Privacy Policy

Last updated: 11 November 2026

This policy explains what personal information Nakupu collects, why, and your rights under the Philippine Data Privacy Act of 2012 (RA 10173). Nakupu is operated by NAKUPU SOFTWARE PUBLISHING SERVICE ("we", "us"), the personal information controller. Contact: support@nakupu.com.

What we collect

You give us:

• Account details: email address, password (stored only as a one-way hash), date of birth (to confirm you're 18+), and your agreement to our terms.
• Profile: username, bio, and an optional profile picture. These are public.
• Content: battle roasts, votes, Roast Me posts, comments, reactions, and Tambayan messages. These are public. We automatically hide phone numbers and email addresses we detect in them. If you post anonymously, other users don't see your username, but we still store who wrote it, and our moderators can see it.
• Room activity: your joined and favorite rooms and your last-read position, so the app can show unread messages.
• Follows: the accounts you follow and those following you. Follower and following counts are visible on profiles.
• Safety actions: reports you make and people you block.
• Shares: that you shared an arena, post or room (not who you shared it with or which app you used). Each account counts once per item; arena shares can count toward a topic's popularity.
• Sign-in with Apple, Google or Facebook (optional): the account ID and email address that service shares with us. We don't get your password for those services.

Collected automatically:

• Device push token, if you allow notifications, so we can alert you about battles and replies.
• Usage events (for example "battle completed," "vote cast"), linked to your account ID only, to understand how the App is used. We never include your email, username or messages in them.
• Crash and error reports, linked to your account ID only.
• Server logs: IP address, device and app version, kept for security and troubleshooting.

We don't collect your contacts, location, photo library, or microphone. We only receive a photo you choose to upload as a profile picture. We don't sell your personal information.

Ads

Nakupu shows ads from Google AdMob in the Roast Me feed, marked "Sponsored". To show ads, limit how often you see them and count clicks, Google's ad software in the app collects device information such as your device's advertising ID, IP address and how you interact with the ads. We don't give Google your email, username, date of birth or anything you post.

• iPhone: we don't ask to track you across other apps, so ads aren't based on your activity elsewhere.
• Android: you can reset or delete your advertising ID in your phone's settings (Settings → Privacy → Ads, or Settings → Google → Ads).
• Europe, the UK and some US states: Google asks for your consent first. You can change it any time in Profile → Ad privacy choices.

How Google uses this information: policies.google.com/technologies/partner-sites.

Why we use it

• To run your account and the App (lawful basis: performing our contract with you).
• To keep the community safe: moderation, preventing abuse, multiple accounts and cheating (legitimate interest, and legal obligations).
• To send you emails you need (verification codes, password resets) and notifications you turned on.
• To fix bugs and improve the App (legitimate interest).
• To comply with the law and respond to lawful requests from authorities.

Who we share it with

• The public: your username, bio, profile picture, battle record, and the content you post are visible to other users and on public share pages.
• Service providers who process data for us under contract: Google Cloud (hosting and profile-picture safety screening), Cloudflare (profile-picture storage), Neon (database, Singapore), Upstash (cache, Singapore), Resend (email), Sentry (error reports), PostHog (usage analytics), Expo (push notification delivery), and Google AdMob (ads, see above). Some of these may process data outside the Philippines; we use providers that commit to protecting it.
• Apple, Google or Meta, only to verify your sign-in if you use it.
• Authorities, when the law requires it, or to protect someone's safety.

How long we keep it

• Your account: until you delete it. Deletion takes effect right away (your profile and content are hidden); if you don't sign in again within 30 days, we permanently erase your email, password, date of birth, profile, sign-in links, and the text of your messages, roasts, posts and comments.
• Reports and moderation records: copies of reported content and moderation decisions are kept as long as needed for safety reviews and legal claims, even after an account is deleted.
• Profile pictures: when replaced or removed, a picture is hidden immediately. Stored copies are removed when your account is permanently erased, except pictures retained as report evidence.
• Battle results and votes stay in battle history, attributed to "deleted user."
• Post and room share records are removed when your account is permanently erased.
• Server logs: up to 90 days. Error reports and usage events: up to 1 year.

Your rights

Under the Data Privacy Act, you have the right to be informed, to access, to correct, to object, to erasure or blocking, to data portability, and to file a complaint. You can:

• edit your username and bio in Profile → Edit profile;
• delete your account in Profile → Delete account (or ask us at support@nakupu.com; see deleting your account);
• email support@nakupu.com for a copy of your data or any other request. We'll respond within 30 days.

If you're not satisfied with our response, you can complain to the National Privacy Commission (privacy.gov.ph).

Security

Passwords are hashed with argon2id, connections use HTTPS, and access to data is limited to what's needed to run and moderate the App. No system is perfectly secure; if a breach affects you, we'll notify you and the National Privacy Commission as the law requires.

Age

Nakupu is only for people 18 and older. If we learn that a minor has an account, we'll delete it.

Changes

We'll post updates here and tell you in the App about significant changes.

Contact

NAKUPU SOFTWARE PUBLISHING SERVICE, 9208 Mulawin Street, Acacia, Pinagbuhatan. Email: support@nakupu.com.