The short version. We keep the smallest amount of data that makes the show work: an email, a display name, a birthdate (to check you are 18), who you are and who you are looking for, a zip code and search radius, and the things that happen inside a room - chat, hearts, throws, gifts, and who sat where. Your live video and audio pass through and are not recorded by us. There are two deliberate exceptions, the bench headshot and the end-of-show winner photo, and both are described below. Looks that use Snap Camera Kit process your camera on your own device; we store nothing from them. We do not run ads, we do not sell anything about you, and there are no analytics or tracking SDKs in this app.
This policy describes what the app actually does today. It will change - and when the code changes, this page changes with it.
Your account. Your email address and password are handled by Supabase Auth (our database and authentication provider). We never see your password. If you ask for an invite and are not on the list yet, we keep your email address so we can let you in later.
Your profile. A display name (we start it from the part of your email before the @, and you can change it), your birthdate (used once to confirm you are 18 or over), the photos, bio and details you add to your card, and a note that you accepted these terms. The zip code is used to decide which rooms to show you - we do not ask for or collect precise GPS location.
What happens in a room. While a show is running we store the room itself (its name, tagline, who is hosting, whether it is live), who is in it and in what role (in line, in a chair, kept, watching), presence timestamps so we can tell who is still there, and the events of the show: chat messages, hearts, throws (tomatoes, pies, roses), gifts, reactions, and seat, keep, pass and timeout decisions.
Contact swaps. If you win a show and go backstage, anything you type into the swap box - a handle, phone number, or email - is stored with that swap. It is only ever shown to the other person if you both offer. If only one of you offers, nothing is revealed.
Reports and blocks. When you report someone we store who reported whom, the room, the reason you picked, and an email snapshot of both accounts. Blocks are stored so the person you blocked stays blocked.
What they are used for. One thing: putting you on the show. The app turns on your camera and microphone when you host a show or take a chair. Stepping up to the bench uses the camera once, for the headshot below. While you are watching from the crowd they stay off. Your camera and microphone streams go from your device to Daily.co and out to the other people in the room in real time. We do not record them. There is no recording feature in the app, no archive of shows, and nothing for us to replay later. Daily handles the media in transit; their own privacy practices apply to that leg of the trip.
Two still photos, said plainly. First, when you step up to the bench the app counts down from three and takes a single still frame from your own camera. It is saved on your profile and shown to the crowd as your bench headshot (the host and the chairs see a silhouette instead). It is replaced the next time you step up, and cleared if the capture fails. Second, when someone wins a show, the app counts down from three and takes a single still frame from the winner's own camera; it is saved with the room's events and shown to the room as the closing shot. Both captures happen on your device, with a visible countdown, and both are deleted when the account is deleted. Nothing else about a show is captured.
Looks and face processing. You can put a look on your own video during a show. The simple looks (a colour grade, a frame, a crack) are drawn by the app on your device. Some looks are Snap Camera Kit lenses: when you choose one, Snap's Camera Kit SDK runs on your device, reads your camera frames there to find your face and draw the lens, and hands the result back to the app to put on the show. The face detection happens on your device. Your camera frames are not uploaded to Snap by the SDK and are not sent to us; the SDK downloads the lens from Snap, and Snap may receive technical and usage information from its own SDK under Snap's privacy policy and the Camera Kit terms you accept the first time you use a lens. We store nothing from a lens - no face data, no frames, no measurements - only the name of the look you are wearing, which the whole room can see anyway. Take the look off and the SDK stops.
We are a young app, run by a small team, so the app leans on a few service providers. These are the only third parties involved, and each one only sees what it needs to do its job:
Apart from the Camera Kit SDK described above, the font and CDN requests are the only third-party network calls the app makes that are not strictly ours, and they exist to deliver files, not to profile you. We would also hand over data if a valid legal demand required it, or if we genuinely believed someone was in danger.
Your sign-in session is kept in your browser's local storage so you are not logged out every time you close the app, and a service worker caches the app files so it loads fast and survives a flaky connection. That is it - no advertising cookies, no tracking pixels, no third-party cookies set by us.
Display names, avatars, bench headshots, looks, and room activity are visible to the other people in a room - that is the point of a live show. While a show is live, signed-in people in the lobby can see the host's live video on that show's card before they join. Profile information is readable only by signed-in accounts, never by the anonymous public internet. Your email address is never shown to other players. Contact details are private until a mutual swap reveals them.
Room events stay with the room. Profiles stay until you delete your account. Moderation records are the deliberate exception and are kept as long as we need them (see below).
Open the settings menu in the lobby and choose Delete my account. You will be asked to confirm twice. Deleting removes your profile, any rooms you hosted, your memberships, and your messages and other room events, including the bench headshot and the winner photo if you have one. It is immediate and it cannot be undone.
What survives, on purpose: if you were reported, the moderation record stays, and it keeps an email snapshot of the accounts involved. Without that, a banned account could be erased and re-created in a minute, and the report would mean nothing. If you would rather we handle the deletion for you, email us.
Throw Tomatoes is for people 18 and over. We do not knowingly collect anything from anyone younger. If we learn that a minor made an account, we delete it. If you believe a minor is using the app, report them in the app or email us.
Data is encrypted in transit, access to the database is restricted by row-level rules so signed-in accounts can only reach what they are supposed to reach, and the video service issues short-lived tokens per room. That said: this is a young app built by a very small team, and no system is perfectly secure. Do not put anything in Throw Tomatoes that would hurt you if it leaked.
You can change your display name, zip code, and radius in the app, delete your account at any time from the settings menu, or email us to ask what we hold about you, to get a copy, or to have it corrected or erased. Depending on where you live you may have formal rights along these lines - we will honor them regardless of where you live, and we will not treat you differently for asking.
When the app changes, this page changes. The date at the top tells you when it last did. If we ever start doing something materially different with your data, we will say so in the app before it happens.
Privacy questions, data requests, or anything else:
throwtomatoes.lol.app@gmail.com
Scholls Development LLC, Oregon, USA