Effective July 21, 2026

Privacy Policy

TreatTally is operated by Grey Park Development. This policy explains the data used to provide invite-only treat groups and their safety features.

Data we process

We process your account identifier, email address supplied through authentication, display name, emoji, group membership, treat photos and tallies, reactions, reports and optional report notes, blocks, bans, and messages you send to support. This data is linked to your account and used only for app functionality, safety, security, and support. We do not track you and do not use advertising.

Services

Supabase provides authentication, database, private file storage, and server functions. OpenAI receives each new photo, and each display name or group name you choose, through its moderation API (/v1/moderations) to determine whether it violates safety rules. OpenAI documents that this endpoint retains no customer content for abuse monitoring and does not train on it; TreatTally never stores an automatically rejected photo. Apple’s Sensitive Content Analysis may also analyze a photo on your device before submission. Resend sends operational moderation alerts to the TreatTally operator; report contents are included only as needed for review.

We confirm that each third party named above provides the same or equal protection of your data as stated in this policy. We share only what the stated purpose requires, we do not sell your data, and none of these services is permitted to use it for advertising, profiling, or model training.

Visibility and moderation

Approved photos are stored privately and shown through short-lived links to eligible group members. A report immediately hides the content from its reporter. Nudity/sexual-content, violence, and hate/harassment reports move the photo to private quarantine and hide it group-wide. Blocks create mutual invisibility across every shared group. Group owners see report details but never reporter identity; reports about an owner go only to the operator.

Retention

Approved group content is retained until its author, a group owner, group deletion, or account deletion removes it. Safety-quarantined media is deleted within 30 days. Moderation event and report audit records are deleted after one year. Standard open reports are retained while needed to investigate and document the resolution. Local pending photos remain on your device only until accepted, rejected, removed, group departure, or account deletion.

Deletion and control

You can leave a group, block or unblock people, remove your content, and choose Safety & Support → Delete Account. Account deletion removes authored photos, tallies, reactions, reports and authentication data. An owner must first transfer or delete each owned group. TreatTally attempts to revoke Sign in with Apple authorization; if that cannot complete, the app provides Apple’s manual instructions.

Contact

Questions and privacy requests: support@greyparkdevelopment.com.