📄 Privacy Policy for Wittley

Effective Date: June 13, 2025

Wittley ("we", "us", or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our platform.

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and where applicable, the General Data Protection Regulation (GDPR).

1. About Wittley

Wittley is a daily social platform that posts one debate-style or reflective question per day. Users respond, vote, and comment. While the platform resets each day, all content is archived for Pro users.

Our platform is designed for users aged 13 and over and is available globally. We are based in Australia and operate under Australian privacy laws.

2. What Data We Collect

• Account Data: Email address, username, and hashed password
• Authentication Data: Google or Apple login data (if used)
• User Content: Answers, comments, votes
• Usage Info: Streaks, likes, activity logs
• Device Data: IP address, session cookies (via Supabase)
• Cookies: Only essential cookies for login/session

We do not collect location, contacts, direct messages, or sensitive data.

3. How We Use Your Data

• To create and manage your account
• To display your activity and content
• To send transactional and optional marketing emails
• To improve and monitor the platform
• To comply with legal obligations

We may enable usage analytics (e.g. Vercel Analytics, Google Analytics) in the future for platform improvement.

4. Legal Basis for Processing (GDPR)

• Consent (for marketing emails and optional cookies)
• Performance of a contract (to provide the Wittley service)
• Legal obligations
• Legitimate interests (e.g., improving functionality and maintaining platform security)

5. User Rights

• Access, correct, or delete your personal information via your account
• Delete your account entirely (removing all personal data and content)
• Unsubscribe from marketing communications
• Lodge a complaint
• Request data portability (EU/EEA)
• Restrict or object to processing (EU/EEA)
• Withdraw consent at any time (EU/EEA)

6. Data Sharing

We do not sell your personal data. We may share data only with trusted service providers that help us operate Wittley:

• Supabase (backend database, storage, and authentication)
• Vercel (hosting and frontend deployment)
• Google / Apple (social login)
• Email services (e.g., SendGrid – planned)

7. International Data Transfers

Some service providers may process data outside Australia and the EU. We ensure they meet equivalent data protection standards through contracts and safeguards.

8. Data Retention

• User-generated content is retained unless deleted by the user
• Archived answers available only to Pro users
• Deleted accounts are permanently erased
• Inactive accounts may be deleted after long periods (planned)

9. Security Measures

• HTTPS encryption
• Passwords hashed securely (via Supabase)
• Role-based access for admin/moderators
• Cloud infrastructure via Vercel and Supabase

Note: We do not use end-to-end encryption since Wittley is public-facing.

10. Your Privacy Rights in Australia

You may contact us to access, correct, or remove your data. We aim to respond within 30 days. If you're unsatisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

11. Children’s Privacy

Wittley is not for users under 13. If we discover an account from a child under this age, it will be deleted.

12. Changes to This Policy

We may update this policy. Significant changes will be announced by email or via the platform.

13. Contact Us

If you have questions or privacy concerns, contact us at:

Email: support@wittley.com

Jurisdiction: Australia