Privacy Policy

This Privacy Policy explains how Kamiyaa Technologies Inc. ("we", "us") accesses, collects, uses, shares, keeps, and deletes your information when you use potatoroad, including the website at potatoroad.com, the potatoroad web app, the potatoroad app for Android and other mobile devices, and related services (together, the "Service"). It's part of our Terms of Service.

1. Who we are

potatoroad is operated by Kamiyaa Technologies Inc., based in Ontario, Canada. We're responsible for your personal information under this policy. For any privacy question or request, contact our privacy contact at support@potatoroad.com.

2. Information we collect

Information you give us

• Account information: your email address, username, name, and password. We store passwords only in hashed form. If you turn on two-factor authentication, we store the secret needed to check your codes.
• Profile information: your profile photo, bio, and whether your account is public or private.
• Content you create: the photos, captions, tags, location names, and stories you post, save as drafts, or archive; the comments you write; and the posts, stories, and comments you like.
• Connections: the people you follow, who follows you, and follow requests you send, receive, accept, or decline.
• Communications with us: anything you send when you contact us, for example for support or a privacy request.

Photos and their metadata

Photo files can contain embedded metadata, such as the date taken, the camera model, and, if your camera recorded it, the GPS location. We keep the original files you upload privately, so we can process them and let you re-crop or edit your posts later. The copies we show to other people are re-created from the image pixels alone and contain none of that metadata. The only location others see is the location name you type into a post, if you add one.

Device permissions in our mobile apps

• Photos: the app asks for access to your photo library only so you can choose photos to post or use as your profile photo. Only the photos you choose are uploaded.
• Internet: the app needs a network connection to reach the Service.
• The app doesn't use your camera, microphone, contacts, or your device's location, and it doesn't collect a list of the other apps on your device.
• The app stores your sign-in session and settings on your device so you stay signed in.

Information collected automatically

• Activity: which stories you've viewed, notifications you've read, and achievements you've earned, so the Service works as expected (for example, so story authors can see who viewed their story).
• Device and log information: your IP address, browser or device type, operating system, pages or screens requested, and timestamps, which our servers record when you use the Service.
• Bot protection: when you sign up or sign in, Cloudflare Turnstile checks signals from your browser or device (such as your IP address and browser characteristics) to confirm you're not an automated bot.
• Diagnostics (web app): crash reports and error details, which may include a recording of what happened on the page around the time of an error, to help us find and fix bugs.
• Analytics (web app): how people use the web app, such as which pages are visited, collected with Google Analytics using cookie identifiers.

Cookies and local storage

We use cookies, your browser's local storage, and the equivalent storage on your device to keep you signed in, remember your preferences (such as light or dark theme), protect the Service from abuse, and, in the web app, understand how it's used. You can control cookies through your browser settings, but some parts of the Service, like staying signed in, won't work without them.

3. Summary of data we collect and share

4. How we use information

• To provide the Service: create and manage your account, show your posts and stories to the right people, build your feed, deliver notifications, and let you find and follow others.
• To keep things safe and secure: verify accounts, prevent spam, fraud and abuse, detect bots, investigate suspicious activity, and enforce our Terms.
• To improve the Service: fix bugs, measure performance, and understand which features people use.
• To communicate with you: send sign-up, sign-in, password reset, and email change messages, and important notices about the Service or changes to our policies.
• To meet legal obligations and respond to lawful requests.

We don't sell your personal information, we don't use it to show you third-party advertising, and we don't share it with data brokers.

5. How information is shared

With other people on potatoroad

• Public information: your username, name, profile photo, bio, and follower and following counts can be seen by anyone using the Service, even if your account is private.
• Your content: if your account is public, anyone can see your posts and stories. If it's private, only the followers you approve can. Comments and likes you leave on someone else's post are visible to the people who can see that post.
• Activity on others' content: people can see if you've liked their post or viewed their story.
• Anyone who can see your content can take screenshots or otherwise share it outside potatoroad, so please share thoughtfully.

With service providers

We share information with companies that help us run the Service, only as needed for them to do that work for us, and under agreements that require them to protect it:

• Google Cloud: hosting, databases, and storage of the Service and your content.
• Cloudflare Turnstile: bot protection on sign-up and sign-in.
• Sentry: error monitoring and diagnostics for the web app.
• Google Analytics: usage analytics for the web app.
• Our email provider: sending account and security emails.

For legal reasons

We may share information if we believe in good faith it's required by law, such as in response to a subpoena or court order, or necessary to detect and prevent fraud or abuse, protect the safety of any person, or protect our rights and the Service.

If ownership changes

If potatoroad is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that deal, and this Privacy Policy will continue to apply to it. We'll let you know before that happens.

6. How long we keep information

• Your account and content are kept for as long as your account exists. Moments roll off feeds after a week, but they stay on your profile until you delete them or your account.
• Content you delete is removed from the Service right away and from our backups within 90 days.
• Server logs, including IP addresses, are kept for up to 30 days unless they're needed to investigate a security incident or abuse.
• Diagnostics and analytics data are kept according to the retention settings of Sentry and Google Analytics, and no longer than needed for the purposes above.
• When your account is deleted, we delete or anonymize your personal information within 30 days, and it's cleared from backups within 90 days.
• Exceptions: we may keep limited information for longer where we need it for security, fraud and abuse prevention (for example, to stop a banned person from signing up again), to comply with a legal obligation, or to resolve disputes. We keep it only as long as that reason applies.

7. Deleting your account and data

You can ask us to delete your potatoroad account and its associated data at any time. See how to delete your account for the steps, what gets deleted, and what we keep. You can also delete individual posts, stories, and comments yourself at any time without deleting your account.

8. Your choices and rights

• Control who sees your posts: make your account private in Settings so only approved followers can see your posts and stories.
• Edit or delete your content: edit or delete your posts, stories, and comments at any time, or archive posts to hide them from others.
• Update your information: change your profile, email address, and password in Settings.
• Photo access: you can turn off the mobile app's photo access at any time in your device's settings.
• Analytics cookies: you can block or delete cookies in your browser, or use Google's Analytics opt-out browser add-on.

Under Canadian privacy law, and the laws of other places where you may live, you have the right to access the personal information we hold about you, ask us to correct it, ask us to delete it, and withdraw consent to how we use it (which may mean we can no longer provide the Service). Depending on where you live, you may also have the right to receive a copy of your data in a portable format or to object to or restrict certain uses. To make a request, email support@potatoroad.com. We may need to verify your identity first, and we'll respond within 30 days.

If you're not satisfied with how we've handled your concern, you can complain to the Office of the Privacy Commissioner of Canada or to the data protection authority where you live.

9. How we protect your information

We take reasonable steps to keep your information secure, including:

• encrypting data in transit between your device and our servers with HTTPS (TLS);
• storing data with a cloud provider that encrypts it at rest;
• storing passwords only as salted hashes, never in plain text;
• offering two-factor authentication for your account;
• serving private content only through access-controlled, short-lived links;
• limiting access to personal information to the people and providers who need it to run the Service.

No system is perfectly secure, so we can't guarantee the security of information you share with us. If we learn of a breach that affects your personal information and creates a real risk of significant harm, we'll notify you and the appropriate authorities as required by law.

10. Where information is stored

We're based in Canada, but we and our service providers may store and process your information outside Canada, including in the United States. There, it may be accessible to courts, law enforcement, and national security authorities under local laws. When we transfer information, we use contracts and other measures to keep it protected as described in this policy.

11. Children

potatoroad isn't for children under 13, and we don't knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us and we'll delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll let you know (for example, by email or a notice in the app) before they take effect. The "Last updated" date at the top shows when it last changed.

13. Contact us

Questions, concerns, or requests about your privacy? Contact Kamiyaa Technologies Inc. at support@potatoroad.com.