Privacy Policy

Last updated: November 8, 2026

This Privacy Policy explains what personal data Rawly OÜ collects when you use the Rawly app and the website rawly.app (together, the "Service"), why we collect it, how long we keep it, who we share it with and what rights you have. We do not sell your data and we do not show ads.

1. Who is responsible

Rawly OÜ is the controller of your personal data: registry code 17484887, Narva mnt 5, 10117 Tallinn, Harju maakond, Estonia, hello@rawly.app.

2. What we collect

Account. Your username, email address and date of birth. We use your date of birth only to check that you are at least 18 and never show it. If you sign in with Apple or Google, we receive the email address they share with us. Your password is stored only as a secure hash. We do not ask for a phone number. If someone invited you, we record who.

Your acceptance of the Terms. When you create your account, we record when you accepted the Terms of Service and which version you were shown. When you confirm an updated version in the app, we record that too. We keep this to show which Terms you agreed to.

Profile. Your display name, bio, website, profile photo and cover photo. If you take your profile photo with both cameras at once, the second side is stored with it and shown beside it on your profile; you can keep one side only at any time.

What you post. Photos and videos you take with the in-app camera (nothing can be uploaded from your gallery), captions, comments, voice comments, emoji reactions and stories. Each photo or video is taken together with a frame from your phone's other camera, at the same moment. That verification frame is stored with your post. Only you see it, unless you choose to show it for that post. Our moderators can see it when they review a report about the post.

Votes. Your answers in the vote deck (+1 or skip) and your votes in challenges, RAW NOW, VS and spots, so they can be counted and, where a challenge pays its voters, so you get your share. Other people see vote counts, never who voted.

VS. A VS puts your photo beside another person's, with both names. Unless the person who started it keeps it to one chat or one club, signed-in people can see both photos and vote for 24 hours, and the page a VS link opens on the web shows only the names and what to shoot, never a photo. The starter can invite up to five people who follow each other with them; each one is told who sent it. A VS kept to a chat is seen only by its two players and nobody votes; a VS kept to a club is seen and voted on only by the club's members. A photo you take to answer a kept VS stays in your Archive and is shown only in that VS. When a VS link is sent in a chat or a club, the app asks our server for the VS's current state to draw it; someone else's photo stays blurred until you play in that VS or it is over.

Messages. Direct messages and group chats are end-to-end encrypted (see section 5). To deliver them we keep who sent a message to whom and when, until the messages are deleted by you or the other person, or until an account is deleted.

Clubs. When you are in a club, we keep that you are a member, your role (owner, moderator or member), your member number and who invited you. What members share in a club (messages, round photos and reactions) is shown only to the club's members; nothing from inside a club appears in feeds, in search or on the web. To join or start a club tied to a place (a city, a neighbourhood or a campus), you send a photo taken inside that place and an optional note: only you and the club's moderators see them, and Rawly staff review a request to start a new club. The photo becomes your member card if you are accepted and is deleted if you are not or you withdraw. In search, on the map and on the web page an invite link opens, a club shows only its name, mark, kind and member count; the map also shows whether a round is on, and the invite page names who sent the link. The clubs you are in show on your profile only if you turn that on for each club.

Spots. A spot is a public place Rawly picked. A photo you take there to hold the spot, challenge it or leave in its album is shown only to signed-in people who have taken a photo at that spot themselves, except across a block, and is never a post. Anyone else sees the spot's name and how many photos it holds, never a photo or a name. For an hour after you take it, neither the photo nor your name is shown to anyone else, so the map never tells where someone is at that moment, and while you challenge a spot your name stays hidden until the final's result. If you turn on alerts for new photos at spots you have opened (they are off until you do), we tell you of a new photo there at most once a day per spot, at least an hour after it was taken, and never who took it. You can take your spot photo down at any time, and anyone who can see it can report it. Each week, the photos taken at spots in a neighbourhood count for the clubs their authors are in, once per person, for that neighbourhood's board: it shows only club names and numbers, never who, and only clubs that can be found in search and have at least three members take part.

Close friends and meetups. Your close friends list (people who follow each other with you, chosen by you) is seen only by you, and nobody is told they are on it. A meetup's place, time and line are seen only by you and the close friends you send it to; the place is the point you put on the map, never your phone's position, and the notification it sends says who invites, not where or when. If you say you are going, your name is shown to the others invited. A meetup and its answers are deleted a day after it ends, or at once when you call it off.

Location. Only when you allow it, and never before you open something that needs it. A post you choose to tag keeps that place. For an on-site challenge, a spot, or a club tied to a place, your phone's position is checked once, at the moment you take the photo there, and is not stored: we keep only which place it was and when you were there. Your own dot on the map is never sent to us. If you share live location with a close friend (it starts only when they say yes, lasts at most eight hours, and either of you can stop it), your position is sent from the app's open map every half minute while it lasts, kept only in our server's memory, never written to our database or logs, and gone when the sharing ends. The map itself and place names come from other services (section 7).

Gifts. When you send a gift on a post or a challenge entry, we record who sent it, who received it, the post, the gift and its Token value. Gifts are public: a post's supporters and a profile's top supporters of the last 30 days show the name and photo of each sender, unless the sender chose to hide their name (the person receiving the gift still sees who sent it).

Payments and withdrawals. When you buy Token, the App Store or Google Play processes the payment and we receive a confirmation, never your card details. When you withdraw Jeton, you enter your bank details directly with Stripe, which holds them. Only if a payout has to be arranged by hand do we ask for your bank account number (IBAN), account holder name and bank country. Stripe verifies your identity (KYC) before a first payout, which may require an identity document and a selfie; we receive the result, not the documents. We keep a record of every Token and Jeton transaction.

What you do in the feed. Which posts were shown to you and where, how long each stayed on your screen in the feed, and your votes, comments, shares and saves. Section 4 explains what this is for.

Device and security. Your device model, operating system and app version, device identifiers we use to keep your account secure and to treat accounts that shared a phone as one person, the IP address of each request, and the results of the device checks in section 7. When you take a screenshot or a screen recording in the app, the app reports it with the name of the screen, and we log it to investigate abuse.

Usage. Which screens you open and a few key actions (sign-up, sign-in, posting), with Google Analytics for Firebase, and crash reports with Firebase Crashlytics. Both are linked to a pseudonymous ID, never to your name or email. With Firebase Performance Monitoring, how long a few things take (the app starting, the camera opening, a photo reaching the review screen, the first feed page loading, network requests), along with your device model, operating system and country, linked to an ID Firebase makes for the app on your phone, not to your account. We do not use advertising identifiers.

Reports and support. What you report and why, and what you write to us.

Website. rawly.app uses Umami, a self-hosted, cookieless analytics tool that does not track you across sites or identify you. Visits to a VS link page are counted as daily totals, without an address, an account or a device.

3. Why we use it, and on what legal basis

We also publish public totals for the object of the day on rawly.app/objects: for each day that has ended, how many photos were taken, how many people voted and how many time zones the photos came from. These are counts only, never a photo, a name, a profile or a country, and the time zone count is not shown for a day with fewer than five photos.

4. Feed views and personalisation

The feed has four views and you pick one from the menu at the top. New shows the newest posts first, in time order, and is where Rawly opens the first time. Following shows the people you follow, newest first. Best shows the most voted posts of a day, a week or a month. Hot is optional: it shows posts that are rising right now, put in order automatically. The app remembers the view you picked. New, Following and Best are the same for everyone and do not use anything about you beyond who you follow.

Hot weighs how new a post is, its recent votes and comments, its author's rank, whether a Praetor or higher endorsed it, the camera details recorded when it was taken, whether you follow the author, whether you have already seen it, and how many posts by the same author it has just shown you. It also uses a summary of how much you interact with each account: your votes, comments, shares and saves on their posts and how long their posts stayed on your screen in the feed (a quick skip counts against). It does not use your messages, your location, your age or anything you have not done in Rawly's feed.

Nothing on Rawly makes a decision about you based solely on automated processing that has legal or similarly significant effects. The automatic check at upload can stop a photo from being published (see section 6); any action on your account is decided by a person.

5. End-to-end encrypted messages

Direct messages and group chats are end-to-end encrypted, built on X3DH key agreement and the Double Ratchet. Photos and voice notes you send in a direct message are encrypted with their own key, which travels inside the encrypted message.

Club threads are different: they are not end-to-end encrypted. Their messages, round topics, notes to moderators and photos are stored encrypted on our servers, with a key kept outside the database and its backups. Members see them, and our moderators can read a club message, or see a club photo, that is reported.

6. Moderation

Every photo you upload is checked automatically by Google Cloud Vision for sexual, violent or illegal content before it is published. A photo the check finds likely to be sexual or violent is not published, and you can take another. Challenge entries are also checked against the challenge's subject. Reported content and verification frames open only in our admin tools, behind a fresh two-factor check each time. The email that tells our moderators about a report carries only its number, reason and place, never a photo, chat lines or a username.

7. Who we share it with

We do not sell your personal data. We share it only with the providers below, who process it for us under contract (or, where stated, as independent controllers), with authorities when the law requires it, and with others only with your consent.

8. Transfers outside the EU

Rawly is based in Estonia, and our servers, database and media storage are in Germany. Some providers above process data in the United States: Google (Cloud Vision, Speech-to-Text, Translation, Firebase Cloud Messaging, Analytics, Crashlytics, Performance Monitoring, Play Integrity and Maps), Apple (App Attest and, on an iPhone, place names), RevenueCat and Stripe. These transfers are protected by the European Commission's Standard Contractual Clauses (GDPR Art. 46) and, where the provider is certified, the EU-US Data Privacy Framework. Infomaniak is in Switzerland, which has an EU adequacy decision.

9. How long we keep it

We keep your data while you have an account, except where this policy gives a shorter time. You can delete your account at any time in Settings > Delete Account. Deleting it removes at once your profile, posts and their verification frames, voice comments, stories, emoji reactions, RAW NOW entries, challenge entries, VS (with their votes and invites), direct and group messages, follows, likes, saved collections, mutes and blocks, location check-ins, notifications (including those shown to other people that named you), reports, club memberships, club messages, round photos and member card photos, spot photos and spot votes, close friends lists, meetups and meetup answers, live location shares, device keys, feed personalisation data and security logs. The media files themselves (every photo, video, verification frame and voice note) are deleted from our storage at the same time.

What stays after deletion:

Other limits: feed personalisation data as in section 4; screenshot and screen-recording logs for 12 months; a meetup until a day after it ends; live location only while it is shared; usage analytics for 2 months, crash reports for 90 days and performance measurements for up to 60 days.

10. Security

Encrypted connections (TLS) for all traffic, password hashing (bcrypt), end-to-end encrypted direct messages and group chats, club data encrypted at rest, encrypted backups, private media storage reachable only through signed-in requests, sessions you can end on every device by changing your password, optional two-factor sign-in (TOTP), two-factor sign-in and a fresh code for every look at reported content in our staff tools, rate limits, device checks and regular security reviews. No system is completely secure. If you find a vulnerability, please tell us at hello@rawly.app.

11. Your choices

12. Your rights

Under the GDPR you have the right to:

To use these rights, write to hello@rawly.app. We answer within one month.

13. Children

Rawly is for adults: you must be at least 18 to use it. We do not knowingly collect personal data from anyone under 18. If an account turns out to belong to someone under 18, we close it at once, tell its owner by email where we can, and delete the account and its data within 30 days; until then the owner can ask us for a copy. If you believe someone under 18 has an account, write to hello@rawly.app.

14. Data breaches

If a personal data breach is likely to put your rights and freedoms at risk, we report it to the Estonian Data Protection Inspectorate within 72 hours of learning of it (GDPR Art. 33). If the risk is high, for example financial data or private messages are exposed, we also tell you directly without undue delay, by email and, where we can, in the app (Art. 34). We keep an internal record of every breach (Art. 33(5)).

15. Cookies and storage on your device

The Rawly app uses no cookies. It keeps on your phone what it needs to work: your sign-in session, your settings, the keys for your encrypted messages and a local copy of your conversations. The website uses no cookies for analytics (see section 2).

16. Changes to this policy

When we change this policy in a way that matters, we tell you in the app or by email before the change applies. The date at the top shows when it last changed.

17. Language

This policy is published in English and in translation. If a translation differs from the English text, the English text applies, unless the law of your country requires otherwise.

18. Contact

Rawly OÜ, Narva mnt 5, 10117 Tallinn, Estonia. Email: hello@rawly.app. We aim to answer privacy questions within 5 business days.