Privacy Policy

Last updated: August 6, 2026

1. Information We Collect

When you use PauPau, we collect the following information:

• Account Credentials: PauPau signs you in with a passkey (WebAuthn). We store only the public key of your passkey; the private key and any biometric data never leave your device and are never sent to us.
• Email Address (optional): If you set up account recovery, we store your email address so you can regain access if you lose your devices. It is used only for recovery and never as a sign-in method or for marketing.
• Profile Information: Your display name, username, birth date, and profile photo, if you choose to set them.
• Content: Videos you upload. A video is shared only with the members of the room you post it to, for 24 hours, after which it is moved to a private archive that only you can access.
• Push Notification Token: If you enable notifications, we store a messaging token (Firebase Cloud Messaging) so we can alert you about new videos and room activity.
• Room Information: The name of a room you create and its invite code.
• Diagnostic Data: We collect crash and error reports (Firebase Crashlytics) to keep the app stable.
• Upload Metrics: We record measurements of your video uploads — duration, success or failure, and retry counts — together with your user ID, so we can investigate upload problems and improve the service.

2. How We Use Your Information

• To provide and maintain the service
• To display your profile and share your content with the members of the rooms you post to
• To send push notifications you have opted into
• To send account recovery emails when you request them
• To diagnose crashes and improve the app experience
• To measure upload quality and improve the service

3. Rooms and Visibility

PauPau is organized into private rooms. A video you upload is visible only to the members of the room you post it to — not to the public or to all users. You join a room with an invite code shared by a member, and a room holds up to 12 people.

4. Data Storage and Security

Your account data is stored securely using Firebase (Google Cloud), and profile photos are stored in Firebase Storage. Videos are processed and delivered through Cloudflare Stream. 24 hours after upload, videos are moved to private storage (Cloudflare R2) accessible only to you. Account recovery emails are sent via Resend.

5. Data Sharing

We do not sell your personal information. We share data only with the following service providers to operate the app:

• Firebase (Google): Authentication, database, profile photo storage, push notifications, and crash reporting
• Cloudflare: Video processing, delivery, and archive storage
• Resend: Sending account recovery emails

6. Your Rights

You can:

• View and edit your profile information at any time
• Delete your account from the Settings page. This removes your profile, your videos (the stored video files included), your passkeys, your username, your recovery email address, your push notification tokens and your room memberships. It cannot be undone
• Request a copy of your data by contacting us

7. Data Retention

• Videos: Visible to room members for 24 hours, then kept in your private archive until you delete them. Deleting a video deletes the stored file as well, usually within minutes
• Account data: Retained until you delete your account. Diagnostic reports (Crashlytics) are not tied to your profile and are retained by that service for up to 90 days

8. Children's Privacy

PauPau is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page.

10. Contact Us

If you have questions about this Privacy Policy, please contact us at last.pass.oda@gmail.com. See also our support page.