[Privacy Policy] This policy applies to SEORO, a profile-free global anonymous social app provided by OrbickK. Its effective and last-updated date is 2026-09-12.

[App identification and eligibility] The app name is SEORO and its Android package name is com.orbickk.seoro. SEORO is intended for people aged 18 or older and is not directed to anyone under 18.

[Account and authentication] On first use, Firebase Authentication creates an anonymous account and authentication identifier. SEORO links that identifier to a random internal account identifier to maintain sessions, settings, block lists, and Signal state. Internal account identifiers and Firebase UIDs are not disclosed to other users.

[Optional Google account protection] If a user chooses account protection, a Google credential is linked to the current anonymous Firebase account. Google and Firebase Authentication may process the Google account identifier, authentication information, and provider-returned email, name, or photo. SEORO does not turn these details into a public profile, disclose them to other users, or unnecessarily copy the email, name, or photo into the service database. The anonymous account can be used without linking Google.

[Recovery code] If a user creates a recovery code, the server separately generates a recovery ID and a secret with sufficient entropy. The plaintext secret is shown only once and is not stored by the server. The server retains only a verifier derived with a salt and versioned pepper, issuance, revocation and use status, and minimum records required to limit recovery attempts. A successful recovery or reissue immediately invalidates the previous code.

[Private settings] App language, translation language, display mode, a user-selected country code, gender, sought gender, interests, and consent to conditional matching are used for onboarding and matching. The country code is a user-selected matching setting, not GPS-derived precise location. These settings are not shown to a match or included in public responses. SEORO does not request contacts or precise-location permission.

[Public World content] World posts, comments, one-level replies, selected reactions, original-language labels, and uploaded images may be visible to other users. SEORO does not create a public profile based on a nickname, photo, or followers, but information a user writes in a post becomes public content. Other users may see or separately retain content before it expires or is deleted, so users should not post direct contact details or identifying information.

[Image processing] If a user chooses to upload a post image, the app re-encodes it on the device as JPEG at no more than 1280px and removes EXIF and GPS metadata and the original filename before sending it with a checksum. The finalized image and a 320px thumbnail are stored in Cloudflare R2 for delivery, integrity checks, and deletion processing. Image upload is optional.

[Random and comment conversations] A random one-to-one conversation normally runs for 30 minutes and a conversation started from a comment normally runs for 24 hours. Ordinary temporary messages are processed as needed in server memory for room operation and reconnection, with replay data covering up to 10 minutes. Only when both participants consent to Keep are messages after that consent point stored on the server for up to 7 days; earlier messages are not uploaded retroactively. SEORO does not describe ordinary chat as end-to-end encrypted.

[On-device chat and translation] A limited local chat cache is encrypted in app-specific storage with an Android Keystore-backed key and AES-256-GCM and is removed in line with room expiry. Android app backup is disabled. Language identification and translation use Google ML Kit models on the device, and required translation models may be downloaded from Google. The ML Kit SDK may process app, device, and installation information for diagnostics and usage analytics.

[Reports, blocks, and safety] When a user submits a report, the target type, reason, report time, and necessary evidence such as up to 30 chat messages selected by the reporter may be stored for safety operations. Block relationships are stored to hide content and prevent future connections. Minimum safety signals derived from content and account activity may be used for automated limits, risk assessment, and prevention of duplicate or abusive requests.

[Signal activity records] SEORO stores balances, ledger entries, reservations, settlements, daily and weekly progress, and duplicate-grant prevention records for Signal earned through activities or purchased. Conversation rewards use room duration, message counts, language codes, and safety outcomes; reward metrics do not contain message bodies.

[Purchases and subscriptions] Google Play and RevenueCat provide one-time Signal products and the auto-renewing monthly SEORO Plus subscription. An opaque app user ID, product and transaction identifiers, purchase time and status, subscription expiry and cancellation status, and purchase history are processed to verify purchases, restoration, renewals, and refunds. Google Play handles the payment method; OrbickK does not receive full card numbers. The app does not set email, name, or photo as RevenueCat customer attributes. Free features remain available without a purchase.

[Advertising and privacy choices] Google Mobile Ads provides World native ads and user-initiated rewarded ads. Google UMP checks consent status and requests privacy choices where required. Google and advertising partners may process approximate location inferred from IP addresses, app and ad interactions, device and advertising identifiers, and diagnostics for ad delivery, measurement, analytics, and fraud prevention. Where required, users can revisit ad privacy choices in Settings and manage advertising IDs in Android settings. Reward verification uses an expiring opaque reward-request identifier.

[Push and in-app notifications] Firebase Cloud Messaging delivers push notifications. When notifications are allowed, FCM registration tokens, related device or installation information, notification types, and opaque navigation references are processed. Limited comment or message text may be included when previews are enabled. Users can manage notifications and previews in the app and Android settings. Opening the relevant screen marks completed notifications as read.

[Purchase records and provider deletion] Account deletion includes the service's RevenueCat customer mapping, transaction and entitlement data, and retryable deletion of the RevenueCat customer. Provider-held records, such as Google Play orders retained for the provider's obligations, follow that provider's retention and deletion practices. Uninstalling the app or deleting a SEORO account does not cancel a Google Play auto-renewing subscription; users must cancel it separately in Google Play subscription management.

[Technical data processed automatically] Request times, app and platform versions, session, device or installation identifiers, public opaque references, error codes, and network information may be processed for connectivity, authentication, security, idempotency, incident handling, and abuse prevention. Cloudflare processes IP addresses and HTTP security information when providing the network service. Recovery rate limits use keyed hashes of IP and device identifiers instead of plaintext values. The system is designed not to place recovery secrets, OAuth tokens, Firebase tokens, or message bodies in application logs.

[Purposes] Information is used for anonymous accounts and account protection, World and conversations, private matching, on-device translation, Signal rewards, purchases and use, subscription entitlements, restoration and refunds, advertising and measurement, notifications, reports and blocking, deletion, security and fraud prevention, incident response, and legal obligations.

[Service providers and international processing] Google LLC provides Firebase Authentication and Google Sign-In for authentication, Firebase Cloud Messaging for push, ML Kit for on-device language features, Google Mobile Ads and UMP for advertising and consent, and Google Play for payments. RevenueCat, Inc. processes an opaque app user ID and purchase and subscription information for verification, entitlement management, restoration, refunds, and purchase analytics. Cloudflare, Inc. provides Workers, D1, R2, and Durable Objects for the API, database, images, real-time connections, and security. Information may be processed in the United States and other countries where these providers operate facilities. Google: https://policies.google.com/privacy / Firebase: https://firebase.google.com/support/privacy / ML Kit: https://developers.google.com/ml-kit/android-data-disclosure / Google Mobile Ads: https://developers.google.com/admob/android/privacy/play-data-disclosure / RevenueCat: https://www.revenuecat.com/privacy/ / Cloudflare: https://www.cloudflare.com/privacypolicy/

[Sharing and analytics] SEORO does not sell personal information. Service providers process information for the purposes described here; content deliberately published or sent by a user is delivered to other users. Advertising-related sharing follows Google and advertising-partner policies and the user's privacy choices. Separate Firebase Analytics and Crashlytics integrations are not enabled, but advertising measurement and diagnostics, ML Kit usage and diagnostics, and RevenueCat purchase analytics may be processed.

[Retention] World posts, comments, and images normally expire within 7 days of creation. Ordinary random and comment chats are processed within the 30-minute or 24-hour room lifetime and the replay window of up to 10 minutes; messages stored after mutual Keep consent are retained for up to 7 days. Selected report evidence is normally retained for 30 days, but may be kept longer for an open report, legal obligation, or legal hold. Account settings, authentication links, block lists, and Signal state remain while the account is active. Minimum hashed security and anti-abuse records, deletion tombstones, and deletion receipts may be retained only to the extent needed for those purposes and legal obligations, without plaintext authentication identifiers or message bodies.

[Deletion and account closure] A user may request account deletion in Settings > Account. The account becomes unavailable immediately, and Firebase authentication plus internal authentication links, settings, recovery credentials, device information, block lists, private chat and Signal data, and user content are deleted through a retryable asynchronous process. Open report evidence, a legal hold, and minimum records needed to prevent abuse may be excluded from ordinary deletion. If the app is unavailable, a user may request deletion at [email protected]; minimum information may be requested to verify account ownership.

[Security] Data in transit is encrypted with HTTPS or WSS, and internal user identifiers are excluded from public API responses. SEORO applies image metadata removal, opaque public references, server-side authorization, rate limits, persistent idempotency, retryable asynchronous deletion, and encrypted on-device storage. No internet service can guarantee absolute security.

[User choices and rights] Users may decline Google linking and image upload, turn off private matching criteria, and use report, block, and unblock controls. They may delete content and their account in the app or contact the email below about applicable access, correction, deletion, or restriction rights. Account-ownership verification may be required before fulfilling a request.

[Policy changes] If collection, retention, accounts, chat, advertising, analytics, payments, or service providers change, this policy and Google Play Data safety information will be updated. Material changes will be announced in the app or on the website.

[Contact] Developer and data controller: OrbickK, Privacy and account deletion contact: [email protected]