# Playthread Privacy Policy

_Last updated: [publish date]. Operator: [legal entity name and address]. Contact: support@duoplay.example (placeholder)._

Playthread is a private 1:1 messenger with games. It is built so that we, the operator, **cannot read your messages, photos, videos or game moves**, and so that we hold as little about you as possible.

## What we do not collect

* **No sign-up details.** There is no email, phone number, name, username or password. Your account is a random ID that your phone creates.
* **No contacts or address book.** You add people only by pairing with them (QR code in person, or a one-time invite).
* **No analytics, advertising or tracking.** The app contains no third-party analytics, ads or tracking SDKs, and we do not track you across apps or websites.
* **No location, no device identifiers for advertising, no IP-address logs.** The relay does not write request logs and does not store IP addresses. Rate limiting is held in memory only.
* **No message content.** Everything you send is end-to-end encrypted on your phone with the Signal Protocol before it leaves the device. Only the other person's phone holds the keys.

App Store privacy label: **Data Not Collected.**

## What our relay server handles, and for how long

To deliver messages between two phones, our relay temporarily stores encrypted data it cannot read. Here is everything it holds:

| Data | Why | How long |
|---|---|---|
| Your random account ID and a hash of your account secret | So only your phone can collect your messages | Until you delete your account |
| Your public keys (identity and one-time "prekeys") | So a paired contact can start an encrypted session with you | Until you delete your account. One-time keys are deleted as they're used. |
| A push token from Apple | To wake your phone when a message arrives | Until you delete your account or it's replaced |
| Which accounts are paired with which | So only people you've paired with can message you | Until either account is deleted |
| One-time invite codes (stored only as a hash) | Pairing | First use, revocation, or **24 hours** |
| Encrypted messages waiting for delivery | Delivery | Deleted **as soon as the recipient's phone confirms delivery**, or after **7 days** undelivered |
| Encrypted "Delete for Everyone" requests | So deletes reach phones that were offline for a long time | Deleted on delivery, or after **90 days** undelivered |
| Encrypted photo and video files | Delivery | Deleted **when the recipient's phone confirms the download**, or after **30 days** |
| Your block list | So blocked contacts can't reach you | Until you unblock or delete your account |

The relay can see when encrypted items are sent, their size, which paired accounts they pass between, and whether a push should read "message" or "turn". Because "Delete for Everyone" requests are kept longer, the relay can tell that an item is a delete request. It cannot see what is being deleted.

**Notifications** go through Apple's Push Notification service and only ever say "New message in Playthread" or "Your turn in Playthread". They never contain names or message content.

## What stays on your phone

Your chats, contacts (with the nicknames you choose), photos and videos, your Save Folder, game history, keys and settings live only on your phone. They are stored in an encrypted database (SQLCipher) whose key is kept in the iOS Keychain for this device only. This data is **excluded from iCloud and device backups**, so it is not restored to a new phone.

Photos and videos can't be saved to your photo library or shared out of the app. Playthread only uses your camera and microphone when you choose to scan a QR code, take a photo or record a video. It only reads the photos you pick in the photo picker.

## Reporting abuse

If you choose **Report** in a chat, the app sends us the report **you** put together: the reason you pick, any note you write, and the messages you choose to include, which your phone decrypts and attaches. We use reports only to investigate abuse and respond to legal obligations, and we delete them after the investigation is closed (at most [12 months], unless the law requires longer). We never see anything you don't choose to send.

## Deleting your data

* **Delete for Me** removes a message from your phone.
* **Delete for Everyone** removes it from both phones in the app once the other phone is online. Your phone tells you if the delete is confirmed or if it expired after 90 days unconfirmed.
* **Disappearing messages** (Off, 24 hours, or 7 days, the default) delete messages automatically on both phones.
* **Delete Account** (Settings → Account → Delete Account) removes your account, keys, pairings, block list and anything still waiting on the relay, and erases everything on your phone. If the relay can't be reached, you can still erase your phone. Anything left on the relay then expires on the schedule above (7 to 90 days).
* Deleting the app erases its data on your phone. Your account on the relay is not deleted that way: its waiting items expire as above.

## Children

Playthread is rated 17+ and is not intended for children.

## Your rights

Because we don't hold readable personal data about you, there is very little we could provide or correct. If you have a question or a request under data-protection law (for example the UK/EU GDPR or CCPA), contact us at the address above. You can delete everything yourself with Delete Account.

## Changes

If we change this policy, we'll update the date above and describe the change in the app's release notes.