Privacy Policy

About this policy

Samo is a photo app for small groups of close friends. It is run by an independent developer (“we”). This policy explains what we collect, why we collect it, which companies help us run Samo, and the choices you have.

If anything here is unclear, write to support@samoonline.com.

What we collect

• Account details: your email address, username, password (we never store it; our sign-in provider keeps only a one-way hash of it), the avatar you pick from our presets, and your time zone.
• If you sign in with Apple or Google: the email address they provide and, if you choose to share it, your name. Apple lets you hide your real email address.
• What you post: photos and videos (including Live Photos), captions, chat messages, comments, likes, paw-print reactions and saved vibe posts, room names and covers, Story Relay prompts, study to-dos, goals and focus records, stickers you make, vibe posts, and messages you send us through the in-app contact form.
• Device and diagnostics: a push-notification token so we can notify you, and crash and error reports. These reports are linked to your account ID only. They don’t include your posts or your IP address.
• Location, only when you tap “Find nearby” while adding a location sticker: your coordinates are sent to OpenStreetMap’s Overpass service and Apple’s geocoding service to suggest place names. We don’t store your coordinates; only the place name you pick appears on the sticker.
• Photo library: only the photos you choose, including when they were taken, so you can post a photo at the hour it was taken. Samo saves to your library only when you ask it to.
• Social connections: your friends and friend requests, the rooms you join, and the people you block. We work out streaks from your posts: friends see how many days in a row you both posted in rooms you share, and a room’s members see each member’s streak in that room.
• Security records: if a username sign-in fails because the username or password is wrong, we keep the username you typed and a one-way hash of your IP address. If you enter a room code that matches no room, we keep your account ID and the time. We use these to limit repeated guesses.

How we use it

• To run Samo: rooms, timelines, chat, notifications and widgets.
• To keep Samo safe: reviewing reports and enforcing our Terms.
• To fix problems and keep the app working.

We don’t sell your data, we don’t show ads, and we don’t track you across other apps or websites.

Who can see your content

• Photos, videos, chat and comments in a room: only that room’s members.
• Vibe posts: other Samo users.
• Your username and avatar: other Samo users.

We don’t share your data with anyone else, except the service providers listed below or when the law requires it.

Service providers

These companies process data on our behalf, only to provide their service to Samo:

• Supabase: database, sign-in and server functions (United States).
• Cloudflare: storage for photos and videos, our website, and support email forwarding.
• Expo and Apple: delivering push notifications and app updates. Expo receives update checks with an anonymous identifier.
• Sentry: crash and error reports.
• Resend, using Amazon SES: sending verification and password-reset emails.
• Apple and Google: when you choose to sign in with them.
• OpenStreetMap (Overpass) and Apple: place suggestions, only when you tap “Find nearby”.
• GitHub: runs our daily database backup; the backups are stored with Cloudflare.

How long we keep it

• Photos and videos you post in Timeline and Colorwalk rooms are deleted automatically 14 days after upload, along with the likes, paw-print reactions and comments on them.
• Story Relay scenes and study-room photos are not deleted automatically. Story Relay scenes stay until the room is deleted or the person who made them deletes their account. Study-room photos stay until you delete them, the room is deleted, or you delete your account.
• Vibe posts stay until you delete them or delete your account.
• Chat messages and comments can’t be deleted one by one in the app. They go when the room is deleted or their author deletes their account, and comments also go with the photo or video they’re on.
• Leaving a room doesn’t remove what you posted there.
• When you delete your account, your account and what you posted are deleted from our database right away. Rooms you created pass to another member, or are deleted if no one else is in them. Copies in our database backups are removed within 30 days.
• Image and video files can stay in our storage after they have disappeared from the app, for example when a room is deleted or a clean-up is interrupted.
• Messages you send us through the in-app contact form are kept until we delete them. If you delete your account, they stay but are no longer linked to you.
• Crash reports are deleted automatically when Sentry’s retention period ends.
• Anything else stays until you delete it or delete your account, or until the room, post or person it belongs to is deleted. Two exceptions: notification records are trimmed automatically (the activity list in your notifications keeps only the latest 30 items), and records of failed sign-in and room-code attempts are cleared when a later attempt is made, with no fixed time limit.

Your choices and rights

• In the app, you can delete your own photos and videos, vibe posts, stickers, study-room photos, study to-dos and goals. You can edit the photos and videos you post in rooms, except Live Photos, and change their captions unless the caption is part of the picture. You can also change your username and avatar.
• Delete your account at any time in Settings > Delete account.
• Turn off notifications, location or photo access in iOS Settings at any time.
• If you can’t sign in, email support@samoonline.com from your account’s email address. We’ll help verify ownership and arrange the safest available way to delete your account or send you a copy of your data.

Children

Samo is not for children under 13. If we learn that a child under 13 has an account, we’ll delete it.

Security and where data is stored

Data is encrypted in transit (HTTPS). Database access is restricted row by row, so people can only read what they’re allowed to, and photos and videos are served through links that expire. Our servers are primarily in the United States.

Our website

samoonline.com doesn’t use cookies or analytics.

Changes to this policy

If we change this policy in a way that matters, we’ll tell you in the app and ask you to agree again. The effective date shows which version you’re reading.

Contact

Questions or requests: support@samoonline.com.