Privacy Policy

Version 4.0 · Effective October 28, 2026

toska is built around pseudonymity. We collect as little as we can, we never sell your data, and this policy is written to match what the code actually does — no more, no less.

1. What we collect

Everything below is collected only because a feature needs it. We collect no real name, phone number, location, contacts, photos, camera data, or advertising identifiers, we serve no advertising, and we do no cross-app tracking. (One literal caveat, so this reads true: Firebase Analytics pulls in Google's ads-attribution library as a transitive dependency, so that code is present in the binary. We never call it, no ads are served, and the app declares no tracking.)

Email address — sign-in, password reset, account recovery, support. Stored with Firebase Auth only — it is never copied into our post/profile database.
Random handle — your display identity (generated; never your real name).
Posts, replies, reflections, prompt responses — the app itself.
Drafts — posts you saved but didn't publish (only you can read them).
Likes, saves, reposts, follows, blocks — core features. Your lists are private to you; a like/repost's existence is visible on the content it touches.
Feeling tag, breakup stage, mood (if you set them) — feed personalization. Stage and mood live in your private, owner-only profile area.
Days you opened the app (date only) — powers your streak; only you can read it.
Push notification token — delivering push notifications you opted into; private area. The notification toggles in Settings control push delivery only — your in-app notifications list still shows every type.
Reports you submit (including the reported text) — readable only by moderators.
Crash reports — Firebase Crashlytics, not linked to your account, error text scrubbed of identifiers before sending.
Usage analytics (event names only; opt out in Settings → Privacy) — a fixed event vocabulary that never includes what you wrote, your handle, your ID, or search terms.
Performance data (app start time, screen render time, network request timing; opt out with the same Settings → Privacy toggle) — Firebase Performance Monitoring. No content, handle, or account identifier.

Timestamps on content are server-assigned and used for ordering and expiration — we don't collect device clocks, time zones, device models, or OS-version analytics of our own. One precise exception: a midnight post's expiry time is calculated on your device from your local midnight, so the stored expiry instant reflects the time zone your device was in when you posted; it is used only to expire that post and is deleted with it.

2. What "anonymous" actually means here — the honest version

To other users: you are a random handle. Nothing in the app shows any other user your email, name, or account identifiers, and our database rules — not just the interface — prevent other users from reading your private data.
To us (the operator): toska is pseudonymous, not anonymous. Your posts are stored against your account ID, which is connected to your email. We can technically connect content to an email address, and will do so only for moderation, safety, or valid legal process. We can't honestly claim otherwise, and we won't.
One persistent handle: all your posts appear under the same handle. Whisper and midnight posts are ephemeral, not extra-anonymous — they show your handle like any post until they expire.
What other signed-in users can see: your handle; your live posts, replies, reflections, and prompt responses (anything held for review is visible only to you and moderators); your reposts; your total felt count and your follower and following counts — the hide follower count setting hides the count from your profile display, it does not make the number private; whether a post of yours is shareable; and the fact that you liked or reposted a piece of content, on that content. Nothing else: not your email, mood, stage, settings, drafts, blocks, saved items, liked list, notification token, or any moderation or restriction status.
Crisis signals: if our systems detect crisis language in a post or reply of yours, it may be held for human review and crisis resources are shown to you. Since July 2026 our database rules structurally prevent moderation and crisis flags from ever being readable by other users, and content restored after review is scrubbed of all such markers.

3. How we use data

To run the app (feeds, threads, notifications), personalize your feed, detect and act on content that violates the Terms, keep the service safe (report review, crisis-content review, abuse rate-limiting), and fix crashes. We do not sell, rent, or share your personal data with advertisers or data brokers, we do not use your data for advertising at all, and we do not use your content to train AI models or allow anyone else to.

4. Public sharing of posts (your control)

If your allow sharing setting is on (new accounts start with it off; you can turn it on or off any time in the toska app (Settings → Privacy) or on the web, from your profile): other users can render a post of yours as a share-card image — words and feeling tag only, never your handle; and a small number of posts, a share page on toskaapp.com exists for any live post of yours that you or another user shares while sharing is on, and — separately — we hand-pick which posts appear on the site itself and in search engines such as Google (only hand-picked posts are indexable) — same rule: words, tag, felt-count, and an approximate age (e.g. "3h ago") only, no handle, no identifier, no profile link.

Turning it off ends both, including for existing posts — share cards stop immediately; share pages, the website and search-engine listings we control clear within a few minutes. Deleting a post removes it everywhere, including the website — the website's cache can take up to about ten minutes to catch up. Letters and expiring posts are never shareable regardless of this setting.

5. Third-party services

Firebase / Google Cloud — our infrastructure: authentication, database, serverless functions, push delivery, crash reporting, analytics, performance monitoring, and app-integrity checks all run on Google's servers under Firebase's privacy documentation. We use them to run toska, not to advertise.
Apple — push notifications are routed through Apple's service; the payloads contain no post content and no handles — only generic text and routing IDs. Sign in with Apple shares your email with us (or Apple's private relay address if you Hide My Email).
Google Sign-In (optional) — shares your Google account email with us.
Google reCAPTCHA Enterprise — on the web app and admin dashboard, sign-in and database access are protected by reCAPTCHA Enterprise as part of our app-integrity checks. Your browser shares technical information with Google so it can check that you're a person, not a bot. Google's Privacy Policy and Terms of Service apply to this processing. reCAPTCHA isn't used in the iOS app, which uses Apple's App Attest instead.
Giphy — GIF search goes through our server, so Giphy does not receive your identity, account ID, or IP address for searches. When a GIF is displayed, your device loads the image directly from Giphy's servers, which — like any image host — see your IP address. Giphy privacy policy.

No other third party receives user data. There are no ad networks, no data brokers, no tracking SDKs.

6. Retention — exact windows

Posts, replies, profile: until you delete them or your account.
Drafts: until you delete them or your account (only you can ever read them).
Whisper posts: 1 hour after posting, then hard-deleted from the live database — usually within about ten minutes — by a cleanup that runs every ten minutes (a database time-to-live policy is the backstop if a run fails). Midnight posts: same, from your local midnight (calculated on your device when you post).
Notifications in your inbox: pruned after 90 days.
Reports and moderation records: retained after content deletion — and after account deletion — for safety, abuse-pattern, and legal-defense purposes. This includes reports you filed, reports others filed about your content (with the reported text), and our moderation decisions on it.
Admin action log: retained as an internal accountability record; contains no post content beyond what moderation required.
Re-registration block list: if we remove an account for serious violations (including underage use), we retain a one-way cryptographic hash of its sign-in identifiers (email address and Apple/Google account identifier) to prevent the removed account from re-registering. The hashes cannot be reversed to reveal the identifier; no plaintext identifier is retained. (Added 2026-07-29.)
Backups: point-in-time 7 days; daily backups 7 days; weekly backups 8 weeks — deleted data ages out of all backups within about 60 days.

7. Account deletion — exactly what it deletes

Deleting your account (Settings) starts an automated server-side cascade that removes: your profile and handle, private profile data (mood, stage, settings, push token), posts, replies, likes and their effect on counts, saves, reposts, follows/followers, blocks, drafts, streak days, notifications you received, notifications you triggered in other users' inboxes, and your authentication account (which is where your email lives). Sign-in-with-Apple tokens are revoked with Apple. The cascade retries hourly until complete if any step fails. What survives: reports about content and reports you filed that we already acted on (for safety); our internal moderation-action log — note that the deletion itself writes entries there, one per removed post, each recording the account identifier and handle as a permanent moderation record; the one-way hash that blocks re-registration if the account was removed for a serious violation; and backup copies until they age out. We aim for the live-database cascade to complete within minutes, not days.

Not deleted by the cascade: reports (ones you filed and ones filed about your content) and moderation records, and — if the account was removed for serious violations — the one-way re-registration hash (section 6).

8. Your rights

Available to everyone, in-app, today: export my data (Settings — a JSON file of everything you've authored and own), deletion (per-item and full-account), correction (edit posts/replies, change email), analytics opt-out, and sharing opt-out.

Do Not Track / Global Privacy Control: we do no cross-app or cross-site tracking and serve no advertising, and we do not sell or "share" personal information — so there is no tracking or sale to opt out of. The in-app analytics opt-out (Settings → Privacy) turns off the only optional collection we do, and we treat a browser Global Privacy Control (GPC) or Do-Not-Track signal on our websites as a valid opt-out preference.

If you're in the EU/EEA/UK, these mechanisms are how we honor GDPR access, portability, erasure, and rectification; if you're in California, they cover CCPA/CPRA access, deletion, correction, and opt-out rights (we do not sell or "share" personal information as those laws define the terms, and we honor these rights regardless of whether the laws technically cover us, and we do not discriminate against you for exercising them). Email salte@saltedevelopments.com for anything the in-app tools don't cover; we respond within 30 days. toska is US-based and your data is processed on Google Cloud infrastructure in the United States.

9. Legal requests

We may disclose data when required by law — a valid subpoena, court order, or equivalent legal process. We will notify affected users when legally permitted. We do not voluntarily hand data to law enforcement or governments, with one exception: we may report imminent threats of serious harm.

10. Security

Data is encrypted in transit and at rest on Google's infrastructure. Access rules are enforced in the database layer (not just the app), are covered by an automated test suite, and are audited regularly. App integrity checks limit API access to genuine builds of the app. No system is perfect: if we learn of a breach affecting your personal data, we will notify affected users and any required regulators without undue delay after confirming it.

11. Age

toska is for users 18 and older, and your age confirmation is recorded at signup. We do not knowingly collect data from anyone under 18; if we learn we have, we delete the account and its data. toska is not directed at children under 13, and we never knowingly collect their data.

12. Changes to this policy

Each version is numbered and dated. Material changes are shown in the app for re-acceptance before continued use, and your accepted version and timestamp are recorded on your account.

13. Contact

salte@saltedevelopments.com