Privacy

Your data, plainly.
No dark patterns.

We try to keep this short and honest. If anything here is unclear, email us — a real person reads every message.

Last updated · May 5, 2026

Data we collect

  • Account: email, password (hashed by Firebase — we never see the plaintext), and an optional display name and handle.
  • Profile: the challenge category you pick, your goal length, your partner pairing, your timezone.
  • Proof submissions: the photos you post for each daily snap, plus the captions and votes attached to them. These are visible to your partner and, if you opt in, to people you share with.
  • Activity: snap timestamps, streak history, partner messages and reactions, voting decisions.
  • Device: your push-notification token (so we can ping you when your partner acts), browser/OS for support and crash debugging, and basic request logs (IP, user-agent, route).
  • Usage analytics: aggregate page-view and Web Vitals data via Vercel Analytics and Speed Insights. No third-party ad cookies. No fingerprinting.

We don't sell your data. We don't run ads. Your snaps are not used to train AI models.

Who processes your data

We use a small set of well-known infrastructure providers. Each one handles a specific part of the stack, and we've signed a Data Processing Addendum (DPA) with each one — links are on every card below.

  • Firebase (Google)

    Authentication (email/password, Google sign-in) and verification emails.

    Data Processing Addendum ↗

  • Firebase Cloud Messaging (FCM)

    Delivers push notifications to your device. We store the FCM token associated with your account; we do not send your message contents through any other party.

    Data Processing Addendum ↗

  • Supabase

    Stores your snap photos and related metadata. Access is enforced at the application layer — your snaps are only shown inside features that check your account, your match, or a share link you've opted into.

    Data Processing Addendum ↗

  • Railway

    Hosts the ProofUp API and database. All traffic to the API is TLS-encrypted.

    Data Processing Addendum ↗

  • Vercel

    Hosts the website you're reading and provides aggregate analytics (Vercel Analytics, Speed Insights). No personally identifying analytics events.

    Data Processing Addendum ↗

We don't share your data with anyone outside this list, except when required by law or to protect the safety of our users.

How long we keep it

  • Active accounts: we keep your data as long as your account exists.
  • Deleted accounts: snaps, streaks, messages, and profile data are removed within 30 days. Backups roll off within 90 days.
  • Server logs: request and crash logs are retained for up to 30 days, then rotated.
  • Support emails: kept in our inbox until the thread is resolved, then archived.

How to delete your data

You can wipe your account yourself, anytime:

  1. Open Settings.
  2. Scroll to the Danger Zone.
  3. Tap Delete account and confirm.

Deletion is permanent and removes every snap, streak, and message. If you can't access the app for any reason, email hrach.harutyunyan49@gmail.com from your account address and we'll do it for you.

Your rights

You can request a copy of the data we hold about you, ask us to correct anything that's wrong, or have it deleted. Email hrach.harutyunyan49@gmail.com from your account address — we'll respond within 30 days.

Kids

ProofUp is not for anyone under 13. If you believe a child has created an account, email us and we'll remove it.

Changes to this policy

If we make a meaningful change, we'll update the “Last updated” date at the top of this page and, for changes that affect how we use your data, send a heads-up to your account email before the change takes effect.

Contact

Questions, complaints, or just curious? hrach.harutyunyan49@gmail.com.

See also: /support