Privacy Policy

We collect the information needed to create, secure, and recover your account:

• Email address - Collected through Google, Apple, or email-code sign-in. Your email is private and is not shown to other users.
• User ID - A unique account ID used to connect your profile, content, activity, settings, reports, and notification preferences.
• Authentication provider data - Limited sign-in information returned by Google, Apple, or Supabase Auth so we can verify your account.

What we do not require:

• Phone numbers
• Physical addresses
• Legal names
• Device contacts/address book access or upload
• Precise or coarse location tracking

Decidr collects and stores user-generated content you choose to create or send:

• Photos/images - Images uploaded to posts, private drops, room walls, comments, avatars, messages, or custom R assets.
• Videos - React Videos and related preview/thumbnail media.
• Audio - Audio tracks contained in videos or audio you add to React Video content. If you choose Dictate in a direct message, Apple’s Speech recognition service turns spoken audio into an editable draft. Depending on device, language, and recognition availability, audio may be sent to Apple for processing. Decidr does not retain a recording of this dictation audio.
• Text content and profile links - Captions, descriptions, comments, messages, room names, bios, public profile website links, prompts, labels, and text overlays.
• Reactions and picks - Your picks/swipes, emoji reactions, custom R reactions, comments, and engagement with posts or videos.
• Private-room activity - Private drops, room wall posts, room membership, invitations, and messages shown according to room settings.

Content visibility depends on the surface and settings you choose. Public content can be seen by other users. Private-room content is limited to eligible room members, except when we need to review reported content or enforce safety rules.

To support profiles, discovery, and social graph features, we collect:

• Username - Required and publicly visible.
• Display name, avatar, bio, and profile links - Optional profile fields you control. Public profile links are visible to signed-in Decidr users who can view your profile.
• School/campus fields - Optional campus information used for campus discovery and community features when enabled.
• Followers/following - Account-linked social connections you create. We do not access or upload your device address book.
• Blocked users - Users you choose to block.
• Mention/tag settings - Preferences for how other users can tag or mention you.

We collect in-app usage data to operate Decidr, personalize the feed, power creator insights, measure safety, and improve reliability:

• Feed and post activity - Views, picks, reactions, comments, shares, saves, and post performance metrics.
• Video metrics - Watch time, completion, pause/resume, and related React Video engagement.
• In-app search - Submitted user, campus, mention, and content searches, plus linked query-behavior metrics such as query length, query type, and result count. Decidr does not offer a user-visible saved-search history.
• Interests and onboarding choices - Categories, campus/community choices, and voting-style preferences.
• Notification interactions - Notification preferences, opt-in state, opened notifications, and dismissed/tapped notifications.
• Safety events - Reports, moderation status, review queue records, enforcement actions, and repeated-report signals.

We use this data inside Decidr. Decidr does not sell personal data or use its own account and activity data to track you across other companies' apps or websites.

If you choose to enable return notifications, we store your notification preference and native push token so Decidr can send app-relevant alerts, such as comments, reactions, messages, mentions, private-room activity, followed-user activity, and closing or ended drops.

Notifications are optional. You can turn them off in the app, and you can also manage push permissions in iOS Settings.

Decidr may store limited local crash information on your device, such as error message, page URL, user agent, and timestamp, to help recover gracefully from startup errors. Current in-app crash records are local unless you choose to share them with support.

We may also collect app performance and usage events in our backend when needed to operate the service, troubleshoot reliability, and improve the user experience.

• No precise GPS location tracking.
• No contact/address book upload.
• No health, fitness, or financial data collection.
• No payment or purchase history collection; Decidr currently has no in-app purchases.
• Decidr does not sell personal data or provide Decidr account, profile, message, or private-room data to advertising networks for their use.
• No sale of personal data.
• No use of your data to track you across apps or websites owned by other companies.

Your data is used to:

• Operate, secure, and maintain your Decidr account.
• Display your content based on audience and privacy settings.
• Power picks, reveals, comments, reactions, private drops, messages, and custom R features.
• Personalize feeds and help creators understand how their content performs.
• Send optional return notifications after explicit opt-in.
• Detect abuse, review reported content, enforce Community Guidelines, and protect users.
• Debug, improve, and measure Decidr's reliability and performance.

Decidr provides reporting and blocking tools and may review reported content to enforce our Community Guidelines. Safety records may include the reported content, reporter and target identifiers, report reason, status, reviewer decision, and enforcement record. Access to report records is limited to authorized safety reviewers.

We may retain limited safety records when necessary to protect users, investigate abuse, comply with law, or prevent repeat violations, even if related content or an account is later removed.

Pre-publication safety review: During account setup after age confirmation, Decidr asks the creator for explicit permission before it sends a new Drop or React Video for publication. For a Drop, Decidr may send the caption, optional description, and images to Amazon Bedrock for safety review. For a React Video, Decidr may send its caption and on-screen text to Amazon Bedrock and sends the new video file to Mux for video safety review. Choosing not to allow this review does not affect browsing, but Decidr will not submit that new Drop or React Video for publication. New profile artwork has a separate permission prompt before its image is sent to Amazon Bedrock. Direct Messages and comments are not sent to Amazon Bedrock or Mux through this pre-publication safety-review flow.

You may withdraw future safety-review permission in Profile & Settings → Privacy → Content safety review. If that control is unavailable in your version, update Decidr or contact support@decidr.us for help withdrawing permission. Browsing remains available, but new Drops, React Videos, and profile artwork cannot be submitted for review while the relevant permission is off. Checks or uploads already started may finish; withdrawal cannot recall content already sent to a provider and does not itself delete an existing post. A pending item may need to be submitted again after you grant permission. Account deletion is a separate option.

Supabase: We use Supabase for authentication, database, storage, Edge Functions, and real-time/app backend services.

Google Sign-In: We use Google OAuth when you choose Google sign-in. Google may process your sign-in under Google's own privacy policy.

Sign in with Apple: On iOS/native builds, Apple sign-in may be available as a privacy-focused sign-in option. Apple may provide a private relay email if you choose it.

Mux video infrastructure: We use Mux for React Video upload, safety review, video processing, playback, thumbnails, and related delivery workflows.

Amazon Bedrock: With your explicit permission, we use Amazon Bedrock to review new Drop text and images and React Video captions and on-screen text, and separately consented profile artwork images, for the limited safety purpose described above.

Apple Speech recognition: Optional direct-message dictation uses Apple’s Speech recognition service. Audio may be sent to Apple for processing. You can type instead and can withdraw microphone or Speech Recognition permission in device Settings. Apple’s speech and dictation privacy information explains Apple’s handling.

Apple Push Notification service: If you opt in to native push notifications, notification delivery uses Apple's push notification infrastructure.

GIFs and stickers: The current launch version does not offer third-party GIF or sticker search, delivery, or display. Decidr does not request GIF or sticker media from an outside provider in this version.

Decidr does not use third-party advertising networks to sell or market Decidr users' data. We remain responsible for the personal data we send to service providers. Our provider requirements include processing for the authorized service purpose, confidentiality, security safeguards, and protection of personal data consistent with this policy and applicable law. Supabase and Mux describe their processor obligations in their data-processing terms; Apple and Google also provide their own disclosures for the sign-in or device services you choose.

Private to you or limited by settings:

• Email address and authentication identifiers.
• Blocked users and privacy settings.
• Private-room content except for eligible room members and safety review.
• Votes/picks where anonymity or audience settings apply.
• In-app search and usage data used for app operation and personalization.

Visible to others when you choose public or social surfaces:

• Username, display name, avatar, bio, school/campus fields you choose to show.
• Public posts, videos, comments, reactions, and custom R activity.
• Follower/following relationships where surfaced by the app.

We protect data using HTTPS/TLS, Supabase Row Level Security, authentication checks, access controls, moderation tooling, and least-necessary access patterns. No system is perfect, but we design Decidr to fail gracefully and avoid exposing private data when errors occur.

• Access and update profile data from the app.
• Control privacy settings, including visibility, school display, tagging/mention preferences, and notification preferences.
• Report content or users that violate our Community Guidelines.
• Block users to restrict unwanted interaction.
• Delete your account from Profile settings. The deletion process removes your sign-in account and linked personal data from the active service and removes account-owned media through our storage and video-provider cleanup processes, subject to the limited retention described below.
• Request access, a copy, correction, or deletion of your personal information by contacting support@decidr.us. We may need to verify that the request concerns your account before providing information or making changes.

We keep account information and the content you choose to store while needed to provide your account and its features. Usage and search records are kept for app operation, account-linked insights, personalization, safety, and reliability. You may delete content using the available controls or request deletion of your account or personal information.

When you delete your account, our cleanup removes account-owned media from active storage and video-provider assets and removes linked account and analytics records. Cleanup can require retries if a storage or provider service is unavailable; a failed deletion is reported so you can retry or contact support. Limited safety, security, or legal records may be kept only when needed to investigate abuse, prevent repeat violations, resolve a dispute, or meet a legal obligation, with access restricted to authorized personnel.

Deletion from the active service is separate from backup and provider-log expiry. Residual copies may remain for the applicable backup or provider retention cycle and are not part of normal user-facing access. Retention depends on the record’s purpose, the necessary safety or legal requirement, and the service’s backup or deletion process. Contact support@decidr.us for help with the scope or progress of a deletion request. We cannot remove copies that another person independently saved or reshared outside Decidr.

Decidr is not intended for users under 13 years old. If you believe a child under 13 has created an account, contact us immediately so we can review and remove the account as appropriate.

We may update this Privacy Policy from time to time. When we make significant changes, we will update the date above and may provide additional notice through the app.

If you have privacy, safety, or data rights questions, contact us at: