18+ Contains sexual content. For adults 18+ only.

Bare Truth

Privacy policy

How Bare Truth uses your data. Short version: Bare Truth is for adults aged 18 and over. We collect what the game needs to work. Many questions are about desire, dating and sex, so we treat your answers as sensitive data: they are shown only to the players in your game, and we process them only with your explicit consent. Only if you agree, we measure how the apps are used with Google Analytics for Firebase, including (on iPhone and iPad, only after you tap Allow on Apple's tracking prompt) your device's advertising identifier. There are no ads in the apps. We never sell your data.

Last updated: 6 November 2026

1. Who we are

Bare Truth (the apps for iPhone, iPad and Android, and the website baretruth.app) is made by SELLTICKETS Ltd, Ras Al Khaimah, UAE, licence no. 07011340, Office A, Innovation City Business Centre, RAK Bank ROC Office, Ground Floor, Al Rifaa, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah, United Arab Emirates. We are the controller of your personal data. Contact for anything about privacy: [email protected].

This policy covers the apps and this website. The website sells nothing; question decks and the Bare Truth Pass are bought only inside the apps, through the App Store or Google Play.

2. What we collect

  • Sign-in: when you sign in with Apple or Google, the account id they give us and, if they share it, your email address (Apple may give a private relay address). We never see your Apple or Google password.
  • Your profile: name, @handle, date of birth, gender, language, and your photo, drawn avatar or initials. Your date of birth is used to check you are 18 or older and to work out your age band; other players never see it.
  • Profile photo (optional): if you add one, the image you pick or take. The camera or photo library is used only when you choose to, and we remove location and other hidden details (EXIF) from the image.
  • Friends and settings: friends, friend requests, players you blocked, privacy, analytics, tracking and notification settings, your chosen skin, and your consent to the processing of your answers (section 4).
  • Games: the games you play, the settings, your answers (including answers you type), timing, marks and scores. Your answers can reveal things about your sex life or sexual orientation; see section 4. With each game we store your age band (for example 25–34), gender and language at the time, for statistics.
  • Reports you send about other players or content, and reports others send about you.
  • Purchases: when you buy a question deck or the Bare Truth Pass, Apple or Google take the payment. We receive the store's signed record of the purchase: the product, a transaction id, the date, the store country and price and, for a subscription, when the paid period ends, linked to your Bare Truth account so we can unlock what you bought, restore it and let the players in your games play it. We never see your card or bank details.
  • Your device: an install id made by the app, platform, app version, system version, device model, language and, if you allow notifications, a push token.
  • Usage analytics (apps, only with your consent): app interactions, an app-instance id, coarse location worked out from your connection and, only if you allow it, the device's advertising identifier; see section 6.
  • Crash reports (apps): when an app crashes, a report of what went wrong; see section 6.
  • Website visits: one strictly necessary cookie that remembers you confirmed you are 18 or older. Only if you accept analytics cookies, the information in section 8.
  • Support emails: what you write to us and your email address.
  • Technical logs: our servers and Cloudflare see your IP address and basic request details when you connect. We use them only to run and protect the service and keep them for at most 30 days.

We do not collect your contacts, precise location, microphone, health, financial or browsing data. The apps contain no advertising SDK. Advertising identifiers (the IDFA on iPhone and iPad, the advertising ID on Android) are used only by Google Analytics for Firebase, only when you allow it, and only for analytics and measurement as described in section 6; they are never linked to your answers.

3. Why we use it, and our legal basis

  • To run the game and your account — sign-in, rooms, turns, scores, friends, invites, skins (contract: needed to give you the service you asked for).
  • To process your answers, which can reveal your sex life or sexual orientation — only to run the game and show them to the players in your game (your explicit consent; see section 4).
  • To unlock and restore decks and the Pass you bought, let everyone in the games you host play them, and keep the records tax law requires (contract and legal obligation).
  • To keep the community safe — the word filter, automatic checks of profile photos, reports, moderation and blocking (legitimate interest, and our duty under app store rules).
  • To check age — Bare Truth contains sexual content and is only for people aged 18 and over (legal obligation and our terms).
  • To send notifications you allowed — game invites, friend requests, updates (consent; turn them off any time in Settings or your phone's settings).
  • To find and fix crashes — crash reports from the apps (legitimate interest: keeping the app working for everyone; see section 6).
  • To understand and improve the apps and measure our marketing — usage analytics with the advertising identifier, Google signals and the user properties age band and gender (your consent, and on iPhone and iPad Apple's tracking permission; see section 6), and which website pages help (your consent; see section 8).
  • To answer you when you write to support (legitimate interest).

We don't make decisions about you that are based only on automated processing and have legal or similarly significant effects. The automatic photo check only decides whether a photo is shown; a person reviews disputes.

4. Your answers are sensitive data

Bare Truth asks frank questions about desire, dating and sex. Under the UK and EU GDPR (and Türkiye's KVKK), information about a person's sex life or sexual orientation is special category data. Your answers can be that kind of information, so we protect them in these ways:

  • Your explicit consent first. When you set up your account, the app asks: "Your answers in Bare Truth can reveal things about your sex life or sexual orientation. I agree that Bare Truth may store and process my answers to run the game and show them to the players in my games." You tick it yourself; nothing is ticked for you. Without it you can't play, because answering questions is the game. You can withdraw your consent at any time by deleting your account (Settings › Account › Delete my account); withdrawing does not affect what was done before.
  • Game answers only. Your answers are part of the game and nothing else. They are shown only to the players in the room, when the answers are revealed. They are never public, never shown on your profile, never used for advertising, profiling or marketing, never sent to Google Analytics or any other analytics service, and never shared with anyone for their own use.
  • Stored like every other game record. We store your answers with the game they belong to (the question, the choice you picked or the text you typed, timing, marks and scores), encrypted on our servers in Frankfurt, Germany. Only the people who run the service can reach them, and only to keep the game working or to handle a report.
  • Deleted with your account. When you delete your account, the text you typed in answers is erased at once, and your name, @handle, date of birth, gender and photo are removed. The choices you picked stay only as anonymous game records, so the other players' scores stay correct; they can no longer be linked to you.
  • Other players. What other players do with what they saw in a game is up to them; our terms ask everyone not to record or share other players' answers outside the game.

5. What other players see

Players in your games see your name, @handle, face (photo, avatar or initials) and your answers when they are revealed. Who can find you, send you friend requests, invite you and see your photo follows your privacy settings.

6. Analytics and crash reports in the apps (Google Analytics for Firebase, Firebase Crashlytics)

Only if you agree, the apps use Google Analytics for Firebase, a service of Google, to count how they are used and to measure our marketing. What is sent: app interactions (the app opening, signing up, finishing the how-to-play slides, creating a game with its kind and number of players, a game ending with its rounds, choosing, viewing and buying a deck or the Pass, restoring purchases, adding a friend, sending a report), the app version, device type, operating system, language, the country and city worked out from your connection (coarse location), a random app-instance id that Google creates, two user properties — your age band (for example 25–34) and your gender — and, only if you allow it, the advertising identifier described below. We do not send a user id, your name, email, @handle, photo, date of birth, answers or typed text.

  • Off until you agree: analytics is switched off when you install the app. After you set up your profile the app asks you once; nothing is collected unless you tap Allow. You can change it at any time in the app: Settings › Privacy › Share usage analytics.
  • iPhone and iPad: after you allow analytics, the app shows Apple's App Tracking Transparency prompt. Only if you tap Allow does Google Analytics for Firebase read the advertising identifier (IDFA), with ad-personalisation signals on, so we can measure which of our campaigns bring players and understand our audience across Google's services. This counts as "tracking" under Apple's rules. If you tap Ask App Not to Track, the IDFA is not read and analytics works without it. You can change this at any time in iOS Settings › Privacy & Security › Tracking.
  • Android: when you allow analytics, Google Analytics for Firebase also collects the Android advertising ID, for the same measurement. You can reset or delete your advertising ID at any time in Android Settings › Privacy › Ads (or Settings › Google › Ads); turning analytics off in the app stops it being sent.
  • Google signals is on in our Google Analytics property: for people signed in to a Google account who have allowed ad personalisation there, Google can link this app's analytics with their Google account to give us cross-device reports and aggregated demographics and interests. We only ever see totals, never who you are.
  • Not for ads in the app: Bare Truth shows no ads, so none of this is used to show you ads in the apps. Google uses the data as our processor under the Google Analytics and Firebase data processing terms, and for Google signals also under its own policies: how Google uses information from sites or apps that use its services.
  • How long: analytics events are kept for 14 months, then deleted automatically. IP addresses are not stored by Google Analytics 4.

Crash reports (Firebase Crashlytics). Separately from analytics, the apps use Firebase Crashlytics, a service of Google, to tell us when an app crashes so we can fix it. It is on for everyone because it is needed to keep the app working; it is not analytics. A crash report holds the crash and diagnostic details (where in the app it went wrong, the stack trace), the device model, operating system, app version and a random app-instance id. It holds no name, email, @handle, answers or typed text, and no advertising identifier. Our legal basis is legitimate interest: keeping the app working. Crash reports are kept for 90 days, then deleted automatically. You can object by writing to [email protected].

7. No ads

The apps show no ads: no Google AdMob, no Meta Audience Network, no other advertising SDK, no reward videos and no house ads.

We may advertise Bare Truth itself on other platforms (for example Facebook or Instagram). The apps send nothing to those platforms.

8. Cookies and analytics on this website

This website sets one strictly necessary cookie and, by default, loads no analytics:

  • Age check: because the site is about an adult game, the first page you open asks whether you are 18 or older. When you confirm, we set the cookie bt_age (value 18, nothing else) for one year so we don't ask again on this device. It is not used for anything else. Legal pages (this policy, the terms, support and account deletion) are always open without it.
  • If analytics is switched on for the site, a banner asks you first. If you accept: we load Google Analytics 4, which sets the cookies _ga and _ga_<id> to tell visits apart. They last up to 13 months. We use them only to count visits, pages viewed, where visitors come from and which buttons (for example "Download on the App Store") are tapped. On the website, Google signals and advertising features are off, and IP addresses are not stored.
  • If you reject: nothing from Google is loaded and no analytics cookie is set.
  • Your choice is remembered in your browser's local storage (bt.consent, not a cookie) for 6 months, then we ask again. You can change it at any time with Cookie settings at the bottom of every page.
  • Cloudflare, which protects the site, may set a strictly necessary security cookie (__cf_bm, 30 minutes) to tell people from bots. It is not used for analytics.

9. Adults only

Bare Truth contains sexual content and is only for people aged 18 and over (or the age of adulthood where they live, if higher). People under 18 cannot create an account: if a date of birth under 18 is entered, no account is kept, and the device remembers the refusal. The website asks every visitor to confirm they are 18 or older. If we learn that we hold data of someone under 18, we delete it. Parents and guardians can write to [email protected].

10. Who processes data for us

We share data only with these service providers, who handle it on our instructions and must protect it at least as well as we do:

  • Amazon Web Services — servers, database (including game answers), photo storage and backups in Frankfurt, Germany; Amazon Rekognition checks new profile photos for nudity, violence and hate symbols.
  • Cloudflare — network, delivery of images and skins, and protection against attacks.
  • Apple — Sign in with Apple, App Store purchases, and push notifications (Apple Push Notification service).
  • Google — Google sign-in, Google Play purchases, push notifications (Firebase Cloud Messaging), Google Analytics for Firebase, Firebase Crashlytics, Google Analytics 4, and Google Workspace, the mailbox where support emails arrive. For Google signals, Google also decides itself how it uses the data (section 6).

We may also share data if the law requires it, to protect people's safety, or with a buyer if the business is sold (you would be told first). We never sell or rent personal data, and we never share your answers with anyone outside your games.

11. Where data goes

Our game servers and database are in the EU (Frankfurt, Germany). SELLTICKETS Ltd is based in the United Arab Emirates, and some providers above may process data in other countries, including the United States. Where data leaves the UK or the EEA, it is protected by the European Commission's standard contractual clauses, the UK International Data Transfer Agreement or addendum, or an adequacy decision.

12. How long we keep it

  • Account data: until you delete your account.
  • Game answers: with the game record, until you delete your account; then typed text is erased and the choices you picked stay only without anything that identifies you (section 4).
  • When you delete your account, your name, @handle, date of birth, gender, photo, sign-in details, devices, friends and settings are erased at once. Game records stay without your name, so other players' scores and statistics remain correct; they can no longer be linked to you.
  • Purchase records: as long as tax and accounting law requires (up to 7 years), without your profile.
  • App analytics: 14 months. Crash reports: 90 days. Website analytics: 14 months; cookies at most 13 months. Age-check cookie: 1 year.
  • Server logs: at most 30 days. Database backups: 30 days, then deleted.
  • Reports and moderation decisions: as long as needed to keep the service safe, at most 2 years.
  • Support emails: 2 years after the conversation ends.

13. Security

All connections are encrypted (HTTPS/TLS). Data is stored encrypted in AWS data centres. Only the people who run the service can reach it, through accounts protected by two-factor authentication, and every admin action is logged. Photos are served from unguessable addresses. No system is perfectly secure; if a breach puts you at risk, we tell you and the authorities as the law requires.

14. Your rights and choices

You can ask for a copy of your data, correct it, delete it, take it elsewhere, object to how we use it, ask us to limit it, and withdraw consent at any time (for example for your answers, analytics, tracking or notifications) without affecting what was done before. Much of this you can do in the app (Settings). Delete your account in the app (Settings › Account › Delete my account) or on the account deletion page. For anything else write to [email protected]; we answer within one month.

  • UK and EU: you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
  • California and other US states: we never sell personal information and we don't show targeted ads. If you allow analytics and tracking, Google's use of the advertising identifier and Google signals for measurement could count as sharing personal information under some state laws. To opt out: turn off Share usage analytics in the app's Settings; on iPhone and iPad turn tracking off in Settings › Privacy & Security › Tracking; on Android delete or reset your advertising ID; or email [email protected] and we will help. Your answers can be sensitive personal information; we use them only to provide the game you asked for and never to infer things about you. You have the right to know, delete and correct, and we won't treat you differently for using these rights.
  • Türkiye: you can use your rights under the Personal Data Protection Law (KVKK, article 11) by writing to us. Answers about sexual life are special category data under KVKK article 6 and are processed only with your explicit consent.

15. Changes

If we change this policy in a way that matters, we tell you in the app before it applies and update the date above.