Am I Nuts
Am I Nuts
Privacy Policy

Privacy Policy

Effective Date: 15 October 2026

Contents

  1. Who We Are
  2. What This Policy Covers
  3. Personal Data We Collect
  4. How We Use Your Data
  5. Legal Bases for Processing (GDPR)
  6. Data Sharing & Third-Party Service Providers
  7. International Data Transfers
  8. Data Retention
  9. Data Security
  10. Your Rights Under the GDPR
  11. Children's Privacy
  12. Cookies & Tracking Technologies
  13. Push Notifications
  14. Changes to This Policy
  15. Contact Us

1. Who We Are

AM I NUTS B.V. ("we", "us", or "our") is the data controller responsible for your personal data. We are incorporated under the laws of the Netherlands and our registered address is Prinseneiland 43, 1013 LL Amsterdam, the Netherlands.

If you have any questions about this Privacy Policy or our data practices, you may contact us at: contact@aminuts.app.

2. What This Policy Covers

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the Am I Nuts mobile application (the "App"), available exclusively through the Apple App Store and Google Play Store.

Am I Nuts is a native mobile application: it is not a website or web app. This distinction is relevant because certain web-specific data practices (such as cookies) do not apply.

This Policy also covers two pages on our website that open in your browser:

See Sections 3.6 to 3.8.

3. Personal Data We Collect

3.1 Data You Provide at Registration

To create an account, you must provide the following:

Data Purpose
Email address Primary account identifier, login credential, and communications
Full name (first & last) Display name within the App (e.g., within Circles)
Password Account authentication (stored as Argon2 hash only - we never access your plaintext password)

If you register using Google Sign-In, we receive your email address, first name, last name, and a unique Google account identifier from Google. We do not receive or store your Google password, nor do we request access to any other Google services.

If you register using Sign in with Apple, we receive your email address (which may be a private relay address if you choose Apple's "Hide My Email" option), a unique Apple account identifier, and, the first time you sign in and only if you choose to share it, your first and last name. We also store a token issued by Apple, used solely to revoke your Sign in with Apple authorisation when you delete your account. We do not receive or store your Apple ID password.

Email confirmation: when you register with an email address and password, we email you a 6-digit code to confirm that the address is yours. Your account is only created once you enter that code. Until then, we keep the details you entered (email address, name, your password as an Argon2 hash only, and any invitation you arrived with, and, if you found us through one of our links, where you came from, see Section 3.8) together with a hashed copy of the code. The code expires after 15 minutes and can be guessed wrong at most 5 times; only the most recent code works. We do this to make sure that nobody can create an account with an email address that is not theirs. These details are deleted as soon as the code is used, and at the latest 24 hours after the last code was sent. You can also confirm the email address of an existing account from the App's settings, in the same way. We record whether, and when, your email address was confirmed (also when you sign in with Google or Apple, which confirm it for us).

3.2 Optional Profile Data

After registration, you may optionally provide:

Country and city are self-reported text fields. We do not access your device's GPS or location services.

3.3 Data Generated Through Your Use of the App

Data Description
Poll answers Your selected option for each daily poll question
Favourites / Likes Poll questions you have "liked"
Circles membership Which social groups you belong to
Circle activity Actions within Circles (e.g., answering polls, joining or creating a Circle)
Points & levels Gamification points earned through actions (answering, referrals, profile completion)
Streak Count of consecutive days you completed daily polls
Affiliation code A unique 6-character code auto-assigned to you for referral purposes
Share codes Unique codes generated when you share a question set
Invitation records When you create an account through another user's invitation link, we record who invited you (and, for a Circle invitation, which Circle) so that the inviter can be credited. We also record how the invitation reached the App (a tapped link, the Google Play install referrer, or the network match described in Section 3.6) and, where known, which app the invitation link was opened in (for example Instagram, TikTok or a regular web browser, see Section 3.6)
Where you found us If you installed the App through a link from one of our own social media posts or promotions (Section 3.8), we store with your new account the name of the platform (for example YouTube, TikTok, Snapchat or Instagram), the campaign name in the link, and how this reached the App (Google Play install referrer or network match). This is recorded once, only when a new account is created
Pending Circle invitations When you open a Circle invitation link while signed in but do not join straight away, we keep the invitation (who invited you, which Circle, and whether you later joined or dismissed it) so that you can find it again in the App
Reports When you report a user or a Circle, we store who made the report, what was reported, the reason you chose and any details you add, and we send it by email to our own support inbox so that we can review it. We also record when the report was closed
Blocked users Which users you have blocked. Blocking works both ways: neither of you sees the other in Circles, results or activity. The blocked user is not notified

3.4 Data Collected Automatically

Data Purpose
IP address Abuse prevention, security, and, on iPhone and iPad, delivering invitations and the source of our social media links after you install the App (see Sections 3.6 and 3.8)
API request logs Each authenticated request is logged with: session token, client IP, request path, sanitised request body (passwords redacted), and response status. Used for security and anti-abuse monitoring.
Timestamps Account creation, last update, and session activity times
Session tokens Unique, server-generated identifiers for session management
Network connectivity status Whether your device is online or offline - stored in device memory only, never sent to our servers
Install referrer (Android only) Once, on the first launch after installing from Google Play, the App reads the install referrer provided by Google Play. If you installed the App through an Am I Nuts invitation link, it contains that invitation's codes (and, where known, which app the link was opened in), which we use to show you the invitation. If you installed it through one of our own social media links (Section 3.8), it contains the platform and campaign name of that link. We do not read anything else from it.

3.5 Data Stored on Your Device

The App stores certain data locally on your device:

3.6 Invitation Pages on Our Website

If you open an Am I Nuts invitation link on a device that does not have the App installed, our invitation page (aminuts.app/join/…) opens in your browser. It shows who invited you and, for a Circle invitation, the Circle's name, its number of members, and its members' first names and profile photos (see Section 5.2 of our Terms and Conditions).

The page also notes which app the link was opened in, where your browser makes this visible (for example Instagram, TikTok, Snapchat, Facebook, Messenger, LinkedIn or X; links opened from WhatsApp, Messages, email and most other apps simply count as "browser"). It works this out from the technical description your browser sends with every web request (its "User-Agent"); nothing is read from your device.

To show you the invitation once you have installed the App:

The invitation page loads all of its content from aminuts.app and does not use cookies, analytics, or advertising trackers. On iPhone and iPad, Safari may display Apple's Smart App Banner, a built-in Safari feature that offers to open or download the App.

3.7 Statistics We Count Without Personal Data

To understand whether invitations and our own posts reach people, and whether sign-up works, we count a small number of steps. Each count is stored as a single line containing only: what happened, the type of device (iPhone/iPad, Android, desktop or other), the time, and at most a short label (the platform and campaign name of a link, the name of an app, or which button in the App was used). A count never contains your name, email address, user ID, IP address, device identifier or invitation code, and we do not use cookies or similar technologies for it. We count:

Because these counts cannot be linked to a person, they are not personal data. We keep them for as long as they are useful to us.

We also read aggregate download numbers per day, platform and campaign from Apple (App Store Connect) and Google (Google Play Console). Apple and Google compute these numbers themselves; they contain no information about individual people.

3.8 Links From Our Social Media Posts and Promotions

We share links to the App in our own posts and paid promotions on social media platforms such as YouTube, TikTok, Snapchat and Instagram. These links point to our download page, for example aminuts.app/download?src=tiktok&c=launch, where src names the platform and c names the campaign. We also use short forms of this link that behave exactly the same way: aminuts.app/ig (Instagram), aminuts.app/tt (TikTok), aminuts.app/yt (YouTube) and aminuts.app/sc (Snapchat), optionally with a campaign name, for example aminuts.app/tt?c=launch. The store buttons on our homepage (aminuts.app) also go through the download page when you tap them on a phone, with "website" as the platform; on a computer they link straight to the app stores and nothing is counted. We do not place advertising pixels, tracking SDKs or cookies from these platforms on our pages or in the App. The platform where you saw our post may record your click according to its own privacy policy.

When you open such a link, our server counts the visit (Section 3.7) and the download page sends you to the app store for your device. To know where a new account came from once the App is installed:

When you then create a new account, the App sends the platform, campaign name and how it was received, and we store this with your account ("Where you found us", Section 3.3). If you sign in to an existing account instead, nothing is stored and the App deletes it from your device. If you came both through one of our links and through a friend's invitation, we keep both.

4. How We Use Your Data

We use your personal data for the following purposes:

Nuts Score explained: Your Nuts Score is calculated as 100 minus the average percentage of the options you picked across a daily result set. It is derived from aggregate statistics, not from other users' individual data. A higher score indicates more unconventional opinions.

4a. Automated Decision-Making and Profiling

Please note: Your poll answers are processed by an automated algorithm to calculate your Nuts Score. Whilst this constitutes profiling under Article 4(4) GDPR (automated processing to evaluate aspects of your behaviour and preferences), we note that the Nuts Score does not produce legal effects or similarly significant effects within the meaning of Article 22(1) GDPR. It is an entertainment metric only, with the limited purpose of displaying your score within the App. You can object to this processing (Section 10) or delete your account and its data at any time from the App's settings.

5. Legal Bases for Processing (GDPR)

Under the General Data Protection Regulation (GDPR), we rely on the following legal bases:

Legal Basis Applicable Processing Activities
Performance of a contract
(Art. 6(1)(b))		 Account creation and management (including confirming your email address), delivering the core service (polls, results, Circles), session management, gamification features, referral processing, and pending Circle invitations.
Consent
(Art. 6(1)(a))		 Optional profile data (date of birth, gender, location, photo). Push notifications (when activated - you will be asked to opt in via your device's OS prompt).
Legitimate interests
(Art. 6(1)(f))

Security measures (IP logging, abuse prevention), API request audit logging, fraud detection, and profiling for the Nuts Score entertainment feature (see Section 4a).

Content moderation and safety: AI review of the names, city, Circle names and profile photos you submit, and handling reports and blocks (Sections 3.3 and 4). It is in our and our users' legitimate interest that the App stays free of offensive content and that people can report abuse and avoid each other, as the app stores also require.

It is our legitimate interests to maintain the security, integrity, and availability of the service; and to provide an engaging entertainment product.

Delivering invitations: storing a short-lived invitation record for your network when you tap the button on our invitation page (Section 3.6), reading the Android install referrer (Section 3.4), and showing a Circle's name and members to people who receive its invitation link. It is in our and our users' legitimate interest that an invitation reaches the person it was sent to, including when they still need to install the App.

Understanding how people find us: storing with a new account where it came from (Sections 3.3 and 3.8), including the short-lived network record on iPhone and iPad and the Android install referrer. It is in our legitimate interest to know which of our own posts, promotions and invitations bring people to the App, without using advertising trackers. You can object to this at any time (Section 10).
Legal obligation
(Art. 6(1)(c))		 Retaining certain records where required by applicable Dutch or EU law.

Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

6. Data Sharing & Third-Party Service Providers

We do not sell your personal data. We share data with third-party service providers (sub-processors) only as necessary to operate the App:

Provider Purpose Data Shared Location / Transfer Mechanism
Google LLC OAuth 2.0 authentication (Google Sign-In) Auth request; Google ID token (email, name, Google user ID) verified on our servers Standard Contractual Clauses
Apple Inc. Authentication (Sign in with Apple) Auth request; Apple identity token (email or private relay address, name if shared, Apple user ID) verified on our servers; authorisation revocation request when you delete your account Standard Contractual Clauses
OpenAI, L.L.C. AI-generated poll assessments; AI content moderation; poll option illustrations For poll assessments and illustrations: only anonymised, aggregate poll statistics, no personal data. For content moderation: the text being checked (your name, city or a Circle name) and the address of the profile photo being checked, without your email address or user ID Standard Contractual Clauses
Mailgun (Sinch) Transactional email delivery Recipient email, name, email content Standard Contractual Clauses
DigitalOcean, LLC Hosting of our servers and database All data described in this Policy that we store on our servers Stored in the EU (Amsterdam, the Netherlands); Standard Contractual Clauses
BunnyCDN (BunnyWay d.o.o.) Profile photo storage & delivery Profile photo files (anonymised UUID filenames) N/a (EU)
OneSignal, Inc. Push notification delivery and delivery statistics Device push token, your user ID (to address notifications to your account), app language, notification content, and whether notifications are delivered and opened (see Section 13) Standard Contractual Clauses
Apple / Google App distribution Standard store listing data. Apple and Google collect their own analytics per their respective policies. When you reach the store through one of our links, the store link may carry the platform and campaign name of that link (Section 3.8), so that Apple and Google can show us aggregate install numbers. Standard Contractual Clauses in Appstore standard terms.

Other users. Some of your data is visible to other users as part of the service. Members of your Circles can see the information described in Section 5.2 of our Terms and Conditions. Anyone who receives an invitation link to one of your Circles can see the Circle's name, its number of members, and its members' first names and profile photos, on our invitation page or in the App. When you send someone an invitation, they can see your name.

Our marketing partner. We work with a marketing agency that helps us promote the App. The agency has read-only access to a statistics dashboard, and to nothing else. It sees only aggregated statistics, such as numbers of sign-ups, active users, invitations and installs per platform or campaign, and totals by age group, gender, country or city. It never sees names, email addresses, user IDs, photos or any other details of individual users: people are shown only as counts, the most active inviters are shown as "Inviter 1", "Inviter 2" and so on, and any group of fewer than 5 people (for example a city with only two users) is merged into "Other" so that no one can be singled out. The agency also sees the questions of our daily polls and how they were answered overall.

We may also disclose your data if required by law, court order, or governmental authority, or to protect our rights, safety, or property.

7. International Data Transfers

Some of our sub-processors are located outside the European Economic Area (EEA), specifically in the United States. Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place in accordance with Chapter V of the GDPR, including:

You may contact us at contact@aminuts.app to obtain further details about the specific safeguards applied to any transfer.

8. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this Policy, or as required by law:

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

While we take reasonable precautions, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Your Rights Under the GDPR

If you are located in the European Economic Area (EEA), you have the following rights with respect to your personal data:

To exercise any of these rights, please contact us at contact@aminuts.app. We will respond within one month of receipt of your request. In cases of complexity or high volume, this period may be extended by up to two further months; we will inform you within one month of receipt and explain the reasons.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority of your EU Member State of residence.

11. Children's Privacy

Am I Nuts is not intended for individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have inadvertently collected data from a person under 18, we will take steps to delete that data promptly. If you believe that a minor has provided us with personal data, please contact us at contact@aminuts.app.

12. Cookies & Tracking Technologies

Am I Nuts is a native mobile application. It does not use cookies, web beacons, pixel tags, browser-based local storage, or any other web-based tracking technologies. There are no first-party cookies, third-party cookies, analytics cookies, or advertising cookies.

Our invitation pages and our download page, including its short links (Sections 3.6 to 3.8), do not set cookies, do not store anything in your browser, and do not use analytics or advertising trackers, pixels or third-party scripts. When you tap the button to get the App on an invitation page, or when the download page sends you on to the app store, the page sends a single request to our own server. That request is used only to deliver your invitation or the link's source after you install the App (iPhone and iPad, Sections 3.6 and 3.8) and to count the step without personal data (Section 3.7). Our emails do not contain tracking pixels, and we do not track whether you open them or click their links.

We do not use any advertising SDKs or ad networks, and we do not engage in behavioural advertising or cross-app tracking.

13. Push Notifications

We offer push notifications to inform you when daily results are available, to remind you of the day's questions if you have not answered them yet (reminders pause after 14 days without opening the App), and for other service-related updates. Push notifications are delivered via OneSignal.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will notify you through the App or by other appropriate means. The "Effective Date" at the top of this page will be updated accordingly.

Your continued use of the App after any changes take effect constitutes your acceptance of the revised Policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data, please contact us:

© 2026 AM I NUTS B.V. All rights reserved.