Rate your rip.

Traf Privacy Policy

Last updated: 13 September 2026

This policy explains what data Traf collects, why we collect it, and what we do with it.

Who we are

Traf is operated by Cook My Fish Limited, a company registered in England and Wales, number 12100140, whose registered office is 79 Fawe Park Road, London, England, SW15 2EG. Cook My Fish Limited is the data controller for the personal data described below. Contact: hello@gettraf.app.

What we collect

When you use Traf, we collect:

• Account information: your first name, last name, username and email address. We use email for sign-in via a one-time code.
• Audio recordings you submit. Each recording is stored in our private Supabase storage bucket, accessible only to members of leagues you belong to.
• Acoustic features derived from your recordings: duration, peak loudness, RMS loudness, onset count, envelope shape, and numeric measurements produced by our scoring service. These are measurements, not audio.
• Photographs you choose to upload, if you generate a profile portrait. We keep the photo you supply and the generated portrait.
• Content you post: comments, chat messages, images and stickers attached to them, rip titles you write, reports you file, and who you have blocked.
• League and challenge activity: which leagues you create or join, when you submit recordings, peer ratings you give and receive, challenges and their outcomes.
• Feedback you send us through the in-app feedback form.
• Device-level metadata required to run the app: microphone permission status, and a push notification token if you allow notifications.
• Presence: a timestamp of when you were last active, so leagues can show who is online.

We do not collect:

• Your contacts.
• Your location.
• Browsing or device usage outside the app.
• Advertising identifiers (IDFA / AAID).
• Any payment information.

How we use it

• To run the app: sign you in, show you your leagues, deliver ratings, surface the leaderboard, and send notifications you have opted into.
• To rate submissions: your recording is sent to our scoring service and to Google's Gemini API, which listen to the audio to check it is genuine and to score it. A short written title and commentary are then generated by Anthropic's Claude API from the resulting scores.
• To generate a profile portrait, if you ask for one: the photograph you upload is sent to Google's Gemini API to produce the portrait, and the generated portrait is sent to Anthropic's Claude API to produce your profile title.
• To enable peer ratings and playback: your audio submissions are accessible to the other members of leagues you have joined, played back via short-lived signed URLs.
• To keep the app safe: we screen posted text against a list of prohibited terms, act on reports, and honour blocks.
• To fix problems: crash reports and in-app feedback.

We do not use your data to train AI models. We do not sell your data.

Who we share it with

We use the following processors. Each receives only what is listed.

We do not share your data with anyone else.

How long we keep it

• Audio recordings, ratings, photographs, comments and league memberships: as long as your account exists.
• Rejected recordings (those that fail server-side validation): deleted immediately.
• Reports you file: kept while the report is open and for a reasonable period after it is resolved, so repeat behaviour can be recognised.
• If you delete your account, everything above is removed. See below.

Deleting your account

You can delete your account from inside the app: Profile → Delete account. This removes your profile, recordings, photographs, comments, ratings, challenges and league memberships. It cannot be undone.

Two things survive deliberately, and neither identifies you:

• Frozen season results. Past season leaderboards keep the name you had at the time, because a historical result that silently rewrites itself is not a result. The row no longer links to an account.
• The bare record of any report filed about you, closed and marked as relating to a deleted account. It holds no name, handle or content. The reported item itself is deleted with everything else.

You can also email us to request deletion, and we will action it within 30 days.

Your rights

You can:

• See the data we hold about you, email us.
• Export your data, email us.
• Delete your account and all associated data, in the app, as above, or by email.

Under UK GDPR, you also have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk/).

Children

Traf is not intended for children under 13. We do not knowingly collect data from anyone under 13.

Changes to this policy

If we change this policy materially, we will notify users via the app before the change takes effect. The "Last updated" date at the top of this page reflects the most recent change.

Contact

Questions or requests: hello@gettraf.app