privacy policy

this explains what mahfah collects, why, the legal basis for it, who it goes to, how long we keep it, and your rights. plain language, no tricks.

who runs mahfah

mahfah is operated by an individual (a sole operator), who is the data controller for the personal data described here. contact for any privacy question or request: admin@babydraft.app. we have not appointed a data protection officer (we are not required to).

what we collect

• email address (only if you sign up with email)
• google or apple account identifier (only if you use social login)
• date of birth (for the 18+ age gate. we store the date only, never an ID document)
• username and the profile photo you upload
• your lore (the statements you write) and the judgments you make
• your aura score and badges (derived from how you play)
• device push notification token (only if you turn notifications on)
• reports you file and users you block

why we use it, and our legal basis

each purpose has a legal basis under the EU/UK GDPR:

• running the app (account, profile, photo display, lore, votes, aura, badges): contract (art 6(1)(b)). we can't provide mahfah without this.
• safety and moderation (photo + text checks, handling reports, blocking abuse, security): legitimate interest (art 6(1)(f)) in a safe community.
• age gate (date of birth): keeping mahfah 18+ (legitimate interest / legal duty). under-18 accounts are deleted.
• push notifications: opt-in only (consent, art 6(1)(a)), withdrawable any time.
• anonymous analytics and crash reporting: keeping the app working and improving it (legitimate interest). analytics are anonymous: no profiles, no tracking.

where we rely on legitimate interest, you can object (see your rights).

your photo, and automated moderation

is your face treated as biometric data? no. mahfah does not use facial recognition. we do not build faceprints or face templates, and we never use your photo to identify, match, or recognise you. under EU law a face photo is only special-category "biometric" data when it is run through technology built to uniquely identify a person, and we do none of that. your photo is ordinary personal data: we use it to show your profile and to keep the app safe.

photos and lore are checked automatically before they go live. these checks run without a human and can reject content on their own. the logic, plainly: if an automated safety score crosses our threshold, the content is rejected and we fail closed (if a check can't run, the upload is blocked). a rejected photo or line of lore is simply not published and you're asked to submit a different one. it does not affect your account standing or scores.

your right to a human. if you think a rejection was wrong, email admin@babydraft.app and a person will review it, hear your view, and can overturn it.

where your data goes (international transfers)

your account and content are stored on supabase in the EU (stockholm), and anonymous analytics on posthog in the EU. some processors that briefly handle (but do not store) your data are in the united states: openai (automated moderation), expo (push delivery and builds), sentry (crash diagnostics), vercel (the mahfah.app web pages), and resend (only used to email ourselves if you flag child-safety content). when data leaves the EU we rely on the EU-US data privacy framework where the processor is certified, and on the european commission's standard contractual clauses as a fallback. email us for detail on any specific processor.

third parties

• supabase. database, auth, storage (EU)
• openai. automated photo + text moderation for lore and comments (US; processed, not stored)
• expo. push notification delivery and build infrastructure (US)
• vercel. hosting for the mahfah.app web pages + share links (US). vercel logs each request (including your IP address, browser user-agent, and the path you visited) to keep the site secure and mitigate DDoS attacks; these logs are kept short-term per vercel's standard retention.
• sentry. crash and error diagnostics so we can fix bugs (US). error logs can include device data and your IP address (only from internal "trace" test builds), retained around 90 days.
• resend. transactional email, used only to alert us if you flag child-safety content (US). such a report emails a snapshot of the reported content and its metadata to the operator so we can file it with NCMEC.
• posthog. anonymous product analytics, hosted in the EU. no profiles, no autocapture, no session recording. a handful of anonymous events only (a judgment made, signed up, a share attempt, a sign-up prompt) plus app-open
• google / apple. sign-in, only if you use social login

each is contractually bound to protect your data as described here.

for transparency: we previously used sightengine (photo moderation) and anthropic (claim suggestions). both have been removed and no longer receive any of your data.

how long we keep it

• account data (profile, photo, lore, votes, aura, badges): kept while your account is active; deleted immediately when you delete your account.
• date of birth: kept as proof of age while your account is active; deleted with your account.
• lore you wrote about other people: stays on their profiles after you leave, but de-identified (your authorship removed).
• reports you file and moderation records: kept de-identified for up to 12 months for safety.
• content we are legally required to preserve (for example, material reported for child safety) may be retained and disclosed to law enforcement as required by law, even after you delete your account (GDPR art 17(3)(b)). this is the only exception to immediate deletion.
• anonymous analytics: aggregate, not linked to you.
• crash logs (sentry): around 90 days, then deleted.

on deletion, cached copies on content-delivery networks can take up to 72 hours to expire. we keep no backups of deleted accounts.

guests (anonymous mode)

you can use mahfah as a guest without an account. we create an anonymous session and keep your progress on your own device. we don't collect your email or identity as a guest. anything you upload still goes through the same safety moderation. if you create an account later, your guest progress transfers to it. deleting the app clears your local guest data.

your rights

under the EU/UK GDPR you can, at any time:

• access. get a copy of the data we hold about you.
• delete. erase your account and all associated data (in-app, or by emailing us).
• correct. fix data that's wrong (rectification).
• restrict. ask us to pause processing while a dispute is sorted.
• port. get the data you gave us in a portable, machine-readable form.
• object. object to any processing we base on legitimate interest.
• withdraw consent. turn off push or withdraw any consent at any time, without affecting what came before.
• complain. lodge a complaint with your local data protection authority. in the EU, find yours at edpb.europa.eu; UK users can contact the ICO.

for any right that isn't a button in the app, email admin@babydraft.app. we respond within one month.

age

mahfah is for users aged 18 and over. we verify age at signup via date of birth. mahfah is not directed to children. if we find a user is under 18, their account is deleted.

deleting your account

you can delete your account and all associated data at any time. how to delete your account. our community rules are in the terms.

changes to this policy

if we change this policy in a way that materially affects you, we'll update the date above and surface a notice in the app before the change takes effect.

contact

questions? email admin@babydraft.app.