Purpy Privacy Policy

Version of October 2, 2026.

This Policy applies to https://purpy.app, https://studio.purpy.app, the Telegram Mini App, applications and related Purpy features. It supplements the separate consent to the collection and processing of personal data. Where applicable law requires separate consent, the Policy itself does not replace it.

1. Operator

Operator: Purpy Limited Liability Partnership
BIN: 260740011419
Address: 78 Zenkova St., apt. 3, Medeu District, Almaty 050010, Republic of Kazakhstan
E-mail for data matters: support@purpy.app

2. Age

The Service is intended for users aged 13 and over. We may ask for age and for confirmation of a legal representative's consent. 18+ materials are hidden from minors. If we learn that a child's data were collected without the required consent, the account and data are deleted or restricted in accordance with the law.

In countries where a child's consent to an online service is valid only from an older age, the local threshold applies. A parent or legal representative may contact support@purpy.app to verify, delete data or stop further processing.

3. What data are processed

3.1. Account data

Name, nickname, e-mail, password hash, date of birth or age group, country/region, language, interests, avatar, profile description, settings, identifiers and information about the sign-in method.

3.2. Telegram data

Telegram ID, username, display name, photo and other data transmitted by Telegram in accordance with the user's settings and the sign-in mechanism.

3.3. User content

Stories, projects, scenes, choices, texts, images, audio, files, covers, comments, messages, complaints and materials of requests. Publicly published content and profile data are available to an unlimited number of persons.

3.4. Usage and recommendations

Tags, queries, views, scene openings, transitions, favourites, follows, ratings, hides, complaints, language, approximate location, sequence of interactions and selected feed settings.

3.5. Payments

Order number and status, amount, currency, time, payment identifier, purchased pack, Coin operations, refunds and chargebacks. The full card number, CVV/CVC and expiry date are processed by the bank and are not received by Purpy.

3.6. Technical and security data

IP address, session and device identifiers, advertising identifiers, browser, OS, application version, cookies, timestamps, referrer, sign-in events, error, security and moderation logs, and evidence of acceptance of documents.

3.7. AI features

The text of the instruction, the project fragments selected by the user, context, the result and technical metadata of the request. Purpy does not use these data to train Purpy models without separate express consent.

4. Purposes and legal bases

We process data for:

registration, sign-in and performance of the contract;
storing, publishing, searching and displaying stories;
personalised and non-personalised recommendations;
operation of Studio and AI features;
payments, Purps, refunds, accounting and tax records;
support, complaints, moderation, age restrictions and protection of rights holders;
prevention of fraud, hacking, spam and rule violations;
reliability analytics and improvement of the Service;
displaying advertising, including interest-based (behavioural) advertising, and measuring its effectiveness;
compliance with the law and protection of the rights of Purpy, users and third parties.

Legal bases, depending on the country: consent; performance of a contract; compliance with a legal obligation; protection of vital interests; legitimate interest in security, prevention of abuse and improvement of the Service, where it is not overridden by the user's rights.

Separate consent is requested for cross-border transfer, publication of personal data in a public profile, optional cookies and other cases where the law requires it. Consent is recorded together with the version of the text, date, time, account and method of confirmation.

5. Public nature of content

When a story, comment or public profile is published, the selected data become available to an unlimited number of persons and may be copied by third parties. Before publication the interface must clearly indicate that the content will be public. The user must not publish other people's personal data without lawful grounds.

Deletion from Purpy does not guarantee deletion of copies previously made by independent third parties. Purpy deletes the copies and search representations available to it within a reasonable technical period, unless there are lawful grounds for retention.

6. Recipients and processors

To the extent necessary, data may be received by:

ДО АО «Банк ВТБ (Казахстан)» — processing of payments and refunds;
Telegram — sign-in and operation of the Mini App;
Google Gemini API — fulfilment of AI requests selected by the user and, if enabled, auxiliary moderation;
Timeweb — current hosting, database and file infrastructure;
Sentry or another specified error service — technical diagnostics when connected;
third-party advertising networks and advertising partners — displaying and measuring advertising, including interest-based advertising (Section 9);
CDN, e-mail, anti-fraud, analytics and security providers listed in the current consent interface or contractor register;
professional advisers, auditors and insurers under a duty of confidentiality;
state authorities and rights holders — only on lawful grounds or to protect rights.

We do not sell personal data for money. Data are transferred to advertising networks to display advertising on the terms of Section 9. If such transfer is considered a "sale" or "sharing" under applicable law, the user is given the necessary notices and the right to opt out.

7. Location and cross-border transfer

Current state: to host the Service, Purpy engages the foreign infrastructure processor Timeweb; the relevant infrastructure is located in the Russian Federation. Purpy is carrying out the transfer and localisation of the primary storage of personal data, files and backups in the Republic of Kazakhstan. Until the migration is complete, cross-border processing is disclosed to the user and is carried out with the applicable consents and contractual safeguards.

After the migration, the primary personal-data database must be located in the Republic of Kazakhstan. Transfer to foreign processors is carried out only to the extent necessary, on a contractual basis, with the required consent and the safeguards of applicable law. For users in the EEA/United Kingdom, the international transfer mechanisms provided by law are applied where required.

8. Recommendations and automated processing

Purpy uses tags, language, queries, favourites, follows, interactions, freshness, popularity, quality, age rating and safety signals to rank content. The user may use the available non-personalised feed or sorting and manage individual signals.

Automated moderation and anti-fraud may flag content or operations for review. Decisions that significantly affect the user's rights are reviewed by a human on request where the law requires it. Purpy does not use sensitive data for advertising profiling.

9. Cookies and advertising

Necessary cookies provide sign-in, security, load balancing, language and recording of legal consents. Analytics, advertising and other optional cookies are enabled only after the required consent and can be disabled. Refusing optional cookies does not deprive the user of the core features.

The Service may display advertising, including through third-party advertising networks. Advertising networks may use cookies, advertising identifiers and similar technologies to collect information about the user's activity in the Service and on other websites and applications and to show interest-based (behavioural) advertising. Such technologies are enabled after the required consent; interest-based advertising can be refused in the settings of the Service or of the device. Processing of data by advertising networks is also governed by their own policies, and Purpy does not control their technologies. Interest-based advertising is not shown to users identified as minors.

10. Retention periods

account and non-public projects — while the account exists (an account inactive for more than 365 consecutive days may be closed), then normally up to 30 days for deletion from active systems;
backups — according to the rotation cycle, normally up to 90 days;
public content — until deleted by the user or by moderation;
messages and complaints — up to 3 years after the request is closed, unless a longer period is needed for a dispute;
security and sign-in logs — normally up to 12 months;
evidence of consents and document versions — the term of the relationship plus the applicable limitation period;
payment, tax and accounting information — the period established by law;
evidence of serious violations — the period necessary to prevent repeat violations and to defend claims.

A specific period may be extended in the event of a dispute, investigation, legal hold or legal obligation, after which the data are deleted or anonymised.

11. Security

We use HTTPS, access control, password hashing, backups, logging, updates and contractor oversight. No method of storage guarantees security.

In the event of an incident, Purpy limits the consequences, investigates the event and notifies users and authorities within the periods and in the cases provided by applicable law. The user must report a compromised account without delay.

12. User rights

Depending on applicable law, the user may:

learn whether their data are processed and obtain a copy;
correct, supplement, delete or restrict processing;
withdraw consent without retroactive effect;
object to processing and profiling;
obtain a portable copy of the data provided;
request human review of a significant automated decision;
opt out of interest-based advertising and of the sale/sharing of data;
lodge a complaint with the authorised body or a court.

A request is sent to support@purpy.app. We may verify identity and a representative's authority. A response is provided within the period set by applicable law. Withdrawal of consent does not end processing that is necessary for an unfulfilled obligation, the defence of claims or compliance with the law.

13. Changes

The current version is published at https://purpy.app/privacy. Purpy may amend the Policy without prior notice; a new version applies from the moment of publication. If the law requires new consent, we request it.