Your privacy

What you share with us

Sign in with Apple supplies an identifier for this app, an email address that may be an Apple relay address, and a name if you allow Apple to share it. Apple’s name, when supplied on your first sign-in, is used as an editable suggestion. We store only the display name you confirm in your profile and authentication account, along with the adult and membership declarations you provide for account review. Apple may offer limited account-risk or optional age-range signals. The optional age request asks whether the threshold of 18 is met; it does not ask for your exact date of birth.

Apple does not provide a gender field, Apple Account creation date or proof that you are an adult woman. We do not use Apple Pay, credit card details, names or appearance to establish gender. We do not request government identification, your contacts or photographs through the app.

We use account and session information to sign you in, enforce membership decisions, protect accounts and handle support requests. We use your choices and activity only to provide the community features you select, review concerns, prevent abuse and maintain the service.

Your area stays broad

Location permission is optional. When you allow it, the current app converts your Toronto-area location into a broad grid area on your device. This map integration sends the grid, rather than raw GPS coordinates or a location history. Ghost mode starts on. Turning visibility on creates temporary area presence.

The member map shows a limited set of area groups only where a minimum group size is met. It does not show individual member names, exact counts or person coordinates. A refreshed map cannot be used to request an unrestricted list of people. Ghost mode, signing out and expired eligibility restrict visibility.

A separate exact-location-sharing system exists for consented help connections. It is not exposed by the current app interface. If introduced, it must ask you separately before sharing with a specific approved responder, and access will be limited to at most one hour or end sooner when consent or eligibility ends.

Chillin, requests and conversations

A Chillin plan records your chosen activity and broad area. Plans are private by default and last one hour. If you choose to share a plan, eligible nearby members may see the activity and a “Nearby” label. Discovery does not disclose your name, account identifier, exact position or a travel trail. An invitation records both participants’ choices. Chat opens only after both agree.

Help requests contain a category, severity, broad area and requested responder count. Staff review is required before responder offers. Responders need reviewed approval. A private help conversation requires an accepted offer and separate requester consent.

Messages are stored to deliver the temporary conversation. Private live-update signals carry a change notice rather than message text. Push notifications do not include names, chat text, an incident description or precise location. Choosing to message someone still gives that person access to what you send; they may remember or copy it. Avoid unnecessary identifying, medical or financial details.

Reports and community review

You may privately report an age, impersonation, membership, harassment or unsafe-behaviour concern involving a connected participant. A report can include a short note. Authorized staff review the case; an accusation alone does not automatically ban a member. Blocking is a separate choice that restricts interaction.

We record review decisions, their reasons and the responsible staff account so decisions can be checked. Reports and safety records are used for moderation, abuse prevention and responding to legitimate legal requests, rather than advertising. Access is restricted to authorized staff and service providers supporting those functions.

Private interaction feedback

After an eligible connection ends, you can privately rate respect, responsibility and appropriateness from 1 to 5 during a 24-hour window. Ratings are limited to one submission per person and connection. Authorized staff can review summaries separately from allegations and documented review decisions. A rating is not identity verification and does not automatically change another person’s access. Feedback is scheduled for deletion after 90 days, or removed when an accepted account deletion starts.

How long information stays

• Social plans expire after one hour. Social chat access ends at the earliest plan, review or session expiry, or sooner after a block, withdrawal or loss of eligibility. Ended social conversations have their messages removed; scheduled cleanup removes expired content.
• Help chat and exact-location access are limited to at most one hour and can end sooner. Expired private content is removed by scheduled cleanup in bounded batches, so access expiry and physical deletion are not necessarily simultaneous.
• Notification registrations expire after 15 minutes unless renewed while the app is active. Expired delivery jobs are cleaned up after their short delivery window.
• Private participant reports are scheduled for deletion 90 days after creation. Account, request and moderation records remain while needed to operate the service and address safety concerns.
• After completed account deletion, related safety records may be retained for up to 90 days. Limited obfuscated review attribution may remain. Backups can contain earlier copies until the provider’s backup retention ends.

Retention may be extended where required by law or to preserve a specific legal claim. We limit that retention to the relevant information and purpose. We do not promise that signing out immediately erases all server records.

Deleting an account

The in-app deletion flow requires deliberate confirmation and fresh Apple authentication for the same account. When an accepted deletion starts, access, active sessions, profile, plans, chats, location sharing and device registrations are revoked before provider cleanup finishes. The process also removes personal text from reports you submitted and removes your help-request area. Limited safety attribution can remain as described above.

Apple authorization revocation and server-account cleanup can take longer if a provider is unavailable. The app shows whether deletion is complete, pending or unavailable. If in-app deletion is unavailable, contact support. You can request account deletion and help through contact@tnaado.ca. We may ask for limited information to confirm the request belongs to your account. Never send a password, Apple verification code or identity document by email.

Notifications and advertising

If you allow notifications, Apple and our service process a device token and temporary session-linked registration to deliver generic updates. Delivery can be delayed or fail. Signing out attempts to remove the registration; an offline removal may remain pending until it expires.

Home, urgent requests, responder and chat screens have no ads. Clearly labelled native placements may appear on Chillin and nonurgent information pages, below content and above navigation. There are no fullscreen, app-open or forced-wait ads. Code Girly may display its own promotional artwork when a paid advertisement is unavailable; this does not count as a paid ad impression.

Google Mobile Ads and Google’s User Messaging Platform support advertising and privacy choices. Paid ads load only when configuration and required consent permit. When ads load, Google’s SDK may process device identifiers, IP address and derived broad location, diagnostics and advertising interactions. Nonpersonalized ads can still involve data processing. The app does not send requests, reports, chat text or its location grid as ad-targeting data. Required privacy choices must remain available in the app.

Read Google’s privacy policy and how Google uses information from partner apps. This policy website has no advertising, analytics scripts or signup forms.

Providers and safeguards

We use Apple for sign-in and push delivery, Supabase for authentication, database storage, private update signals and server functions, and the Google advertising and consent SDKs described above. The app’s Supabase project is hosted in Canada. These providers may process service data in other countries under their own terms. The policy website is hosted by Vercel, which processes ordinary hosting and security request information such as IP addresses.

We use restricted access, current-session checks, time limits, request limits and staff multifactor authentication to reduce risk. A rotating refresh token is kept in the iOS Keychain. No system can guarantee absolute security. We do not sell your community messages, reports or location-sharing data, or disclose them to another member beyond the feature and consent you choose. We may disclose limited information when legally required or necessary to address a serious safety incident.

Your choices and privacy requests

You can decline optional location, age-range sharing and notifications, use Ghost mode, withdraw plan sharing, end a connection, sign out, and report or block a connected participant. Declining required eligibility declarations prevents community access. Withdrawal may prevent the relevant optional feature from working.

For access, correction, deletion, consent withdrawal or a privacy concern, write to TNAADO Inc at contact@tnaado.ca with “Code Girly privacy” in the subject. We will explain any information needed to confirm your identity and any lawful limits on a request. If your concern remains unresolved, you may contact the Office of the Privacy Commissioner of Canada.

Material changes affecting a new use or disclosure will be explained before they apply, with fresh consent where required. This policy will be updated when information handling changes.