← tooface

privacy policy & terms of service

privacy policy

last updated: 15 june 2026

this privacy policy explains how punk it ltd ("we", "us", "our") collects, uses, stores and protects your personal data when you use the tooface application ("the app"). we are committed to protecting your privacy and complying with the uk general data protection regulation (uk gdpr) and the data protection act 2018.

1. who we are

data controller: punk it ltd
registered address: 128 city road, london, ec1v 2nx, united kingdom
contact: hello@tooface.app

2. age restriction

tooface is intended for users aged 13 and over. we do not knowingly collect personal data from children under the age of 13. if you believe a child under 13 has provided us with their data, please contact us at hello@tooface.app and we will delete it promptly.

users aged 13-17 should have parental or guardian consent before using the app.

3. data we collect

we collect the following personal data when you use tooface:

  • account information: email address, username, display name, profile avatar
  • authentication data: encrypted password (we never store your password in plain text), session tokens
  • voice recordings ('blurts'): audio clips you record and send, stored in encrypted object storage
  • device data: device push notification token (to deliver notifications to your device)
  • usage data: when blurts are sent, received, and played; friend connections; invite codes used
  • technical data: ip address (collected at login for security purposes only), app version

4. how we use your data

we use your data to:

  • provide and operate the tooface service (sending and receiving blurts between friends)
  • authenticate your identity and maintain your session
  • deliver push notifications when a blurt arrives (including custom alert sounds)
  • apply voice mimic filters to your recordings as you have selected
  • enable the mystery sender feature (temporarily concealing sender identity for 24 hours)
  • facilitate friend connections, username search, and friend suggestions
  • improve and debug the app

our legal basis for processing your data is the performance of a contract (providing the app service to you), and in some cases our legitimate interests in operating and improving the service.

5. voice recordings and audio data

your voice recordings are central to how tooface works. here is how we handle them:

  • blurts are stored in encrypted object storage and are only accessible to the intended recipients
  • audio clips are automatically deleted 30 days after delivery to all recipients
  • if a blurt cannot be delivered, it will be deleted after 30 days
  • voice mimic filter processing (pitch/speed adjustment) is applied at the point of sending; we do not retain unfiltered recordings separately
  • you can delete your own blurts at any time within the app

6. mystery sender feature

when you send a blurt using the mystery sender feature:

  • your identity as the sender is concealed from the recipient for 24 hours
  • after 24 hours, your name and avatar are automatically revealed on that blurt in the recipient's inbox
  • the sender identity data is retained as part of the clip record for as long as the clip exists (up to 30 days after delivery)
  • neither party can access sender identity data before the 24-hour reveal window expires

7. push notifications

with your permission, we send push notifications to your device when you receive a blurt. notifications include:

  • an alert that a blurt has arrived
  • a custom chime sound (one of several pre-bundled sounds matched to the mimic voice used)
  • a 3-second audio preview of the blurt (where technically supported on your device)

for mystery sender blurts, the sender's identity will not appear in the notification — only 'mystery blurt' will be shown.

we use expo's push notification service to deliver notifications. your push token is shared with expo solely for this purpose. you can disable notifications at any time in your device settings.

8. who we share your data with

we do not sell your personal data. we share data only with:

  • expo (push notification delivery service) — push tokens only
  • our hosting provider (for database and storage infrastructure)
  • law enforcement or regulatory authorities if required by law

all third-party service providers are bound by data processing agreements and may not use your data for their own purposes.

9. data retention

we retain your data for the following periods:

  • account data (email, username, profile): retained for as long as your account is active, then deleted within 30 days of account deletion
  • voice recordings (blurts): deleted 30 days after delivery, or immediately upon your request
  • session tokens: deleted on logout or after 30 days of inactivity
  • push tokens: deleted on logout

10. your rights (uk gdpr)

under uk gdpr, you have the right to:

  • access the personal data we hold about you
  • correct inaccurate data
  • delete your data ('right to be forgotten')
  • restrict or object to processing
  • data portability (receive your data in a structured, machine-readable format)
  • withdraw consent at any time (where processing is based on consent)

to exercise any of these rights, contact us at hello@tooface.app. we will respond within 30 days.

you also have the right to lodge a complaint with the information commissioner's office (ico) at ico.org.uk.

11. data security

we implement appropriate technical and organisational measures to protect your data, including encrypted storage, secure https transmission, hashed passwords, and access controls. however, no system is completely secure and we cannot guarantee absolute security.

12. international transfers

your data is stored and processed within the uk/eu. where any data is transferred outside the uk/eea, we ensure appropriate safeguards are in place in accordance with uk gdpr.

13. changes to this policy

we may update this privacy policy from time to time. we will notify you of significant changes via the app or email. continued use of the app after changes constitutes acceptance of the updated policy.

14. contact us

for any privacy-related queries or to exercise your rights:
email: hello@tooface.app
post: punk it ltd, 128 city road, london, ec1v 2nx

terms of service

last updated: 15 june 2026

these terms of service (terms) govern your use of the tooface application operated by punk it ltd. by creating an account or using tooface, you agree to these terms.

1. eligibility

you must be at least 13 years old to use tooface. by creating an account, you confirm that you are 13 or older. if you are between 13 and 17, you should have parental or guardian consent.

we reserve the right to suspend or delete accounts where we have reason to believe the user is under 13.

2. your account

you are responsible for:

  • keeping your password secure and confidential
  • all activity that occurs under your account
  • ensuring your account information (username, email) is accurate

you must notify us immediately at hello@tooface.app if you suspect unauthorised access to your account.

3. acceptable use

you agree not to use tooface to:

  • send content that is abusive, harassing, threatening, hateful, discriminatory, or illegal
  • share content that infringes any third party's intellectual property rights
  • impersonate another person or entity
  • send unsolicited or spam content
  • upload malware, viruses, or any harmful code
  • attempt to gain unauthorised access to our systems or another user's account
  • use the app for any commercial purpose without our prior written consent
  • share, distribute, or upload content involving minors in any inappropriate context

we reserve the right to remove content or suspend accounts that violate these rules, at our sole discretion.

4. voice content and blurts

by sending a blurt through tooface you confirm that:

  • you own or have the right to share the audio content
  • the content does not violate any laws or third party rights
  • you consent to the content being processed (including mimic filter effects applied as you select) and delivered to your chosen recipients

you retain ownership of the voice content you record. by using tooface, you grant us a limited licence to store, process, and deliver your blurts solely for the purpose of operating the service.

5. mystery sender feature

when using the mystery sender feature:

  • you understand that your identity will be concealed from the recipient for 24 hours
  • you agree not to use this feature to harass, intimidate, or cause distress to recipients
  • after 24 hours, your identity will be automatically revealed to the recipient
  • misuse of the mystery sender feature is a violation of these terms

6. push notifications

by granting notification permissions, you consent to receiving push notifications from tooface including custom alert sounds and audio previews of incoming blurts. you can withdraw this consent at any time in your device settings.

7. intellectual property

the tooface name, logo, branding, design, and software are owned by punk it ltd and protected by intellectual property laws. you may not copy, modify, distribute, or create derivative works without our written permission.

8. reporting and blocking

tooface provides in-app tools to block users and report abusive content. we investigate all reports and take appropriate action. if you experience harassment or abuse, please report it immediately using the in-app reporting feature or by contacting hello@tooface.app.

9. disclaimer of warranties

tooface is provided as-is and as-available. we make no warranties, express or implied, regarding the reliability, availability, or fitness for a particular purpose of the app. we do not guarantee that the app will be uninterrupted or error-free.

10. limitation of liability

to the maximum extent permitted by law, punk it ltd shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of tooface. our total liability to you for any claim shall not exceed the amount you have paid us in the 12 months preceding the claim (or £100 if you have not paid us anything).

11. termination

you may delete your account at any time through the app settings. we may suspend or terminate your account if you violate these terms, with or without notice.

on termination, your personal data will be deleted in accordance with our privacy policy. some data may be retained where required by law.

12. governing law

these terms are governed by the laws of england and wales. any disputes shall be subject to the exclusive jurisdiction of the courts of england and wales.

13. changes to these terms

we may update these terms from time to time. we will notify you of material changes via the app or email. continued use after changes constitutes acceptance of the updated terms.

14. contact

for any queries regarding these terms:
email: hello@tooface.app
post: punk it ltd, 128 city road, london, ec1v 2nx, united kingdom

© 2026 punk it ltd. all rights reserved.