Privacy Policy

1. Who we are

Beach is operated by Block 19 LLP ("Beach", "we", "us", "our"), a limited liability partnership registered in Singapore. This Privacy Policy explains how we collect, use, share, and protect personal data when you use the Beach mobile app and related services (the "Service").

2. When this policy applies

This policy applies whenever you use Beach — the iOS or Android app, the website at beachapp.co, and any other product we say it covers. Because Beach is only for people aged 18 and over, this policy assumes you are an adult.

3. Information we collect

3.1 Information you give us

When you create an account and set up your profile we collect:

• Authentication details — we sign you in using Sign in with Apple or Sign in with Google. We receive a unique identifier from the provider and, in some cases, an email address.
• Account recovery token — when you set up account recovery, we generate a one-time token tied to your account so you can restore access if you lose your sign-in provider (for example, if you uninstall the app and lose your Apple or Google session). The token is hashed before it is stored and is consumed on first use.
• Profile details — a username, a display name, your date of birth, your gender (male, female, or non-binary), your country, the languages you speak, your interests, and what you're looking for on Beach (for example, friendship, language exchange, or dating).
• Your avatar — an emoji you pick from a curated set.

We use your date of birth to confirm you are 18 or older. We do not publicly display it.

3.2 Content you create on Beach

When you use Beach you create and share content: posts (text, photos, GIFs), comments on posts, direct messages (text, photos, GIFs, voice messages), and messages you send in chat rooms (text only — chat rooms do not support photos, GIFs, or voice). We store this content on our servers so we can show it to the people you intend to reach.

• Photos are stored in secure cloud storage, capped at 5 MB each.
• Automated photo moderation. Every photo you upload is automatically scanned for content that violates our Community Guidelines (for example, nudity, sexual content, graphic violence, or other prohibited material). The scan runs in two places:
  • On our servers using Google Cloud Vision, which classifies the image and returns a safety verdict.
  • On iOS 17 and later, also on your device before the upload starts, using Apple's on-device SensitiveContentAnalysis framework. This client-side check happens entirely on your phone — Apple does not see the image, and we do not see the image until the upload begins.
  When a photo is rejected by either check, we log the rejection event (image hash, the rule that was triggered, and your user ID) so we can detect repeated abuse and take action on accounts that try to bypass moderation.
• Photos and voice messages in 1:1 chats are view-once. Once the recipient opens them, a Cloud Function deletes the file from our servers and clears the media URL on both sides of the chat, so the media no longer exists on Beach.
• If you use the Report feature to flag a post, message, or user, we keep a record of your report so our moderation team can review it. Once a post or comment receives 3 reports, it is automatically hidden from every user while the review is pending — severe violations may be taken down at the first report. The reporter sees the content hidden immediately, regardless of the threshold. Moderation decisions (rejections from automated scanning and outcomes of human review) are logged for the same anti-abuse purposes.

3.3 Official messages from Beach

Beach itself may send you messages through two clearly-labeled official accounts:

• Beach - Sandy 🌊 — friendly broadcasts (product news, announcements). You can turn these off in Settings → Notifications.
• Beach Trust & Safety ⚖️ — account-specific notices, including moderation warnings if you've broken our Community Guidelines. These are part of safe operation of the Service and are not subject to the announcements toggle.

Both appear as conversations in your inbox and are read-only — you can't reply, mute, or delete them. Translation, where applicable, is performed at send time by our service providers based on the language preference stored on your profile.

3.4 Location data

Beach has an optional Nearby feature that shows other users roughly within 100 miles of you. To make this work we need your approximate location. With your permission, we collect:

• Your current latitude and longitude, captured when you open the Nearby tab or the app. We do not track your location in the background.
• The timestamp of when your location was updated.

You can decline location access or revoke it at any time in your device settings. If you decline, the Nearby feature will not work, but the rest of Beach will. Other users see your approximate distance from them, never your exact coordinates.

3.5 Device and usage data

We collect limited information about your device and how you use Beach so we can keep the Service running, find bugs, and understand what works.

• Device information — device model, operating system version, app version, screen size, language, and time zone.
• Usage events — which screens you open, which features you use, session timestamps, and crash reports.
• Push notification tokens — a token issued by Apple (APNs) or Google (FCM) so we can deliver the notifications you've opted into. The text of each notification is rendered in your device's current system language; we do not store a server-side language preference.
• Mobile attribution identifiers. So we can measure which marketing campaigns brought a new user to Beach, our attribution partner AppsFlyer reads:
  • iOS: Apple's IDFV (a per-vendor identifier that resets when you uninstall Beach). We do not request the App Tracking Transparency prompt or read Apple's IDFA.
  • Android: Google's Advertising ID (GAID), which you can reset or delete from your device's system settings (Settings → Google → Ads).
  AppsFlyer also receives app install + open events and basic in-app milestones (sign-in, registration, purchase amount + currency). We do not use these identifiers to track you across other apps or websites.

3.6 Communications with us

If you contact us by email at hi@beachapp.co or through an in-app report, we keep a record of your message and our reply so we can help you and improve our Service.

4. How we use your information

We use personal data to:

• Create and run your account, keep you signed in, and help you recover access if you need it.
• Show you the parts of Beach that should be visible to you (your feed, your chats, Nearby) and show other people the content you intended to share.
• Enforce our rule that Beach is for people aged 18 and over.
• Maintain your in-app Beach credits balance.
• Send you push notifications for events you've chosen to be notified about.
• Investigate abuse, harassment, fraud, or attempts to violate our Terms or Community Guidelines, and take action on reports we receive.
• Fix bugs, measure performance, and improve Beach over time.
• Comply with our legal obligations and respond to lawful requests.

We do not use your personal data to show you advertisements, and we do not sell your personal data.

5. Who we share with

We share personal data only as described below.

5.1 Service providers

Beach is built on top of several trusted providers. Each receives only the data it needs to do its job and is contractually required to protect that data.

• Google Firebase — authentication, database (Firestore), realtime presence, file storage, cloud functions, and push notification infrastructure. Data here is stored in Google Cloud's us-central1 region (Iowa, USA).
• Amplitude — product analytics. Amplitude receives usage events and basic device information. Amplitude does not receive your messages or your photos.
• Apple and Google — authentication and push notification delivery (APNs, FCM).
• Google Gemini — used server-side to translate official messages from Beach (Sandy broadcasts, Trust & Safety notices) into the language preference stored on your profile, so you can read them in your own language. Gemini processes the source text on our behalf.
• Klipy — provides GIF search results when you send a GIF.
• AppsFlyer — mobile attribution. Receives device-level identifiers (Apple's IDFV on iOS, Google's Advertising ID on Android), app install + open events, and in-app milestones (sign-in, registration, purchase amount + currency) so we can measure marketing campaign effectiveness. AppsFlyer does not receive your messages, photos, or chat content.

5.2 Other users of Beach

Content and profile information you make available on Beach is, by design, shown to other users. This includes:

• Your public profile (username, display name, avatar, gender, country, languages, interests).
• Posts, comments, and public chat room messages you create.
• Your approximate distance from a viewer (if you've enabled Nearby) — never your exact coordinates.
• Whether you are currently online and when you were last active.

Direct messages are shown only to the participants of the conversation.

5.3 Legal and safety

We may share personal data when we believe in good faith that disclosure is necessary to:

• Comply with a lawful request (subpoena, court order, or similar legal process).
• Investigate, prevent, or take action against suspected fraud, abuse, or violations of our Terms or Community Guidelines.
• Protect the safety, rights, or property of any person, including reporting suspected crimes to the appropriate authorities.

5.4 Business transfers

If Block 19 LLP is involved in a merger, acquisition, reorganisation, or sale of assets, personal data may be transferred as part of that transaction. Your data will remain protected by terms at least as strong as this policy.

6. International data transfers

Beach's servers are hosted by Google Cloud Platform in the United States (us-central1, Iowa). If you use Beach from outside the United States, your personal data will be transferred to and processed in the United States. By using Beach you consent to this transfer for the purposes described in this policy. Where required by law (for example, for users in the EEA, UK, or other jurisdictions that restrict cross-border transfers), we rely on appropriate safeguards such as Google Cloud's Standard Contractual Clauses.

7. How long we keep information

• Your account and profile — for as long as your account is active. When you delete your account, we hard-delete your profile, your posts, your direct messages, and your uploaded files. Messages you sent in public chat rooms are kept but stamped as "from a deleted user" so conversations remain readable.
• Voice messages — deleted from our servers as soon as the recipient first listens.
• Reports — retained for a reasonable period so we can investigate patterns of abuse, even after a reported account is closed.
• Backups and anti-abuse records — operational backups are kept for up to 90 days. Anti-abuse data may be retained longer where necessary to protect the community.
• Purchase records — retained for as long as required for tax, accounting, and audit purposes.

8. Your rights and choices

Depending on where you live, you have rights over your personal data. We honour these rights for every Beach user regardless of location unless a legal exception applies.

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data. Most profile fields can be edited directly in the app.
• Deletion — ask us to delete your account and personal data. You can also trigger this yourself from the app's settings.
• Portability — ask for your personal data in a structured, commonly used format.
• Object or withdraw consent — object to certain uses of your data or withdraw consent where processing is based on it. Withdrawing consent does not affect the lawfulness of processing before your withdrawal.
• Lodge a complaint — you can contact the data protection authority in your country. In Singapore that is the Personal Data Protection Commission.

To exercise any of these rights, email us at hi@beachapp.co. We will respond within 30 days.

9. Security

We use commercially reasonable measures to protect your personal data — encryption in transit (TLS) and at rest, access controls on our infrastructure, and regular review of our security practices. No system is perfectly secure; if we become aware of a data breach that affects your personal data, we will notify you and the relevant authorities as required by law.

10. Children's data

Beach is an 18+ service. We do not knowingly collect personal data from anyone under 18. If we learn that someone under 18 has created an account, we will suspend the account, delete the associated data, and block the user from re-registering until they reach the age of majority. If you believe a child has provided us with personal data, please contact us at hi@beachapp.co.

11. Third-party links

Beach may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. Please read their privacy policies before providing them with personal information.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by other reasonable means before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

13. How to contact us

If you have questions about this Privacy Policy or how Beach handles your personal data, email us at hi@beachapp.co.

Block 19 LLP