Penpal America Privacy
Penpal America is operated by Tick Waves Limited. This Privacy Policy explains, in plain language, how we handle information used to provide the Penpal America social communication platform.
This page is intended to support transparency for users of Penpal America. It should be read together with our Terms and Conditions.
We collect information you provide when creating and managing your account, including username, email address, date of birth, location, country, bio, interests, languages, profile photo, gallery media, messages, reports, support requests, subscription status, and settings.
We use information to provide authentication, user discovery, messaging, voice and video calls, profile features, moderation, safety tools, subscriptions, notifications, support, analytics, fraud prevention, and service improvement.
Penpal America processes user-generated content such as messages, images, videos, voice notes, profile details, reports, and support tickets so the platform can function and so safety and moderation features can be provided.
Paid subscriptions are handled through payment providers such as Stripe. Penpal America does not collect card details inside the app. We may store subscription identifiers, plan status, renewal information, and billing portal references needed to manage access.
We may review reports, profile content, gallery media, messages, and account activity where needed for safety, abuse prevention, moderation, legal compliance, and enforcement of our Terms and Conditions.
We do not sell your personal information. We may share information with service providers that help operate the platform, such as hosting, email, payments, analytics, notifications, security, and lawful authorities where required.
The Android app may show banner ads through Google AdMob for users who are not on a Plus subscription. We request non-personalized ads and may use Google's consent tools where required, including for users in the EEA. Google and its partners may process device identifiers, approximate location, app activity, and ad interaction data to deliver, measure, and protect ads.
We use technical and organisational measures to protect user information, including password hashing, authentication controls, secure environment configuration, and access restrictions. No online service can guarantee absolute security.
You can manage profile details, privacy controls, notifications, subscriptions, blocked users, and account settings in the app. You may also request account deactivation, deletion, or a copy of your data where supported.
For privacy questions or requests, contact Tick Waves Limited at support@penpalamerica.com. This address may be updated from time to time.
Effective 10 November 2026 · Revision video-stories-legal-2026-11-09-v2
Tick Waves Limited operates Penpal America. Video Stories is optional and uses YouTube API Services. You submit through your own Post or Wall, rather than supplying access to a personal Google account. The official channel controller separately authorises the Penpal America YouTube connection.
The video form presents two independent publication choices: (1) publication on Penpal America, subject to normal Post/Wall moderation and visibility rules; and (2) submission for publication on the official social destination after administrator approval. YouTube is the only available social publication destination for this rollout. Facebook and TikTok publication are not active. Choose either destination or both. Ordinary posting does not authorise YouTube publication. A YouTube-only choice keeps the originating video out of other members’ normal Wall, Post, media and comment access; authorised administrators can still review it. A YouTube Story appears in Penpal America’s public Video Stories collection only when you also select Penpal America publication. YouTube-only consent does not authorise that local display.
We record the exact video reference, your member identity, selected destinations, title, description, requested YouTube visibility, audience designation, consent wording/version and timestamp, and acceptance of the identified Terms and Privacy revision. We also record necessary moderation decisions, administrator identity, timestamps and publication outcomes. Do not submit private information that you do not intend to disclose, or information about others without the necessary permission.
We store an unpublished processing copy privately, with access restricted to the submitting member, authorised administrators and necessary processing services. Approval is required before any YouTube upload. When live publication is separately enabled, approval queues an automatic upload to Penpal America’s official YouTube channel. It is not an administrator manual-upload service.
You select visibility. The initial launch accepts only explicitly selected Public YouTube submissions for approval and upload. Private and Unlisted selections are not converted to Public and do not authorise a future upload. Public videos, their approved titles/descriptions and permitted member display-name attribution can be viewed, embedded and shared outside Penpal America. If you also select Penpal America publication, we may display the confirmed public video through a YouTube player in Video Stories. Pending, rejected, withdrawn and private processing media are not public Video Stories.
We send the selected video, approved metadata and audience/visibility settings to Google/YouTube for the authorised operation. Google processes data under its Privacy Policy and YouTube Terms, including where its infrastructure is outside your country. Necessary hosting and backup providers process application data for us under our access controls. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google account data or use it for advertising, profiling, model training or unrelated purposes. Advertising and other services described elsewhere in this Policy are separate; they do not receive stored OAuth credentials through Video Stories.
The channel controller’s Option A connection requests youtube.upload to upload approved content, and youtube.readonly to verify the official channel and read upload/processing/visibility information. It does not request permission to edit or delete existing YouTube videos. Tokens are encrypted on the server, never embedded in the website or Android app, and restricted to authorised backend functions. Only authorised administrators can initiate account connection or review submissions. Relevant authorised staff may inspect necessary operational information for support, moderation, security or legal obligations; secret tokens are not shown in ordinary status screens or logs.
The controller can request disconnection through the protected administration/support process and can revoke access in Google Account permissions. Disconnection stops new authorised operations. We delete applicable stored Google authorisation/API data on the applicable provider-policy timetable, including within seven days after a verified deletion request or revocation notification, and refresh or delete stale API data within 30 days as required. These periods do not authorise retaining stale provider data in moderation records or backups. Local cleanup does not itself revoke Google’s permission, and restoring an encrypted backup does not reverse Google-side revocation. A legacy grant awaiting an explicitly authorised migration is not silently replaced.
You can withdraw a nomination before the external upload attempt begins. We then block upload. Once an attempt has started, an upload may already exist even if its response was lost; we suppress local public display and open an administrator-assisted removal/reconciliation case. We do not retry an uncertain upload blindly.
Option A does not automatically delete YouTube videos or change their privacy. An authorised channel administrator must handle an approved external removal through YouTube Studio and record evidence of the result. Removing a Penpal America copy or requesting takedown does not prove YouTube removal and cannot recall copies others have shared. The Wall tracking entry remains while a Penpal America or recorded social copy exists, or an external outcome remains unresolved. An individual deletion link is hidden only after its corresponding removal succeeds. Ordinary Post/Wall expiry and deletion rules remain separate and unchanged.
Subject to the approved operational schedule:
• Abandoned temporary processing uploads are removed after 24 hours.
• Pending nominations expire after 30 days without resolution. Approved nominations not started within 30 days of approval expire and cannot subsequently upload under that consent.
• Rejected or withdrawn private processing copies are removed within seven days of the decision/withdrawal. A closed nomination deletion request can trigger earlier cleanup.
• After confirmed successful YouTube publication, the additional private processing copy is removed within 24 hours. An independent ordinary Post copy follows existing Post/Wall rules.
• Known failed attempts retain processing media for up to seven days. Uncertain outcomes require review within 30 days; unresolved case records remain for reconciliation, but this does not justify indefinitely retaining raw processing media.
• Minimum non-Google-derived consent/moderation evidence is retained for up to 365 days after the case is resolved, then personal fields are removed. A documented, necessary hold can last at most 90 days at a time and must be reviewed; it does not extend Google-specific deletion deadlines. Unresolved external-copy records retain only information necessary for the removal/reconciliation case.
• Private scheduled cleanup records failures for operational attention. Protected backup copies containing affected Video Stories/Google data must expire or be sanitised on the approved schedule, ordinarily within seven days; verified deletion requests include affected backup handling. Mixed customer backups are never indiscriminately deleted: operators must establish a verified replacement and approve the exact affected archive. A restore must replay deletion records before serving restored data.
Deletion means logical removal from active storage and the controlled backup lifecycle; we do not promise forensic erasure of underlying hardware. Temporary delays or failures are escalated for correction rather than represented as successful deletion. Necessary legal preservation must be documented and limited, and cannot be used as a blanket exception to provider requirements.
The public page permits an embedded player only when current YouTube verification confirms eligible Public playback and a Not Made for Kids status, consistent with the submission’s audience designation. Made-for-Kids videos and videos with unknown audience status use a link to watch on YouTube instead; no embedded player or YouTube thumbnail is loaded for them. For eligible embedded videos, the public page does not load a YouTube player until you choose Load video and accept the linked notices. Loading transfers device/network information to YouTube and may involve cookies or similar technologies. Privacy-enhanced embedding does not eliminate third-party processing. Playback is subject to Google’s policies and the YouTube Terms. We do not promise that a public video remains available indefinitely.
For consent withdrawal, local data deletion, external takedown or privacy questions, use the submission controls or contact support@penpalamerica.com, identifying the relevant submission without sending passwords or tokens. Tick Waves Limited handles these requests and explains any necessary, limited continued retention.
