Privacy Policy

This Privacy Policy explains what information STU collects, how we use and share it, and the choices you have. STU is operated by STU SOCIAL LLC, a Florida limited liability company (“STU,” “we,” “us,” or “our”). By using the STU mobile app or related services (the “Service”), you agree to this Policy. If you do not agree, please do not use the Service.

1. Information we collect

Information you give us

• Account information. To create an account you sign in with Google, with Apple, or with a one-time code sent to your email. We receive and store your email address. We do not use or store passwords.
• Profile information. Your handle (username), display name, an optional short bio, optional profile photo (avatar), and your chosen accent color.
• Content you create. Submissions you post to challenges (“targets”) — photos, videos, and audio recordings — along with any captions, and the ratings you give to other members’ submissions.
• Direct messages. The text content and metadata — sender, recipient, and timestamps — of the 1:1 messages you send to and receive from other members, plus whether a conversation is still a pending request, who started it, and when it was accepted.
• Social connections. The accounts you follow, your league memberships, and the users you block.
• Reports and communications. Reports you submit about content or users, and messages you send us for support.
• Waitlist email. If you sign up for the waitlist on trystu.com, we store the email address you enter and which section of the page you submitted it from, so we can send you an invite. That is the only personal information the website itself collects.

Information collected automatically

• Device & push tokens. If you enable notifications, a push token for your device so we can send notifications. Basic device type and app version.
• IP address. Our hosting and infrastructure providers record the IP address your device connects from, as part of the standard logs they keep to deliver, secure, and rate-limit the Service. We don’t use IP addresses to build a profile of you, to advertise to you, or to determine your precise location.
• Usage & log data. Limited technical logs needed to operate and secure the Service (for example, timestamps of actions such as submitting or rating, sign-in events, and error/diagnostic information).

Information from third parties

• When you sign in with Google or Apple, we receive basic profile information you authorize them to share — typically your email address and name. If you use Apple’s “Hide My Email,” we receive Apple’s relay address instead of your personal email.

What we do not collect

• Your real/legal name (your display name is whatever you choose).
• Your precise location or GPS data.
• Your contacts or address book.
• Your date of birth or age. We ask you to confirm you’re at least 13 when you sign in, but we don’t verify it and we don’t store a birth date, an age, or a record of the confirmation itself.
• Anything from your camera roll that you do not explicitly select or capture for a submission.

The app requests camera, microphone, and photo-library access only to let you capture or choose media for a submission. You can manage these permissions in your device settings.

2. How we use information

• To operate the Service — create and display leagues, deliver submissions, deliver your direct messages, calculate ratings and standings, and show profiles and activity.
• To authenticate you and keep your account secure.
• To send notifications you’ve enabled (you control categories in Settings).
• To enforce our Terms of Service, review reports — including reported direct messages — and keep STU safe (including detecting abuse, spam, and prohibited content). When you file a report it is sent to our team’s internal channel so a person can look at it. That alert includes your handle, the handle of the member or content you reported, and anything you wrote in the report. We still never tell the reported member who reported them.
• To respond to your support requests.
• To comply with legal obligations and protect the rights, safety, and property of STU, our users, and the public.

3. How we share information

• With other members of your leagues. STU is social. When you join a league, other members can see your handle, display name, and avatar. Your submissions are visible to league members according to that league’s visibility settings (all members, or judges/admins only). Ratings — including the running average and individual raters’ scores — are visible to members of the league. Your following list is private; your follower count is public.
• Direct messages stay private. Your 1:1 messages are visible only to you and the member you’re messaging — they are never shown to other league members. They are kept private by access controls but are not end-to-end encrypted: they are stored by our database provider (Supabase) on our behalf, and we can access message content only when needed to investigate a report, enforce our Terms, or comply with the law.
• With service providers. We share data with the vendors that power STU, only as needed to provide the Service (see Service providers below). They are bound to use it only on our behalf.
• For legal and safety reasons. We may disclose information if required by law, subpoena, or other legal process, or where we believe disclosure is necessary to prevent harm, fraud, or abuse, or to protect our rights.
• In a business transfer. If STU is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction; we will require the recipient to honor this Policy.

4. Service providers

We rely on a small set of trusted providers to run STU:

We may add or change providers as the Service evolves and will update this list accordingly.

5. Push notifications

If you grant permission, we send push notifications about activity relevant to you (for example, new targets, results, and follows). You can turn notification categories on or off in the app’s Settings, and disable notifications entirely in your device settings. Disabling notifications does not delete your account or other data.

6. Data retention & deletion

• While your account is active, we keep your account and content so the Service works as expected.
• When you delete your account (Settings → Delete account), we delete your profile, submissions, ratings, follows, and related records. Your media is made permanently inaccessible and purged from storage. Leagues you created are transferred to another admin or deleted if you were the only member. Limited records may persist where required for legal, security, or fraud-prevention purposes, and residual copies may remain in routine backups for a limited period before being overwritten.
• Direct messages are kept while both participants’ accounts are active, and are deleted when either participant deletes their account. Declining a message request deletes that conversation and its messages immediately.
• Push tokens are stored while notifications are enabled and are deleted along with everything else when you delete your account. You can stop notifications at any time in Settings or in your device settings.
• Waitlist emails are kept until we send your invite, or until you ask us to remove you — email privacy@trystu.com.

7. Your rights & choices

• Access & correction. View and edit your profile in Settings.
• Deletion. Delete your account and associated data anytime from Settings → Delete account.
• Data export. Request a copy of your personal data by emailing us.
• Notifications. Control categories in Settings.
• Blocking. Block another member to cut off your personal connection with them: blocking disables direct messages between you in both directions, hides their profile from you (and yours from them), and removes any follow between you. It does not hide that member’s submissions or ratings in leagues you share — those remain visible to league members. Manage blocked accounts anytime in Settings → Safety.

How to make a request. Email privacy@trystu.com from the address on your account and tell us what you’d like — a copy of your data, a correction, or deletion. We verify you by your control of that email address; if you used Apple’s “Hide My Email,” write from the relay address. We’ll acknowledge within 10 days and respond within 30 days (or within 45 days for requests under California law), and we’ll tell you if we need more time. Requests are free. You can also delete everything yourself, immediately, from Settings → Delete account.

Depending on where you live, you may have additional rights. To the extent the GDPR applies to our processing, residents of the EEA/UK have rights under it (access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with a supervisory authority); our legal bases for processing are performance of our contract with you, your consent, and our legitimate interests in operating and securing the Service. Residents of California have rights under the CCPA/CPRA (to know, delete, correct, and to opt out of “sale”/“sharing” — note that we do not currently sell or share personal information as those terms are defined; if that changes, we will provide the required opt-out). To exercise any right, contact us at the address below; we will not discriminate against you for doing so.

Do Not Track & “Shine the Light.” Some browsers send a “Do Not Track” (DNT) signal. There is no common industry standard for responding to DNT, and STU does not track you across third-party websites or services, or allow third parties to do so through the Service, so we do not respond differently to DNT signals. California’s “Shine the Light” law also lets California residents ask about personal information we disclose to third parties for those third parties’ own direct marketing; we do not share personal information for that purpose.

8. Security

We use industry-standard measures to protect your information, including encryption in transit, authenticated access to media, and access controls that limit who can view submissions to authorized league members and who can read a direct message to its two participants. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. Please keep access to your email and sign-in accounts secure.

9. Children’s & teen privacy

STU is not directed to children under 13, and you must be at least 13 years old to use it. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us information, email privacy@trystu.com and we will delete the account and its data. Some regions require a higher minimum age for consent to data processing; where that applies, you must meet your region’s minimum age.

We ask about age; we don’t verify it. When you sign in, STU asks you to confirm you meet the minimum age. We don’t verify age and we don’t store a birth date — so we can’t tell which members are teens, and the Service behaves the same way for everyone. In practice that means a member aged 13–17 has the same profile visibility and the same direct-messaging access as anyone else: any member can send them a direct message. A first message from someone they haven’t accepted goes to a separate Requests area, sends no notification, and is capped at three messages until accepted — but that applies to every member equally, not because we know anyone’s age.

The safety tools are the same for everyone. Any member can report or block any other member from their profile, leave a league at any time, and turn notifications off. We review reports of abusive behavior, including reports about direct messages. Parents and guardians who want an account and its content removed can email support@trystu.com and we will delete it.

10. International users

STU is operated from the United States and is intended for users in the United States. We do not target or market the Service to the European Economic Area or the United Kingdom. If you choose to use STU from outside the U.S., you do so on your own initiative, and you understand that your information may be transferred to, stored, and processed in the United States and other countries whose data-protection laws may differ from those in your country. Where required, we rely on appropriate safeguards for such transfers.

11. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you in the app. Your continued use of the Service after changes take effect means you accept the updated Policy.

12. Contact us

Questions about this Policy or your data? Email us at privacy@trystu.com.

STU is operated by STU SOCIAL LLC, a Florida limited liability company. Mailing address: 7901 4th St N, Ste 300, St. Petersburg, FL 33702.