Penpal America Privacy
Penpal America is operated by Tick Waves Limited. This Privacy Policy explains, in plain language, how we handle information used to provide the Penpal America social communication platform.
This page is intended to support transparency for users of Penpal America. It should be read together with our Terms and Conditions.
We collect information you provide when creating and managing your account, including username, email address, date of birth, location, country, bio, interests, languages, profile photo, gallery media, messages, reports, support requests, subscription status, and settings.
We use information to provide authentication, user discovery, messaging, voice and video calls, profile features, moderation, safety tools, subscriptions, notifications, support, analytics, fraud prevention, and service improvement.
Penpal America processes user-generated content such as messages, images, videos, voice notes, profile details, reports, and support tickets so the platform can function and so safety and moderation features can be provided.
Paid subscriptions are handled through payment providers such as Stripe. Penpal America does not collect card details inside the app. We may store subscription identifiers, plan status, renewal information, and billing portal references needed to manage access.
We may review reports, profile content, gallery media, messages, and account activity where needed for safety, abuse prevention, moderation, legal compliance, and enforcement of our Terms and Conditions.
We do not sell your personal information. We may share information with service providers that help operate the platform, such as hosting, email, payments, analytics, notifications, security, and lawful authorities where required.
The Android app may show banner ads through Google AdMob for users who are not on a Plus subscription. We request non-personalized ads and may use Google's consent tools where required, including for users in the EEA. Google and its partners may process device identifiers, approximate location, app activity, and ad interaction data to deliver, measure, and protect ads.
We use technical and organisational measures to protect user information, including password hashing, authentication controls, secure environment configuration, and access restrictions. No online service can guarantee absolute security.
You can manage profile details, privacy controls, notifications, subscriptions, blocked users, and account settings in the app. You may also request account deactivation, deletion, or a copy of your data where supported.
For privacy questions or requests, contact Tick Waves Limited at support@penpalamerica.com. This address may be updated from time to time.
Revision: video-stories-legal-2026-11-11-v3. These provisions apply to new unified Video Stories. Historical posts and submissions keep their recorded choices and applicable earlier notices; they are not converted into new consent.
Earlier Video Stories Privacy notice
Members create video-only Stories. My Penpal Wall is a required destination. After administrator approval, the hosted video is available to its creator and accepted friends under existing account, friendship and blocking rules. It is not placed in Penpal America's public Video Stories feed. Selecting YouTube does not broaden Wall access or add this new Story to that public feed. Public YouTube content can independently be viewed, shared or embedded outside Penpal America.
YouTube publication is optional and unchecked by default. Only an explicit member choice, valid rights/policy acknowledgements, deliberately selected Public visibility and audience designation, and administrator approval can authorise an upload. The initial launch supports Public only; visibility and audience are never preselected. Facebook and TikTok publishing are inactive and cannot be selected. Members do not connect their own Google accounts.
We store the video in private application storage, its caption, creator reference, chosen destinations, exact consent text/version, legal revision, confirmations and timestamp. Where YouTube is chosen, we also store title, description, audience, visibility and the minimum provider identifiers and status needed to verify an upload. Necessary staff can review content, record decisions and handle support/removal. Unapproved media and internal moderation evidence are not public. Transactional notifications report actual approval, rejection, publication or removal status.
The authorised official-channel controller separately connects YouTube using youtube.upload and youtube.readonly. Access is used to verify the channel and upload approved, opted-in videos, and to read processing and visibility results. OAuth credentials are encrypted server-side, never embedded in clients or ordinary logs, and restricted to authorised operations. Google processes authorised media/metadata under its Privacy Policy and YouTube terms. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including Limited Use. We do not sell Google account data or use it for advertising, profiling, model training or unrelated purposes.
The controller can request disconnection through protected administration/support or revoke access in Google Account connections. Applicable Google credentials/API data are removed within seven days of a verified deletion request or revocation notification; stale API data are refreshed or deleted within 30 days as required. Local backup restoration does not undo Google-side revocation. A new consent must not silently overwrite an unrelated grant.
Required Wall selection at creation does not remove subsequent deletion rights. Members may request local removal. Withdrawing YouTube consent before an external attempt blocks that upload without removing a separately active Wall copy. After an external attempt starts, removal requires administrator-assisted YouTube Studio action and provider reconciliation. Option A cannot automatically delete YouTube videos or change their privacy. Removing a local copy does not prove external deletion; removing an external copy does not delete an active Wall copy. Unknown external outcomes retain a private management case; a public/local entry is not retained when no legitimate destination remains active.
Temporary uploads expire after 24 hours. Unresolved pending submissions and approved submissions not actually published expire after 30 days. Rejected, withdrawn or known failed private processing copies are cleaned within seven days, subject to an active separately authorised local copy or necessary bounded hold. Redundant processing copies are cleaned within 24 hours after confirmed external publication when no local copy remains active. Active approved Wall media remains subject to member removal, moderation and account controls; it is not an abandoned processing copy. Uncertain external outcomes are investigated, review is due within 30 days and urgent takedowns are escalated promptly. Minimal closed-case consent/moderation evidence is normally retained no longer than 365 days, except documented necessary bounded holds.
Private backups are access-restricted and expire through the operational backup schedule, normally within seven days. Deletion is not represented as completed in a backup until the copy expires or is actually removed; verified replacement and necessary holds can affect exact archive cleanup. Provider-data deletion obligations are handled separately. Necessary hosting/backup providers process data under restricted access; Google may process data internationally. Questions and privacy requests: Tick Waves Limited, support@penpalamerica.com.
Google Privacy · Google account connections · Video Stories Terms
