Privacy Policy

Last updated 15 October 2026

1. Who we are

AskMe is a conversation-starter card app operated by Pharanos Ltd (“we”, “us”), a company registered in England and Wales, company number 17376780. “AskMe” and “AskMe: Endless Question Cards” are trading names of Pharanos Ltd. We are the data controller for the personal data described here.

Contact us about anything on this page via the Contact page in the app, at privacy@pharanos.com, or by post at Flat 1, 242a High Street, Sutton, SM11PA.

2. What we collect

2.1 If you just play, without an account

Your device is given an anonymous identifier so your progress and the cards you write stay on it. That identifier is not linked to your name, email or phone number, and we cannot tell who you are from it.

2.2 If you create an account

Data	Why
Email address	To identify your account and let you sign in on another device
Display name	Shown to people you share a question with
Date of birth	To check you meet the minimum age, and to gate 16+ decks. We store the date, not a copy of any document
Which sign-in method you used	So we offer you the right one next time
Time zone, card theme, saved card designs, safe-mode setting	Your preferences, so they follow you to any device you sign in on

If you sign in with Apple you may use Apple’s “Hide My Email” relay address. That works fine, we treat it as your email address and never ask for your real one.

2.3 How you use the app

We record which cards you swiped and whether you answered or skipped them, which deck they came from, and when. This is what powers your progress bars, your stats, the shuffle that keeps your place, and which decks are shown as popular. It does mean we can see which questions you engaged with, including in 16+ decks.

2.4 What you create

The questions and decks you write, including their styling; the cards you save; questions you submit to the community feed, together with the outcome of moderation and any reason a moderator gave; and which community questions you liked.

If you report a community question we store which question, the reason you chose, any note you added, and when, visible to our moderators only, never to the question’s author. A report also opens a conversation between you and our moderators, held with your other messages (see 2.8) so we can tell you what we did and you can reply.

If you block another user we store which user you blocked and when, so we can hide their community posts from your feed. A block is visible only to you, is never shown to the person you blocked, and you can undo it at any time in Settings.

2.5 Sharing a question, and answers you receive

When you share a card or a deck, we store a copy of that card’s text and design so the link keeps working, plus a short code that identifies it. Share links expire after 30 days.

When someone answers a question you shared, we store their answer, the name they gave, and their IP address. The IP address is kept to detect and limit abuse of the answer form, not to identify or track anyone.

2.6 Invites

If you use an invite link we store your invite code and a record linking the account that invited you to the account that joined, so a reward can be credited. We do not read your contacts or address book, sharing a link is entirely up to you and happens through your own messaging app.

2.7 Purchases

If you buy something we store what you bought, when, which store or payment processor handled it, its transaction identifier and its receipt. We never see or store your card details: web payments are handled by Stripe, and purchases in the mobile apps by Apple or Google.

2.8 Contacting us

If you use the Contact page we store your message, the category and topic you chose (feedback, help, partners or press, and what it concerns), your first name, your email address, when it arrived, our replies, and, only if you choose to give them, your last name and phone number. We use these solely to read, prioritise and answer your message. Conversations started by reporting a community question (2.4) are kept the same way.

2.9 Notifications and devices

We store notifications addressed to you inside the app. If push notifications are enabled in future we would also store a device push token, platform and app version; the mechanism exists in the code but no push notifications are sent today.

2.10 Sign-in IP address and approximate location

When you sign in to AskMe, we record the IP address your device connects from and derive an approximate location (city and country only, and never a precise or GPS location). We process this data under our legitimate interests to keep AskMe secure and to prevent platform abuse, such as ban evasion, account takeover, or automated scraping. Location lookups are processed entirely on our own servers using an offline database (IP geolocation by DB-IP); your IP address is never shared with third-party geolocation services for this purpose. We retain this sign-in log for 90 days, after which entries are automatically deleted; the most recent entry is refreshed the next time you sign in. This is not special-category data.

2.11 Stored on your device, not sent to us

The app keeps some things locally so it works offline and starts quickly: your swipe history awaiting sync, your own decks and cards, a cached copy of the catalogue, your entitlements, your cookie choice, your theme and colour preferences, the tab you were last on, and any pending invite code. Signing out or deleting the app removes them.

3. What we don’t do

• No analytics or tracking SDKs. There is no Google Analytics, no Firebase Analytics, no Crashlytics and no Sentry. We verified this against the dependency list, not just our memory of it. The advertising SDK described below is the only third-party SDK that receives anything about your device.
• We do show ads, and here is who serves them. Ads in AskMe are supplied by Google AdMob (in the iOS and Android apps). To select, deliver, measure and protect those ads against fraud, Google receives your IP address, an approximate location derived from that IP address, what you did with the ad, and, on platforms that provide one, a device advertising identifier. On Android that is the Google Advertising ID. On iOS we deliberately do NOT ask for permission to track you across other companies’ apps and websites, so Apple withholds the identifier (the IDFA) and Google does not receive it. It may set or read cookies and similar identifiers on your device, and it may use that data to build an interest profile for personalised advertising where you have consented to it. We do not send Google your name, your email address, your answers, or anything you have written. You can withdraw consent at any time through “Ad privacy choices” in Settings, or remove ads altogether with the “Remove ads” purchase in the Store, which is also included with VIP.
• We never handle your password. Sign-in runs through Google Firebase Authentication, which holds credentials. AskMe’s own database has no password field.
• We don’t sell personal data, and we don’t share it with data brokers.
• No profiling or automated decisions that have a legal or similarly significant effect on you.
• No special-category data. We don’t ask for, and don’t set out to collect, the special categories UK GDPR singles out, health, genetic or biometric data, racial or ethnic origin, political, religious or philosophical beliefs, trade-union membership, or data about your sex life or sexual orientation. The questions you engage with, including in 16+ decks, are recorded as ordinary usage data (see 2.3); we don’t use them to infer any of the above.

4. Why we’re allowed to use it

Under UK and EU data protection law we rely on:

• Performance of a contract, running your account, saving your decks and progress, delivering shares and answers, honouring purchases.
• Legitimate interests, keeping the service secure and free of abuse (including the IP address on share answers and our rate limits), moderating community submissions, and understanding which decks are played so we can improve the catalogue.
• Legal obligation, keeping purchase records, and applying an age limit.
• Consent, for personalised advertising. In the UK and the EEA we collect it through Google’s User Messaging Platform, a Google-certified consent management platform, which also records a choice to opt out of sale or sharing where United States state law provides one. You can change your mind at any time via “Ad privacy choices” in Settings, or “Cookies” on the web. Declining does not remove ads, it means the ones you see are not personalised.

5. Who else is involved

Who	What they handle
Google (Firebase Authentication)	Sign-in, credentials, your email and account identifier
Google (Fonts & app delivery)	The web version loads fonts and rendering code from Google servers, which means your IP address is visible to Google when the page loads
Apple, Google, Meta (sign-in providers)	Only if you choose to sign in with them. They confirm your identity to us and tell us your email and name; we don’t get access to your account with them
Apple / Google app stores	Payment processing for purchases made in the mobile apps
Stripe (web payments)	Processing card payments and subscriptions made on the web. Stripe receives your payment-card details (which we never see or store), billing information, email address and what you bought; it returns only confirmation of payment to us
Resend (email delivery)	Sending you account emails such as verification codes, purchase receipts and security alerts, and forwarding messages you send us through the contact form. Receives your email address and the content of those emails
Our hosting and database provider	Storing the data described above
Google AdMob (in the iOS and Android apps)	Selecting, delivering and measuring the ads you see, and detecting ad fraud. Receives a device advertising identifier (IDFA or Google Advertising ID), your IP address, an approximate location derived from it, and your interactions with the ad. Used for interest-based advertising only where you have consented

6. Where your data goes

Some of these providers, notably Google, Apple, Stripe and our email provider, process data outside the UK and EEA, including in the United States. Where that happens we rely on the safeguards those providers offer for international transfers, such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.

7. Age

AskMe is not for children under 13, and we ask for a date of birth at sign-up to enforce that. Some decks are marked 16+ and are only unlocked for accounts whose declared date of birth allows it. If you believe a child under 13 has an account, contact us at privacy@pharanos.com and we will delete it.

In compliance with COPPA, the UK Children’s Code and comparable standards elsewhere, we do not show personalised advertising to under-18s, and we do not rely on remembering to. Anyone without a confirmed 18th birthday, which includes anyone playing without an account and any older account that never gave a date of birth, has their ad requests tagged for age-restricted treatment, so the advertising identifier on their device is not used to build an interest profile. They are served contextual, non-personalised ads, and the rating of ads they may be shown is capped below the rating adults may see. Because an unknown age is treated as under age, the restriction applies until an adult birthday is confirmed rather than after someone is found to be a child.

8. How long we keep it

• Your account and content, while your account exists.
• Share links and their snapshots, 30 days, then they expire.
• If you delete your account, we mark it deleted and immediately remove your email address, which frees it for use again, and we delete your sign-in credential at Firebase. Some records connected to other people, such as an answer someone sent you or a question already published to the community feed, may remain but are no longer linked to your email.
• Purchase records, kept as long as we need them for tax and accounting.

9. Your rights

You have the right to access your data, correct it, have it deleted, restrict or object to how we use it, ask for it in a portable form, and withdraw consent where we relied on it.

• Delete your account, Settings → Delete account, in the app. This works immediately and needs no email to us.
• Change your name or email, Settings.
• Advertising consent, “Ad privacy choices” in Settings on mobile, or “Cookies” in the app footer on the web, at any time.
• If you are in the United States, the same control is how you opt out of the sale or sharing of your personal information for targeted advertising, and of targeted advertising itself, where your state gives you that right. Choosing to opt out has the same effect as declining consent: ads keep appearing, but they stop being personalised and the advertising identifier stops being used to profile you.
• A copy of your data, Settings → Export my data, in the app: a machine-readable file of everything we hold about your account, available any time without asking us. You can also email us instead and we will provide the same within one month.

10. Security

Traffic is encrypted in transit. Access to your account requires your sign-in credential, which we never see. Sensitive changes such as altering your email, changing your password or deleting your account require you to prove who you are again first. Changing your email address only takes effect once you click a link sent to the new address, which is what stops a typo locking you out. We apply rate limits and validate everything sent to our API.

No service can promise perfect security, and we won’t pretend otherwise.

11. Cookies and similar technologies

The web version stores data on your device to keep you signed in and to remember your preferences, this is necessary for the app to work and cannot be turned off while you use it. Separately, you can accept or decline advertising cookies, and change your mind at any time. Declining does not remove ads; “Remove ads” in the Store does that. The advertising networks named in section 5 set their own cookies and identifiers when ads are shown.

12. Changes to this policy

If we change how we use your data we will update this page and its “last updated” date, and for significant changes we will tell you in the app.

13. Complaints

If you are unhappy with how we have handled your data, please tell us first, the Contact page in the app is the fastest route. You also have the right to complain to your data protection regulator. In the UK that is the Information Commissioner’s Office (ico.org.uk).