Privacy Notice

The controller for the processing described here is:

Controller

Pre-launch draft — operator details will be added before public launch.

Business identifier

Pre-launch draft — operator details will be added before public launch.

Address

Pre-launch draft — operator details will be added before public launch.

Privacy contact

Pre-launch draft — operator details will be added before public launch.

• Account and contact data — email address, sign-in identifiers, account status.

  Purpose: Creating and running your account, signing you in, security, and sending service messages.

  Legal basis: Performance of the contract; legitimate interests in keeping accounts secure.

• Public profile — handle, display name, bio, avatar, verification state, country where set.

  Purpose: Showing you to other users as the service is designed to work.

  Legal basis: Performance of the contract.

• Date of birth — stored privately and never shown to other users.

  Purpose: Confirming you meet the requirement to be at least 18 years old.

  Legal basis: Legal obligation and performance of the contract.

• Your content and interactions — videos, captions, comments, Keeps, Pass Ons, Responses, follows, feed views.

  Purpose: Operating the service, building your feeds, and recommending content.

  Legal basis: Performance of the contract.

• Reports and blocks — what you report, who you block.

  Purpose: Handling reports, keeping people apart when they choose to be, and safety.

  Legal basis: Legal obligation and legitimate interests in a safe service.

• Moderation and review data — automated review outcomes, categories, review cycles.

  Purpose: Deciding whether content can be published and handling reports about published content.

  Legal basis: Legal obligation and legitimate interests in preventing unlawful content.

• Security and abuse-prevention data — rate-limit counters, audit records of privileged actions.

  Purpose: Preventing spam, abuse and unauthorised access.

  Legal basis: Legitimate interests in protecting the service and its users.

• Payment and promotion records — promotion purchases, payment provider references, payment status. Card details never reach 5TIN.

  Purpose: Providing the promotion service, accounting and handling withdrawal or refund questions.

  Legal basis: Performance of the contract and legal obligation (accounting).

• Transactional email records — recipient address, template, delivery state and short error codes.

  Purpose: Sending the service messages you would expect, and being able to tell whether they were delivered.

  Legal basis: Performance of the contract and legitimate interests in reliable notices.

• Legal notices — what is reported to us and, where required, the notifier's name and email.

  Purpose: Assessing and answering notices about unlawful or infringing content.

  Legal basis: Legal obligation.

We only rely on consent where the app actually asks you for it. Where we rely on legitimate interests, we have considered your rights and interests as well as ours.

We use service providers to run 5TIN, in these categories: database and hosting; content delivery and media storage; payment processing; transactional email delivery; and AI/model services used for automated content review. Providers act on our instructions.

We may also disclose data to professional advisers, or to public authorities where the law requires it. We do not sell personal data, and we never target advertising using sensitive characteristics.

Some providers may process data outside the EU/EEA. Where that is the case we rely on the transfer mechanisms available under data-protection law. The specific providers and transfer mechanisms will be listed here before public launch rather than described inaccurately now.

Account, profile and content data are kept while your account exists. When you request deletion, we delete or anonymise personal data except where we must keep it: payment and accounting records for the statutory retention period, and records of reports, moderation decisions and security incidents for as long as needed for those purposes.

Short-lived operational data — rate-limit counters, transactional email records, signed media links — is kept only as long as it is useful for that purpose. Deletion is always subject to lawful retention, so we do not promise an exact date for every record.

Every upload is checked automatically before it can be published, and reports about published content trigger a further automated check. The consequence is practical: publication can be refused, or published content can be removed or made unavailable.

Where a rejection concerns content assessment rather than a technical failure, you can request one further automated review. We do not claim that a human reviews every decision at launch. Raw review data, prompts and scores are internal and are not published.

You can ask for access to your data and download an export from your account settings. You can also ask us to correct data, delete it, restrict processing, or object to processing based on legitimate interests, and you can ask for a portable copy. Where processing is based on consent, you can withdraw it at any time without affecting what happened before.

If you think we have handled your data wrongly, you can complain to your local data protection supervisory authority — in Finland, the Office of the Data Protection Ombudsman.

Keeps are private by default; you choose if a collection is public. Your date of birth is never shown to anyone. Uploads stay private until publication checks pass, and playback uses short-lived links rather than permanent public file URLs.

Questions about this notice go to our privacy contact above, or through the contact page.