Privacy Policy

Last updated: 7 October 2026

PolyTickles is run by the PolyTickles team (“we”, “us”). We decide how your data is used, so we’re responsible for it. We don’t get any data from Polytoria and don’t send any to it.

What we collect

What you give us

• Account: username, email and password. We only store a scrambled (hashed) version of your password, never the password itself.
• Sign-up confirmation: that you said you’re 13+ and accepted the terms, and when. We don’t ask for your birthday.
• Profile: display name, bio and profile picture (if you add one). We resize pictures and strip hidden data like GPS location.
• What you post: videos, captions and comments, plus basic file details like type, size and length, and a thumbnail we make. We strip hidden data like GPS location from videos.
• Reports and appeals: the reason and anything you write.

What we record when you use the app

• Likes, follows, followers and blocks.
• View counts. These are totals only and aren’t linked to you.
• Your login session (we store a hashed token and when it expires).
• Moderation records: what was reported, removed or restored, warnings, appeals and their outcomes, and any suspensions or bans.
• Moderator notes: short private notes our moderators may write about an account (for example, “talked to them, they understand the rule”). Only staff can see them. You can ask for a copy (see your rights).
• When things were created.

Technical info

We store the IP addresses (networks) you sign up and log in from, with when we first and last saw each one. We use them only to stop spam, fake and duplicate accounts, ban evasion and people boosting their own account with extra ones. Only our admins can see the addresses; moderators only see which accounts share a network. We delete each address 90 days after we last saw it, and you can see yours in your data download. Your IP address is also used briefly, in memory, for rate limits. Cloudflare, which protects the site, also sees IP addresses (see who we share it with).

To keep out bots and spam, when you sign up, log in, post, comment, report, like or follow we also look at how the request was made: your browser’s name and language, your network, how quickly a form was filled in and how often requests come. We keep this only in the server’s memory, for minutes to hours, and never write it to our database.

We don’t collect your location, contacts, birthday, phone number or payment details.

How we use it

• To run PolyTickles: your account, login, videos, comments, likes, follows and blocks. (This is needed to provide the service you signed up for.)
• To send account emails: email verification, password reset and “password changed” emails.
• To keep people safe: rate limits, stopping spam, fake accounts and boosting, handling reports and appeals, enforcing the rules and keeping banned users out. (This is in our and our users’ legitimate interest, and sometimes required by law.)
• To follow the law: for example, reporting child sexual abuse material to the authorities.

AI moderation. Text you post (usernames, display names, bios, video captions and comments) may be sent to an AI model through OpenRouter to check it for rule-breaking. Your videos and pictures are not sent. This is only for moderation, never for ads or profiling. Our automated filters can hold or remove content, or apply a short suspension. You’ll always get a notice and can appeal to a person.

Feeds. “For You” shows recent public videos, newest first, minus accounts you’ve blocked. “Following” shows videos from people you follow. We don’t build a profile of your interests.

No selling, no ads. We don’t sell your data or use it for ads, and we don’t use it to train AI.

What others can see

Public: your username, display name, bio, profile picture, videos, captions, comments, likes, followers, following and when you posted. Private: your email, password, who you’ve blocked and the reports you file. Moderators can see reports and moderation records. Only admins can see email addresses.

Who we share it with

We only share data with the services that help us run PolyTickles, and only so they can do that job:

• Microsoft Azure hosts our servers in the United States (Central US).
• Cloudflare stores and delivers videos, thumbnails and profile pictures (R2 storage and CDN). It also sits in front of the site for security and speed, so it sees IP addresses.
• Cloudflare also sends account emails (verification, password reset). It gets your email address and the message.
• Cloudflare Turnstile checks you’re a person when you sign up (and sometimes when you log in). It looks at signals from your browser and device; it doesn’t set advertising cookies. See Cloudflare’s Turnstile privacy notice.
• OpenRouter (US) passes text you post to an AI model for moderation checks.

We also share data when the law requires it, for example with the police or with NCMEC to report child sexual abuse. If you send a copyright counter-notice, we pass it to the person who complained (see the Copyright Policy). If someone else ever takes over PolyTickles, we’ll tell you first.

Your data is stored in the United States. If you live elsewhere, like the EU or UK, we use legal safeguards such as Standard Contractual Clauses for these transfers where needed.

How long we keep it

When you delete your account, we delete your profile, videos, comments, likes, follows, blocks, moderator notes and sessions straight away. If we’re legally required to keep some of it (for example, after a report to the authorities), we’ll tell you we can’t delete the account yet. If your account was banned, we keep a hashed copy of your email and the ban details until the ban ends, so you can’t sign up again to get around it. Reports and moderation records follow the times above. We may also keep something longer if the law requires it.

Your rights

Depending on where you live, you can:

• Get a copy of your data: Settings → Download my data.
• Fix your data: edit your profile in Settings.
• Delete your data: Settings → Delete account, or delete single videos and comments yourself.
• Object or ask us to limit how we use your data.
• Complain to your local data protection regulator.

For anything you can’t do in Settings, use Report → “Something else” in the app. We may need to check it’s really you. We reply within one month, it’s free, and we won’t treat you differently for asking.

California residents have the right to know, access, correct and delete their data, and not to be treated differently for using these rights. We don’t sell or share personal information for ads, including for users under 16. If you’re under 18, you can remove anything you’ve posted at any time (it disappears from view straight away).

Children and teens

PolyTickles is not for children under 13. Everyone confirms they’re 13 or older when signing up. If we learn an account belongs to someone under 13, we delete it and its data. If you think a child under 13 is using PolyTickles, report their profile with “Puts a kid in danger”.

Because many of our users are teens, we keep things simple: no ads, no tracking, no profiling, no location data and no private messages. Please don’t share your full name, school, address or phone number anywhere on PolyTickles.

Keeping it safe

We use HTTPS, hashed passwords, hashed session tokens in a cookie that scripts can’t read, strict security settings, checks on uploaded files and rate limits. Only people who need access get it. No system is perfect, but if a breach puts you at risk, we’ll tell you.

We use one cookie to keep you logged in. See the Cookie Policy.

Changes and contact

If we change this policy, we’ll update the date at the top and tell you in the app about big changes.

Questions or requests? Use Report → “Something else” in the app. You can also complain to your local data protection regulator.

Back to top