Privacy Policy

lowk is a product and service operated by TallyHQ, Inc., a Delaware corporation.

Privacy contact: arul@tally.kitchen. General support is available on our Support page.

Depending on how you use lowk, we may collect:

• Your mobile phone number and authentication records needed to create, secure, and access your account.
• Profile information you provide, such as display name, school, and optional profile image.
• Your responses to polls, private votes, and the anonymous flame events shown in a recipient's inbox.
• Individual contact phone numbers you explicitly select, handled as described below.
• Notification preferences and device push tokens if you enable notifications.
• Support communications, security records, limited diagnostics, and information needed to prevent abuse.

lowk does not require you to upload or synchronize your entire address book. Contact names and browsing remain on your device. Only phone numbers for contacts you individually select are submitted to lowk.

Selected numbers are normalized and processed transiently. lowk uses a keyed cryptographic HMAC to compare a selected number with registered identities. Raw contact phone numbers are not retained in lowk's application database.

Your private one-way votes are not exposed to other users through lowk's client-facing database or API. When you are picked, the resulting flame is delivered anonymously; the identity of the person who picked you is protected and only ever partially revealed through in-app reveal mechanics that you control.

When you enter your own phone number and tap Send Code, you request a one-time authentication message. lowk uses Supabase Auth and Twilio Verify to process and deliver that code. This request does not enroll you in promotional or recurring text messages.

lowk also offers a consumer-initiated, one-time invitation feature. An invitation is sent only after a registered user individually identifies a recipient, confirms that they know the recipient and have permission to send one invitation, and explicitly requests the message. Invitations are not recurring and do not authorize future messages.

Message and data rates may apply. Reply STOP to a lowk invitation to opt out or HELP for assistance. We honor applicable opt-out requests and maintain suppression records as needed to prevent additional messages.

All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.

We use information to authenticate users, present polls, process private votes, deliver anonymous flames, deliver requested communications, operate support, secure the service, enforce limits, investigate abuse, and comply with law.

lowk does not sell personal information or use contact information for third-party advertising.

We use service providers to operate lowk, including Supabase for authentication, database, and backend infrastructure; Twilio for requested SMS delivery; Apple for platform and push-notification services; and vendors supporting hosting, security, and diagnostics.

These providers process information only to perform services for us under their own contractual and legal obligations. We may also disclose information when required by law, to protect users and the service, or in connection with a corporate transaction subject to appropriate protections.

We retain account and service information only as long as reasonably necessary for the purposes described here. Raw selected contact numbers are handled transiently rather than stored in application tables. Cryptographic identifiers, rate-limit records, and SMS suppression records may be retained as needed for security, duplicate prevention, and compliance.

You may request account deletion through the app or by contacting us. Some records may be retained where legally required or necessary to protect the service and other users.

We use technical and organizational safeguards designed to protect information, including access controls, row-level authorization, server-only identity and vote data, and restricted server secrets. No system can guarantee absolute security.

You can decline Contacts or Notifications permission, remove selected contacts before submitting, reply STOP to invitation texts, or delete your account.

lowk is not directed to children under 13. If we learn that we collected personal information from a child under 13, we will take appropriate steps to delete it.

We may update this policy as lowk evolves. We will update the effective date and provide additional notice when required.

Questions or privacy requests may be sent to arul@tally.kitchen.