Privacy Policy | Stratum

The short version

What we collect: Your email address, the profile you build (username, name, bio, photos), and what you rate, save and add, plus any reports and blocks you make, and the text you type into search. Plus technical and usage data.
What we don’t: No passwords, no precise location, no contacts, no camera or microphone, no payment details and no advertising ID.
Who sees your profile: Other people with a Stratum account. Not the public, and not people without an account, even if they have a link. Your email is never shown.
Selling and ads: We don’t sell your data, we don’t share it for advertising, and there are no ads in Stratum.
Analytics: We use PostHog and Firebase Analytics, including screen recordings with on-screen text and images masked. We don’t send either one your account ID or email, so analytics isn’t tied to your account and isn’t deleted when you delete your account. It expires on its own, and uninstalling the app stops it. You can object by email.
Support chat: The website’s support chat sends your question and the recent chat to Google’s AI service to write an answer. Your chat is saved only in your browser.
Where it lives: On servers in the United States, run by an independent developer based in Nigeria.
Deleting: Delete your account in the app. Your data leaves our live systems right away and clears from backups within 7 days.
Age: You must be 16 or older to use Stratum.

Who we are

Stratum is a mobile app for Android and iOS, distributed through Google Play and the Apple App Store, where you discover, rate and share experiences, and meet people through the things you love. It is built and operated by Jeffrey Inyang, an independent developer based in Abuja, Nigeria (“Stratum”, “we”, “us”). For data protection law, we are the controller of the personal information described in this policy.

This policy covers the Stratum app and the servers that power it (together, the “Service”). It also covers visitors to joinstratum.app, in the section Our website. Using the Service is also subject to our Terms of Service.

What we collect

Information you give us

Email address. Used to create your account and send you sign-in codes. If you use Google sign-in, we receive the email address on your Google account instead.
Profile details. A username, a display name, an optional bio, a profile photo and a banner image. New accounts start with a generated username (like user02947382) and default pictures. Nothing from your email address is used to make them.
Your taste. Star ratings, saved picks, the names and descriptions of collections you create, and the genres you choose when you join.
Your connections. The accounts you add and the accounts you block.
Reports. If you report an account, we store who reported it, who was reported, the reason you chose, and a copy of the reported profile (username, name, bio and photo address) as it was at that moment. We also email the report to ourselves.
Searches. The text you type into search. It is sent to our servers, which use it to look up things to rate (such as songs, movies and books) and people. Our servers record it in server logs, which we keep for 7 days (see Server and security data below). We don’t build a search history for your account. Your list of recent searches is stored only on your phone.
Photos you pick. Profile and banner images from your photo library. We only receive the image you choose, never the rest of your library, and we strip location (EXIF) data when we process it.
Messages to us. Anything you send to hello@joinstratum.app.

Information from Google, if you use Google sign-in

Google tells us the email address and profile photo on your Google account, plus an account identifier so we can recognise you next time. Google also shares your name; we replace it with a generated username straight away and don’t use it. Your Google photo becomes your starting profile picture, and you can replace it whenever you like. We never receive your Google password.

Information collected automatically

Server and security data. Your IP address, device and app version, operating system, request times, the actions you take and the text of your searches, kept in server logs for 7 days to run, secure and debug the Service.
Usage and device data. App opens, screens viewed, device model, operating system and app version, language, approximate location (country or city, worked out from your IP address) and a random identifier for your app installation. See Analytics and on-device storage.
Screen recordings. Session replay, with on-screen text and images masked. Details below.
Image requests. When your phone loads a profile photo, or cover art for something you search for or rate, it contacts the server that hosts that image. That server can see your IP address and device details. See Who we share it with.

What we don’t collect

We don’t collect passwords (Stratum has none), precise location, your contacts, camera or microphone data, government IDs or advertising identifiers. Stratum currently has no purchases, so we don’t collect payment details. Notifications are scheduled on your device, so we don’t collect push notification tokens.

A note on sensitive information

We don’t ask for sensitive information such as health, religion, politics or sexual orientation. But what you rate, collect or write in your bio can say a lot about you, and other signed-in users can see it. Only share what you’re comfortable with.

What other people can see

Stratum is social. Other people with a Stratum account can see:

your username, display name, bio, profile photo and banner
every rating you give
your named collections and the picks inside them
how many people have added you

They can also find you by searching for your username. They can’t see your email address, your genres, your onboarding status or your full “All” saved list. Only your named collections are visible.

When you add someone, they see you in their new-follower notifications with your photo and username, and you count towards their follower number. Tap “Added” again to undo it.

If you block someone, you and that person disappear for each other: neither of you can find the other, open the other’s profile or add the other, and any adds between you are removed. We don’t tell them, and your list of blocked accounts is private. You manage it in Settings, under Blocked accounts. If you report someone, only we see the report.

Profiles are only visible to signed-in users. A shared link opens a profile only for someone who is signed in to Stratum. Anyone else sees nothing. There is currently no setting to make a profile private. If you want to limit what’s visible, change what you rate or write, or delete your account. We can’t control what other people do with what they see, for example taking a screenshot.

How we use your information

If you’re in the EEA, the UK or Switzerland, the law requires us to have a legal basis for each use. Here they are, side by side with what we use your information for.

Run your account and the app: Create your account, show your profile, ratings, saves and collections, power search, the daily picks and notifications. Basis: contract, because it’s what you asked us to provide.
Sign you in securely: Email, one-time codes, your Google account identifier and IP address. Basis: contract, and our legitimate interest in keeping accounts secure.
Keep Stratum safe: Automated checks on profile images and text, rate limiting and abuse prevention using IP addresses and logs, and reviewing the reports and blocks you make so we can act on problems and keep blocked people apart. Basis: our legitimate interest in preventing abuse, spam and harmful content, and legal obligations where they apply.
Understand and improve Stratum: Analytics and masked session recordings, to fix bugs and make confusing screens clearer. Basis: our legitimate interest in improving the app. You can object at any time by emailing us (see Your rights and choices).
Talk to you: Sign-in code emails, replies to your messages, and important notices about the Service or this policy. Basis: contract and legitimate interests.
Answer support questions: Questions you type into the website’s support chat, and the recent chat, so Google’s AI service can write an answer. Basis: our legitimate interest in helping you quickly.
Backups and reliability: Daily backups so we can recover from a failure. Basis: our legitimate interest in keeping the Service running.
Follow the law and protect rights: Respond to valid legal requests, enforce our Terms and protect people’s safety. Basis: legal obligation and legitimate interests.

Our image and text checks are automated. If something is flagged, it simply isn’t saved and you can try something else. If you think it’s a mistake, email us and we’ll take a look. We don’t make decisions with legal or similarly significant effects on you using automated means.

We don’t sell your personal information, we don’t share it for cross-context behavioural advertising, and we don’t use your ratings, profile or content to train AI models. We don’t send marketing emails. The emails you get from the app are your sign-in codes and occasional service or legal notices.

We share information only with companies that help us run Stratum (“service providers”), and only what each one needs. There are no ad networks, data brokers or advertising pixels in the app.

Amazon Web Services: Hosts our servers and database in Ohio, United States. Holds your account data.
Cloudflare: Stores and delivers profile photos and banners, and stores our daily backups. When a photo loads, Cloudflare sees the requesting IP address and device details.
Resend: Sends your sign-in code emails and delivers report emails to us. Receives your email address and the message we send you and, when someone files a report, the report email (the reported profile’s username, name, bio and photo address, plus the reporter’s username and ID).
Google: If you choose Google sign-in, Google handles the sign-in and learns that you signed in to Stratum. The app may also download its typeface from Google Fonts, which sees your IP address when it does.
PostHog: Analytics and session replay, on its US cloud. Receives usage events, device information, your IP address and masked screen recordings. We don’t give it your account ID or email.
Firebase Analytics (Google): Receives screen navigation, device and app information, an app-installation identifier and approximate location. We don’t give it your account ID or email, and we’ve switched off the optional settings that let Google use this data for its own products and advertising.
Google Gemini API: Used only for the website’s support chat. Receives your question and the recent chat (up to your last six exchanges) to write an answer, and nothing from your account. Please don’t put personal details in your questions.
OpenAI: Checks the profile photo or banner you upload for sexual, graphically violent or self-harm content, and checks your username, display name and bio for hateful, harassing, sexual or graphically violent content when you change them. It receives the image after we’ve processed it, with location data removed, or the text you changed, but not your email or account identity. Text that our own word list has already rejected is never sent. OpenAI says data sent through its API isn’t used to train its models, and that it may keep it for up to 30 days to watch for abuse.
Deezer, TMDB, Google Books, Open Library and Genius: Our catalogues of the things you can find and rate in Stratum, such as songs, films and books, and song descriptions. Our servers send your search text to them, without your name, email or account ID. Cover art is loaded straight from their servers to your device, so they can see your IP address.
Apple and Google Play: Provide the app download. They have their own privacy policies for what they collect about you in their stores.

Other disclosures

Legal and safety. If a valid legal process requires it, to report suspected child sexual abuse and exploitation to NCMEC or law enforcement (see Our standards against child sexual abuse and exploitation), or to protect someone’s safety or our rights. We’ll only disclose what is required, and we’ll tell you first where the law allows.
Business changes. If Stratum is sold, merged or transferred, your information may move to the new owner, who must honour this policy. We’ll tell you before it becomes subject to a different one.
Your request. When you ask us to share something or give consent.
Aggregated data. Statistics that can’t identify you, such as how many people use a feature.

Analytics and on-device storage

Stratum is a mobile app, so it doesn’t use browser cookies. It does use similar technologies:

Sign-in token: A token kept in your phone’s secure storage (Keychain on iOS, encrypted storage on Android). It lasts 7 days, then you sign in again. The app can’t work without it.
Local storage: Cached daily picks, pick details, recent searches, your notification inbox (kept for 7 days) and a flag that remembers you’ve seen the intro. It stays on your device and goes when you uninstall the app. Recent searches are cleared when you sign out or delete your account. If a different account signs in, the previous account’s cache is wiped first.
Analytics identifiers: Random IDs created by PostHog and Firebase to count installations and sessions. They are not advertising IDs, and we don’t link them to your account, email or username.
Session replay: PostHog records how the app is used: the screens you open, taps, scrolling and navigation. On-screen text and images are masked, so recordings don’t show readable text, usernames, bios, photos or what you type. We use recordings to find bugs and confusing screens. They’re currently kept for 30 days. We may change that period and, if we do, we’ll update this page.
Firebase Analytics: Event data is kept for no more than 14 months, the longest Google allows.

Your choice. Stratum doesn’t have an in-app switch for analytics or session replay. You can stop collection by uninstalling the app. We don’t send PostHog or Firebase your account ID, email address or username, so analytics data isn’t linked to your account and we usually can’t tell which data is yours. That means deleting your account doesn’t delete it, and we can’t find and remove one person’s analytics data on request. It expires on its own on the schedule below. You can still object to analytics by emailing hello@joinstratum.app, and we’ll tell you what we can do. We don’t respond to Do Not Track or Global Privacy Control signals in the app, because we don’t sell your data or share it for advertising. We also don’t track you across other companies’ apps or websites, which is why Stratum doesn’t show Apple’s tracking permission prompt on iOS.

How long we keep it

Account and profile data: As long as your account exists. Deleted when you delete your account (see below).
Sign-in codes: Expire after 5 minutes and work once.
Sign-in tokens: 7 days.
Server and system logs: 7 days. This includes the text of your searches.
Daily backups: We keep the 7 most recent. Each one is overwritten within 7 days.
PostHog data: Currently 30 days. If we extend it, we’ll update this policy.
Firebase Analytics: No more than 14 months.
Content checks: To avoid re-checking the same content, we keep an irreversible fingerprint (a hash) of an image or text we’ve checked, along with the result. It can’t be turned back into your image or words.
Messages to us: As long as needed to answer you and keep a record of the request.
Reports and blocks: Kept until either account is deleted, then deleted with it. A report is also emailed to us, and that copy may stay in our inbox for as long as we need it to handle the report.
Support chat: Saved only in your browser (your last 20 exchanges) until you clear it or your browser data. We don’t keep your questions on our servers. Google processes them under its Gemini API terms.

We may keep information longer where the law requires it, or for a limited time to resolve a dispute or enforce our Terms.

Deleting your account

In the app, open your Profile, tap Settings, choose Delete account, and follow the two steps. You’ll be asked to type ERASE MY DATA before the final delete.

When you delete your account, we permanently delete your profile, collections, ratings, saves, the accounts you added, and every report and block you made or that involves you, from our live systems right away. We also remove the times other people added you, so their follower counts go down, and we delete your profile photo and banner files.

We also keep automated backups for up to 7 days so that we can recover from a system failure. Your data may remain in those backups until they are overwritten, which happens within 7 days of the deletion. We only use backups to recover from a failure, and if a backup is ever restored we delete your account again.

Deleting your account doesn’t delete analytics data. We don’t send PostHog or Firebase your account ID or email, so that data isn’t tied to your account, and it expires on its own on the schedule above. Server logs, which include the text of your searches, don’t disappear instantly either; they expire after 7 days, and if you’d like them removed sooner, email us and we’ll do what we reasonably can. We can’t delete what other people have copied from your profile, such as screenshots.

If you can’t get into the app, email hello@joinstratum.app from the address on your account with the subject “Delete my account”. We’ll confirm it’s you and delete it within 30 days.

Other controls: you can edit your profile at any time, pause notifications and manage blocked accounts in Settings, remove Stratum’s access to your Google account at myaccount.google.com/permissions, and turn off photo or notification permissions in your phone’s settings.

Your rights and choices

Wherever you live, you can ask us to give you a copy of your information, correct it, delete it, move it to another service in a common format, restrict or object to how we use it, or withdraw consent you’ve given. Most of this you can do yourself in the app. The exception is analytics data, which isn’t linked to your account, so we usually can’t find it to copy or delete it (see Analytics and on-device storage). For the rest, email hello@joinstratum.app from the address on your account so we can verify it’s you. We reply within 30 days, and if the law lets us take longer we’ll tell you why. We don’t charge for requests, unless they’re clearly excessive or repeated and the law allows a fee. We won’t treat you worse for using your rights.

EEA, UK and Switzerland

Under the GDPR and UK GDPR you also have the right not to be subject to decisions based solely on automated processing that significantly affect you (we don’t make any), and to complain to your local data protection authority. In the UK that’s the Information Commissioner’s Office. We’d appreciate the chance to fix a problem first, so please contact us.

United States

If you live in California, Colorado, Connecticut, Texas, Virginia or another state with a privacy law, you have the rights above, including the right to know what we collect. We extend them to all users, wherever they live. In the last 12 months we collected the following categories of personal information:

Identifiers: email address, username, IP address and device or installation identifiers.
Personal details: display name and bio.
App and internet activity: ratings, saves, collections, searches, reports and blocks, support chat questions, screens viewed and interactions.
Approximate location: country or city derived from your IP address.
Photos and visual information: profile photo, banner and masked screen recordings.

We get these from you, your device and Google (if you use Google sign-in). We use them for the purposes in “How we use your information” and disclose them only to the service providers listed above, for business purposes. We have not sold personal information or shared it for cross-context behavioural advertising in the last 12 months. We don’t intentionally collect sensitive personal information as defined by US state laws, and we don’t use your email and one-time code for anything beyond signing you in.

If we decline a request, you can appeal by replying to our response or emailing us with “Appeal” in the subject. We’ll answer within 45 days. You may also contact your state attorney general. An authorised agent can make a request for you with your written permission. We don’t disclose personal information to third parties for their own direct marketing.

Nigeria

Under the Nigeria Data Protection Act 2023, you have the right to be informed about how we use your data, to access, correct and delete it, to restrict or object to its use, to receive it in a portable format and not to be subject to solely automated decisions with significant effects. You can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

Everywhere else

If your country gives you additional rights, for example in Canada, Australia or Brazil, email us and we’ll honour them to the extent they apply.

Age limit

Stratum is for people who are 16 or older. When you create an account, you confirm that you’re at least 16. The app isn’t directed at children, and we don’t knowingly collect personal information from anyone under 16. If we learn that we have, we’ll delete the account and its information promptly. If you’re a parent or guardian and think your child has an account, email us.

Our standards against child sexual abuse and exploitation (CSAE)

Stratum: Music, Movies, Books (“Stratum”), built and operated by Jeffrey Inyang, has zero tolerance for child sexual abuse and exploitation (CSAE). This section is our published child safety standard. It applies to every account and to everything anyone puts on Stratum.

By CSAE we mean any content or behaviour that sexually exploits, abuses or endangers children. That includes grooming a child for sexual exploitation, sextorting a child, trafficking a child for sex, and child sexual abuse material (CSAM): any visual depiction of a minor in sexually explicit conduct, including photos, videos and computer-generated images. For these standards, a child is anyone under 18, wherever they live and whatever the local age of consent.

What isn’t allowed

CSAM in any form, including drawn, edited or AI-generated images, in a profile photo, a banner or anywhere else on Stratum.
Sexualising a child or a minor in a username, display name, bio, collection name or description, or in any other text.
Using Stratum to groom, sextort, traffic or otherwise sexually exploit or endanger a child, or to contact a child for any of those purposes.
Sharing or linking to CSAM, asking for it, or pointing people to where they can find it.

How Stratum limits the risk

Age limit. Stratum is for people who are 16 or older, and you confirm that when you sign up (see Age limit). We don’t verify age, so some of our users are 16 or 17, and we can’t promise that no younger person has an account. That is why these standards protect every user under 18, and why we delete any account we learn belongs to someone under 16.
No private channels. Stratum has no direct messages or group chats, no location sharing, and no way to send images or files to another person. The only images a person can upload are a profile photo and a banner.
Signed-in users only. Profiles, ratings and collections can be seen only by people with a Stratum account.
Automated checks. Profile photos and banners you upload are checked for sexual content before they’re saved, and usernames, display names and bios are checked when you change them (see How we use your information). These checks are not designed to detect CSAM, and we don’t rely on them for that. We rely on reports and on our own review.
Report and block. Anyone can report or block any account in a couple of taps.

How to report a concern

In the app. Open the person’s profile, tap the three dots, choose Report and pick the closest reason: Inappropriate photo, Inappropriate name or bio, or Other. Only we see your report, and the person you report isn’t told. You can also block the account from the same menu.

By email. Write to hello@joinstratum.app with “Child safety” in the subject line and tell us the username and what you saw. Please don’t attach or forward images or other material that may be CSAM, and don’t share it with anyone else. Describe where you saw it instead, and report it to the authorities listed below.

What we do when we find or are told about CSAE

We treat any report that involves a child as urgent and review it ahead of other reports.
We remove the content and delete the account responsible.
We report apparent CSAM and other child sexual exploitation to the US National Center for Missing & Exploited Children (NCMEC) through its CyberTipline, and to the relevant law enforcement authorities, as the law requires. We also cooperate with valid investigations.
We keep the content and account information that the law requires us to preserve for an investigation, with access limited to us and the authorities, even if the account is later deleted. Deleting an account doesn’t stop us from doing this.
We don’t tell the account we act on who reported it.

The law

We follow the child protection and anti-exploitation laws that apply to us, including Nigeria’s Cybercrimes (Prohibition, Prevention, etc.) Act 2015 and, because our servers are in the United States, US law on reporting child sexual abuse material. We may share information to meet these duties (see Who we share it with).

Our child safety contact

Our designated child safety contact is Jeffrey Inyang, who can speak to our child safety practices and our compliance with these standards. Email hello@joinstratum.app with “Child safety” in the subject line. Law enforcement agencies and child protection organisations can use the same address.

Reporting outside Stratum

If a child is in immediate danger, contact your local emergency services first. You can report suspected CSAM, or the sexual exploitation of a child, anywhere online to NCMEC’s CyberTipline at report.cybertip.org, or to a hotline in your own country through INHOPE at inhope.org.

These standards will change as Stratum does. If we ever add features that let people message each other, share images or meet in new ways, we’ll update this section, and add protections to match, before the feature launches.

Security

We protect your information with measures that include HTTPS encryption in transit, secure on-device storage for your sign-in token, passwordless sign-in with expiring one-time codes, rate limits against guessing and abuse, a database that isn’t reachable from the public internet, and re-encoding of uploaded images. No system is perfectly secure, so we can’t promise absolute security. If a breach puts your information at risk, we’ll tell you and the relevant authorities as the law requires.

Where your information is stored

Your information is stored and processed in the United States: our servers and database run on AWS in Ohio, and our other providers, including Cloudflare, PostHog, Resend and Google, mainly operate there too. We run Stratum from Nigeria, so we access it from there. The laws in these countries may differ from the laws where you live. By using Stratum from outside the United States, you understand your information will be transferred to and processed in the United States and Nigeria.

Where the law requires safeguards for these transfers, we and our providers rely on mechanisms such as the EU–US Data Privacy Framework or standard contractual clauses, where applicable, and on contracts that limit how providers can use your information.

Our website

This policy is hosted on joinstratum.app. When you visit the website:

Hosting. The site is hosted by Vercel, which receives your IP address and browser details to deliver pages.
Analytics. We use Vercel Web Analytics and Speed Insights to measure page views and loading performance. We also use Google Analytics to count visits and see how people find us, but only if you accept it in the cookie banner. If you accept, Google Analytics sets cookies and records pages visited, browser and device, and approximate location. If you reject, or haven’t chosen yet, it doesn’t load and sets no cookies. You can change your choice at any time with . Your choice is saved in your browser, and we ask again after 12 months.
Support chat. The support page lets you ask a question and get an AI-written answer. Your question, and up to your last six exchanges for context, go to our server and then to Google’s Gemini API, which writes the reply. We don’t store them on our servers. Your chat is saved only in your browser, and the server uses your IP address briefly to limit how many questions one person can ask. Please don’t include passwords, sign-in codes or other personal details. Answers can be wrong, so for anything important talk to a human.
Store and social links. Buttons that take you to the Apple App Store, Google Play, X, Instagram or TikTok open those services, which have their own privacy policies.

Changes to this policy

We’ll update this policy when our practices change. The date at the top shows when it last changed. For material changes we’ll tell you in the app or by email before they take effect. If we ever add advertising, advertising identifiers, new analytics or other new uses of your information, we’ll update this policy first, give you notice and ask for your consent where the law requires it.

Contact us

Questions, requests or complaints? Email hello@joinstratum.app.

Jeffrey Inyang, operating as Stratum
Abuja, Nigeria