Stickus
Privacy Policy
Draft. This policy has not been through legal review yet and will be updated before the app is publicly released. If this English version and the Turkish version differ, the Turkish version prevails.
Stickus is a mobile app for couples to share their daily status and availability with each other. This policy explains what data we process when you use the app, why, where we store it and how you can use your rights.
In short
- The content you share (check-ins, invitations, notes, logs) is encrypted with a key unique to you.
- Your partner sees only the categories you choose to share, and only while you are paired.
- Data is stored in the European Union (Frankfurt, Germany).
- We do not show ads, and we do not sell or share your data for advertising. We use no third-party analytics or tracking tools.
- You can delete your account in the app at any time and export your data for free.
Data we process
| Data | Why |
|---|---|
| Account: your email address; when you sign in with Apple or Google, the account identifier and email address the provider gives us (with Apple this may be a private relay address) | To identify you, sign you in and send your sign-in code |
| Profile and settings: display name, language, time zone, morning and evening notification times, sharing preferences | To run the app with your settings and send notifications at the right time |
| Pairing: when your pairing with your partner started and ended | To decide who may see which data |
| Content you share (encrypted): your daily status, activities you are open to, notes, invitation activity and message, history logs, activity names you create | The core function of the app |
| Non-content record data (not encrypted): days and times, the answer to an invitation (yes / maybe / another day), whether a log is marked private | Notification timing and operating the app |
| Consent records: which version of which text you accepted or withdrew, and when | To prove your consent |
| Device: push notification token and platform (iOS / Android) | To send notifications |
| Security and technical records: hashes of session tokens, sign-in and pairing attempts, server request logs (IP address, time, request path) | To protect your account, prevent abuse and fix errors |
We do not access your location, contacts, photos, microphone or advertising identifier.
Sensitive data
What you share may include information about your relationship, health or sex life, which the law treats as sensitive. The app therefore asks for your explicit consent before you start sharing content, and separately for each category you share with your partner. You can withdraw consent at any time in the app's settings.
What your partner sees
- Only the categories you turn on (status, activities, note). Turning a category off also hides past entries.
- Only entries from the day your pairing started. Never entries you mark private.
- When the pairing ends (one of you leaves or deletes their account), partner access ends immediately. Each of you keeps your own history.
Security
The content you share is encrypted with AES-256-GCM using a data key unique to you, which is itself protected by a separate master key. Connections are encrypted with TLS. Sign-in codes, pairing codes and session tokens are not stored in plain form. Database access is restricted and logged.
Where data is stored and who we share it with
We do not sell your data. We share only what is needed to provide the service with these providers:
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud | Servers, database, backups, server logs | Frankfurt, Germany (EU) |
| Firebase Cloud Messaging (Google), Apple Push Notification service | Delivering notifications. Notifications contain generic text (such as "You have a new invitation") and never the content you share. | Global |
| Brevo | Sending sign-in code emails (only your email address and the code) | EU |
| Apple, Google | Authentication when you use Sign in with Apple or Sign in with Google | Global |
| Expo (EAS Update) | Downloading app updates; your IP address and device information may be processed | USA |
We may also respond to valid requests from competent authorities and courts where required by law.
Sign in with Google
When you sign in with Google, we receive only basic profile information (account identifier and email address) and use it only to identify you. Stickus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this information for advertising, do not sell it and do not use it to train AI models.
Retention
- We keep your data while your account is open.
- Sign-in codes are valid for 10 minutes and deleted within 1 day.
- Session tokens are deleted 7 days after they expire.
- Notification delivery records are kept for 60 days, server request logs for 30 days.
- Database backups are kept for 7 days.
Deleting your account
In the app, go to Settings → Your data → Delete my account to delete your account at any time. If you cannot access the app, email [email protected] from the email address linked to your account; we will delete your account after verifying it is you.
When you delete your account:
- Your data key is deleted immediately, so your encrypted content can no longer be read. All your sessions end and your pairing ends.
- Your encrypted records are removed from the database within 30 days and drop out of backups at most 7 days later.
- Records your partner created themselves stay in their account.
Your rights
You have the right to access, correct and delete your data, to object to processing and to withdraw consent. In the app, Settings → Your data → Export my data downloads all of your own data as a readable file for free; it does not include anything your partner wrote. For other requests, email [email protected]. If you are in Turkey, your rights are detailed in the KVKK disclosure (Turkish).
Children
Stickus is for users aged 18 and over. If we learn that we process data of someone under 18, we delete that account.
Changes
When we change this policy we update its version and date. For significant changes we will inform you in the app and ask for your consent again where required.
Contact
Data controller: [Name and address of the data controller, to be confirmed with legal counsel]
Email: [email protected]