Privacy Policy

Orange Turtle — Privacy Policy

Effective Date: 30 September 2026

1. Introduction

This Privacy Policy explains how Wontle Ltd (“we”, “us”, “our”) collects, uses, and protects your personal data when you use Orange Turtle (the “App”). We are the data controller for the personal data described in this policy.

2. Who We Are

Wontle Ltd
Registered in England and Wales, company number 17061501
Registered office: 17 Arundel Close, Warwick, England, CV34 5HZ
Contact: support@wontle.com

3. What Data We Collect

Account & identity data: the email address you register with, your name, your display name, your interests (if you add them), and (optionally) a profile picture.

Message content: the text of every message you send, so it can be delivered to other participants in the relevant chat room. Messages are automatically screened against a filter that blocks certain hateful or slur-based language before they are posted.

Reactions: emoji reactions you add to messages.

Moderation and report data: if you report a message or user, we record the report (who made it, who/what was reported, the reason given), a snapshot of the reported content (so it can be reviewed even if the original message is later deleted), and certain automated signals used to detect abuse of the reporting system, such as the reporting account’s age and how many reports have recently been made against the same user. If action is taken against an account — a warning or a lock — we log that action.

Guest usage: if you use the App without an account (“Guest Mode”), we do not collect any personal data from you beyond what’s technically necessary to load and display content. See Section 8 (Advertising) for advertising-related identifiers, which may apply in Guest Mode too if ads are shown.

Advertising data: see Section 8.

We do not collect payment information (the App does not process payments), and we do not knowingly collect data from anyone under 18 — see Section 10.

4. How We Use Your Data

We use your data to:

Operate the Service — deliver your messages, display your profile to other users in shared chat rooms, and remember your preferences;
Enforce our Terms of Service — review reports, apply the automated content filter, and take moderation action where needed;
Communicate with you — for example, email verification, password reset emails, and responses to support or report submissions;
Maintain safety and security — detect and prevent spam, abuse, and fraudulent reporting, and automatically check uploaded profile pictures for inappropriate content;
Serve advertising, where applicable — see Section 8;
Comply with our legal obligations.

5. Legal Basis for Processing (UK / EU Users)

Where UK GDPR or EU GDPR applies to you, we rely on the following legal bases:

Contract — processing your account and message data is necessary to provide the Service you signed up to use.
Legitimate interests — for moderation, abuse prevention, and safety-related processing (report records, automated report-abuse signals, blocked-word filtering), which we consider necessary to keep the Service safe and which we’ve balanced against your rights.
Consent — for personalized advertising where required (see Section 8), and for any processing where we ask for your consent directly.
Legal obligation — where we’re required to retain or disclose data by law.

6. How Long We Keep Your Data

Messages — Deleted 4 months after posting, on a rolling basis.

Reported-content snapshots (moderation evidence) — Retained 12 months from the date of the report.

Soft-deleted messages — The message text is cleared by an automated monthly cleanup process, typically within about 60 days of deletion. The message stays attributed to your account (and shows your current display name) until it reaches the normal 4-month retention limit, or until you delete your account.

Profile picture — Deleted immediately when you remove it or delete your account. When you replace it with a new photo, the previous file is cleared by an automated weekly cleanup process, typically within about 9 days.

Account data while your account exists (email address, display name and profile details) — Kept while your account is active. If you haven’t signed in or used the app for 24 months, we delete your account and its data.

Account data, on deletion — See Section 7 — deletion is not instant for every field.

7. Deleting Your Account

When you delete your account, whether from within the App, by emailing us at support@wontle.com from the email address linked to your account:

Your profile picture and any other uploaded images are deleted immediately.
Your profile information (name, display name, interests, and similar fields) is cleared, and your account is marked as deleted.
All active sessions on all your devices are ended, and you’re immediately blocked from logging back in.
Messages you previously sent are not deleted immediately — they remain visible to other users, attributed to a placeholder (“Deleted User”) rather than your name, until they reach the normal 4-month message retention limit described above, at which point they’re permanently deleted along with the rest of your account record.

We keep it this way, rather than erasing everything the instant you tap “delete,” because your past messages are still visible to other people in a shared chat room — immediately breaking that link would leave broken or confusing gaps in conversations other users are part of. Contact us using the details in Section 2 if you’d like to understand this in more detail.

8. Advertising

Orange Turtle shows ads through Google AdMob, a service provided by Google. AdMob may collect information such as your device’s advertising identifier and general usage data to serve and measure ads, and — where you’ve consented — to personalize the ads you see.

For users in the UK, EEA, and Switzerland, we present a consent choice before showing personalized ads, in line with Google’s requirements and applicable law. If you don’t consent, you’ll be shown non-personalized ads instead.

United States. In U.S. states whose privacy laws give you the right to opt out of targeted advertising, the App includes a “Privacy Options” entry (Profile → Legal Info) that opens a privacy choices form provided through Google’s User Messaging Platform. Through that form you can opt out of personalized (interest-based) advertising at any time. Unless you opt out, ads shown to you may be personalized. If you opt out, AdMob shows you non-personalized ads only — ads based on context, such as the screen you are viewing and your general (city-level) location, rather than on your past behavior.

Under some U.S. state laws, personalized advertising of this kind is called “targeted advertising,” and the related data sharing may be called “sharing” or a “sale” of personal data. Using Privacy Options is how you exercise your right to opt out in those states. Section 11 explains your other U.S. privacy rights.

Everywhere else. For users elsewhere (including in U.S. states where the Privacy Options entry is not shown), ads may be shown on a non-personalized or standard basis as governed by AdMob’s own settings.

Google’s use of advertising data is governed by its own privacy policy and its Data Privacy Framework certification, which covers transfers of UK and EU personal data to the US, as set out by the US Department of Commerce. You can find more information at https://policies.google.com/privacy and manage certain ad personalization settings at https://adssettings.google.com.

9. Who We Share Data With

We share data with the following service providers, who process it on our behalf:

Supabase — provides our database, authentication, file storage, and backend infrastructure, hosted in London, UK (AWS eu-west-2 region).
IONOS — our email provider, used to send transactional emails (verification, password reset, and report/support responses).
Google Cloud Vision — Google’s image-analysis service, which automatically checks uploaded profile pictures for inappropriate content on our behalf.
Google (AdMob) — as described in Section 8.

We do not sell your personal data to third parties in exchange for money. Advertising through Google AdMob (Section 8) may involve Google receiving information such as your device’s advertising identifier and general usage data. Some U.S. state privacy laws treat this as “targeted advertising,” “sharing,” or a “sale” of personal data; if you live in one of those states, you can opt out as described in Sections 8 and 11.

10. Age Restriction

Orange Turtle is intended for users aged 18 and over. We ask you to confirm you meet this requirement when you create an account, but we do not independently verify age. Orange Turtle is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us using the details in Section 2 so we can investigate and remove it.

Because we do not knowingly collect personal data from anyone under 18, we also comply with the requirements of the U.S. Children’s Online Privacy Protection Act (COPPA), which protects children under the age of 13.

11. Your Rights

If UK or EU data protection law applies to you

You have the right to:

Access the personal data we hold about you;
Rectify inaccurate data;
Erase your data (see Section 7 for how this works for message data specifically);
Restrict or object to certain processing;
Data portability, where technically feasible;
Withdraw consent at any time, where we rely on consent — this won’t affect processing carried out before withdrawal.

To exercise any of these rights, contact us using the details in Section 2. If you’re not satisfied with our response, you have the right to complain to the UK Information Commissioner’s Office (ico.org.uk) or, if you’re in the EU, your local data protection authority.

If you are a California resident

Under the California Consumer Privacy Act (CCPA), as amended, you have the right to:

Know what personal information we collect, use, and disclose about you;
Request deletion of your personal information;
Correct inaccurate personal information we hold about you;
Opt out of the “sale” or “sharing” of your personal information;
Non-discrimination for exercising any of these rights.

Sale and sharing. We do not sell your personal information for money. Personalized advertising through Google AdMob (Section 8) may count as “sharing” under the CCPA, which covers cross-context behavioral advertising. You can opt out at any time through Privacy Options in the App (Profile → Legal Info), after which AdMob shows you non-personalized ads only.

To exercise your other rights, see “Making a request, and appeals (U.S. residents)” below.

If you live in another U.S. state

A number of other U.S. states — including Colorado, Connecticut, Virginia, and Texas — have their own comprehensive privacy laws, and more are being added. If you live in a state with such a law, then wherever it applies to us, or where we choose to extend the same protections, you may have the right to:

Confirm whether we process your personal data, and access it;
Correct inaccurate personal data;
Delete personal data you provided or that we obtained about you;
Obtain a copy of your personal data in a portable format, where technically feasible;
Opt out of the processing of your personal data for targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects;
Appeal our decision if we decline to act on a request (see below).

Targeted advertising, sale, and profiling. Personalized advertising through Google AdMob (Section 8) may be treated as “targeted advertising” (and in some states as a “sale” or “sharing”) of personal data. You can opt out through Privacy Options in the App (Profile → Legal Info), where your state’s law requires it to appear, or by emailing us as described below. We do not sell your personal data for money, and we do not carry out profiling that produces legal or similarly significant effects. We do not use your personal data to train large language models (AI systems), and we do not sell it for that purpose.

Making a request, and appeals (U.S. residents)

To make a request under any of the U.S. rights above, email support@wontle.com (see Section 2) and tell us which right you want to use. We may ask you to confirm your identity using details already linked to your account.

We will respond within 45 days of receiving your request. If we need more time, we may extend that period once by up to 45 days, and we will tell you why within the first 45 days.

If we decline to act on your request, we will tell you why and how to appeal. To appeal, email support@wontle.com with the subject line “Privacy Appeal” within a reasonable time after you receive our decision. We will respond to your appeal in writing, with an explanation of our reasons, within 45 days of receiving it. If we deny your appeal, we will explain how to submit a complaint to your state’s Attorney General.

We will not discriminate against you for exercising any of these rights.

12. Security

We protect your data with encrypted connections (HTTPS/TLS) between the App and our servers, and our hosting provider also encrypts stored data at rest. Access to data is restricted through row-level security policies on our database, which control who can read or write each category of data.

While we work hard to protect your data, we acknowledge that no method of storing or sending information online can be completely risk-free. If a breach ever affects your data, we will notify the relevant authorities and, where required, affected users.

Users can also help keep their accounts secure by protecting the email account they use to sign in (since sign-in links are sent there), keeping their device and the App up to date, and being cautious of unexpected messages or links. If a user thinks their account has been compromised, they can contact us at support@wontle.com.

13. International Data Transfers

Our core infrastructure (Supabase) is hosted in the UK. Where data is transferred outside the UK/EEA — for example, to Google in connection with advertising (Section 8) and automated image checks (Section 9) — we rely on recognized transfer mechanisms, including Google’s Data Privacy Framework certification covering the UK Extension to the EU-U.S. DPF.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we’ll take reasonable steps to let you know, for example by emailing the address linked to your account or posting a notice on our website. The “Effective Date” at the top of this page shows when it was last updated.

15. Contact Us

Wontle Ltd
17 Arundel Close, Warwick, England, CV34 5HZ
Email: support@wontle.com

This document was last updated 30 September 2026.