Last updated: 2026-09-11
iFarted is a dead-simple, Yo-style app: "I farted." is the entire message. No typing, no inbox, notification IS the message. We take privacy seriously — we collect minimal data, and we don't track you.
- Username: You choose a username (3-20 alnum/_). Used to identify you to friends.
- Display Name: Optional, same as username by default.
- User ID: Random UUID generated on registration, used as primary key.
- API Key: Random 64 hex, used for auth (Bearer token). Stored locally on device, never shared.
- Location: Optional, one-time lat/lng when you send a fart. Only if you grant location permission (NSLocationWhenInUseUsageDescription on iOS, ACCESS_FINE_LOCATION on Android). Used to show map pin in fart-detail. Not stored long-term beyond rate limiting. You can deny, and farts still work.
- Contacts: Optional, one-time read of contacts to find friends. Only if you grant contacts permission (NSContactsUsageDescription on iOS, READ_CONTACTS on Android). We hash phone numbers (SHA-256) and only send hashes to server for matching (like Yo). We don't upload raw contacts. You can deny, and you can still add friends via username search or invite codes.
- Phone Number: Optional, for phone-discovery if you enable it. Normalized to E164, hashed. Only if you opt-in via settings phone-discovery. Used to let friends find you by phone hash.
- Expo Push Token: Required for push notifications. Generated by Expo, format ExponentPushToken[...]. Stored on server to send you fart notifications via Expo Push Service → APNs/FCM. You can disable push in OS settings, but then you won't receive farts.
- Friends List: Who you add, via username, contacts hash, or invite code. Stored on server to enforce mutual friendship for farts (optional — currently allows any friend to fart you, but future may require mutual).
- Messages: When you send a fart, we store messageId (UUID), senderId, recipientId, timestamp, optional lat/lng. Kept only for rate limiting (30/hour per sender, 100/hour per recipient) and abuse prevention. No inbox/history in client — notification IS message. Server keeps messages table but client doesn't show history (Yo-style ephemeral).
- Metrics: Aggregated counts — totalUsers, totalFarts, fartsLastHour, activeUsersLastHour. No PII. Used for admin dashboard and monitoring.
- Rate Limit State: In-memory + SQLite persistent per-recipient, to prevent spam.
- Invites: Invite codes you create, with creator userId, code, used count, expiry. Used for invite flow.
- We don't collect: email, real name, address, birthdate, photos, files, messages content beyond "I farted." (which is fixed), browsing history, tracking across apps, advertising ID for tracking.
- We don't use third-party analytics that track you (no Facebook SDK, no Google Analytics). AdMob is configured non-personalized (npa=1) if ads shown, and Remove Ads IAP removes them.
- To let you send/receive farts: username + userId + apiKey + push token + friends list + optional location.
- To find friends: username search, contacts hash matching, invite codes.
- To prevent abuse: rate limiting, metrics, message timestamps.
- To show you fart-detail: sender name, timestamp, optional map pin.
- To show ads (if not removed): AdMob Banner, non-personalized, no tracking. Remove Ads IAP ($1.99) removes ads.
- We don't sell your data.
- We share push token with Expo Push Service (exp.host) to deliver notifications, which then goes to APNs (Apple) / FCM (Google). That's how push works.
- We don't share contacts raw, only hashes for matching.
- We don't share location except as part of fart payload to recipient (if you include it).
- Admin dashboard (protected by ADMIN_KEY) can see aggregated counts and recent users/farts (ids truncated) for monitoring, but not PII.
- User: until you sign out / delete account (future feature) or server reset. For MVP, data persists in SQLite, but we may reset during alpha.
- Messages: kept for rate limiting, but we may prune old messages (e.g., >30 days) in future.
- Metrics: hourly buckets, pruned after 24h.
- You can request deletion via contact email (future).
- API Key: 64 hex random, stored locally, Bearer auth.
- Passwords: we don't have passwords, only apiKey.
- Hashing: phone numbers hashed SHA-256, apiKey hashed for storage (we store hash, not raw? Actually we store raw apiKey hash? In current impl we store apiKey directly but we should hash — TODO).
- Rate limiting: in-memory + persistent SQLite to prevent spam.
- Security headers: X-Content-Type-Options nosniff, X-Frame-Options DENY, X-XSS-Protection block, Referrer-Policy strict-origin-when-cross-origin, HSTS in prod, CORS configurable.
- No PII in logs.
- Location: NSLocationWhenInUseUsageDescription — "iFarted uses your location to show where you farted on a map (optional, only when you send a fart)." You can deny.
- Contacts: NSContactsUsageDescription — "iFarted uses your contacts to find friends (optional, only hashes are sent)." You can deny.
- Notifications: UIBackgroundModes remote-notification — to receive farts. You can disable in OS settings.
- Android: ACCESS_FINE_LOCATION, READ_CONTACTS — same as above, optional.
- Age rating 12+ for infrequent crude humor. Not directed to children under 13. We don't knowingly collect from children.
- We'll update this policy if data practices change. Check date at top.
- For privacy questions: see GitHub repo lin2mm/udlbook issues or contact email (to be added when domain ifarted.app live).
- This project is open source (see README.md). Server code is auditable.
This is a template for alpha. For store submission, host at https://ifarted.app/privacy and update with real contact email, and ensure compliance with App Store Privacy Nutrition Label (Data Not Collected except username, optional phone, location, contacts, push token — all with user permission) and Play Data Safety (same).