PRIVACY POLICY

We collect only what the service needs to work, including data handled on our behalf by the third-party services listed in section 4:

• Account information — your phone number (required for SMS one-time-code sign-in), display name, email address if you provide one, and your BRUH user ID. Your date of birth is stored only to enforce our 18+ rule and is never displayed to other members.
• Profile information — age range, bio, interests, up to 10 photos or videos, your status, an optional self-described gender identity (or “prefer not to say”) together with your choice of whether to display it, and your private “who would you like to see?” discovery preference, which is visible only to you.
• User-generated content — Local Board posts, replies, messages you send, and the photos attached to them.
• Location information — a precise device location, only while location sharing is switched on. Sharing is off by default. A precise coordinate is used only on our servers, to work out who is within your search radius: your exact location, address and exact distance are never shown to other members, to internal agents, or through any API. Other members only ever see an approximate, randomized pin according to your choice of Hidden, Neighborhood (the default) or Wider area, which rotates periodically, plus a coarse distance range such as “under 1 mile”. You can switch sharing off at any time, or use Incognito Mode to hide from discovery.
• Purchase information — your BRUH+ subscription status, product identifier, purchase history and expiration date. Web purchases are processed by Stripe; in-app purchases on iOS and Android are processed by the Apple App Store or Google Play Billing and linked to your BRUH+ entitlement by RevenueCat. BRUH never receives or stores full card numbers.
• Device and technical data — device type, operating system, app version, IP address, product interaction and analytics events, and crash and diagnostic logs.
• Contacts — BRUH does not access your device address book.
• Cookies and similar technologies — used to keep you signed in, remember preferences, secure the service, and measure aggregate usage. You can manage optional categories at any time through cookie preferences in the footer.

• Create and maintain your account.
• Authenticate you by SMS one-time code.
• Show you people nearby and show you to others, according to your privacy settings and your private discovery preference.
• Verify you are at least 18 and block underage accounts, using your date of birth.
• Deliver messages, notifications, and account-related alerts.
• Process subscriptions, renewals, and cancellations.
• Detect, investigate, and prevent fraud, spam, abuse, harassment, and safety risks.
• Moderate user-generated content, including profiles, photos, Local Board posts and messages, with human review of enforcement decisions.
• Handle reports and blocks, and enforce their effects across the service.
• Diagnose bugs, monitor performance, and improve features using aggregate analytics.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not share your phone number or SMS consent with third parties for their own marketing.

BRUH uses phone-number sign-in. When you create an account or sign in, we send a one-time passcode by SMS through our messaging provider. These are transactional messages tied to your account — verification, login, account recovery, security alerts, and important account notices. Message frequency varies, and message and data rates may apply. Reply STOP to opt out or HELP for help. Full details are in our SMS Terms. Opting out of SMS may prevent you from signing in, since codes are our authentication method.

We use vetted service providers who process data on our behalf under contract:

• Supabase — database, authentication, and realtime messaging infrastructure.
• Twilio — delivery of SMS verification and account messages.
• Stripe — subscription payments and billing management on the web.
• RevenueCat — connects your Apple or Google in-app purchase to your BRUH+ entitlement.
• Apple App Store / Google Play Billing — processing of in-app purchases on iOS and Android.
• Google Maps Platform — map rendering, places, and geocoding for the discovery map.
• Daily.co — transmission of video and audio for Rooms. BRUH does not record Rooms.
• Cloudflare — hosting, content delivery, and protection against abuse.
• Analytics and crash reporting — aggregate, privacy-respecting usage measurement and diagnostics.

These providers may process data in the United States and other countries. Where personal data leaves the European Economic Area, the United Kingdom or Switzerland, transfers rely on Standard Contractual Clauses or another lawful transfer mechanism. We may also disclose information when required by law, to respond to lawful requests, to protect the safety of a person, or in connection with a merger or acquisition.

We keep account and profile data while your account is active. Precise location points are short-lived and are overwritten or removed as you move or when you turn sharing off. Messages are retained so conversations remain available to participants. You can delete your account at any time, in two ways:

• In the app — BRUH app → Settings → Sign-in & account → Delete account → confirm “Yes, delete everything”. Your profile leaves discovery immediately.
• On the web — visit heybruh.app/delete-account, the deletion page for BRUH Friend Finder as listed on Google Play. You can request deletion without reinstalling the app: sign in with your phone number and a one-time SMS code to delete it yourself, or email privacy@heybruh.app from the phone number or email address associated with your account and we will verify the request and delete the account for you.

A deletion request deletes or de-identifies the following within 30 days: your profile, photos and videos, bio, interests, precise and approximate location history, discovery preferences, messages you sent, Local Board posts, and device logs tied to your account. This is deletion — not a suspension, freeze or deactivation of your account.

We retain a limited set of records after deletion:

• Hashed identifiers connected to banned accounts, abuse reports and moderation decisions — up to 3 years, to prevent re-registration, support safety enforcement, and meet child-safety obligations.
• Transaction and tax records held by Stripe, Apple and Google — up to 7 years where tax and accounting law requires it.
• De-identified crash logs — up to 90 days.

Retained data is isolated, access-controlled, and deleted at the end of the applicable period.

The deletion flow may direct you to Manage subscription: a BRUH+ subscription bought inside the iOS or Android app is billed by Apple or Google and must be cancelled separately in your App Store or Google Play account. Cancelling a subscription does not delete your account, and deleting your account does not cancel Apple or Google billing.

• Access, correct, or update your profile at any time in the app.
• Turn location sharing off at any time.
• Choose Hidden (or Wider area) for your map pin.
• Enable Incognito Mode to hide from discovery.
• Block or report another member.
• Delete your account in the app or through heybruh.app/delete-account.
• Cancel a BRUH+ subscription at any time; access continues until the end of the paid period.
• Request a copy of your data by emailing privacy@heybruh.app.

BRUH is strictly for adults 18 years of age or older, and we have zero tolerance for child sexual abuse and exploitation (CSAE). We do not knowingly collect personal information from anyone under 18.

The following are prohibited on BRUH:

• Sexual abuse of a minor.
• Grooming a minor for sexual purposes.
• Sexualization of a minor in any medium, including text, imagery and generated material.
• Romantic or sexual relationships between an adult and a minor.
• Producing, soliciting, acquiring, sharing or linking to child sexual abuse material (CSAM).
• Trafficking or sextortion of a minor.
• Any other conduct that endangers a child.

To report a concern, open the profile, Local Board post, message, meetup or Room and choose Report, then select Underage participant if you believe someone is under 18, or Sexual content or solicitation for suspected CSAE or CSAM, noting in the details that a minor is involved. Your identity as a reporter is never exposed publicly or to the reported member.

Accounts we confirm to belong to someone under 18 are terminated and the associated data deleted in line with this policy, except the limited safety records described in section 5. Content we confirm to be CSAM is removed, the account permanently banned, and the case reported to the National Center for Missing & Exploited Children (NCMEC) through the CyberTipline and to appropriate authorities as required by law.

Designated child-safety contacts: safety@heybruh.app and hello@heybruh.app. Our full standards are published on our Child Safety Standards page.

BRUH does not record Rooms. However, other participants may screen-record what they see or hear, so treat a Room as public. Video and audio are transmitted through Daily.co. Where a report is filed, we may preserve limited evidence for safety review to the extent permitted by law. Please do not share personal or financial information in a Room.

If you are a California resident, you have the right to know what personal information we collect and how it is used and disclosed, to request access to or deletion of that information, to correct inaccurate information, and to not be discriminated against for exercising these rights. BRUH does not sell personal information and does not share it for cross-context behavioral advertising. To exercise a right, email privacy@heybruh.app from the address or phone number associated with your account, or contact us through the contact page. You may use an authorized agent, and we will verify the request before acting on it.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process personal data on these legal bases: performance of our contract with you (providing the service), your consent (location sharing and optional features), our legitimate interests (security, abuse prevention, service improvement), and compliance with legal obligations. You have the right to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, and the right to lodge a complaint with your supervisory authority. International transfers rely on Standard Contractual Clauses or another approved mechanism. Contact privacy@heybruh.app to exercise any right.

We use encryption in transit, row-level database access controls, role-based administrative access, and audit logging. No system is perfectly secure, but we work to protect your information and will notify you and regulators of a qualifying breach as required by law.

We may update this policy as the service evolves. We will revise the “last updated” date and version above and, for material changes, provide notice in the app or by message before the change takes effect. This policy is maintained in English; English is the reference version, and any translation is provided for convenience only.

Privacy requests: privacy@heybruh.app
Support: support@heybruh.app
Child safety: safety@heybruh.app
General: hello@heybruh.app