, with its safety scores, if it may break the rules. Your chat preferences and internal moderation records are not public profile fields.

Service providers process information needed to perform their functions:

• Cloudflare provides website delivery, media storage, AI safety checks of discovery messages and nicknames, and the secure network connection to our servers. App requests, including discovery messages and text sent for translation, pass through Cloudflare.
• Google/Firebase provides crash reporting, app configuration and push notifications.
• Apple provides purchases, device verification and push notifications.
• Microsoft Azure Translator processes text sent for cloud translation.
• Zoho Mail processes support correspondence.
• Hosting providers store and process the service records needed to operate TideWhisper.

We require each service provider to protect information to at least the standard in this policy and to use it only to provide its service to us. Apple handles purchases, device verification and push delivery under its own privacy policy.

We may disclose information where required by a valid legal obligation, or where reasonably necessary and permitted by law to address fraud, security incidents, threats to safety or legal claims. These circumstances do not give us the ability to decrypt conversation content for which we do not hold the private keys.

7. International processing

Service data is hosted in Singapore, and support correspondence is processed in the United States. The other providers in section 6 operate internationally, so they may also process information in the United States and other countries.

International transfers must comply with applicable data-protection law. You can ask Support about processing locations and the safeguards that apply to a transfer, and request copies where applicable.

8. How long information is retained

Retention depends on the record and its purpose:

• Account profile: kept while the account exists, then removed from active systems when deletion is processed.
• Discovery messages: expire after approximately 30 days and may be removed earlier through cleanup or account deletion.
• Safety-check records: results and related identifiers for messages and nicknames, including checks of rejected content, expire approximately 30 days after their last use.
• Conversation messages: encrypted copies are removed from active servers after both participants have read them, or through other cleanup. Active message records also expire after approximately 30 days. Related media may take longer to clear; profile photos follow account retention instead.
• Daily usage records: kept for approximately 365 days after the daily usage window, for abuse prevention and analytics. Account deletion does not reset or immediately remove them.
• Purchase records: unresolved Apple purchase notifications are kept for approximately 90 days. Completed notifications and purchase records have no fixed automatic expiry.
• Device, moderation, block, report and feedback records: remain after account deletion and have no fixed automatic expiry. They support restrictions, investigations, feedback and the other purposes described here.
• Provider diagnostics: follow the provider’s retention rules and service settings. Firebase states that it starts removing Crashlytics crash records and related identifiers after 90 days.
• Server logs: a rolling log of recent requests is kept for troubleshooting and security. It can include IP addresses and account and conversation identifiers, but no message content. Newer entries replace the oldest.

For records without a fixed expiry, continued retention depends on ongoing payment or subscription issues; blocks, restrictions, reports, investigations or disputes; legal record-keeping and claim periods; and whether identifiable information is still needed to resolve issues or feedback. A continuing restriction does not by itself justify keeping unrelated information. You can ask Support to review retention.

Information no longer needed for a lawful purpose must be deleted or de-identified where required by law. Expiry and background cleanup may take time.

Backups are retained for 30 days from creation. Information removed from active systems may remain in an existing backup until it expires. This does not change the active-system periods above or the retention of copies held by other providers. Backups are used for recovery.

9. What account deletion does and does not remove

Use Delete account in TideWhisper to request deletion. The current waiting period is 14 days; the app shows the deadline for your request. You may cancel before that deadline. Once it passes, the request can no longer be cancelled and deletion cannot be undone. Processing can finish after the displayed deadline.

Deletion removes your profile and associated account content from active systems and disconnects your device from the subscription account currently linked to it. It does not cancel your Apple subscription or erase purchase records.

After deletion, these records remain: daily usage, device, moderation, block, report, feedback and purchase records (section 8), and the public encryption key that other participants need to read their own history. These records are pseudonymous, not anonymous. Device and Apple identifiers can link them to each other, and report and feedback text stays as written.

Account deletion does not erase other people’s copies or all records held by providers. Uninstalling is not a deletion request: some account and lock information may remain on your device, while local message history is removed.

10. Your choices and privacy requests

You can edit the profile fields available in the app, change notification settings, manage device permissions, clear available local history, block or report users, and request account deletion. Camera, microphone and photo-library permissions can be managed in your device settings; denying a permission may prevent the corresponding feature from working.

Depending on applicable law, you may have rights to access, correct or delete information; restrict processing; receive a portable copy; or withdraw consent. Withdrawal does not affect earlier lawful processing. Some requests are limited by other people’s rights, security needs or lawful retention requirements.

Right to object. Where applicable, you may object to processing based on our legitimate interests. Contact Support to explain your request; we will assess it under applicable law.

To make a privacy request, contact Support and describe what you need. We may ask for information to identify the relevant account and verify your request. An email address alone may not identify your app account. Do not send PINs, private encryption keys or your Apple Account password.

For a privacy concern or complaint, contact Support with the relevant details. We will review the matter, request clarification if needed, and communicate our response within the time required by applicable law. If we cannot fulfil a request, we will explain the reason where permitted.

Where provided by applicable law, you have the right to lodge a complaint with a competent data protection authority.

11. Adults only

TideWhisper is intended for people aged 18 and over. Anyone under 18 must not use the app. If you believe an under-18 user is using the service or has provided personal information, contact us through Support so we can investigate and take appropriate action.

12. Website and security

Hosting and delivery providers process technical information, including IP addresses and requests, to serve pages and protect the service. Other providers’ practices apply when you follow their links.

We use access controls and technical protections, including end-to-end encryption for conversation content as described above. No service, device or transmission can be guaranteed completely secure. Please protect your device and avoid sharing information you do not want another person to retain.

13. Changes and contact

We will update this policy’s version and date when it changes. Material changes will be communicated through the app or website as appropriate. Where a change requires separate consent, updating this policy alone does not provide that consent.

For privacy enquiries or requests, visit Support. Simplified Chinese and Traditional Chinese translations are available. If the versions differ, the English version controls to the extent permitted by law.