Privacy policy

Hauntline is a reading and archive app operated by Khac Phuc Nguyen. This policy explains what we collect, why, who we share it with, and how you can get it removed. We keep collection to what the app actually needs to run.

Account data

You can browse the archive as a guest without an account. If you sign in, we use Google Sign-In or Sign in with Apple and store:

• Your email address, display name, and avatar image URL.
• The date you created your account and completed onboarding.

We never receive your Google or Apple password. If you use Sign in with Apple with “Hide My Email,” we only ever see the relay address Apple gives us.

Your activity in the app

• Saved stories and collections — what you bookmarked and how you grouped it.
• Reading progress — which chapters of a story you have finished, so you can resume.
• Submissions — stories you submit for review.
• Reports — content you report to us for moderation.
• Reels activity — likes, saves, and comments if you use those features.

Usage analytics

We record an event log of how the app is used — screens viewed, stories opened and finished, searches performed, narration played, and similar in-app actions. Each event records the action, your device platform, and a timestamp.

When you are signed in, these events are linked to your account, not stored anonymously. We use them to understand which stories land, to fix what breaks, and to decide what to publish next. Events recorded while you browse as a guest are not linked to an account.

We also use Google Firebase Analytics for aggregate product metrics and crash diagnostics.

Advertising

Hauntline shows ads supplied by Google AdMob. Ads appear as occasional sponsored cards in story lists, and as a full-screen ad shown when you leave a story you finished. We never interrupt a story you are still reading.

To serve, measure, and limit the repetition of ads, Google may process your device’s advertising identifier (the IDFA on iOS, the Advertising ID on Android), IP address, approximate location derived from it, and interactions with the ads themselves. Google acts as an independent controller of this data. Its practices are described at business.safety.google/privacy and the current list of ad partners at Google’s ad partner list.

Personalized ads and your choice. On iOS, we ask for permission through Apple’s App Tracking Transparency prompt before any tracking-based personalization. If you decline, you still see ads — they are just not personalized. In the EEA and the UK, we show a Google-certified consent form before ads load, and your choice there controls whether personalized ads are used. You can change these choices at any time in your device settings, and Android users can reset or delete the Advertising ID from system settings.

Ads are off entirely unless we have enabled them for your region and build.

Notifications and email

• Push notifications — if you allow them, we store a device push token and your chosen content language so we can send new-story alerts in the right language. You can turn notifications off in system settings.
• Email — we may email you about the archive, including occasional re-engagement messages. Every email has an unsubscribe link, and we record unsubscribes so we stop.

Who processes your data

• Supabase — database, authentication, and storage.
• Google — AdMob (advertising), Firebase Cloud Messaging (push), Firebase Analytics, Google Sign-In.
• Apple — Sign in with Apple.
• Cloudflare — hosting of story artwork and narration audio.

We do not sell your personal data for money. Serving personalized ads may count as “sharing” for cross-context behavioural advertising under some privacy laws, including the CCPA — declining the prompts described above opts you out of it.

Storage and retention

Data is stored on Supabase (Postgres) and transmitted over HTTPS. Your authentication token is held in your device’s Keychain (iOS) or encrypted storage (Android). We keep account and activity data until you delete your account; analytics events are retained in aggregate for product analysis.

Your rights and choices

• Delete your account at any time from inside the app. This removes your profile, saved stories, collections, reading progress, and pending submissions.
• Request a copy of your data, or correction of it, by emailing us.
• Withdraw advertising consent, or turn off push notifications, at any time.
• If you are in the EEA, the UK, or a US state with a comprehensive privacy law, you may have additional rights to access, portability, and objection. Contact us and we will honour them.

Children

Hauntline contains disturbing content and is not intended for children. The app requires you to confirm you are old enough for mature content before entering the archive, and we do not knowingly collect data from children. Our ad requests are not tagged as directed to children. If you believe a child has given us data, contact us and we will delete it.

Changes

If we change this policy materially, we will update the date above and, where required, ask for your consent again.

Contact

Privacy questions: privacy@hauntline.space
Content reports: moderation@hauntline.space