TBC Privacy Policy

1. Plain-English summary

• What we collect: account credentials (username, email, password — password handled by Google Firebase Authentication), the optional profile information you choose to add (display name, biography, profile photo), the videos and metadata you upload, and your activity inside TBC (Cliffs you watch, react to, continue, favorite, follow).
• What we don't collect: phone number, date of birth, real name, mailing address, contacts, location, advertising identifiers, browsing history outside our app.
• Permissions the app asks for: camera, microphone, and your photo / video library — only to record or upload Cliffs and (optionally) to set a profile photo.
• Where it lives: our backend database and object storage (Cloudflare R2). Email is delivered via Google Workspace.
• Automated analysis: uploaded videos are scanned on our private servers for unsafe content (NSFW), spoken transcripts, scene summaries, and on-screen characters. No third-party AI vendor sees your content.
• Activity analytics: we measure how Cliffs and creators perform on TBC — including the Serial Momentum Index (SMI) — to power recommendations, surface promising stories, and (in the future) measure sponsored StoryWorld performance for brand partners. We do not run third-party advertising or attribution SDKs.
• You can delete your account at any time by emailing privacy@2bc.app while we finish building the in-app delete control.

2. Information we collect

Information you provide

• Account information. When you create an account we collect a username, email address, and password. Authentication is handled by Google Firebase Authentication; your password is stored by Firebase and never stored in cleartext on our servers.
• Profile information (optional). You can add a display name, a short biography, and a profile photo. You can leave any of these blank, and you can change or remove them at any time. Your profile information is visible to other users when they view your profile or your Cliffs.
• Content you upload. The videos (“Cliffs”) you record or upload, plus the title, description, tags, and parent-Cliff reference you provide.
• Communications. Messages you send to support@2bc.app and other support channels.

We do not collect: real name, date of birth, phone number, mailing address, contacts, calendar, browsing history outside our app, or precise device location.

Information we collect automatically

• Account activity. Account creation, last-login, and last-activity timestamps; whether your email is verified.
• Content you generate by using the Services. Cliffs you publish, reactions you give (like / favorite / dislike), Cliffs you continue, comments you post, the creators you favorite (favoriting a user is the same as following them on TBC), story-graph relationships, and group memberships you join.
• Activity and engagement metrics. Aggregated counts of plays, completions, reactions, comments, follows, and continuations on each Cliff and StoryWorld; the timestamps and graph relationships needed to compute your Serial Momentum Index (SMI) and other narrative-impact metrics; and aggregated performance metrics for sponsored StoryWorlds.
• Server logs. When your device contacts our API we record the request method, URL path, response code, timestamp, and the IP address that made the request, for security, abuse-prevention, and operational debugging.
• Generated artifacts. Thumbnails, transcoded video renditions, transcripts, on-screen text, character embeddings, scene summaries, and content-moderation flags produced by our automated analysis pipeline.

Permissions the mobile app requests

We do not request location, contacts, calendar, motion, Bluetooth, or App Tracking Transparency permissions in the current version of the app.

Information from third-party sources

When you sign in, Google Firebase Authentication handles credential verification on our behalf and returns an identity token to our backend. We receive the Firebase user ID, the email address you signed up with, and email-verification status. Firebase's own handling of your credentials is governed by Google's Privacy Policy.

3. How we use your information

• Operate the Services — host your account, store and play back the Cliffs you upload, render the StoryBoard graph, and run the social features (favorites, follows, comments, continuations).
• Personalize your experience — recommend Cliffs, StoryWorlds, and creators that fit what you've already engaged with on TBC, including the people you follow.
• Measure narrative impact — compute the Serial Momentum Index (SMI) and related metrics that score how a Cliff's story is being continued, reacted to, and built upon by other creators.
• Power sponsored StoryWorlds — when a brand creates a sponsored StoryWorld on TBC, we will share aggregated, anonymized performance reports with the sponsor. Sponsors do not receive your identity, profile, contact information, or browsing history.
• Keep TBC safe — detect spam, abuse, and content that violates our Content Policy, including by running automated NSFW screening on uploads.
• Communicate with you — send transactional email (sign-up confirmation, password reset, security notices) via our SMTP relay.
• Provide support — respond to your messages and troubleshoot issues.
• Comply with law — meet our legal obligations and respond to valid legal process.
• Improve the Services — analyze aggregate, de-identified usage patterns to fix bugs and prioritize features.

We do not use your information for cross-context behavioral advertising, we do not run third-party advertising or attribution SDKs, and we do not sell your personal information.

4. Automated content analysis

When you upload a Cliff, our content-analysis pipeline processes the video to make TBC usable and safe. The pipeline runs on infrastructure we operate; your videos are not sent to a third-party AI service. The pipeline produces:

• Moderation signals using NudeNet to detect explicit nudity. Cliffs flagged as explicit are blocked from the public StoryBoard; other flags may be reviewed by our trust & safety team.
• Speech transcripts using Whisper, used for search, accessibility (closed-caption generation), and moderation review.
• Scene summaries using a vision-language model (Qwen3-VL) to power search and recommendations.
• Character recognition using face-detection and face-embedding models. Embeddings are numeric vectors, not photographs, and are scoped to your StoryWorlds.

These signals are stored alongside the Cliff record. If you delete a Cliff, the derived analysis artifacts are deleted with it.

5. How we share your information

• With other users. Your username, the Cliffs you publish, and your reactions are visible to other users in accordance with the publish settings of the StoryWorld they belong to. Cliffs in a StoryWorld marked private are visible only to its members.
• With our service providers — see §6.
• For legal reasons. When we believe in good faith that disclosure is necessary to comply with the law, respond to valid legal process, protect rights and property, address fraud or abuse, or protect the safety of users or the public.
• In a corporate transaction. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets. We will notify you if your information becomes subject to a different privacy policy.
• With your consent for any other purpose we describe to you.

We do not sell your personal information for money. Because we run no third-party advertising or analytics SDKs, we do not “share” personal information for cross-context behavioral advertising as that term is defined under the California Consumer Privacy Act.

6. Third-party service providers

We use the following categories of third-party providers to operate the Services. Each provider acts as our processor, is bound by a contract, and may use the information we send only to provide the service to us.

We do not run third-party analytics, crash-reporting, advertising, attribution, push-notification, or A/B-testing SDKs in the current version of our apps. If we ever introduce one, we will update this policy before doing so.

7. Tracking & advertising identifiers

TBC does not currently track you across other companies' apps and websites. We do not access Apple's IDFA or Google's Advertising ID, do not run advertising SDKs, and do not sell or share personal information for cross-context behavioral advertising.

Because we do not engage in tracking as defined by Apple's App Tracking Transparency framework, the iOS app does not present an ATT prompt at this time. If we ever introduce third-party analytics, advertising, or attribution that would qualify as “tracking,” we will update this policy, present an ATT prompt on iOS, and respect your choice.

Our website may set a small number of strictly necessary cookies; see our Cookie Policy for details.

8. Apple App Store disclosures

The table below summarizes the data the TBC iOS app collects, mapped to Apple's Privacy Nutrition Label categories.

9. Google Play data safety

Google Play security practices

• Encryption in transit: all traffic between the TBC app and our servers is encrypted using HTTPS / TLS.
• Encryption at rest: the videos and thumbnails you upload are stored in Cloudflare R2, which encrypts all object data at rest by default.
• Data deletion: users can request deletion of their account by emailing privacy@2bc.app.
• Families Policy: the TBC app is not designed for or directed at children. We comply with Google Play's Families Policy and the U.S. COPPA.

10. Data retention

• Account information. Retained for as long as your account is active. If you delete your account, your personal information (username, email, profile photo, biography, follows, reactions, and viewing history) is purged within 30 days, and the account record is removed from backups on the next rotation cycle (no longer than 90 days).
• Published Cliffs. Because TBC is a collaborative storytelling platform, your published Cliffs are not deleted when you delete your account. They remain on TBC as anonymous contributions to the stories other creators have built on. Your username on those Cliffs is replaced with a generic [deleted] label, and the personal identifiers attached to them are severed. The video files, thumbnails, and derived analysis artifacts (transcripts, embeddings, moderation flags) are retained so that StoryBoard branches that continue from your work do not break. See §11 for an exception process for individual Cliffs.
• Cliffs you delete yourself. A Cliff you delete yourself (while your account is active) is removed from public view immediately, deleted from R2 storage within 30 days, and purged from backups on the next rotation cycle (no longer than 90 days).
• Server logs. Retained for up to 90 days for security and debugging, except where a longer period is required for an active investigation.
• Email correspondence. Retained as long as necessary to provide support and resolve disputes.

11. Account & data deletion

By email (current method)

Email privacy@2bc.app from the address associated with your account and ask us to delete it. We will confirm the request, complete the deletion within 30 days, and reply when it is done. We may need to verify your identity first.

In the app (coming soon)

We are building an in-app account-deletion control reachable from Profile → Settings → Delete account. This control will be available before our public app-store launch.

What happens when you delete

• Your username, email, profile photo, biography, follows, favorites, likes / dislikes, viewing history, and group memberships are purged from our database.
• Your Firebase Authentication record is deleted from Firebase.
• Backup copies of the deleted personal data are purged on our standard rotation cycle (no longer than 90 days).
• Your published Cliffs remain on TBC as anonymized contributions attributed to a generic [deleted] label, so the StoryBoard graph that other creators have continued from your work is not broken. Their video files, thumbnails, transcripts, embeddings, and moderation flags are retained for that purpose.
• Information we are legally required to keep is retained only for the period required by law.

Removing an individual Cliff after account deletion

If a specific Cliff that has been retained as an anonymous contribution should be removed — for example, because it depicts an identifiable person who objects to its retention, because the content has become defamatory or non-consensual, or because you are exercising a right of erasure under the GDPR or UK GDPR — email privacy@2bc.app with the Cliff URL and the reason for removal. We will review the request under applicable law (including the balancing test in Article 17(3) GDPR) and respond within 30 days.

12. Your privacy rights and choices

Depending on your location, you may have the right to:

• Access a copy of the personal information we hold about you.
• Correction of inaccurate or incomplete information.
• Deletion of your personal information, subject to legal exceptions.
• Portability — receive your information in a structured, machine-readable format.
• Objection or restriction of certain processing.
• Opt out of any future “sale” or “sharing” of personal information (TBC currently does neither).

How to exercise your rights

Send your request to privacy@2bc.app from the email address associated with your account. We will respond within the timeframes required by applicable law and will not discriminate against you for exercising any right.

13. Regional disclosures (US, EEA, UK)

California (CCPA / CPRA), Colorado, Connecticut, Virginia, Texas and other US states

If you reside in a US state with a comprehensive privacy law, you have the right to know, access, correct, delete, port, and opt out of any “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined in those laws.

We honor the Global Privacy Control (GPC) signal as a valid opt-out.

European Economic Area, United Kingdom, and Switzerland

If you are located in the EEA, UK, or Switzerland, our legal bases for processing are:

• Contract performance — to provide the Services under our Terms of Use.
• Legitimate interests — to keep TBC safe (including running NSFW screening on uploads), prevent fraud and abuse, and improve the Services.
• Consent — for any optional processing we describe to you, which you can withdraw at any time.
• Legal compliance — to satisfy legal obligations.

You have the right to lodge a complaint with your local data protection authority.

14. Security

We protect your information with the following measures:

• Encryption in transit. All traffic between our apps and our API is served over HTTPS / TLS.
• Encryption at rest. The videos and thumbnails you upload are stored in Cloudflare R2, which encrypts all object data at rest by default.
• Authentication. Sign-in is handled by Google Firebase Authentication and credentials are never stored in cleartext on our servers.
• Signed media URLs. Video and thumbnail downloads are gated by short-lived signed URLs (HMAC-SHA256) issued by our backend.
• Network isolation. Our content-analysis pipeline runs over a private overlay network; analysis services are not exposed to the public internet.
• Access control. Production database and storage credentials are restricted to the backend service.

No system is perfectly secure. You are responsible for keeping your account credentials safe and should notify us at support@2bc.app immediately if you suspect unauthorized access.

15. International data transfers

TBC is operated from the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States. Where we transfer personal information out of the EEA, UK, or Switzerland we rely on appropriate safeguards such as the Standard Contractual Clauses approved by the European Commission and the UK ICO.

16. Children's privacy

Our Services are not directed to children under 13 (or the higher minimum age required in your country) and we do not knowingly collect personal information from children under that age. If you are under 13, please do not use the Services or provide any information to us.

If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete that information promptly. If you believe we have collected information from a child under 13, contact privacy@2bc.app.

Users between 13 and 18 must have permission from a parent or legal guardian to use our Services. We comply with the U.S. COPPA, the Google Play Families Policy, and Apple's Kids Category requirements.

17. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes — including any future addition of analytics, advertising, or tracking — we will notify you by email, an in-app notification, a notice on our Services, or another appropriate means, and give you a reasonable opportunity to review the changes before they take effect.

18. Contact us

TBC Media, LLC
4700 Belleview Avenue, Suite 300
Kansas City, Missouri 64112
Privacy: privacy@2bc.app
Data Protection Officer: dpo@2bc.app