Privacy Policy

Chopped or Not

Last updated: 2026-08-24

This policy describes what Chopped or Not collects, why, who else touches it, how long it is kept, and what you can do about it. It describes the app as it is actually built. Where the app enforces something in code rather than only promising it, this policy says so.

Chopped or Not ("we", "us") is an independently operated app. We do not publish a postal address; contact is by email only. You can reach us at choppedornotapp@gmail.com, and we answer every message sent there.

The short version

• You take a photo in the app. Strangers respond 🔥 (liked) or 😑 (meh). That is the whole product.
• This is not a dating app. There are no names, no profiles, no messaging, no matching, and no way for one user to identify or contact another.
• Voting is anonymous in both directions. You never learn who voted on your photo. Voters never learn whose photo they are looking at.
• The app cannot open your photo library. Photos are taken live, in the app, only. There is no picker and no camera-roll permission.
• We never sell your data, and we do not track you across apps or websites. There is no advertising SDK and no ad identifier in this app.
• We hold the email address from your Apple or Google sign-in, because that is how you get back into your account. No other user ever sees it. If you use Apple's Hide My Email, what we hold is Apple's relay address, not your real one — we never see your real address at all.
• You can erase everything, including your sign-in, in one tap in Settings.

What we collect

Everything below is listed in the app's iOS privacy manifest as well, and the two are meant to match.

Sign-in identity — one email address

You sign in with Apple or with Google. We hold one email address, and nothing else that identifies you. It lives in the authentication system (Supabase Auth), separately from the application data, and no other user can read it. Settings shows it back to you masked.

If you use Apple's Hide My Email, the address we hold is the relay address Apple generates for this app — we never receive your real address, and you can break the relay at any time from your Apple ID settings.

We do not collect phone numbers. There is no SMS in this app.

Apple privacy manifest: Email Address — App Functionality.

About you: age band, gender, US state, and (optionally) ethnicity

During first run the app asks four questions:

The birth year is used for two things: to check that you are 18 or older, and to derive an age band (18-24, 25-34, 35-44, 45-54, 55+). Only the band is ever used in any breakdown.

The state is the state you select from a list. The app never asks for location permission and never reads your device location. Settings shows "Location permission: never requested", and that is accurate.

Ethnicity is optional and is treated as sensitive. See Ethnicity, specifically below.

Apple privacy manifest: Sensitive Info — App Functionality and Analytics.

Your photo

One photo at a time is "live". You take it in the app with the camera; there is no way to submit an image from your photo library, from another app, or from a file. Before upload the image is downscaled (longest edge 1280px) and re-encoded as a JPEG.

Photos are stored in a private storage bucket. They are not public, are not listed anywhere, and are not reachable by URL guessing. See How photos are stored and served.

Apple privacy manifest: Photos or Videos — App Functionality.

Identifiers

• Account ID. A random UUID that identifies your account inside our database. It is never shown to another user, and since the storage-path change it never appears inside a photo URL either.
• Push token. Only if you turn notifications on. It is an Expo push token issued by the notification service, stored against your account, and cleared automatically if the device stops accepting pushes.
• Subscription identifier. If you subscribe, your account ID is also used as the customer identifier in RevenueCat so the entitlement can be matched to your account.

Apple privacy manifest: User ID, Device ID — App Functionality.

Your activity in the app

• Each vote you cast: which photo, whether it was 🔥 or 😑, and when.
• A snapshot of your age band, gender, state and (if shared) ethnicity, taken at the moment you vote. This is deliberate: if you later change your profile, it must not silently rewrite somebody else's historical breakdown.
• Counters used to keep the product honest and to stop abuse: how many votes you have cast, how many were 🔥, when you last voted, when you last posted, and how many photos you posted in the last hour. These enforce a 400ms floor between votes and a limit of 6 photo submissions per hour.
• A "rater quality" flag. If someone votes 🔥 more than 95% or less than 5% of the time over 100+ votes, their votes stop counting toward anyone's breakdown. They still vote; their answers just stop shaping statistics.
• Reports you file against a photo (which photo, which reason).

Apple privacy manifest: Other Data Types — App Functionality and Analytics.

Crash reports

The app can send crash and error reports to Sentry. This is only active in builds where a Sentry DSN has been configured; with no DSN, nothing is sent anywhere. When it is on, it is configured not to attach personal information (sendDefaultPii: false) and a share of performance traces is sampled. Crash reports may still contain technical details such as device model, OS version and a stack trace.

Apple privacy manifest: Crash Data — App Functionality.

Purchases

If you subscribe, the purchase itself is handled by Apple (or Google Play). We do not see or store your payment card. We receive, via RevenueCat, whether the "premium" entitlement is currently active for your account, and we store that as a single true/false flag.

What we never do

• We never sell your personal information, and we never share it for cross-context behavioural advertising.
• We do not track you. The app declares NSPrivacyTracking: false and lists no tracking domains. There is no advertising SDK, no IDFA/ATT prompt, and no analytics product that follows you across other apps or websites.
• We never ask for your name. There is no name field anywhere in the app. Settings shows "Name: none".
• We never open your photo library. The iOS build ships without a photo library usage description, and the Android build explicitly blocks the media and external-storage permissions. This is a permanent product constraint, not a current default.
• We never request location. No GPS, no IP-based location feature. The state in your profile is the one you picked from a list.
• We never let one user identify or contact another. No names, no profiles, no messaging, no comments, no friend lists, no leaderboards.
• We never show anyone who voted on a photo, or show a voter whose photo they are voting on.
• We never use your demographics to decide who sees your photo. The feed is ordered by fewest votes first, then most recent — nothing else.
• We never publish a statistic that describes fewer than 20 people.

How photos are stored and served

• The storage bucket is private. It permits only JPEG and WebP, up to 8 MiB.
• Each photo is stored at an opaque, random path (a two-character shard plus a random 32-character name). The name is random per photo, not per person, so two photos posted by the same person cannot be linked to each other by their paths. Paths used to contain the owner's account ID and the exact millisecond of posting; that was removed precisely because a signed URL carries its path in plain text.
• Photos are served only through signed URLs that expire after 30 minutes, generated per request. There is no permanent public URL for any photo.
• A photo is only served to other users after automated moderation has approved it. See Moderation and reporting.
• A feed card carries exactly three things: the signed image URL, a photo ID, and a vote count. The owner's account ID is stripped before the response is built, and the underlying database function no longer returns it at all.

Voting is anonymous in both directions

This is enforced in the database, not just in the interface:

• The votes table has no read policy for any client. There is no shape of query, and no API call, that returns a voter's identity to any user's device. Statistics are produced by a privileged aggregate function that returns totals only.
• Posters see counts and demographic breakdowns. They never see who voted, and they cannot obtain it by any combination of screens.
• Voters see an image, a photo ID and a vote count. They are never told whose photo it is.
• You cannot vote on your own photo, and you cannot vote on a photo the feed did not serve you. Both are checked on the server.

Analytics, and the 20-person floor

Subscribers see breakdowns of how people responded to their photo — by age band, gender, state and ethnicity, plus a "biggest fans" segment and a distribution chart. These are built with real counts of real votes; nothing is invented or synthesised. Several protections apply, and they exist to stop a poster reverse-engineering an individual voter's answer:

• No percentage is ever shown below 20 votes.
• No published bucket ever describes fewer than 20 people. A bucket under the floor is not hidden — hiding leaks by arithmetic — it is merged into a residual row ("Everyone else", "Elsewhere") until it clears the floor. Rows still add up, and no cell under 20 is ever released.
• Breakdowns are released on 20-vote checkpoints. The breakdown always covers the first multiple of 20 eligible votes, so the data is byte-identical between checkpoints and moves twenty votes at a time. Without this, an owner could poll before and after a single vote and subtract one from the other to read that voter's entire demographic profile.
• Complement guard. A cell is published next to the marginal totals it sits inside, and those subtract. So every attribute naming a published cell must have either nothing outside it, or 20 or more outside it. Where a specific segment does not qualify, the app falls back to a broader one rather than publishing an unsafe cell.
• The distribution chart only counts a demographic cell once it has at least 5 votes, so a two-vote cell cannot shape the curve.
• Votes from accounts flagged by the rater-quality check are excluded from all of the above.

Raw counts (how many people responded, how many liked) are free and are shown to everyone for their own photo. The subscription unlocks the breakdowns.

Ethnicity, specifically

Ethnicity is a special category of personal data under the GDPR and "sensitive personal information" under California, Colorado, Connecticut and Virginia privacy law. It is handled accordingly:

• It is optional. "Prefer not to say" is the resting selection on the onboarding step; nothing is preselected, the Continue button is enabled from the first frame, and moving past the screen without touching anything stores nothing at all — not an empty value, not a record that you declined.
• Choosing a category is the affirmative act of consent, and the moment you did it is recorded (ethnicity_consent_at) so that consent is demonstrable rather than inferred.
• It is multi-select, because people are allowed to be more than one thing. The categories are the 2024 US federal standard (OMB SPD 15) set.
• It is used for one purpose only: to break down how people responded to your photo. It is never used to decide who sees your photo, who is shown to you, or how anything is ranked.
• It is never shown to another user. Like every other demographic, it only appears inside aggregate breakdowns on the owner's own analytics screen, and only subject to the 20-person floor, the checkpointed release and the complement guard described above. It can be combined with age band and gender in the "biggest fans" segment; that combination is subject to the same floor and the same guard, so a published segment still always describes 20 or more people.
• You can withdraw it in one tap in Settings, and withdrawal is real. Withdrawing clears it from your profile and clears the snapshot attached to every vote you have ever cast. It does not just stop future collection — it stops the data continuing to shape other people's breakdowns. Your votes still count; only the ethnicity attached to them is erased.
• Settings always shows what is actually held: the categories you chose, or "not shared".

Moderation and reporting

• Every photo is scanned automatically before it can be seen by anyone. A new photo is pending and is not served. Only after the automated check returns "approved" does it enter anyone's feed.
• The check is run by Amazon Web Services (AWS Rekognition). Detected categories include explicit nudity, sexual activity, violence and gore, and hate symbols. The image bytes are sent to that provider for the sole purpose of that check.
• The gate fails closed. If the provider errors, is unreachable, is unconfigured, or the daily moderation budget is exhausted, the photo stays pending and is never served. Nothing is ever approved by default.
• You are told the verdict — in the app, and by push notification if you asked to be told and notifications are on.
• Anyone can report a photo by long-pressing it, choosing from: inappropriate; not a real person; someone else's photo; other. Reporting removes that photo from your feed immediately and permanently.
• Reports are recorded and we review them. We do not promise a response time, and no photo is removed automatically by report volume alone. We can remove a photo and can suspend or ban an account. A banned account cannot post and cannot vote, and its photos stop being served.

Notifications

If you turn notifications on, we store an Expo push token against your account and may send you:

• A count-move notification — "Your count moved", with the number of people who have responded and the number who liked it. It is only sent when your count has moved by at least 5, and at most once every 24 hours.
• A moderation verdict — only if your photo was still being reviewed when you left the camera screen and you asked to be told.

We do not send engagement nags, streaks, or invented events. You can turn notifications off in Settings or in the OS. Push messages are delivered through Expo's push service and then Apple's (or Google's) push service.

Who else processes your data

These are processors acting on our instructions, not parties we sell data to. Each has its own privacy policy.

the United States (US West)

How long we keep things

• Your live photo is kept until you replace it, take it down, delete it, or delete your account.
• A photo you take down stops being served immediately and stays only in your own grid with its final counts. A photo you delete is gone: the row, the votes cast on it, and the image bytes.
• Image bytes with no photo row pointing at them (which can happen if an app or network failure interrupts a delete) are swept automatically, after a 24-hour grace period.
• Push delivery tickets are kept for at most 3 days, purely to read back delivery receipts and clear dead device tokens.
• Everything else — your profile, your votes, your counts — is kept until you delete your account.

Your choices and controls

All of these are in the app, in Settings or on your own photo:

Deleting everything

One tap, one confirmation, no grace period and no retention dark pattern. It runs in this order:

1. Your data rows are deleted — your profile, your photos, your reports, and every vote you have cast. Deleting your votes also withdraws them from other people's counts: every photo you voted on is recounted so it no longer includes your answer.
2. Your image bytes are removed from storage.
3. Your sign-in is deleted from the authentication system, so the email address we held is gone too. You cannot sign back into that account; signing in again creates a new one.

What can survive an erasure, honestly stated:

• Anonymous, aggregate counters belonging to other accounts. For example, another user's own "votes cast" tally still includes a vote they cast on a photo you have since deleted. These counters name nobody and are not linked to you.
• Records held by processors under their own retention rules — Apple's or Google's purchase records, RevenueCat's subscription history, Sentry crash events, and short-lived operational logs. Ask us at choppedornotapp@gmail.com if you need these addressed.
• If the storage step fails for technical reasons, the image bytes are removed by the automated orphan sweep instead, within about a day.

To make a privacy request other than through the in-app controls — including access, correction, deletion, or a right guaranteed to you by the GDPR, the CPRA or another state privacy law — write to choppedornotapp@gmail.com. We will verify the request against the sign-in identity on the account.

Children

Chopped or Not is 18+. You must be 18 or older to use it.

• We ask for a date of birth, never "are you over 18?" — a neutral age gate rather than a leading question.
• If the date given is under 18, the account is blocked and the account and everything in it is erased, including the email address collected at sign-in. The device is signed out.
• The app is not directed to children and we do not knowingly collect any information from anyone under 18. If you believe an under-18 user has an account, write to choppedornotapp@gmail.com and we will remove it.
• Photographs of minors are prohibited by the Terms of Service and are grounds for removal and a permanent ban.

Security

• All traffic to our servers is over HTTPS.
• Photos are in a private bucket, reachable only through short-lived signed URLs.
• The database uses row-level security as the enforcement point. Each account can read only its own rows; the votes table is unreadable by any client; privileged operations (moderation, deletion of the sign-in record, subscription state) run only in server-side functions holding a service credential, never in the app.
• The subscription webhook and the scheduled jobs authenticate their callers and fail closed when no secret is configured.

No system is perfectly secure, and we cannot guarantee absolute security.

Changes to this policy

If we change this policy we will update the "Last updated" date above. If a change materially affects how we handle information you have already given us — particularly anything about ethnicity, photos, or who can see what — we will say so in the app rather than only editing this page.

Contact

choppedornotapp@gmail.com Chopped or Not