Privacy Policy

BRUH ("we", "our", or "us") is a meme-powered social platform that lets users post prompts and receive anonymous meme replies, and — in the native mobile app — use optional direct messages (Chat) with users they have connected with through meme replies. This Privacy Policy explains what information we collect when you use the BRUH app or website, how we use it, and the choices you have.

By using BRUH, you agree to the practices described in this policy. If you do not agree, please do not use the app.

Account information. When you register, we collect:

• Username (no real name required)
• Password (stored as a bcrypt hash — we never store plaintext passwords)
• Backup email address (optional, used only for account recovery)

Content you create. We store posts (prompts) you create and any meme replies you send to other users.

Chat (direct messages). In the native app, if you use Chat, we store the messages you send and receive (including text and rich media such as GIFs or stickers), conversation metadata (e.g. participants, timestamps, read state), and related technical data needed to operate the feature. Chat is between identified users — participants see each other's usernames in the thread.

Notifications. We store in-app notification records (e.g. meme replies, chat alerts, challenges, product announcements) so you can view them in Settings. Some announcement-style items may be shown as broadcasts. You can mark items read, dismiss them, or clear your inbox in the app; broadcast dismissals may be stored locally on your device.

Device information. When you enable push notifications, we store your device's push token and your notification category preferences (e.g. replies, chat, challenges) as configured in the app, so we can respect your choices when sending pushes. We also store a device fingerprint for account recovery purposes.

Usage data. We collect anonymised metrics about how features are used (e.g. which memes are popular) to improve the app. This data is not linked to your identity.

Even when replies are anonymous to the recipient, sender information is stored in our database for the purposes of safety enforcement (e.g. processing block requests and abuse reports). We do not sell or expose sender identities except as described in this policy.

Chat is different from anonymous replies. In Chat, both participants see each other's usernames. Chat is only available between users who have an existing connection through the meme-reply flow, as implemented in the app.

We use the information we collect to:

• Provide and operate the BRUH service, including Chat where available
• Send push notifications you have opted into (e.g. meme replies, chat messages, challenges, announcements), subject to your device and in-app settings
• Show an in-app notification inbox for the same categories, where supported
• Enable account recovery via backup email or recovery codes
• Enforce community guidelines (processing reports and blocks)
• Improve app features using aggregated, anonymous usage data
• Send transactional emails (e.g. email verification, password reset)

We do not sell your personal information. We do not use your account identity (such as your username) to serve third-party behavioural ads. Users who are not BRUH Pro subscribers may see third-party ads through AdMob; those ads are subject to Google’s policies and your device’s ad and privacy settings.

BRUH uses the following third-party services, each with its own privacy policy:

• Supabase — database and authentication infrastructure. Data is stored on Supabase-managed PostgreSQL servers. See supabase.com/privacy.
• GIPHY — GIF search. Search queries may be sent to GIPHY's API. See GIPHY Privacy Policy.
• Klipy — video clip search. Search queries may be sent to Klipy's API.
• Firebase Cloud Messaging (Google) — push notifications. Your device push token is shared with Firebase solely to deliver notifications. See Google Privacy Policy.
• Resend — transactional email delivery (verification codes, password reset). See resend.com/privacy.
• Apple App Store — in-app purchases and auto-renewable subscriptions on iOS. Apple processes payment; we receive subscription status from Apple via our systems. See Apple’s App Store & Privacy.
• Google Play — in-app purchases and subscriptions on Android. Google processes payment; we receive subscription status through Google Play Billing. See Google’s Privacy Policy.
• RevenueCat — helps us validate subscription entitlements across platforms. RevenueCat may receive a pseudonymous app user identifier tied to your device or account. See revenuecat.com/privacy.
• Google AdMob — on supported platforms we may show ads to users who are not BRUH Pro subscribers. AdMob may use advertising identifiers and similar signals under Google’s policies. See Google’s Privacy Policy and AdMob data disclosure.

When you search for GIFs or clips within BRUH, your search query is transmitted to the relevant provider. We do not share your username or account details with these providers.

All user data is stored in a Supabase-managed PostgreSQL database with Row-Level Security (RLS) enabled. RLS policies ensure that users can only access their own data — for example, you cannot read another user's meme-reply inbox or Chat conversations you are not a participant in.

Passwords are never stored in plaintext. We use bcrypt with a unique salt for every password.

Data is transmitted over HTTPS/TLS at all times. We do not store your payment card or bank details — purchases are completed by Apple or Google. We may store a record that your account has an active BRUH Pro entitlement (subscription status) in our database to unlock premium features.

We retain your account data for as long as your account is active. When you delete your account:

• Your profile, posts, and replies are permanently deleted
• Your Chat messages and conversation participation records are permanently deleted
• Your in-app notification records associated with your account are deleted
• Your push tokens are removed immediately
• Aggregated, non-identifiable analytics data may be retained

Content reported for policy violations may be retained in our audit logs for a limited period after deletion to support moderation review.

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate information via the app's account settings
• Delete your account and all associated data from the app's settings page
• Object to processing — contact us to discuss specific concerns
• Withdraw consent for push notifications in your device settings and adjust notification categories in the app's Settings → Notifications

To exercise any of these rights, use the in-app settings or contact us at the address below.

BRUH is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes we will notify users via the app or email (if a backup email has been provided).

Continued use of BRUH after a policy update constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy or want to exercise your data rights, please contact us: