Privacy Policy

This Privacy Policy explains how booth ("the App") handles your information. booth is operated by Hsien-Yin Wang ("I", "me", or "my"), an individual developer based in Taiwan, publishing under the name Project AfterHours. It is a personal project, not a company. Anyone in the world is welcome to use it.

Data Controller: Hsien-Yin Wang (Project AfterHours), Taiwan. Contact for privacy questions, requests, or complaints: afterhours.prj@gmail.com.

This policy describes what booth collects, why, where it goes, and how long it stays. It covers the booth iOS app and welcometobooth.com.

booth is built so that the thing you'd least want leaked — your daily record — never leaves your phone.

• Your captures, your Log and Strip, and your Me posts stay on your device. booth's servers never receive them, and I cannot see them.
• Your birthday stays on your device, and only the month and day are ever asked for.
• Only what Friends needs is uploaded: your profile, your friend connections, and any post you explicitly publish to Friends — which is deleted 24 hours later.
• No advertising, no analytics SDKs, no tracking, no data sold or shared for marketing. There is no third-party analytics or attribution code in the app.

Stored locally (Application Support, inside booth's app container) and never uploaded:

• every photo and video you capture, and the prompts and captions attached to them
• your Log and Strip films, and every Me post
• your birthday (month and day only)
• your caption category choices, prompt history, and app settings
• drafts and in-progress days

This data is removed when you delete the app. It is not backed up to booth's servers, so booth cannot restore it for you.

Only the following reaches the server, which is a Supabase project (see §7):

Account

• an account identifier created by booth's authentication provider
• an identifier from Apple that identifies you across sign-ins (Apple's sub)
• the email address Apple returns at sign-in. If you chose Hide My Email, this is Apple's private relay address, not your real one. booth does not send you email, and this address is not used for marketing.

Profile

• your Name, your To Friends name (what friends see on posts, lists, and notifications; it starts the same as your Name), and your @username
• your profile photo, if you set one
• your booth number (the join ordinal shown in Settings)
• how many times you changed your username recently, so the limit can be enforced
• your notification preferences

Friends

• who you are friends with, pending friend requests, and invite codes you minted
• people you have blocked or muted

Friends posts — only for posts you publish to Friends

• the four clips, stored as files in a private bucket
• captions and city labels only when those overlays are on; capture times always (so the post plays in order)
• presentation settings (layout, theme, title)
• these are deleted 24 hours after publishing (see §8)

Safety

• reports you submit about a post, a person, or a Booth caption prompt, including the reason you give. Caption reports also keep a snapshot of the prompt text that was shown, so the report can be understood later.

Notifications

• in-app notification rows (friend request, new friendship), which include the other person's To Friends name and username so the row can be shown
• your device's push token, if you turned notifications on. When an alert is sent, the friend's To Friends name travels inside it through Apple's push service

Housekeeping

• storage paths queued for deletion after an account is deleted, so the files can actually be erased

Each purpose maps to one of the above and nothing else:

booth does not profile you, score you, target advertising, or make automated decisions about you.

If you are in the EU, UK, or another region with similar law, the legal grounds are: performance of the contract in these Terms for everything needed to run your account and Friends; legitimate interests for keeping booth safe from abuse and enforcing the limits above; and your consent for location labels and push notifications, which you can withdraw at any time in iOS Settings without losing access to the rest of the app.

Each is asked for in context, and each can be changed any time in iOS Settings.

• Camera — required, to capture your daily clips. Footage goes to your device.
• Microphone — required for video, to record sound with a clip.
• Location — optional. Used once per capture to label it with a city name. booth requests coarse accuracy (about a kilometre), asks iOS for a single position, and sends it to Apple's geocoder to get a place name. Only the city string is kept; your coordinates are never stored and never uploaded. Deny it and booth simply stops adding city labels.
• Photos — optional. Reading your library happens only when you pick a profile photo. Writing happens only when you choose to save a capture or film. booth never scans or indexes your library.
• Notifications — optional. Used for friend requests and new friendships. There is deliberately no push for friends' new posts.

booth has no advertising or analytics partners. These providers run the app and site:

• Supabase — hosts booth's database, authentication, and the private file bucket holding Friends clips and profile photos. The project is in a United States region.
• Apple — provides Sign in with Apple, delivers push notifications through APNs, and turns a location into a place name (MapKit). Apple's own privacy policy governs what Apple does with these requests.
• Vercel — hosts welcometobooth.com. When you load a page it may process standard request data needed to serve the site (for example IP address, date and time, URL, referrer, and user-agent). The site sets no advertising or analytics cookies from booth.
• Google Fonts — the site loads the Inter typeface from Google. Your browser requests the font files from Google's servers; Google may receive the usual technical data that comes with a font request. booth does not send Google any account or profile information.

Data is disclosed to nobody else, except where the law requires it or where it is necessary to investigate a serious safety issue (see §9).

Opening an add link: welcometobooth.com/add/… asks booth's server for the inviter's @username so the page can show who invited you. Opening the same link inside booth also shows their To Friends name. No account is needed on the web page, nothing is written there, and the code itself is a random string that says nothing about either person.

Servers are in the United States. If you use booth from outside the US, the limited data in §4 is transferred and processed there under my data-processing agreement with the hosting provider, which incorporates the European Commission's standard contractual clauses for transfers out of the EEA and the UK.

Settings → Delete account removes your account, profile, username, friend connections, notifications, and any Friends posts still live. The underlying files — clips and your profile photo — are erased from storage within about 15 minutes, on the same cleanup run described above.

Three deliberate exceptions:

• your username and booth number stay reserved so they are not reissued to someone else. The username reservation stops pointing at your account; the retired number keeps the internal account id it belonged to, which no longer corresponds to any account.
• reports that were needed to protect someone else may be kept while that matter is open.
• posts of yours that friends already watched may remain in their device's booth cache until it clears, which I cannot reach into.

Deleting your account does not delete the record on your phone. Remove the app for that. Signing out, by contrast, leaves everything in place so you can sign back in with the same Apple ID.

In the app, at any time:

• sign out, or delete your account outright
• delete an individual Friends post before its 24 hours are up
• remove, block, or mute a friend; hide a single post
• report a post, a person, or a caption prompt
• change your Name, To Friends name, username, or profile photo
• turn location or notifications off

Depending on where you live, you may also have the right to ask for a copy of the data booth holds about you, to correct it, to have it deleted, to object to or restrict how it is used, or to complain to your local data-protection authority. Write to afterhours.prj@gmail.com and say what you want; requests are answered within 30 days. Because the server holds so little, in most cases Delete account already does more than a data-deletion request would.

booth is for people 16 and older. It is not directed at children, and I do not knowingly collect data from anyone under 16. If you believe an under-16 account exists, write to afterhours.prj@gmail.com and it will be removed.

• All traffic uses HTTPS.
• Clips and profile photos live in a private bucket. There are no public URLs; access is through short-lived signed links, and the database rules only issue them to people entitled to see the post.
• Database access is governed by row-level security, so one account cannot read another's rows.
• Your sign-in session is kept in the iOS Keychain.
• Expired Friends posts are deleted from storage, not merely hidden.

booth is maintained by one person and has not been through a third-party security audit. No service can promise perfect security; what is described here is the design, honestly stated.

This policy will be updated when booth changes what it collects — for example if a future feature moves something off the device. The version published at https://welcometobooth.com/privacy with its Last updated date is the one in force, and material changes will be signaled in the app or on the site.

Privacy questions, requests, or complaints — email afterhours.prj@gmail.com.