Privacy policy
Last updated
guffgaff is a local, no-names app for Nepal, run by Alma Data (almadata.io). This page explains what the app collects, why, who can see it, how long we keep it and how to delete it.
In this policy, “we” means Alma Data.
The short version
- We don’t store your email address. We keep a one-way, keyed fingerprint of it so we can recognise you when you log in.
- Your real name and hometown are kept in a separate database. They are never shown to anyone, and no part of the app or our server reads them back.
- We use your location to show you guffs within 5 km. Each guff or repost you make is stored with a rounded location, accurate to about 100 metres. We never log your location.
- Other people see your username and avatar, never your name, email or exact location.
- No ads, no analytics, and we don’t sell your data.
- You can delete your account at any time in Settings.
What we collect and why
Your email address
You log in with your email address. We use it for one thing: to email you a 6-digit login code from no-reply@almadata.io.
We never store the address. We store a keyed hash of it (HMAC-SHA256 with a secret key), made from the address in lowercase. The hash lets us recognise the same address next time, but it can’t be turned back into your address. Our server holds the address in memory only while it sends the code, and never writes it to its logs.
Because we don’t keep your address, we can’t email you about anything else. No newsletters, no marketing.
The login code is also stored only as a keyed hash. It expires after 10 minutes, and the login attempt is deleted after about a day.
Your real name and hometown
We ask for your real name and hometown once, when you sign up, to keep guffgaff for real people. They are stored in a separate database, apart from your account and your guffs, and backed up separately with separate keys.
No screen in the app and no part of our server reads them back. They are written once at signup and deleted when you delete your account. They are never shown to anyone, not even you.
Your username and avatar
Your username and avatar appear on your guffs and comments. You can change them in the app, and your past guffs then show the new ones.
Your location
guffgaff asks for your location while you use the app. When the app loads the feed or a guff, or when you post, comment, repost, vote or report, it sends your phone’s current coordinates to our server. We use them to:
- show you only guffs from within 5 km;
- check that you are in Nepal, because guffgaff works only there;
- name your area in the feed, for example “Patan”;
- catch faked locations, such as a jump between two places faster than about 300 km/h.
What we keep:
- When you post a guff or repost something, we store its location rounded to 3 decimal places, which is accurate to about 100 metres. We never store the exact spot you posted from. Comments store no location.
- To catch faked locations, our server keeps the last location you sent in its memory only. It is never written to disk, and it is forgotten after 12 hours without a newer one, or when the server restarts.
- We never log your location. Apart from the rounded location of your own guffs and reposts, we keep no record of where you have been.
Other people never see coordinates. The app can show them how far away a guff is, rounded to whole kilometres.
You can turn off location access in your phone’s settings, but guffgaff can’t show you the feed without it.
What you post and do
- Guffs, comments and reposts, with the time, the language we detect (English or Nepali), and their votes, replies and reposts. They stay until you or a moderator delete them.
- Votes: which guffs and comments you voted on, and how. Other people see only the totals, never who voted.
- Reports and blocks: what you reported and why, and who you blocked. The people involved aren’t told.
- Masala points and streaks: your points, the history of what earned or cost them, your current streak, and the last day you used the app.
- Activity: replies, upvotes, reposts and other updates about your guffs, shown in your Activity tab.
Logins and devices
When you log in, we create a session for that phone. The app keeps the session token in your phone’s secure storage. Our server keeps only a hash of the token, a device label (“iPhone” or “Android”), when the session started, roughly when it was last used, and when it expires. A session ends when you log out, or 180 days after you last used it.
On your phone, the app also remembers whether you chose light or dark mode.
Notifications
If you allow notifications, the app gives our server a push token for your phone and the language you want notifications in. We send notifications about replies, reposts, guffs that go Hot and new logins to your account through Firebase Cloud Messaging, a Google service, which on iPhone delivers them through Apple. A notification can include the replier’s username and the first words of their reply. The token is deleted when you log out.
Checking that requests come from the real app
To keep out bots and fake copies of the app, every request from the app carries a token from Firebase App Check, a Google service that confirms the request comes from the genuine guffgaff app. Our server checks the token and doesn’t store it.
Technical data
Our server uses your IP address, in memory only, to limit how many requests can be made in a short time. It doesn’t store or log IP addresses. Its logs record the kind of request, whether it worked and how long it took. They never include your email address, location, login code, name or anything you post. Our web server keeps no access log.
The app contains no advertising or analytics code.
Who can see what
- People within 5 km
- Your guffs and comments, with your username, avatar, the time and the score. A comment can be seen by anyone who can see the guff it is under. If someone reposts your guff, people within 5 km of them can see it too.
- You
- Your own guffs and comments from anywhere, your masala points, your streak and your activity.
- Moderators
- Reported guffs and comments, with their author’s username and the reasons given.
- No one
- Your real name and hometown, and the exact location of anything you post. We don’t have your email address to show.
Who else handles your data
- Our server host. Our server and its databases run on a cloud server we rent, which may be outside Nepal.
- Cloudflare R2. Backups of our databases are copied continuously to Cloudflare’s storage. Real names and hometowns are backed up to a separate store with separate keys.
- Our email host. Login codes are sent from the
no-reply@almadata.iomailbox at our web hosting provider. Like any email, the message passes through their mail server and your email provider’s. - Google Firebase, for App Check and, if you allow them, notifications.
- Apple and Google run the app stores and your phone’s operating system, including its location and notification services. Their own privacy policies apply to those.
We don’t sell your data or share it with advertisers. We may disclose data if Nepali law requires it.
How long we keep it
- Login codes: they expire after 10 minutes, and the login attempt is deleted after about a day.
- Sessions: until you log out, or 180 days after you last used the app on that phone.
- Guffs, comments, votes and points: until you delete them or your account. Nothing expires on its own.
- Your last location, in memory: up to 12 hours.
- Retry records: when you post, comment or repost, the server keeps its reply for about a day, so a retried request isn’t posted twice.
- Backups: deleted data can remain in our backups for a limited time before it is replaced.
Deleting your data
A guff or comment
Delete it from its menu. Its text is erased and it disappears for everyone. An empty placeholder, with its time and, for a guff, its rounded location, stays so that replies keep their place in the thread.
Your account
Go to Settings, then Delete account. This can’t be undone. We then:
- delete your real name and hometown;
- log you out on every device;
- erase the text of every guff and comment you wrote, and remove your reposts;
- delete the fingerprint of your email address, so the address can sign up again as a new account.
What stays, linked to an account that no longer has an email, name or hometown: your username, which stays reserved so no one else can take it; your votes, which still count in other people’s totals; the empty placeholders of your guffs and comments; and your reports, blocks and points history.
Security
Session tokens, login codes and email fingerprints are stored only as hashes. Real names and hometowns live in a separate database that no part of our server reads. No system is perfectly secure, so we keep only what the app needs.
Changes
If we change how guffgaff handles your data, we’ll update this page and the date at the top.
Contact
For questions about your data or this policy, email support@almadata.io, or use Contact us in the app’s Settings.