Privacy policy
This policy explains what personal data thatsrelatable.app collects, why, who sees it and what your rights are. We try to collect as little as we can.
Who we are
The data controller is the operator of thatsrelatable.app, United Kingdom. You can contact us through the contact page or at [email protected].
What we collect, and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Account details: email address, username, a hashed password, optional profile picture, and a setting for whether your profile is public. | To run your account, log you in, show your username and picture if you choose, and reset your password. | Contract (providing the service you asked for) |
| Your activity: the relatables you make (the subject and lens you type), your votes, reactions and flags. | To show your account page, count votes, run the leaderboard and keep the library accurate. | Contract; legitimate interests (running and improving the site) |
| Messages: your name, email address and message when you use the contact form. | To reply to you and to keep a record of requests. | Legitimate interests |
| Waitlist: your email address if you join the waitlist for a possible paid plan. | To tell you if a paid plan launches, and nothing else. | Consent |
| Technical data: your IP address, used to create salted, hashed counters that limit sign-ups, log-ins and daily use, and that appear in our server logs. | To prevent abuse, spam and attacks, and to keep the site secure. | Legitimate interests |
What we do not collect
We do not ask for your real name, address, date of birth or payment details. We do not sell personal data. We do not currently show advertising or use advertising or analytics cookies. If that changes we will update this policy and the cookie policy first and ask for your consent where the law requires it.
Please do not type personal information into a relatable
The subject and lens you type are sent to an AI service to write a relatable, and approved relatables are published for anyone to read. Do not include names, contact details or other personal information about yourself or anyone else.
Who we share data with
- AI provider. The subject and lens text (not your name, email or account details) is sent to a third-party AI service to generate the relatable. The provider is currently Google, through its Gemini API, and it may process data outside the UK. Its own terms and privacy policy apply to that processing.
- Hosting and email. The site is hosted by a UK web hosting company, which stores the database and processes server logs, and handles email we send, such as password resets.
- Authorities. We will disclose data if the law requires it.
Where data is processed outside the UK, we rely on the safeguards the provider offers, such as approved contractual terms.
Cookies and browser storage
We use a small number of cookies to keep you logged in and protect forms. See the cookie policy.
How long we keep data
- Account data and your activity: until you delete your account. Deleting your account removes your email, username, password hash, picture, votes and reactions. Relatables you made stay on the site without your name.
- Contact messages: for as long as needed to deal with your request and keep a record of it.
- Waitlist emails: until a paid plan is decided, or until you ask us to remove you.
- Hashed usage counters and server logs: for as long as needed for security and abuse prevention.
Your rights
Under UK data protection law you have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, to withdraw consent at any time, and to receive your data in a portable form. You can delete your account yourself on your account page. For anything else, contact us. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk, though we would appreciate the chance to put it right first.
Children
The site is not aimed at children under 13 and you must be at least 13 to create an account. If you believe a child has given us personal data, contact us and we will delete it.
Security
Passwords are stored only as one-way hashes. Forms are protected against forgery and the site uses HTTPS. No online service is perfectly secure, so please use a password you do not use elsewhere.
Changes
We may update this policy. The date below shows the latest version.