Privacy policy

Last updated 13 October 2026

scrolly is a mobile app where small, invite-only groups of friends share scrollies: usually a link to a video somewhere else, sometimes a video or a photo from a phone. It is published and operated by 312.dev LLC, and the servers behind it are ours. Nothing about this app is a data business.

This policy says what we store, where it lives, how long it stays, and what you can ask us to do with it. If something here is unclear, ask: scrolly@312.dev.

The short version

• We store your account, the things you post, and what you have watched.
• We do not store the videos you link to from TikTok, Instagram, YouTube or anywhere else. We store the link. Your phone fetches the video.
• There is no analytics and no tracking of any kind in the app, and we sell no advertising. Nothing in scrolly reports on you in the background. What the app does send on its own, unless you turn it off, is a crash report when it breaks: what kind of error and where in the app's code, never who you were or what you were looking at, and never linked to your account. The same switch covers how long the app took to start, which goes to Expo, as their row below describes. The diagnostics log described below is the other thing it records about what it did, and it goes nowhere until you send it, or until you let a test build send it for you. A game somebody posts carries its own advertising, run by the company whose game it is; the Games section below says what that means.
• We have never sold or shared anyone's information, and we are not going to.
• Delete your account from inside the app, and everything above goes with it. The two things that outlast it, a record of any action we took against the account and anything we had to preserve for a report of child abuse, are under How long we keep it.

What we store

About that last row. scrolly used to sign people in with a text message. It does not any more: sign-in is Apple, Google or an emailed code, nothing sends a text message, and nothing asks anybody for a number. A host adding somebody to a group used to be asked for theirs and is not any more; a member added now gets a placeholder in that field, derived from their own account, that never was a phone number.

What we have not done is delete the numbers we already hold. The column they sit in cannot be left empty and cannot be removed without rebuilding the table, and that rebuild is waiting on something else. So if you joined during the text-message era, your number is still on your record, nothing reads it, and it goes when your membership does. We would rather say that than call it gone.

What we do not store

• Third-party video and audio. When someone posts a TikTok, a Reddit clip, an Instagram reel or a YouTube video, the server keeps a link and the social details around it. Your phone goes and gets the media from the platform it lives on, at the moment you play it. There is no copy on any server of ours. The other half of that is worth saying: because your phone asks the platform for the video directly, that platform sees the request, the same way it would if you had opened the link in a browser. Avoiding it would mean keeping a copy on our server, which is the thing we are not doing.
• Anything about how you use the app, beyond what is listed above. There is no analytics package, no session recorder, no advertising SDK, and no marketing pixel anywhere in scrolly. The crash reports above are the app's own and go to us alone, and the only other report the app sends on its own is how long it took to start, to Expo, as described under Expo below. We do not read your advertising identifier. We do not build a profile of you. The advertising inside a game is that game's own page doing it, with nothing of ours in the middle; Games below is the whole of it. Besides the crash reports above, the diagnostics log described under “What is on your phone” is the one record the app keeps of what it did, and it sits on the phone until you send it: by email, or, on a test build where you have turned that on, straight to us. Either way it is a press of yours, and you are asked what goes with it every time, unless you agreed on a test build to let it send on its own, as described under “What is on your phone”.
• Your location. The app never asks for it. The closest thing we hold is a time zone: your group's, which someone typed in once, and, if you once set a time for the daily reminder, your own phone's. A time zone is a region, not a place, and neither one is asked of the operating system's location service.
• Payment information. quilted is billed by the App Store or Google Play. Your card goes to the store and never to us, not even the last four digits. What we do hold is under Memberships below.
• A link you have not posted yet. While the share sheet is opening, your app asks our server which of your groups already have that link, so it can mark them before you choose. The question is answered against the groups you are in and nothing else, and neither the link nor the asking is written down. If it is one of the short links a platform's own share button hands out, our server follows it once to find the page it stands for, which is the same thing it does when a link is actually posted. Instagram's and Facebook's short links are left as they are, because following one means asking Meta.
• What you do with a link after you leave. The share arrow on a scrolly hands the source page to your phone's own share sheet. Which app you send it to, and whether you send it at all, happens on your phone and never reaches us.
• Passwords. There are none. Sign-in is Apple, Google, or a six-digit code emailed to you, and the code is stored encrypted and expires in ten minutes. A code to change your email address also expires in ten minutes, and we keep only a keyed fingerprint of it, never the code itself.
• Private messages. scrolly has no direct messaging. Every comment is visible to your group.

Who at scrolly can see it

scrolly is run by 312.dev LLC, and only the people who operate it can see what we store about any account through an admin console: names and email addresses, the groups you are in and who else is in them, what you posted, reported and were reported for, the internet address and device each sign-in came from, your push devices and paired computers, and when you were last active. It is there to answer reports and support requests and to keep the service working, not to read along with your group. It opens only on their own devices, enrolled with Cloudflare, and every change made through it (removing a post, warning, banning, deleting an account) is written to a log that cannot be edited or deleted, with the reason for it.

A report you make goes to your group's host and to us. We look at every report within 24 hours.

Who else touches it

These are the companies scrolly reaches. Each one gets only what it needs, and with one exception, named under the table, none of them is allowed to use it for anything else.

GamePix is the exception the sentence above the table names. Everybody else on that list is handed something because we asked them to do a job with it, and may use it for nothing else. A game is another company's web page, running on their terms, and their advertising is a business of theirs that we have no part in and take no money from. What we choose is which games exist at all, and your group's host can switch the whole thing off.

One more organisation, and only if it comes to that. US law requires us to report apparent child sexual abuse material to the National Center for Missing and Exploited Children. If we find it, we preserve a copy and report it, with what we hold about the account that posted it: the file and when it was uploaded, the account's email address, name, picture and the date it was made, the group and its members, captions and comments, the link and platform of a linked post, and the kind of phone it came from.

Where it is, and whose law reaches it

Every company in that table is American, and so are we. The database is in Ohio. The files you upload are in Cloudflare's storage, under an account of ours. Cloudflare's network is worldwide, so the request your phone makes is answered by whichever of their machines is nearest you, wherever that is; the companies that hold and handle any of this are United States companies, and that is where your information lives.

So it is subject to United States law. A court, a law enforcement agency or a national security authority there can require access to it under rules that are not the ones where you live, and nothing we could put in a contract would change that. It has not happened: we have never had a request of that kind, from any authority of any country. If we get one we will say so on this page and tell whoever it is about, unless we are forbidden to.

You can have this in writing. Email scrolly@312.dev and we will tell you which companies outside your own country handle your information, where each one is, and what it is allowed to do with it. It is the table above with a country beside each row, and we will put it in a letter if that is more use to you than a web page.

Memberships

If you subscribe to quilted, the payment itself never touches us. Your card details go to Apple or Google and we never see them, not even the last four digits. What we store is a single row saying that the account you signed in with holds the membership, which store it came from, whether it is a real purchase or a sandbox one from testing, and the date it runs to. That row is what every locked control in the app checks. The same table is how we hand the membership out without a sale, to somebody testing an unfinished build or to somebody reviewing the app for a store; a row like that names the reason instead of a store.

RevenueCat is how a bought row gets written; the table above says exactly what reaches them. Deleting your account does not cancel the subscription: that is the store's, and you cancel it there.

That row is deleted along with everything else. It is keyed to your sign-in identity rather than to your membership of a group, the same as your saved preferences and any beta access, so deleting your account clears it by that identity rather than by a membership row.

See who watched

scrolly already records that you watched a scrolly and roughly how far through you got, which is what earns you scrollies and what keeps a clip from coming round again. See who watched is the quilted feature that shows a poster who watched their own posts and how much of each one they got through. Both halves need a subscription: without one the app does not open the list at all, and the server refuses it as well, so there is nothing for a modified app to ask for.

The lengths are for their own posts, and only ever for them. A subscriber can see who watched any scrolly in a group they are in; how long you watched is shown only to the person who posted the thing you watched. No host gets a report about their group, and there is no leaderboard.

You can keep yours private. A single switch in settings, called let posters see your watch time, is on by default and turning it off unlinks your name from the figure: the poster still sees that somebody watched and how far, and it says someone instead of you. It costs you nothing to turn off, it is not a paid feature, and it applies everywhere at once rather than per group. The watch still counts towards your scrollies either way.

Games

A scrolly can be a game instead of a video. We pick a handful of them from GamePix, a company that publishes browser games, and posting one sets a challenge for your group. You play it on your own, in a window inside the app, and what is in that window is their web page rather than anything of ours.

We tell GamePix nothing about you. Not your name, not your email address, not which group you are in, not what anybody posted. What they get is what any website gets when your phone opens it: your IP address, what your phone says it is, and a cookie of their own. We keep that cookie between plays rather than clearing it each time, so a game can pick up where you left it without asking you to make an account with them. It sits on your phone, under their name, and deleting the app takes it with it.

The games carry advertising, and it is not ours. Expect something to play or appear before a game starts and sometimes between rounds, and a game may offer you an ad to watch in return for something in the game. Those come from GamePix and the advertising companies it uses, asked for by their page and not by us. Those companies set cookies of their own inside that window, and GamePix's policy says plainly that the ads are tailored to what it has worked out about you, from that page and from elsewhere. We do not run those ads, we do not choose them, we are not paid for them, and nothing we hold about you goes into picking them. What GamePix does with what it sees, and how to turn the tailoring off, is theirs to answer, at gamepix.com/privacy-cookie.

Your score and its picture are yours, and we are the ones storing them. When a game says a round has ended, we write down the score it reported and keep a picture of the game as it stood at that moment. Both go on the post that set the challenge, for your group and nobody else, and they are treated like a comment: they go when that post goes, and they go when your account does.

A host can switch games off. They are on in a new group. The host of a group can turn them off for everybody in it, which takes games out of what can be posted there, and nothing in this section happens in a group with them off.

How long we keep it

Your clips and comments stay until you or a host removes them; sign-in codes and sessions expire on their own. Everything else in your group works the same way as clips and comments: it stays until somebody removes it, and removing it is something a person does.

• A scrolly deleted from the group is really gone: the row, every file we stored for it, and the comments, reactions and watch records attached to it. Your group's host can delete any scrolly in the group. For your own, email us and we will take it down.
• A scrolly we take down for breaking the rules is hidden from everybody at once, kept for 30 days in case we got it wrong, and then deleted in the same way.
• A scrolly we take down because of a copyright notice is kept longer: 75 days, so that a counter-notice sent near the end of the 60 days we give for one can still put it back, and for as long as a counter-notice or a lawsuit about it is open. The copyright page says how that works. Then it is deleted in the same way. The record of the notice itself (who sent it, when, which posts it named and whose they were, and what became of it) is kept with the log below, and outlasts a deleted account for the same reason.
• A deleted comment is gone, along with any replies to it.
• A game score and the picture taken with it sit on the post that set the challenge, so deleting that scrolly takes them along with everything else on it.
• Sign-in sessions expire ninety days after their last use.
• A push token whose device Apple or Google tells us is gone is deleted, along with the delivery records for it, within about fifteen minutes of them saying so.
• Sign-in codes expire in ten minutes.
• A diagnostics report you sent us from a test build is deleted 30 days after it arrives, by a sweep that runs every day. Turning the setting off stops another one being sent; deleting your account deletes every report it holds, and so does asking us.
• The list of scrollies you hid from yourself in an early version of the app is not deleted on a schedule, and that is deliberate: the list is what keeps them hidden from you, so deleting it would undo the thing you asked for. It stays as long as your membership does and goes with it. The record of when you hid them, and who you asked to help, goes when your account is deleted, or the group is.
• When a host removes someone from a group, that person's username and phone number are overwritten and their notification settings and push tokens are deleted. What they posted stays where it is, because deleting it would take other people's comments and reactions with it. Deleting all of it is what deleting your account is for, and that asks which you want before it does anything.
• What we worked out about a website is kept against the website's name and against nothing else: which of the three channels it belongs to, and whether a reputation service called it malware, phishing or pornography. Neither record names a person, a link or a group, so there is nothing in either to go with an account. The channel stands until something replaces it, which in practice means until one of us corrects it. The safety answer is asked again after thirty days, because a hijacked blog gets cleaned up and a clean domain gets sold to somebody else.
• Every action we take through the admin console is kept in a log that nothing can edit or delete: what was done, to which account, group or post, why, and how things stood before and after. It outlasts a deleted account, names and email address included, because it is the record of what we did and why.
• When you change the email address on your account, or remove Apple or Google as a way to sign in, we keep a record of it for a year: when it happened, the old and new address, and the network address the request came from. It outlasts a deleted account for that year, because it is how we help you get your account back if somebody else made the change. After a year it is deleted.
• Anything we preserved for a report to the National Center for Missing and Exploited Children is kept for at least a year from the day we report it, as US law requires, and then deleted by hand. An account, a group or a post connected to preserved material cannot be deleted until that preservation ends; a request to delete one is still received and logged, and done once it can be.
• Our database provider keeps rolling snapshots so we can recover from a failure, so deleted rows can survive in one until it rolls off. We never open a snapshot to bring back something somebody asked us to delete, and re-applying a deletion is part of any restore.

What is on your phone

Your sign-in token lives in the operating system's secure storage, the Keychain on iOS and encrypted preferences whose key is held in the Android Keystore on Android. Your preferences live in ordinary app storage. Deleting the app removes all of it, and removes nothing from the server.

The app also keeps a short diagnostics log on the phone: the last few hundred things it did, which is to say the screens you opened, the requests it made and what came back, and any error it caught. It never contains sign-in tokens, email addresses, links to anybody else's site, or anything you typed, because those are stripped before a line is written rather than before it is sent. You can read the whole of it in the app under Settings, then Help & support, then View diagnostics. It is written to the app's own storage on the phone, and nothing sends it on its own unless you agree to that on a test build, as below.

The one way it reaches us is if you send it, and you are asked each time. Every email from Help & support carries your app version, build number, phone model, OS version, locale, time zone and screen size, and before the mail opens we ask whether to include the diagnostics log as well. Nothing is remembered between messages: the question is put again every time, and closing it sends nothing at all. On an iPhone saying yes puts the log on the message as a text file. On Android it does the same where your version of the app can: the mail app opens in a window of its own, so you can get back to scrolly, and the log rides along as a text file. On older Android versions of the app that route cannot carry a file, so saying yes puts the log on your clipboard instead and the message tells you where to paste it; the app says which of the two you are getting before you answer. You can also use “Copy diagnostics” at any time. Either way it is a thing you do, and what we then hold is your email and whatever you put in it, kept the way any support message is.

A test build of scrolly, the kind we hand to people trying it before it is finished rather than the one on the App Store or Google Play, can also send that log straight to us instead of through your mail app. It is off until you turn it on. Such a build asks you once, in normal use rather than buried in a menu, whether scrolly may send its diagnostics log to scrolly's own server to help fix bugs; the same two sentences above about what the log holds and what it leaves out are in the question, closing the question is not a yes, and nothing is sent until you answer it. Turning it on adds a “send a report now” row under Help & support and does nothing else by itself: every report is still a press, and the question about what goes with it is put again each time. The one exception is when we are looking into a problem you hit and ask for your diagnostics: a test build signed in to your account then asks, each time you open it until you say yes, whether it may send the log to us on its own, and after a yes it does so when you open scrolly and when you leave it, at most once every five minutes, until we stop asking or you turn “send diagnostics automatically” off under Help & support. What arrives is exactly the text you can read on the View diagnostics screen and nothing else: no message, no subject, nothing about your group. It is filed under your account, so we know whose report it is. We keep it for 30 days and then delete it. To stop, turn “let this phone send reports” off under Help & support and the app has no way to send one at all; to have the ones already sent deleted, delete your account or email us and we will. The build you would get from the App Store or Google Play cannot do any of this, and the code for it is not in that build.

Crash reports wait on the phone until they are sent, at most two hundred of them and for at most seven days, in the app's own storage, alongside the random install number they carry. Turning crash reports off deletes the waiting ones. The start times meant for Expo wait in the app's own storage as well, until they are sent; with reports off they are never sent, and the app clears them out on its own schedule.

A game somebody posted keeps a cookie on your phone as well, set by the game's own site and kept between plays so it can remember you without an account. It lives in the app's web storage under that site's name, nothing of ours reads it, and deleting the app removes it with everything else.

Your choices

• Turn notifications off in Settings and the push token for that device is deleted.
• Turn crash and health reports off under Settings, then privacy, then send crash and health reports. The app stops making them, and any not yet sent are deleted from the phone rather than sent later; the start times Expo would have had are never sent either. Reports already sent carry nothing that could find yours among them.
• Change your username, and add or remove your profile picture, whenever you like.
• Ask us to take down any scrolly or comment you posted, without closing your account.
• Block anyone in your group.
• Ask us for a copy of everything we hold about you.
• Ask us to correct something that is wrong.
• Delete your account and everything attached to it, from Settings in the app or by asking us.

Deleting your account is a button: Settings, then Delete account. It asks what to do with your scrollies and comments, and then does it, with nobody in the middle. Everything else on that list is one email to scrolly@312.dev, and so is deleting your account if you cannot get into the app. We will confirm we got it within ten business days and finish within twenty working days. Twenty is the shortest limit any privacy law we looked at sets, so it is the one we apply to everybody rather than running a different clock for each country. If something is going to take longer than that, we will tell you before the twenty days are up, say what is holding it up, and tell you that you can complain about the delay to the privacy regulator where you live. If we cannot do something you asked for, we will say why rather than going quiet. You will never be treated differently for asking. There is one paid membership, quilted, and it is sold to everybody on the same terms; asking us for anything on this list changes neither what it costs nor anything the app does without it.

You can have someone else make a request for you. We will ask you to confirm it is genuinely on your behalf before we act on it.

US state privacy laws

California's Consumer Privacy Act, and the comparable laws in Virginia, Colorado, Connecticut, Utah, Indiana, Kentucky and Rhode Island, each apply to businesses above a size threshold. The lowest of those thresholds is thirty-five thousand residents of one state; the California revenue threshold is over twenty-six million dollars a year. scrolly has a few dozen users in total, and the one membership it sells earns nothing against a figure like that. None of these laws applies to it, and we would rather say that plainly than pretend to a compliance programme we do not have.

The rights those laws grant are cheap to honour at this size, so we honour them anyway. That is the list in the previous section: know, access, correct, delete, take a copy with you, and not be penalised for asking.

Three things those laws ask about by name:

• Sale or sharing. We have never sold personal information and we have never shared it for cross-context behavioural advertising, which is the other thing California means by that word. We sell no advertising and take no money from anybody else's. The one place an ad appears is inside a game somebody posted, which is another company's web page showing its own: we hand them nothing about you and get nothing back, and Games above says what their page sees from your phone directly. Their policy calls what they then do with it a sale and a share in California's sense, and it is theirs to offer you a way out of, at the address in that section. So there is no Do Not Sell or Share My Personal Information link on this site, because there is nothing behind it. If your browser sends a Global Privacy Control signal, it is already satisfied. The same is true of the older Do Not Track header some browsers still send: nothing here tracks you across other sites over time, so a Do Not Track signal has nothing to turn off.
• Sensitive personal information. We do not collect any of it. No government identifiers, no financial account details, no precise location, no race, religion or union membership, no genetic, neural or biometric data, no health information, and nothing about anyone's sex life or sexual orientation. There is therefore no Limit the Use of My Sensitive Personal Information link either.
• Automated decisions. One thing is decided automatically: when you post an upload, or a link whose picture we store, it is scanned, and a high score for sexual content hides the post from your groups until a person reviews it, while other flags mark it as sensitive so members tap to see it. A person reviews every post the scan hides, and every removal and account action is a person's decision, which you can ask us to review. Nothing else decides anything about you: no access, no eligibility, no price, no profile. The feed does sort itself, and you pick how. Oldest first is time. Round robin takes turns between whoever posted. Best puts the scrollies with the most watches, reactions and comments at the top and then takes turns as well, so one person does not fill the screen. Those counts are the group's, not yours, and the only part of the feed that depends on you is which scrollies you have already watched. A group can also show a small trophy mark, which the app calls champ, beside whoever's posts earned the most hearts, bookmarks and comments per viewer over the last seven days; it is worked out the same way for everyone from data already in this policy, a host can turn it off, and it never leaves the app.

Children

scrolly is not for children under 13 and we do not knowingly hold anything from one. Groups are invite-only, so who is in a group is decided by the person who runs it. If you believe a child under 13 has an account, email us and we will delete it.

Security

Everything travels over HTTPS. Uploaded files are in a private bucket that no public URL reaches; every read goes through a check that you are in the group the file belongs to. Diagnostics reports are in a bucket of their own with no read route in front of it at all: the app can put one there and nothing on the web can get one back out. Sign-in codes are stored encrypted rather than in the clear: the database alone cannot read one back, and the one thing that can is server-side, with no web route in front of it. Nobody outside 312.dev LLC has access to the database.

We also keep one working copy of the database for testing changes before they reach you. Every email address, real name and login token in that copy is deleted or replaced with a placeholder before anyone works with it, along with every push token, every report and every block; the links, comments and reactions people posted stay, because testing a feed needs real posts to test it against. That copy is rebuilt from the real database every so often rather than kept in sync line by line, so something you deleted can take a while to disappear from it.

If you find a security problem, email scrolly@312.dev and we will take it seriously.

Changes

If this policy changes, the date at the top changes with it and the current version is always at scrolly.312.dev/privacy. If a change actually affects what happens to your data, we will tell you in the app rather than quietly editing this page.

Contact

A copyright notice goes to our copyright agent instead. The copyright page has the address and what a notice has to say.