Privacy Policy
Effective: 2026-06-07 · Version 2026-06-07-v1
Last updated: 2026-08-29 — automated classification added for content moderation (section 2), and OpenAI added as a processor (section 3).
Stoophood ("we") operates from Dubai, United Arab Emirates, and handles your personal data in line with UAE data-protection law. This Policy explains what we collect, why, and your choices.
1. Data we collect
| Category | Examples |
|---|---|
| Identity & contact | email, phone number, display name, handle |
| Profile | bio, avatar, optional origin country, your city and community |
| Content | posts, comments, reactions, events |
| Messaging | direct messages (1:1 and group). Direct messages are not end-to-end encrypted. |
| Behavioural | login events, IP address, last-active time |
| Trust & reputation | trust label, tenure, profile stage, contribution counts |
| Technical | authentication token, the sh_auth cookie, locale, theme |
| Consent | your consent records (terms, privacy, analytics, marketing) |
2. How we use your data
To provide and secure the service, show your Content to the relevant communities, run messaging and notifications, moderate the platform, maintain trust and reputation features, and meet legal obligations.
Some moderation is automated. Content you post — text, images, and transcripts of voice notes — may be sent to an automated safety classifier that scores it for categories such as sexual content, hate, harassment, violence and child safety. An automated result can hide a post pending human review; it never bans an account on its own, and a moderator can restore anything that was hidden. Classifier output is used only for moderation and is never shown to other users.
3. Who we share data with
We use service providers that process data on our behalf to run Stoops: Google (sign-in), Apple (sign-in), Vercel (frontend hosting), Railway (backend and database), Cloudflare R2 (media storage), Sentry (error monitoring), PostHog (product analytics, only if you opt in — see the Cookie Policy), OpenAI (automated content moderation and voice-note transcription — see below). If you verify your phone number, the one-time code is delivered via WhatsApp or SMS through the relevant delivery provider. We do not sell your personal data.
What happens to the content we send to OpenAI. Under their API terms:
- It is not used to train their models. Data sent through their API has not been used to train or improve their models since 1 March 2023, unless the customer opts in — we do not.
- It can be kept for up to 30 days. Your content and the classifier's output may be retained for up to 30 days to operate the service and detect misuse, and are then deleted — kept longer only where the law requires it or where it is needed to prevent harm.
- A human may read it, for abuse review only. Authorised OpenAI staff and specialist third-party contractors, bound by confidentiality and security obligations, may access this content solely to review for abuse and misuse.
- It is processed mainly in the United States. Their content-moderation sub-processors also operate from Canada and the Philippines.
4. Where your data is processed
Our providers may process data in regions outside the UAE, including the United States and the European Union. By using Stoops you understand that your data may be transferred to and processed in these regions with appropriate safeguards.
5. How long we keep data
| Data | Retention |
|---|---|
| Direct messages | while your account is active |
| Login events | about 12 months |
| Deleted account | 30-day recovery window; afterwards personal data is retained for legal-defence purposes for up to ~2 years, then permanently deleted, unless under legal hold |
| Data-export download link | 7 days |
When an account is deleted, your identity is removed from any remaining Content (it shows as "deleted user").
6. Your rights and choices
You can access and download your data, correct it, delete your account, and withdraw consent:
- Download my data: Settings → Privacy (a machine-readable export). Received direct messages are excluded to protect other people's privacy.
- Delete account: Settings (30-day recovery window, then finalized as in §5).
- Marketing / analytics consent: Settings and the cookie banner.
To make a request, use Settings or email info@stoophood.com.
If you are located in the EEA, the UK, or California, you may have additional rights under your local laws (such as access, deletion, portability, and objection). Contact info@stoophood.com and we will honour applicable rights.
7. Children
Stoops is for users 18 and older. We do not knowingly collect data from anyone under 18.
8. Cookies
See our Cookie Policy for the cookies and storage we use and your choices.
9. Security
We take reasonable measures to protect your data. Note that direct messages are not end-to-end encrypted and should not be used for highly sensitive information.
10. Changes and contact
We may update this Policy; the version and effective date appear above. Questions or requests: info@stoophood.com.