PRIVACY POLICY

Last Updated: October 11, 2026

Welcome to Shtty ("Shtty", "we", "our", or "us").

This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the Shtty mobile application and related services (the "Service").

By creating an account or using the Service, you acknowledge that your information will be processed as described in this Privacy Policy.

1. Who We Are

Shtty is a private social networking platform designed for sharing daily moments within invite-based groups.

Data Controller

RASKENLUND AS BJØNNVEIEN 23, 3962 STATHELLE, NORWAY its@shtty.app

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you may contact us using the information above regarding privacy-related questions or requests.

2. Information We Collect

Information You Provide

We may collect information you provide directly, including:

• Display name
• Username or handle
• Email address
• Phone number
• Date of birth
• Profile photo
• Group membership information
• Photos you upload
• Captions and content you submit
• Communications with support
• Reports and moderation submissions

Information Collected Automatically

When you use the Service, we may automatically collect:

• Device information
• Operating system information
• Application version
• Log data
• IP address
• Approximate location derived from IP address
• Crash reports
• Analytics information
• Notification preferences
• Advertising identifier (Apple IDFA or Android Advertising ID), only where you are shown ads and your device settings allow it (see Section 7)
• Subscription status, meaning whether you have an active Shtty Premium subscription and when the current period ends (see Section 8)

Information From Third Parties

If you sign in through a third-party provider such as Apple, Google, or Facebook, we may receive information associated with your account, subject to your settings with that provider.

If you buy a subscription, Apple or Google and our subscription provider tell us that the purchase succeeded and whether it is active. We do not receive your payment card or billing details.

3. How We Use Information

We use personal information to:

• Create and maintain user accounts
• Operate and provide the Service
• Enable participation in groups
• Process and display user content
• Send invitations and notifications
• Detect and prevent abuse
• Moderate content
• Investigate reports and safety concerns
• Improve and develop the Service
• Maintain platform security
• Comply with legal obligations
• Respond to support requests
• Show advertising to eligible users
• Provide and manage Shtty Premium subscriptions

4. Content Moderation

To help maintain a safe environment, uploaded content may be reviewed using automated moderation technologies and human review processes.

Moderation may include screening for:

• Nudity
• Sexual content
• Violence
• Gore
• Weapons
• Illegal content
• Other content that violates our policies

Content may be delayed, restricted, removed, or escalated for review.

5. Legal Bases for Processing (EEA, UK, and Switzerland)

Where applicable, we process personal information under one or more of the following legal bases:

• Performance of a contract
• Legitimate interests
• Compliance with legal obligations
• Consent, where required

Our legitimate interests include:

• Operating the Service
• Preventing abuse and fraud
• Maintaining platform security
• Enforcing our policies
• Improving user experience

6. Sharing of Information

We do not sell your personal information for money. We do not give advertisers your name, email address, phone number, photos, captions, or group information. Advertising partners collect limited device-level data when they show an ad, as described in Section 7.

We may share information with:

• Cloud hosting providers
• Authentication providers
• Analytics providers
• Content moderation providers
• Customer support providers
• Subscription management providers (see Section 8)
• Advertising partners (see Section 7)
• Professional advisors
• Government authorities, regulators, or law enforcement where required by law

Service providers are permitted to process information only on our behalf and under appropriate contractual protections. Advertising partners may also process some information for their own purposes, as described in Section 7.

7. Advertising

Shtty may show banner advertisements to users who are 18 or older, based on the date of birth in their account, and who do not have an active Shtty Premium subscription. Users under 18 and Shtty Premium subscribers are not shown ads, and the advertising software is not started for them.

Who provides the ads

Ads are provided by Google AdMob (Google LLC and, for users in the EEA, UK, and Switzerland, Google Ireland Limited). Shtty does not choose which advertisers appear.

What advertising partners collect

When an ad is requested or shown, Google and its partners may collect and use:

• Your device advertising identifier (Apple IDFA or Android Advertising ID), where your device settings allow it
• Your IP address and the approximate location derived from it
• Device, operating system, and app information
• Ad interaction data such as impressions and clicks, and diagnostics

They use this to deliver, measure, and personalize ads, prevent fraud, and improve their services. Google may process this information for its own purposes under its own privacy policy, and in some cases as an independent controller. We recommend reading Google's privacy policy for details. We do not pass your name, email address, phone number, photos, captions, or group information to the advertising software.

Your choices

• iPhone: before ads are first requested we ask for your permission through Apple's App Tracking Transparency prompt. If you decline, or later turn it off in Settings > Privacy & Security > Tracking, ads are shown without your advertising identifier.
• Android: you can reset or delete your Advertising ID and turn off ads personalization in your device's Google settings (usually Settings > Google > Ads).
• You can remove ads entirely with a Shtty Premium subscription (see Section 8).

Where applicable law requires your consent for advertising identifiers or similar technologies, we will ask for it before ads are shown to you.

8. Subscriptions and Purchases

Shtty Premium is an optional paid subscription. Purchases are made and processed by Apple (App Store) or Google (Google Play). We never receive or store your payment card or billing details.

We use RevenueCat, Inc. to manage subscriptions and verify purchases. RevenueCat receives your Shtty account ID, purchase and receipt information, subscription status, and device and app identifiers, and tells us whether your subscription is active.

We store whether you have an active subscription and when the current period ends on your account record, so we can give you the right experience and handle support and accounting requests. We process this to perform our contract with you, to prevent fraud, and to comply with legal obligations, including bookkeeping requirements. Records of purchases may be kept for as long as those obligations require.

9. International Data Transfers

Your information may be processed in countries outside your country of residence.

Where required by applicable law, we implement appropriate safeguards for international transfers, including approved contractual mechanisms.

10. Data Retention

We retain personal information only for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, enforce our agreements, and maintain platform safety.

Retention periods may vary depending on:

• Account status
• User requests
• Moderation investigations
• Legal requirements
• Security needs

When information is no longer required, it will be deleted or anonymized.

11. Your Rights

Depending on your location, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Delete personal information
• Restrict processing
• Object to processing
• Receive a portable copy of your information
• Withdraw consent where consent is relied upon

To exercise your rights, contact us using the details provided in this Privacy Policy.

12. Account Deletion

Users may request deletion of their account.

Upon deletion, personal information will be deleted or anonymized unless retention is required for:

• Legal obligations
• Fraud prevention
• Security purposes
• Enforcement records
• Dispute resolution

Certain information may remain in backups for a limited period before permanent deletion.

13. Children's Privacy

The Service is not directed to children below the minimum age permitted under applicable law.

We do not show advertising to users who are under 18 according to the date of birth in their account, and we do not start the advertising software for them.

If we become aware that we have collected personal information from a child in violation of applicable law, we will take reasonable steps to delete that information.

14. Security

We implement reasonable technical and organizational measures designed to protect personal information from unauthorized access, disclosure, alteration, and destruction.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When required by law, we will provide notice of material changes through the Service or by other appropriate means.

The updated version will become effective when published unless otherwise stated.

16. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

its@shtty.app RASKENLUND AS BJØNNVEIEN 23, 3962 STATHELLE, NORWAY