Privacy Policy

1. Who we are

Tambay is operated by Acqron (we, us). We decide why and how your personal information is used in tambay, which makes us the controller of it (in the Philippines, the personal information controller). This policy explains what we collect, why, who sees it, and your choices. It applies to tambay's website and apps.

2. What we collect

Only what the service needs to work:

• Account: your email address and password. Your password is handled by our authentication provider and stored only as a secure hash; we never see or store it in readable form.
• Profile: your display name and username, and the colour of your avatar (which is derived from your account, not a photo).
• What you post: messages in text rooms (including the earlier version of an edited message), pictures you send (compressed in your browser first, with their location and camera data removed), Buddy messages, and your feedback notes.
• Who you are connected to: the tambayans you belong to and your role in each, your buddies, and who you have blocked.
• Voice: live audio in a voice hut is relayed to the other people in it. We do not record it or store it. We do keep, for as long as you are in a hut, who is in it.
• Safety records: reports (including a copy of the reported text, the reason and any note), moderation actions, bans, and an internal log of what platform admins do.
• Basic activity: the times you signed in and posted (for example, when you last read a room, so we can show unread badges), and counters that limit how fast one account or network address can do things, to stop abuse.
• Technical data: your network (IP) address, browser and device type, which our hosting and security providers process to deliver the service and protect it. We keep our own logs minimal and remove sensitive details such as tokens, emails and message text from them.

We do not ask for your real name, phone number, contacts, precise location, or payment details, and we do not use advertising or analytics trackers.

3. Why we use it

We use your information to:

• create and secure your account and log you in;
• deliver messages, pictures, voice, unread badges and notifications;
• show your name to the people you chat with;
• keep people safe: review reports, enforce our Terms, block spam and abuse, and comply with the law;
• understand overall use in aggregate (for example, how many people were active this week) and fix bugs, using data we already hold rather than extra tracking;
• answer your feedback and requests.

Our reasons (legal bases) are: providing the service you asked for, our legitimate interest in keeping it safe and working, complying with the law, and your consent where we ask for it. We do not sell your personal information, and we do not use it to show ads.

4. Who can see what

• Other members: the people in a tambayan or Buddy chat you are in can see your display name, username and what you send there. Anyone who can see a message can copy or screenshot it.
• Tambayan moderators: the owner, admins and co-admins of a tambayan can see reports about that tambayan, including the reported text.
• Tambay platform admins: a small number of people we authorise can see, to run and protect the service, account details such as your email address and sign-in dates, overall activity counts, reports (including the saved text), feedback, and block relationships. They cannot browse your private chats as a matter of routine. They may look at specific content only when it has been reported or when needed to investigate abuse, a security problem or a legal demand. Their actions are logged.
• Authorities and others: we may share information when the law requires it, to respond to valid legal requests, to protect someone's safety or the service, or in a sale or restructuring of the business (with the same protections).

5. Service providers we use

We use trusted providers who process information for us, only to run tambay, under their own security and privacy commitments:

• Supabase: sign-in, our database, private file storage for pictures, and realtime delivery (data is hosted in the Tokyo region);
• Vercel: hosting of the website and app;
• LiveKit: relaying live voice audio;
• Upstash: short-lived counters that limit abuse.

Because these providers operate internationally, your information may be processed in countries other than yours. We choose providers that protect it appropriately.

6. Cookies and similar storage

We use only what is needed to make tambay work:

• a secure sign-in session cookie that keeps you logged in;
• a small cookie that remembers whether you chose the light or dark theme;
• your browser's local storage keeps the position of the Buddy window on your screen.

We do not use advertising or tracking cookies, so there is no cookie banner asking you to accept them.

7. How long we keep it

• Account and profile: while your account exists.
• Messages and pictures: until you or a moderator delete them, or the tambayan is deleted. Deleting a picture message also deletes the file when nothing else uses it. Buddy chats keep only the newest 200 messages.
• Reports, moderation records and the admin log: kept as long as needed for safety, to spot repeat abuse, and to meet legal duties, even if the message has been deleted.
• Feedback: kept until we have dealt with it and it is no longer useful; it stays even if you delete your account, but is no longer linked to you.
• Backups and provider logs: removed on the provider's normal schedule.

When information is no longer needed, we delete it or make it anonymous.

8. Your choices and rights

Depending on where you live (for example under the Philippine Data Privacy Act, or the GDPR in Europe), you can ask us to:

• tell you what we hold about you and give you a copy;
• correct information that is wrong (you can change your name and username yourself in Settings);
• delete your account and personal information;
• stop or limit certain uses of it, or withdraw consent you gave;
• move your information to another service, where that applies.

To use these rights, contact us as described below. We may need to check that it is really you first, and we will answer within the time the law requires (normally within 30 days). Some information, such as reports and moderation records, may have to stay for safety or legal reasons. If you are unhappy with how we handled your information, you can also complain to your data protection authority, such as the National Privacy Commission in the Philippines.

9. Children

tambay is not for children under 13, and we do not knowingly collect information from them. If you are under 18, you should use tambay only with a parent or guardian's permission. If you think a child under 13 has an account, tell us and we will delete it.

10. How we protect it

We use measures such as encrypted connections, secure hashed passwords, sessions that are not readable by scripts, access rules that keep each person's data private to those allowed to see it, private storage for pictures, rate limits, limited admin access with an audit trail, and regular dependency checks. No system is perfectly secure, so we cannot promise it, but if a breach affecting you happens we will tell you and the authorities as the law requires.

Please use a strong, unique password, and never share it or send sensitive information (passwords, IDs, card numbers) in a chat.

11. Changes and contact

We may update this policy. When we make an important change, we will tell you in the app or by email before it takes effect where we reasonably can, and the date at the top will change.

To ask a question or use your rights, send a note through the feedback form in Settings, or reach us through acqron.com. Please say clearly what you need (for example, "delete my account") and the email address of your account.