Privacy Policy

MaskedTalk is operated by Tiki Studios (“MaskedTalk”, “we”, “our”, or “us”), the data controller for the personal data described here. This Privacy Policy explains what we collect when you use the MaskedTalk mobile application, why we collect it, who processes it on our behalf, how long we keep it, and the rights you have over it. You can reach us at any time at support@maskedtalk.live.

1. Information We Collect

Information you give us

• Account information: Email address, username, password (stored only as a salted hash), date of birth, and gender.
• Profile content: Profile photos, bio, interests, and the location text you choose to display.
• Messages and media: Text messages, images, voice recordings, videos, and reactions you send in chats.
• Stories: Text, image, and video stories you post, and who has viewed them.
• Reports you file: The content you report, the reason you select, and any description you add.
• Spotify (optional): If you connect Spotify, we receive the account and track information needed to show your music on your profile. You can disconnect it at any time, and we do not receive your Spotify password.

Information created by using the app

• Anonymous identity: An anonymous identifier we assign to you, and the record of previous identifiers issued to your account.
• Call records: Who called whom, when, and for how long. We do not record the audio or video of your calls.
• Game activity: Matches, moves, results, and game statistics.
• Social graph: Follows, blocks, matches, and chat participation.
• Purchase records: Store transaction identifiers, product identifiers, purchase and renewal dates, and entitlement status. We never receive or store your full payment card details.

Information collected automatically

• Safety and legal telemetry: IP address, user-agent, device and app metadata, authentication and session events, and login attempts. This evidence data is not shown to other users.
• Device identifiers and push tokens: Used to deliver push notifications and to protect accounts.
• Diagnostics: Crash reports, performance traces, and analytics events about how features are used. These are collected through Firebase and are used to keep the app stable and to understand which features work.
• Moderation results: The outcome of automated and manual review of content you post, including any warnings, strikes, or restrictions applied to your account.

MaskedTalk does not use advertising SDKs, does not build advertising profiles, and does not track you across other companies’ apps or websites.

2. How We Use Your Information, and Our Legal Basis

Where the GDPR applies to you, the legal basis for each purpose is shown in brackets.

• Providing the service: Accounts, messaging, discovery, calls, games, stories, and social features. [Performance of a contract]
• Purchases and entitlements: Validating store receipts, granting subscriptions, boosts, and priority messages, and handling renewals and cancellations. [Performance of a contract]
• Content moderation: Automated screening of text and images, and review of user reports. [Legitimate interests in a safe service; legal obligation where applicable]
• Safety and security: Detecting abuse, preventing fraud and payment abuse, enforcing our Terms of Service, and investigating reports. [Legitimate interests]
• Legal compliance: Preserving account, IP address, device, and app metadata when needed to protect MaskedTalk or to respond to a valid legal request. [Legal obligation; legitimate interests]
• Improving the service: Crash triage, performance monitoring, and product analytics. [Legitimate interests]
• Spotify integration: Only if you connect it. [Consent — withdrawable by disconnecting]
• Push notifications: Delivering messages, call, and activity alerts. You can turn these off in your device settings. [Performance of a contract; consent where required]

3. Automated Moderation and Decisions

Text and images sent through MaskedTalk are screened automatically before or shortly after they are delivered. Content that the system classifies as violating our rules may be blocked, removed, or flagged for human review, and repeated violations can automatically add a strike to your account, restrict features, or suspend it.

If an automated decision affects your account, you can ask for a human review by writing to support@maskedtalk.live. We will look at the decision again and tell you the outcome.

4. Data Sharing

We do not sell your personal data and we do not share it for advertising. We share data only with the service providers we use to run the app, and only for the purpose listed:

• Supabase (self-hosted by us): Database, authentication, realtime, and file storage.
• Hetzner Online GmbH: The servers our infrastructure runs on.
• Google Cloud Vision: Automated image moderation.
• Firebase (Google): Push notification delivery, crash reporting, performance monitoring, and product analytics.
• LiveKit: Voice and video call infrastructure.
• RevenueCat: Subscription and purchase management, receipt validation, and entitlement state.
• Apple and Google: App distribution, store billing, and the purchase lifecycle.
• Spotify: Only if you connect your Spotify account.

We may also disclose data where we are legally required to, or where it is necessary to investigate abuse, protect the service, or protect the safety of a person. If MaskedTalk is ever transferred to another owner, we will tell users before their data moves.

5. Where Your Data Is Stored

Our servers and primary database are hosted in the European Union (Hetzner, Helsinki, Finland). Some of our processors — including Google, Firebase, LiveKit, and RevenueCat — operate globally and may process data outside the European Economic Area. Where that happens, the transfer is covered by the European Commission’s Standard Contractual Clauses or another approved transfer mechanism.

6. Data Retention

• Stories: Expire after 24 hours and are deleted, together with their media, within roughly an hour of expiring.
• Messages, reactions, and message media: Deleted from active systems after 30 days.
• Call records: Deleted after 30 days. Call audio and video are never recorded.
• Games: Finished and abandoned games are cleared after 24 hours.
• Login attempts and rate-limit records: Cleared after 24 hours.
• Push notification tokens: Removed after 60–90 days of inactivity, or immediately when you sign out.
• Crash and performance reports: Retained for up to 90 days.
• Account data: Retained until you delete your account. Deletion is scheduled with a 30-day grace period during which you can cancel it by signing back in; after that the account and its content are removed.
• Records we must keep: Deletion logs, security and abuse records, payment records, and evidence subject to a legal hold may be retained after account deletion where necessary to comply with law, prevent fraud, or respond to a lawful request.
• Moderation holds: Reported content and evidence may be preserved for as long as needed to investigate abuse or enforce our rules.

7. Your Rights

Depending on where you live, you have some or all of the following rights. We answer requests within 30 days.

• Access and portability: Email us and we will send you a full export of your data in a commonly readable, machine-readable format.
• Erasure: Delete your account under Settings > Account > Delete Account, or follow the process on our Support page. See the 30-day grace period above.
• Rectification: Correct your profile information at any time in the app, or ask us to correct anything you cannot edit yourself.
• Restriction and objection: Ask us to pause a particular use of your data, or object to processing based on legitimate interests.
• Withdraw consent: Disconnect Spotify, or turn off notification permissions, at any time. Withdrawing consent does not affect processing already carried out.
• Human review: Ask for a person to review an automated moderation decision.
• Complain: If you are in the EEA or the UK, you can lodge a complaint with your local data protection supervisory authority. In Türkiye, you may apply to the Personal Data Protection Authority (KVKK).

To exercise any of these rights, write to support@maskedtalk.live from the email address on your account.

8. Anonymous Identity

MaskedTalk assigns you an anonymous identity for conversations. Your real identity is not shared with other users unless you explicitly choose to reveal it through the identity reveal experience in the app.

If you deliberately sign out and sign back in, you are issued a new anonymous identity. Conversations that were tied to your previous identity are no longer linked to the new one. Being signed out automatically — for example because a session expired — does not change your identity.

Social anonymity does not mean that MaskedTalk cannot retain objective safety evidence. We keep IP address, device and app metadata, and account-event records for security, abuse prevention, and legal request handling. This telemetry is not shown to other users.

9. Children’s Privacy

MaskedTalk is an adult social product and is not intended for children. You must be at least 18 years old to use it; the App Store listing carries a 17+ rating and the Google Play listing carries a PEGI 18 content rating, and our own eligibility requirement is 18. We do not knowingly collect information from anyone below that minimum age, and accounts identified as ineligible are removed. If you believe a child is using MaskedTalk, contact us at support@maskedtalk.live and see our Child Safety page.

10. Security

We protect account and service data with encryption in transit (TLS), encryption at rest for protected message media, hashed passwords, short-lived access tokens, row-level access controls in the database, and monitoring. No security system can guarantee absolute protection. If a breach affects your personal data and poses a risk to you, we will notify you and the relevant authority as required by law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes through the app, the website, or email where appropriate, and update the date at the top of this page. Continued use after an effective update is governed by the updated policy.

12. Contact Us