last updated November 11, 2026 (America/New_York)
Privacy Policy
on this page
- Plain-English summary
- 1. Who we are, and who this policy is for
- 2. Information we collect
- 3. How we use information (purposes)
- 4. Legal bases (EEA, UK, Switzerland, and similar laws)
- 5. Anonymity, and its limits
- 6. How we share information
- 7. Retention
- 8. Ads, analytics, and tracking
- 9. Your choices
- 10. Your privacy rights (United States state laws and similar)
- 11. International transfers
- 12. Security
- 13. Children under 13 (COPPA)
- 14. Teens (13–17)
- 15. Push notifications
- 16. Law-enforcement and safety requests
- 17. Changes
- 18. Contact
Operator: [frfr LLC name] (“frfr,” “we,” “us”) Address: [address] Privacy contact: privacy@frfrapp.co Support: support@frfrapp.co Legal: legal@frfrapp.co
This policy covers the frfr iOS app, the website at frfrapp.co (including reply pages such as frfrapp.co/s/…), and related services (together, the “Service”).
Plain-English summary
- frfr is an anonymous questions app for people 13 and older. It is not for children under 13.
- Friends can send you a question through your public link without making an account. We show you the message, not the sender’s name.
- “Anonymous” is not the same as “untraceable.” We may keep a limited internal record (for example a hashed IP address, or a sender account id if they were signed in) so we can fight abuse and respond to lawful requests. We do not put that record on the message we show you.
- If we offer a sender hint (for example “someone in your grade”), it is only because that fact is actually true and the group is large enough that the hint is not a back-door identity. We do not invent hints.
- We do not sell your personal information. We do not use teen data for targeted or behavioral advertising. Rewarded ads, if they are on for adults, are a tap-to-watch unlock, not banners or pop-ups. For users under 18, our default is no ads, or only non-personalized ads if ads are ever shown.
- You can edit your profile, turn off notifications, cancel a subscription in your Apple ID settings, and delete your account in the app. Deleting the app is not the same as deleting your account, and it does not cancel a subscription.
- Official messages from us say “frfr team” and use our logo. We do not plant fake questions that look like they came from your friends.
This summary is a guide. The full policy below is the official one.
1. Who we are, and who this policy is for
frfr is operated by [frfr LLC name], [address]. If you are in the European Economic Area, the UK, or Switzerland, [frfr LLC name] is the controller of your personal data unless we say otherwise.
The Service is for people 13 and older. If you are 13–17, you should use frfr only with a parent or guardian’s permission where that is required, and some features (including ads and certain late-night reminders) may be limited.
2. Information we collect
We collect only what we need to run the Service, keep it safe, and (if you choose) process a subscription. We do not collect personal information from you until you have passed the age screen, except a first-party device lock we may store so a child who has just told us they are under 13 cannot immediately try again. We do not start our advertising SDK, product-analytics SDK, push-notification token registration, or contacts access until the age screen has been passed.
2.1 Information you give us
| Category | Examples | Required? |
|---|---|---|
| Age-gate data | Birth month and year, or date of birth, or an “I am under 13” choice | Yes, to use the app. We use this to apply the 13+ rule. If you are under 13 we do not create an account. |
| Account and profile | Username, display name, bio / about-me text, grade, school, prompt text, profile photo, banner photo | A display name is required to create an account. Grade is used to keep hints honest. School is optional. Photos are optional. |
| Sign in with Apple | The Apple user identifier (sub). Your name or email only if you choose to share them with us. If you hide your email, Apple may give us a private relay address. | Only if you use Sign in with Apple. |
| Messages you send | The text of a question or reply you send through a frfr link or in the app | Only if you send one. You can do this without an account. |
| Reports and support | A report reason, optional note, and any email you send to support, privacy, or legal | Only if you contact us or report something. |
| Preferences | Notification settings, timezone (for streaks and the daily prompt), app-icon choice | Optional, or set to a default. |
2.2 Information we collect automatically
| Category | Examples | Why |
|---|---|---|
| Device and app | App version, device type and OS, a device identifier the app creates, language, approximate region (not precise GPS) | Operate the app, debug, rate-limit, and apply regional rules. |
| Log and security data | Time of a request, hashed IP address, rate-limit counters, share or page opened | Security, abuse prevention, and delivering the reply page. We hash IP addresses rather than store them in the clear. |
| Usage | Screens opened, actions such as sharing a link, opening a profile, sending a heart, unlocking a hint, or starting (but not completing) a purchase | Run and improve the Service, measure what works, and (if you have plus) provide “who viewed you.” |
| Share source | A short tag such as snap or ig on a reply link | So we can tell which share path brought a reply. This is not an advertising identifier. |
| Cookies or local storage | Session or age-gate flags on the website; similar local storage in the app | Keep you signed in, remember the age-gate hold, and keep the site working. |
We do not ask for your precise location. We do not read your text messages, photos, or camera roll except the images you pick with the system photo picker for a profile photo or banner.
2.3 Information from other people
- Messages and hearts. Someone who has your link may send you a message or visit your public page. We attach that content to your account so it can show up in your inbox or activity.
- Hints. If a sender is signed in and has added a grade or school, we may store that limited profile fact with the message so that, if you are allowed to see a hint and the honesty rules are met, we can show a true hint. We do not show you their name.
- Profile views. When someone opens your public page we may record a hashed identifier, a source tag, and a time, so that “who viewed you” (a frfr+ feature) can be real.
2.4 Information from third parties
- Apple. If you buy frfr+, Apple processes the payment and tells us your entitlement (for example, that your subscription is active, expired, or refunded). We do not receive your full card number. If you use Sign in with Apple, Apple sends us the identifier described above.
- Cloudflare. Hosts the website, API, and file storage, and may process security and performance logs.
- Google AdMob. If a rewarded ad is shown, Google may receive a request to fill that ad. See Section 8.
- PostHog. If we have turned on product analytics (it stays off until we configure a project key), PostHog may receive event names and non-precise properties. See Section 6.
We do not buy marketing lists about you. We do not scrape your other social-media accounts to build a profile.
2.5 Information we do not collect today
- We do not currently access or upload your address book. If we later add an optional “find friends already on frfr” feature, we will ask first, use a hashed comparison where possible, and will not build a public directory from your contacts.
- We do not collect government IDs, payment card numbers, health data, or precise geolocation.
- We do not use your private messages to train public AI models.
3. How we use information (purposes)
We use personal information to:
- Provide the Service — create and secure your account, show your public ask page, deliver messages to your inbox, run streaks and the official daily “frfr team” prompt, and show your profile to people who have the link.
- Keep hints and “who viewed you” honest — only from real data, and only when our k-anonymity rule is met (we do not show a hint from a group smaller than 10).
- Safety and integrity — filter abusive text, handle reports and blocks, rate-limit spam, investigate fraud, and protect the rights, safety, and security of users and the public.
- Payments — confirm frfr+ entitlements with Apple, restore purchases, and provide what you paid for.
- Communications — send the notifications you allow (for example, that you have a new question, or an evening reminder you turned on). We do not send marketing push notifications unless you opt in, and you can turn them off in the app and in iOS Settings.
- Analytics and improvement — understand whether a screen or share path is working. Event names are general (for example,
share_completed). We do not need the text of your private messages for this. - Legal — comply with law, lawful requests, and our terms; enforce our guidelines; and establish or defend legal claims.
- Business transfers — if we are involved in a merger, acquisition, or sale of assets, as described in Section 6.
We do not use official “frfr team” messages as a disguise for fake friend questions, and we do not use personal information to invent engagement that did not happen.
4. Legal bases (EEA, UK, Switzerland, and similar laws)
Where those laws apply, we rely on:
- Contract — to provide the Service you ask for (account, inbox, shares, plus entitlements).
- Legitimate interests — to keep the Service safe, prevent abuse, understand how the product is used in a limited way, and improve it. You may object, subject to law.
- Consent — where we ask for it (for example, notifications, optional photos, optional analytics cookies on the web if we ever use them, or Sign in with Apple information you choose to share). You can withdraw consent at any time, without affecting earlier use.
- Legal obligation — to keep records we are required to keep, or to respond to lawful requests.
- Vital interests — in rare cases, to protect someone’s life or safety.
5. Anonymity, and its limits
The point of frfr is that a message does not show the sender’s name. That is not a promise that a sender can never be identified.
The words in a message, the time it arrives, a hint you unlock, or a legal request can still give you — or us — a clue. If a sender is signed in, we may have their account id on the server. If they are not signed in, we may have a hashed IP address and other technical data.
We may disclose information when we believe in good faith that we must do so to comply with the law or a valid legal process, to protect someone’s safety, to investigate or report abuse or illegal activity (including to the National Center for Missing & Exploited Children), or to enforce our terms. We will consider challenging overbroad requests when we think it is appropriate, but we cannot promise to notify you if the law forbids it.
6. How we share information
We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising as those words are used in the California CPRA. We do not use data from users under 18 for targeted or behavioral advertising.
We do share information in these limited ways:
| Recipient | What | Why |
|---|---|---|
| Cloudflare | Account data, messages, photos, logs, and hashed IPs, on our Worker, D1 database, and R2 storage | Hosting, storage, security, and content delivery |
| Apple | Entitlement checks, Sign in with Apple identifiers, and whatever you submit through App Store or iOS permission sheets | Sign-in, payments, notifications, and operating-system services |
| Google AdMob | A request to fill a rewarded ad, plus standard technical signals Google needs to serve it | Only if a rewarded ad is shown. For users under 18, ads are off by default, or if ever shown are requested as non-personalized. We do not use AdMob to build a marketing profile of a minor. |
| PostHog | Event names and properties, a distinct id | Product analytics, and only if we have configured a project key. It is off until then. We will not use PostHog to sell ads against your profile. |
| People you interact with | Your public profile (name, username, photo, prompt, bio) and any message you send | That is the Service working as you would expect. Recipients see the text you sent, not your name, unless you put your name in the text. |
| Other apps you open | The sticker image and link you choose to share to Snapchat, Instagram, or the system share sheet | Those platforms’ terms and policies apply to what you share there. |
| Authorities and safety partners | The limited information needed | Legal process, safety emergencies, or CSAM reporting. |
| Professional advisers and successors | What they need, under confidentiality | Lawyers, auditors, insurers; or a buyer in a merger or sale, with notice where required. |
Every processor is required, by contract, to use the information only to provide their service to us and to protect it at a level consistent with this policy and applicable law.
We do not let third parties use your private messages to train their general AI models.
7. Retention
We keep information only as long as we need it for the purposes above, including safety and legal holds. This section is our written data-retention policy: it states the purposes for which we collect information, the business need to keep it, and the timeframe for deletion. We do not retain personal information collected from a child indefinitely.
| Data | Typical period |
|---|---|
| Account and profile | For as long as the account is open, then deleted or irreversibly de-identified within 30 days after a deletion request, unless a legal or safety hold applies |
| Messages in your inbox | Until you delete the message or your account, except reported messages, which we may keep for up to 18 months (or longer if a safety or legal matter is open) |
| Hashed IPs and rate-limit rows | Up to 90 days, unless tied to an open report or legal matter |
| Profile-view records | Up to 90 days, or until you delete your account |
| Streak and share-source tags | For as long as the account is open, or 90 days for anonymous share tags |
| Support emails and privacy requests | Up to 3 years |
| Purchase / entitlement records | As long as required for accounting, tax, and dispute purposes (often up to 7 years) |
| Under-13 age-gate hold | A short cooling-off flag only; no profile is created |
| Aggregated or de-identified metrics | May be kept |
When we no longer need information, we delete it or irreversibly de-identify it.
8. Ads, analytics, and tracking
- No banners. No pop-up ads. If ads exist, they are rewarded ads you choose to watch to unlock one thing we also sell (a real hint, or one peek at who viewed you).
- Minors (under 18). Default: no ads. We do not use behavioral or targeted advertising for users under 18, and we do not sell or share their data for advertising. We do not initialize an advertising SDK for anyone we actually know is under 13 (and we do not keep such accounts). If we ever show a rewarded ad to a user aged 13–17, we will request only non-personalized ads and will set the industry under-age-of-consent flag (for Google Mobile Ads,
tagForUnderAgeOfConsent) so the ad SDK does not treat them as an adult for interest-based advertising. - Adults. Rewarded ads may be limited by country and by a daily cap set on our server. If no ad is available, the button is hidden.
- App Tracking Transparency. We will not track you across other companies’ apps or websites for advertising without the iOS tracking prompt, and paid features never depend on saying yes.
- PostHog is used, if at all, for product analytics, not ad targeting.
- You can report an inappropriate ad in the app when ads are on.
9. Your choices
- Profile. Edit your name, photo, bio, prompt, grade, and school in the app.
- Notifications. Turn them off in the app (for the evening reminder) and in iOS Settings.
- Contacts and photos. Photos are opt-in through the system picker. We do not read your address book in the current product.
- Subscriptions. Manage or cancel frfr+ in iPhone Settings → your name → Subscriptions, or at apps.apple.com/account/subscriptions. Deleting the app does not cancel a subscription.
- Restore. Use Restore Purchases in Settings or on the paywall.
- Reports and blocks. Available on each message.
- Account deletion. In the app, go to Settings → Delete account. You can also email privacy@frfrapp.co or use https://frfrapp.co/delete-account. We will delete the account and associated personal data as described in Section 7. Some records may remain where the law or a safety investigation requires it.
- Analytics / cookies. You can send a request to privacy@frfrapp.co. On the website we honor Global Privacy Control (GPC) as an opt-out of sale, share, and targeted advertising.
10. Your privacy rights (United States state laws and similar)
Depending on where you live, you may have some or all of these rights: access / know, correct, delete, portability / a copy, opt out of sale, share, or targeted advertising, opt out of certain profiling, limit use of sensitive personal information, and appeal a denial.
We offer these rights to U.S. residents, including residents of California (CCPA/CPRA), Virginia (CDPA), Colorado, Connecticut, Utah, Texas (TDPSA), and other states that have enacted similar consumer privacy laws as of 2026, even if a particular statute’s numeric threshold would not yet apply to us. We will not require you to create a new account only to use these rights if we can reasonably verify you another way.
How to make a request. Email privacy@frfrapp.co with the subject “Privacy request,” or use the form at https://frfrapp.co/privacy-request. Tell us which right you want to use and enough information for us to verify you (for example, your username and the email or Sign in with Apple address on the account). You may use an authorized agent where the law allows it; we may still need to verify you.
Timing. We will respond within 45 days, or tell you if we need one extension of up to 45 more days and why.
Appeals. If we deny your request, you may appeal by emailing privacy@frfrapp.co with the subject “Privacy appeal” within a reasonable time (please include the date of our decision). We will answer the appeal in writing within 60 days. If we deny the appeal, we will give you a way to contact your state attorney general. For Virginia residents, that is the Office of the Attorney General. For California, the Office of the Attorney General or the California Privacy Protection Agency. For Texas, the Attorney General’s consumer privacy page.
California “Notice at Collection” and Shine the Light. The categories, purposes, and recipients are in Sections 2, 3, and 6. We do not sell or share personal information as CPRA defines those terms, and we have no actual knowledge of selling or sharing the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes other than those that current CPRA regulations allow without a right to limit. California residents may also request information about disclosures to third parties for their direct marketing; we do not do that.
GPC. We treat a valid Global Privacy Control signal on our website as an opt-out of sale, share, and targeted advertising for that browser.
We will not discriminate against you for exercising your rights.
11. International transfers
We are based in the United States. If you use frfr from another country, your information will be processed in the United States and in other countries where our processors (including Cloudflare) operate. Those countries may not have the same data-protection laws as your own. Where required, we use appropriate safeguards, such as standard contractual clauses, for those transfers.
12. Security
We use technical and organizational measures that are appropriate to the nature of the data, including encrypted transport (HTTPS), hashed session tokens, hashed IP addresses, access limits on admin tools, and least-privilege production access. We also maintain a written information security program, with a designated owner, periodic risk assessments, testing of safeguards, and an at-least-annual review, consistent with the kinds of controls described in the COPPA Rule, 16 C.F.R. § 312.8, for any personal information we may collect from a child (which we do not do by design). Before we allow a processor to handle that kind of information, we take reasonable steps to confirm they can protect it and we obtain written assurances that they will.
No method of transmission or storage is 100% secure. Please keep your device and Apple ID safe. If you believe there has been a security incident that affects you, write to privacy@frfrapp.co.
13. Children under 13 (COPPA)
frfr is not directed at children under 13, and we do not knowingly collect personal information from them. This section is also our notice of the practices we follow under the Children’s Online Privacy Protection Act and the COPPA Rule (16 C.F.R. Part 312), as amended in 2025 (effective June 23, 2025; operator compliance date April 22, 2026).
We use a neutral age screen before we collect a name, school, photo, or other profile information, and before we start advertising or product-analytics SDKs, register a push token, or ask for contacts. The screen does not default to 13 or older and does not advertise locked features as a reason to enter a false age.
If the age screen says the person is under 13, we do not create an account, and we do not save a name, school, photos, or analytics events. We may keep a short technical device lock so the same device cannot immediately submit a different age. That lock is not used for any other purpose and is not a profile.
If you are a parent or guardian and you believe your child under 13 has an account, email privacy@frfrapp.co with the subject line “Under-13 account.” Include any username, email, or Sign in with Apple information you have. You may also use https://frfrapp.co/privacy-request. This is a priority request.
What we will do. We will stop further collection, delete the account and the personal information we have that is reasonably linkable to the child, and email you a confirmation if you wrote to us from a reachable address. We do this as soon as we can, and we treat it as an urgent request (not as an ordinary 30-day account-deletion). We may keep a short technical hold so the same child cannot immediately re-register, and we may keep a minimal internal ticket that a deletion occurred. We will not keep the child’s profile, photos, or messages for analytics or advertising. We do not need verifiable parental consent because we do not offer the Service to children under 13.
We do not offer anonymous messaging to children under 13, and we do not seek verifiable parental consent to do so. If that ever changes, we will update this policy and comply with COPPA first, including notice and verifiable parental consent, before any collection.
The retention schedule in Section 7 is our written data-retention policy. For personal information later found to have been collected from a child, we delete it when it is no longer reasonably necessary for the purpose for which it was collected (age screening, the short re-registration hold, or a legal obligation). We do not keep that information indefinitely.
14. Teens (13–17)
If you are 13–17:
- A stricter content filter applies.
- Report and block are always one tap away.
- We do not use your data for targeted or behavioral ads, and we do not sell or share it for advertising.
- Rewarded ads are off by default.
- Some late-night or evening reminders may be limited, especially where state law requires it.
- You should have a parent or guardian’s permission to use the Service where required. A parent can contact privacy@frfrapp.co or support@frfrapp.co about an account.
We may add stronger state-specific rules (for example, parental consent or a higher minimum age in a particular state) when the law requires it.
15. Push notifications
We will ask iOS for permission before sending notifications. You can decline, and you can change this later. We use notifications to tell you that you have a new question, or to send a reminder you turned on (for example, an evening share reminder). Notification text on the lock screen will be generic when we can reasonably make it so, so a message body is not previewed to everyone who can see your screen. We do not require notifications to use the app.
16. Law-enforcement and safety requests
Law-enforcement agencies may send legal process to legal@frfrapp.co (or the registered agent at [address]). We disclose information only when we believe in good faith that we are required to do so, or that an emergency involving danger of death or serious physical injury requires it. We may report apparent child sexual abuse material to NCMEC.
A sender’s anonymity does not prevent us from responding to valid legal process.
17. Changes
We may update this policy. We will change the “Last updated” date above, post the new policy at https://frfrapp.co/privacy, and, if the change is material, give you additional notice in the app or by email (if we have one) where required. If you do not agree, you should stop using the Service and delete your account.
18. Contact
Questions about privacy, requests, and appeals:
- Email: privacy@frfrapp.co
- Support: support@frfrapp.co
- Legal: legal@frfrapp.co
- Mail: [frfr LLC name], [address]
- Phone: [phone]
Web form (once live): https://frfrapp.co/privacy-request
If you are in the EEA, the UK, or Switzerland, you may also complain to your local data-protection authority. We would appreciate the chance to address your concern first.
This document is a draft for counsel review. It is not legal advice.