What ToJoy stores, why it stores it, and what deletion means.

ToJoy is designed around private, real-identity social interaction rather than ad-targeting. This policy explains the core data categories the service uses at launch and the main reasons they are processed.

1. Information you provide

At launch, ToJoy stores the information needed to operate your account and the social graph: email address, real name, immutable handle, optional bio, invites, posts, comments, mentions, reports, blocks, and profile or post images you choose to upload.

2. Billing and entitlement data

Subscription entitlement state is stored so ToJoy can determine whether your account has active access. Apple purchase verification data, transaction identifiers, and server notification events may be stored for fraud prevention, entitlement recovery, billing review, and auditability.

3. Operational and safety data

ToJoy stores moderation reports, block relationships, notification records, analytics events, and operational logs needed to secure the service, detect abuse, review account issues, and understand whether the product is healthy enough to run as a paid network.

4. Why ToJoy processes data

to authenticate you and maintain account access
to render the social graph, feed, profiles, comments, and notifications
to process subscriptions and entitlement changes
to investigate reports, abuse, fraud, and platform misuse
to support deletion requests, billing recovery, and operational review

5. Deletion and retention

You can request account deletion in-app. When deletion happens, ToJoy revokes social access and marks the account as deleted. The launch retention baseline is:

profile visibility, posting access, invites, and social activity are disabled immediately
deleted or suspended accounts stay excluded from public and member-facing surfaces immediately
moderation reports, audit actions, operational logs, and billing or entitlement records may be retained for up to 12 months for fraud prevention, abuse investigation, accounting integrity, and legal obligations
records tied to a live suspension may be kept for the duration of that suspension and for a limited follow-up period after resolution
ToJoy may retain data longer when required by law, security investigation, or unresolved payment disputes

6. Contact

This early build does not yet operate a public privacy inbox. For now, see the Support page for the current member-facing state and the remaining launch gap before public release.