Effective Date: 2026-05-19 · App: Diffr (iOS) — published by Truake · Contact:diffr@truake.com
This is a plain-English summary of what Diffr collects, why, and what we don't.
1. What we collect
From you, intentionally
Apple Sign In: your Apple ID identifier and (only if you provide them on first sign-in) display name + email. These are stored in iOS Keychain and our database.
PSY-Match answers: your responses to the 4-question onboarding (psychological alignment survey). Stored to compute brand recommendations.
Tier lists / ratings / comments / follows / saves: everything you create. Tier lists default to "public" but you can mark as Followers-only or Private at any time.
App analytics: which screens you visit, button taps, session duration. We use Supabase Logs (no third-party SDK like Mixpanel, Amplitude, or Firebase Analytics).
IP address: collected by our hosting provider (Supabase) for rate-limiting and security only. Not used for ads.
What we DO NOT collect
Your contacts
Your location (we don't use CoreLocation)
Your camera or photos (unless you actively upload a brand logo via the feedback flow)
Your microphone
Your health data
Your browsing history outside Diffr
IDFA (advertising identifier) — we don't use it, no ATTrackingManager prompt
You: anything you mark private (Private tier list, deleted comments).
Other Diffr users: anything you mark public (tier lists visibility=public, comments, your follower/following list).
Truake (the developer, that's me): aggregate analytics only. I don't look at individual user data unless you submit a support request and ask me to.
Supabase (our database/auth provider): stores everything per their privacy policy at https://supabase.com/privacy.
No advertisers: we sell zero data. Period.
No analytics third parties: no Google Analytics, no Facebook Pixel, no Mixpanel.
4. AI-assisted brand scoring
Diffr uses third-party AI APIs (currently DeepSeek and optionally Google Gemini) to compute brand psychology scores. These calls happen server-side (Supabase Edge Functions). Your personal data is never sent to AI providers — only brand names and public brand descriptions. The PSY-Match similarity computation happens entirely within our database (pgvector); no user vector ever leaves our servers.
5. Your rights
Access: email diffr@truake.com to receive a JSON export of all your data
Deletion: in-app go to Profile → Settings → Delete Account (this immediately removes your data; per Apple Guideline 5.1.1(v))
Correction: edit anything in-app, or email us
Opt-out: no opt-in required because we don't track for ads — but you can sign out at any time
GDPR / CCPA: residents of EU / California have additional rights. Email diffr@truake.com to exercise them; we respond within 30 days
6. Children
Diffr is not directed at children under 13. We don't knowingly collect data from anyone under 13. If you believe we have such data, email diffr@truake.com and we'll delete it immediately.
7. Cookies / tracking technologies
The Diffr iOS app does not use cookies. Our website (diffr.truake.com) uses Cloudflare's necessary cookies for routing only. No tracking cookies.
8. Data retention
Account data: until you delete the account
Public tier lists / comments: until you delete them, or your account is deleted
Logs: 30 days (Supabase default), then auto-purged
Backups: 7 days (Supabase Pro daily backups)
9. Security
All connections use HTTPS / TLS 1.3
Database uses PostgreSQL Row-Level Security (RLS) — even if our service key were leaked, your private data is still protected by your own auth.uid()
Passwords: we use Apple Sign In (no password stored)
Sensitive fields encrypted at rest by Supabase
Daily automated backups (Supabase Pro)
10. Changes to this policy
We'll update this page if we change anything material. The "Effective Date" at top will change. For substantial changes affecting your data, we'll email you (using the email on file).