HotTakes / Privacy

HotTakes Privacy Policy

Last updated: October 18, 2026

1. Introduction

This policy explains how HotTakes ("we" or "us") handles information when you use the HotTakes app, campus communities and the hottakes.live website. It covers information you provide, activity associated with your account, and technical information processed to operate these services.

2. Information we collect

Account and profile information. We process your Firebase account identifier, sign-in provider and provider identifier, sign-in email, account creation information and new-account status. Apple or Google may provide a name and profile image. We keep account email and provider name in private account records. Your profile can contain a username, display name, profile photo or avatar, join date and profile color. An initial username may be generated from part of your sign-in email, and a provider photo may be used as your avatar. Review your public profile after signing in.

Content and social activity. We store the HotTakes you create, questions and answer options, categories, comments and replies, reactions and likes, vote choices, follows and mutual-friend relationships, blocks, reports and in-app activity notifications. Records can include your account ID, content IDs, timestamps, visibility, campus association, moderation status and counts.

Preferences and technical information. We process selected interests and activity signals for recommendations. Requests to our services and providers also involve IP addresses, software/device information, identifiers, access information and diagnostics. Website analytics is described separately below. The app does not request precise GPS location or import your phone's address book.

3. How we use information

We use information to authenticate accounts, display profiles and content, record votes and social activity, enforce content audiences, verify campus inbox access, personalize feeds, show activity notifications, handle reports and account deletion, and protect the service against misuse. When enabled, website analytics helps us understand visits, site performance and how people use navigation and download links. If you contact us, we process your message and reply details to respond.

The current app and website do not use advertising pixels or combine activity with other companies' apps or websites for targeted advertising. First-party website measurement and service-provider diagnostics are described below; they are not a claim that no technical data is processed.

4. Authentication and accounts

Normal app sign-in uses Apple or Google through Firebase Authentication. These services process credentials and tokens to establish and restore your session. If Apple supplies a relay email address, that is the address we receive. The dedicated App Review account uses Firebase email/password authentication and a server-controlled account allowlist; it does not bypass ordinary content permissions.

Our sign-in and cloud providers also process technical information under their own policies. Google's sign-in software declares processing that can include account contact details, approximate location, user and device identifiers, usage information and diagnostics. Some provider contact details can include a phone number depending on the provider's service and account configuration; HotTakes itself does not offer phone-number sign-in or ask you to enter a phone number.

5. Public, private and campus content

Public. Your public profile, public HotTakes and associated public interactions may be visible to other users. Public profile activity can show participation in public HotTakes. Public HotTakes may be shared outside the app using https://www.hottakes.live/poll/{pollID}. Where available, the public web preview contains the public question and basic service/link metadata, not individual votes, results, author identities, comments or campus records. Social or messaging services receiving a shared link may process its public preview under their own policies.

Private. Private HotTakes are restricted to their creator and eligible users with a current mutual-follow relationship, subject to the app's access checks. They are not exposed through the public preview route.

Campus or ORG. Campus HotTakes are restricted to current verified members of the same available campus community. They are not exposed through the public preview route. Other members do not receive your academic email address.

Audience restrictions do not make content anonymous to HotTakes or end-to-end encrypted. Blocking limits interaction and visibility in supported app flows; it cannot recall public information already seen, copied or shared. Removing a post or comment can hide it while retaining records for moderation. Leaving a campus community does not delete your earlier campus posts or comments. Account deletion has the separate effects described below.

6. Votes and social information

Votes are linked to your account on the backend, including the HotTake and the option you selected. They are not anonymous ballots. The service enforces one vote per HotTake where voting is available. For public HotTakes, a current mutual friend who has also voted can receive information linking your profile to your selected answer through the friend-results feature. The current screen presents totals and percentages. Private and campus rules restrict the audience, not the backend link between a vote and an account.

Your public profile and social features can expose follow relationships and public participation. Block and report records are processed for access enforcement and moderation. Content or answers you choose to submit may reveal personal or sensitive opinions, including political opinions; consider the audience before posting or voting.

7. Academic email and campus verification

Academic email addresses are collected solely to verify access to domain-based campus communities. We use these addresses to send one-time verification codes and do not use them for advertising, marketing, newsletters or promotional communications. Your academic email address is not shown to other users.

Eligible domains currently end in .edu or .edu.in. Departmental subdomains are grouped by their registrable academic domain. No school directory listing or institution approval is required. Verification proves control of an inbox only: it does not prove enrollment, student status, employment, identity or age. HotTakes is not affiliated with or endorsed by a university.

While verification is pending, we temporarily hold the address, domain, protected code-verification material, send/expiry times and attempt/delivery state. Codes expire after 10 minutes. Expiry stops a code from being used; physical removal of expired records depends on cleanup processing. Successful new verification removes the pending challenge and retains the community identifier, academic domain and verification time without retaining the full verified email in the new membership.

Older membership records may still contain a previously verified academic address until you leave that community or delete the account. Leaving removes the private membership and pending verification records. Limited account-linked request counts and timing information may remain until expiry cleanup runs to prevent abuse or repeated requests; these separate rate-limit records contain no raw academic email, verification code or code hash. Account deletion also removes those rate-limit records. Delivery-service logs and message retention are separate from HotTakes application records.

8. Recommendations and personalization

The For You feed uses selected interests, public HotTake interactions such as views, votes, comments and reactions, followed creators, and session and longer-term category activity. We store private account-linked preferences and category signals; session signals are held temporarily in app memory. Older influence fades over time, which is not the same as deleting every stored record.

Private and ORG/campus interactions are excluded from public recommendation learning. Politics can be selected as an interest or receive broad category engagement. The recommendation system does not use which answer option you chose to infer ideology or candidate preference. The voting feature separately records your selected answer as explained above.

9. Website analytics and cookies

When enabled and configured, our first-party website tracker starts on normal page loads without an Allow/Deny prompt. It measures visits and returning visits using random visitor/session identifiers; the analytics database stores a keyed, pseudonymous visitor identifier. It can record page and predefined section exposure, active time, scroll depth, navigation/download-link interactions, referral domain, bounded campaign labels and broad device, browser, operating-system and screen-size categories. It does not capture form text or the contents of keystrokes, and it is not connected to your app account by this tracker.

IP addresses are processed for request handling, abuse protection and, if a local GeoIP database is configured, approximate country, region and city. This is not GPS location. This collector does not store raw IP addresses or full browser User-Agent strings in its analytics session records; short-lived keyed rate-limit records support abuse protection. Hostinger and other infrastructure can maintain separate access/security logs.

The ht_visitor cookie has a rolling 90-day expiry and the ht_visit session cookie has a rolling 30-minute expiry; successful collection refreshes them. A new session starts after 30 minutes of inactivity. This tracker does not start when the browser sends supported Global Privacy Control or Do Not Track signals, and matching signals are also rejected by the collector. You can use those controls or block cookies in your browser. Clearing cookies does not erase records already collected or establish a permanent opt-out from future visits.

The website's default cleanup period for raw session/event data is 90 days when the configured cleanup process is executed; it is not a guarantee that every provider log or backup expires after 90 days. The standalone public HotTake preview adds no analytics script or visitor cookie, although hosting still processes the request.

10. Service providers and sharing

We use Google Firebase for authentication, database, server functions and profile-image storage; Google Sign-In and Apple Sign-In for account access; Hostinger for website hosting; and Google's Gmail SMTP service to deliver campus verification codes. Providers process the information needed for those roles and may maintain their own technical, security and operational records. Their privacy information is available from Firebase, Google, Apple and Hostinger.

Information is also shared with other users according to the audiences above and with external services when you choose to share public content or follow an external link. Provider and recipient copies are subject to their own processing and retention practices.

11. Data retention

Account, profile, social, content and preference records generally remain while the account or relevant feature is in use, unless removed through the service's deletion flow. Removed content can remain as hidden records for moderation. New campus-verification challenges are temporary as described above; expiration and cleanup are separate steps.

Some scrubbed discussion records, moderation/report records and a record that account deletion completed remain after deletion. These retained records do not currently have a fixed automatic deletion period. Reports made by others can still refer to the former account. Recommendation decay periods are not erasure deadlines. Website cookies and analytics cleanup have the separate periods explained above.

Cloud, hosting and email providers may retain connection/security logs, backups or delivered messages under their own settings and retention practices. Deleting application records does not instantly remove every provider copy, recipient copy, screenshot or previously generated social preview.

12. Account deletion

In the app, open Profile → Profile settings → Delete Account and confirm. Recent authentication or reauthentication through your sign-in provider may be required; the dedicated password account may need its password again.

The deletion flow removes the Auth account, public profile, private account details, preferences, avatar files, follows/blocks, personal votes/reactions/likes, related activity notifications, reports you submitted, private campus membership and pending verification/rate-limit records. Authored questions, answer options and comments have their text replaced with deletion notices, and their author is replaced with a deleted-account marker, while structural discussion records remain. Other users' content and certain reports about the account can remain.

Cleanup can run in stages and retry if a step fails; it is not a promise of immediate deletion everywhere. A completion record tied to the former account ID is retained to record and enforce the deleted-account state. Deleting an app account does not automatically identify and remove separate pseudonymous website visits or delete records held independently by Apple, Google, Hostinger, email recipients or people who copied shared content.

13. Your choices and privacy rights

You can review your public profile, change your username or profile photo, choose interests when asked, control what you post and its available audience, follow or block users, leave a campus community, and delete your account. You can manage website cookies and supported privacy signals in your browser. Withdrawing provider access or signing out is not the same as deleting your HotTakes account.

Depending on applicable law, you may have rights to access, correct, receive a copy of, delete or restrict use of personal information, object to processing, or withdraw consent where processing relies on consent. Contact us to make a request. We may need to verify your identity and assess the request, applicable exceptions and records we can identify. Where available under local law, you may also complain to a data-protection authority.

14. Children and age

The app does not currently ask for a date of birth or verify age. Academic-email verification does not establish age or student status. If you are a parent or guardian and believe a child has provided personal information, contact us so we can review the situation and take action required by applicable law.

15. Security and international processing

We use authentication, access checks, protected verification codes and transport security to limit unauthorized access. Public profiles/content are intended to be shared within their stated audiences. No internet service or storage system can guarantee absolute security.

Our service providers may process information outside the country where you live. Processing locations and provider retention depend on the services and hosting configuration; data-protection laws may differ between countries. The providers' linked privacy information describes their processing and international-transfer practices.

16. Changes to this policy

We may update this policy when our service or practices change. The date above identifies the latest version. We will provide additional notice where required by applicable law.

17. Contact us

For privacy questions or requests, contact HotTakes at hello@hottakes.live. Please do not send passwords, sign-in tokens or campus verification codes.