Who is responsible and how to contact us
Avokado Labs Inc., incorporated in Delaware, United States, operates Avokado and is responsible for the processing described here.
Privacy requests: [email protected]. Account, safety or order help: [email protected]. Company matters and escalations: [email protected].
This notice covers Avokado’s accounts, community, marketplace, Guac, merch and support. Connected services have their own notices. Payment providers, social networks and carriers may also process information for their own legal and business purposes.
Information we collect
Information comes from you, your use of the service, providers you authorize, other members who interact with you, and public sources you ask us to import. We collect only the categories relevant to the features you use; visiting a page does not mean every provider below receives your data.
- Account and identity: email, username, display name, declared country of residence, adult declaration, verification and eligibility status, provider IDs, account roles and settings.
- Profile and creator information: avatar or uploaded picture, games, languages, biography, badges, ranks, country, profile media, application answers, profile links you provide, service packages, prices, communication preferences and creator-review feedback.
- Content and interactions: posts, replies, direct and community messages, reactions, reports, reviews, voice introductions, attachments, live voice participation, orders, matching requests, event registrations and connections with other members.
- Commerce and delivery: quotes, wallet ledger entries and their source, purchases, tips, earnings, refund/dispute records, provider references, masked payment-method descriptions, beneficiary information, tax/billing details, shipping address and fulfillment status.
- Support: your contact details, inquiry topic, messages, references and attachments, staff responses and internal handling records.
- Device and security: IP address, request and browser/device information, cookies, sessions, access and error logs, anti-abuse records, notification endpoints, consent choices and screening metadata.
Why we use information and legal bases
We use account, conversation, order and delivery information to provide requested features and perform our agreement with you: sign-in, profiles, messages, services, wallet activity, merch and support. Required fields are marked; without them we may be unable to provide the requested feature.
Where data-protection law requires a legal basis, we rely on contractual necessity for the requested service; legitimate interests in proportionate security, fraud prevention, moderation, reliability and product measurement, balanced against your rights; and legal obligations for matters such as tax records and lawful requests.
Consent applies to optional reminders and processing that requires it, including camera screening. Browser permission or acceptance of general terms is not blanket consent. Sensitive or biometric information requires any additional conditions imposed by applicable law. You may withdraw consent without affecting earlier lawful processing; the affected feature may then be unavailable. Contact us to ask about the basis for a particular use.
Public profiles, conversations and audiences
Public profiles, services, merch, reviews, posts and approved voice introductions may be viewed, copied or indexed by others. Your country may appear publicly and contribute to discovery counts. Privacy settings cannot retract copies already made.
Direct messages and support inquiries are not public posts. We process them for delivery, safety and issue resolution. Authorized staff may access relevant records for support, moderation, security or legal reasons; stored chat is not end-to-end encrypted.
Linked Discord channels may mirror messages, usernames and avatars, and live stages may share audio with Discord participants. Event registration counts may be public without an attendee list. Check the audience before sharing private information.
Camera screening, facial information and age estimates
New-account screening requires an adult declaration and explicit consent before camera access. AWS Rekognition processes camera frames to assess whether a live person is present and uses a reference image to estimate age. This is an age and liveness check, not identity-document verification or proof of your date of birth.
Avokado does not save the camera video, reference image, face template or exact estimated age range. We retain the result, related screening and consent metadata, and a temporary session identifier cleared after 24 hours. Outcome and consent records remain with the account subject to lawful retention and deletion requests. AWS’s own processing and retention terms also apply.
The estimate can be wrong. Declining or failing screening restricts member features; support remains available. Contact our privacy address to request human review or withdraw consent. We will explain the effect on access; an alternative verification method is not guaranteed. Do not email selfies or identity documents. Keep any private phone-continuation link confidential.
Sign-in and connected accounts
Resend delivers email sign-in links. Google sign-in supplies your authorized identifier, email, name and profile image through OpenID, email and profile permissions; it does not request Gmail, contacts, Drive or calendar access. Avokado’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Discord and Twitch connections use the permissions you approve. Discord may provide identity, membership and role information and synchronize member or Avo roles; camera data is not shared for this purpose. Twitch may support authorized clip tools when available.
Review connections in Settings or revoke permissions at the provider. Revocation stops future authorized access where applicable but does not delete your Avokado account, existing posts, imports or transaction records. Contact us if a connection cannot be removed.
Moderation, link checks and AI responses
Eligible messages, profile and creator text, reviews and relevant context may be checked by Avo Intelligence for moderation. Google Web Risk checks submitted URLs. Avoid sharing private access links: a URL can itself contain personal information.
When the community assistant is enabled, OpenAI receives the relevant community message and limited conversation context to generate a reply. This does not automatically send every private message to OpenAI. Provider terms govern retention and data handling; we do not promise zero retention.
Screening and moderation may restrict account access or content delivery. These checks can make mistakes. You can contact support to request human review, explain your position and contest a decision. An automated result is not a final determination of identity, age or wrongdoing.
Uploaded media and live voice
Uploaded images, videos, voice introductions and artwork may be processed and stored with Cloudflare. Media processing does not remove personal information visible or audible in the content. Access depends on the feature and audience; someone who receives media may keep a copy.
Microphone permission is required for recording or live voice. Voice introductions are saved and may be reviewed before public playback. Live audio may pass through Cloudflare connectivity services or a linked Discord stage. Other participants may record what they hear; joining a room does not grant permission for their recording.
Wallet, payment and fulfillment information
We record wallet amounts and sources, purchases, reservations, earnings, tips, refunds, disputes and payment references. Available payment and payout methods depend on the feature, account and country.
Provider checkout pages or hosted fields collect card credentials. We retain necessary payment references and masked descriptions for methods you choose to save. Payout names, bank details and addresses may pass through our server to the provider. PayPal fraud-prevention tools may process browser and session signals when its flow loads.
Payment providers use information for processing, identity checks, fraud prevention, sanctions and legal compliance under their own notices. Printify, print providers and carriers receive order, artwork, recipient and delivery details for fulfillment. Billing and delivery details support tax, shipping and eligibility checks and are not published on your profile.
Services and recipients
The services below handle information for the features indicated. Optional services receive relevant data when you use them; not every integration is available to every account. Providers may use subprocessors and, where applicable, process data for their own purposes. Follow the links for their privacy or service information.
- Hetzner
Core infrastructure
Server hosting for the application, database and operational systems.
Information involved: Account, content, transaction and support records stored on hosted infrastructure, plus network and operational logs.
- Cloudflare R2 and Realtime
Media and live voice features
Uploaded media storage and connectivity for supported live voice features.
Information involved: Media files, temporary access requests and network metadata; relay services transport live voice traffic.
- AWS Rekognition
New-account screening
Camera liveness and estimated-age screening.
Information involved: Camera frames, a reference image used for analysis, session metadata and screening results. See the dedicated camera section.
- Resend
Email features
Sign-in links, transactional mail, support notifications and opted-in reminders.
Information involved: Recipient email, necessary message content and delivery status; messages may contain account or order references.
- Google sign-in
When you choose Google
Create or connect an account through OpenID, email and profile permissions.
Information involved: Provider identifier, email, name, available profile picture and authorized tokens. No Gmail, Drive, contacts or calendar permission is requested.
- Discord
Connected and community features
Sign-in, linked accounts, server roles, supported community message mirroring and voice-stage bridging.
Information involved: Authorized identity and tokens, membership and role information, and messages or live audio for linked channels.
- Twitch and IGDB
Catalogue and chosen Twitch features
Sign-in, linked creator features, clip tools and game catalogue information.
Information involved: Authorized account identifiers, tokens, clip requests and metadata; game search queries and artwork requests.
- Medal
Chosen clip content
Import or display clips you choose to share.
Information involved: Clip URLs and identifiers, public clip metadata and media requests; a viewer’s network data when loading externally served media.
- GIPHY
When the GIF picker or media is used
GIF search, trending results and selected GIF delivery.
Information involved: Search text and browser requests, including IP and device/network metadata. Requests can go directly from your browser to GIPHY.
- Photon / komoot / OpenStreetMap
Address search; manual entry is available
Address suggestions through Photon using OpenStreetMap data.
Information involved: Street search text and selected country, sent by our server. Separate name, email, phone and apartment fields are not included in the search request.
- Google libaddressinput metadata
Delivery address forms
Country address formats and validation rules, adapted from Google’s Address Data Service under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Information involved: Bundled country-level metadata only. Address form values are not sent to Google by this integration.
- Avo Intelligence (Typesafe)
Moderated content features
Automated checks of eligible member text and limited conversational context.
Information involved: Text submitted for moderation, relevant context, rule information and the resulting safety decision.
- Google Web Risk
Link safety checks
Check submitted links for known threats.
Information involved: URLs extracted from content; a URL itself can contain personal information. This does not send your entire browsing history.
- OpenAI API
When community generation is enabled
Generate optional community-assistant replies.
Information involved: The relevant community message and limited conversation context, subject to provider retention terms.
- Stripe
Available checkout and saved-method features
Payment checkout, saved-method references and tax calculations in supported flows.
Information involved: Checkout amounts, account/customer references, billing and tax details, payment status and provider tokens; card entry uses provider controls.
- PayPal
Available payment and payout features
Checkout, saved methods, connected payout identity and fraud prevention.
Information involved: Transaction and account references, authorized profile details, provider tokens and device/session signals through FraudNet when loaded.
- Airwallex
Available payment and payout features
Hosted payment fields, saved-method references and bank-beneficiary/payout tools.
Information involved: Payment and customer references; beneficiary identity, bank and address details submitted in the payout flow, and result/status data.
- Printify, print providers and carriers
Enabled merch fulfillment
Merch catalogue, artwork, production, shipment and delivery.
Information involved: Ordered items and variants, print files, recipient name, delivery address and necessary contact details, destination-required tax or customs identifiers, shipping and tracking information.
- Browser push services
Optional browser notifications
Deliver notifications you permit, through the service used by your browser (such as Apple, Google, Mozilla or Microsoft).
Information involved: Push subscription endpoint, encrypted notification payload and delivery/network metadata. Notifications use generic text rather than private message bodies.
- Self-hosted Umami
Production analytics; respects browser DNT/GPC
Measure site usage on our own infrastructure.
Information involved: Allowed page/event names, bounded campaign information and origin-only referrers. Message text, form fields and profile identifiers are excluded from event payloads.
Address suggestions, GIFs and games
Address suggestions send your street search and selected country to Photon, using OpenStreetMap data. Include only information needed for the search. Manual entry is available; check suggestions before saving.
GIPHY receives GIF searches and browser requests. External clips, artwork and media may expose your IP address and device information to their hosts when loaded.
Email, push notifications and reminders
We send necessary sign-in, security, order and support messages. Optional reminders and notifications are controlled by their settings; disabling them does not stop essential messages. Waitlist or launch-notification requests use the contact details supplied for that purpose.
Browser push requires permission. We store a subscription and deliver generic notification text, rather than private message bodies, through your browser’s push service. Disable push in Settings or browser permissions.
Support correspondence is stored with your inquiry and may be delivered through Resend. Use the indicated reply channel and keep your reference when following up.
Other disclosures
Authorized staff and contractors may access information needed for their work. We share relevant records with the providers described above to operate a feature, and with another member when necessary to deliver your chosen interaction or transaction. We do not make private addresses, bank details or camera results public merely because you have a public profile.
We may disclose information when required by a valid legal process, to meet a legal obligation, to investigate fraud or serious abuse, to protect legal rights and safety, or to advisers handling a dispute. Requests should be assessed for legal validity and scope. A corporate restructuring or transfer may involve relevant business records subject to applicable law and appropriate notice and safeguards.
We do not sell personal information or share it for cross-context behavioral advertising. This statement does not mean there is no disclosure to processors, payment providers or people you choose to communicate with. Where a jurisdiction defines these activities differently, you may contact us to exercise the applicable rights.
International processing
Avokado Labs Inc. is a US company. Our users, hosting and service providers may be in different countries, so your information may be processed internationally.
Where transfer restrictions apply, a lawful mechanism is required, such as an applicable adequacy decision or contractual safeguards. Contact our privacy address for information about the safeguards relevant to your data and any available copy, subject to lawful redactions.
Retention and deletion
We retain account and content records for the features you use, support records to handle inquiries, and transaction records to meet accounting, tax and dispute obligations. Retention depends on account activity, outstanding transactions, security needs and applicable law. Information kept for a legal obligation or dispute is limited to that purpose.
Temporary screening session identifiers are cleared after 24 hours; screening outcomes and consent records follow the account-retention rules described above. Expiry of a sign-in or media link removes access, not the underlying record.
Unsent or replaced media is queued for cleanup. Messages and support attachments may remain with their conversation or case. Logs and backups have separate retention cycles, so deletion from active systems may precede removal from backups. Copies independently saved by others or lawfully retained by providers may remain.
Account deletion is available in Settings once outstanding transactions and balances are resolved. For exports, deletion requests or help, contact our privacy address. We will explain any lawful retention exception; disconnecting a provider or deleting a post does not erase every related record.
Your privacy rights and choices
Depending on where you live and which laws apply, you may have rights to know about and access personal information, obtain a copy, correct inaccurate information, request deletion, restrict processing, receive portable information, object to certain processing, withdraw consent, and challenge qualifying automated decisions. Some US state laws also provide rights to opt out of sale, targeted advertising or certain profiling and to appeal a refused request. These rights have conditions and exceptions; their availability does not depend solely on citizenship.
Email [email protected] with the request and the account identifier needed to locate your information, or use an authenticated support inquiry. We may verify identity or an authorized agent’s authority proportionately. Do not send full card details, passwords, a selfie or an identity document unsolicited. We will respond within the time required by applicable law and explain any permitted extension, refusal or retention exception.
You can change supported profile and privacy settings, revoke provider permissions, disable browser notifications, opt out of optional reminders, and set browser DNT/GPC signals. Some information remains necessary to maintain an account or fulfill an outstanding order. You will not be penalized for exercising a lawful privacy right, although a feature cannot operate without information genuinely required for it.
If you believe our handling is unlawful or a response is inadequate, contact the company escalation address and, where applicable, complain to your data-protection authority or other competent regulator. EEA and UK residents may contact the supervisory authority relevant to their residence or work. You do not have to contact us first where the law allows a direct complaint.
Security and your responsibilities
We use technical and organizational measures to protect information and limit access. No system or transmission is completely secure. We will meet applicable breach-notification obligations.
Secure your email and connected accounts, sign out of shared browsers, keep verification links private and check recipients before sharing. Report suspected unauthorized access through support.
Children and sensitive information
Avokado is intended for adults aged 18 or older. The signup check is not infallible and does not justify allowing a child to use an adult’s account. If you believe a child has supplied personal information or is using the service, contact support with the account reference so we can investigate and restrict or remove information as appropriate.
Avoid putting health information, government identifiers, full financial credentials or other sensitive personal information into public posts, ordinary chats or imports. Do not upload another person’s biometric or intimate material without a valid legal basis. Camera screening and necessary beneficiary forms have dedicated notices and flows; they are not an invitation to send the same information to staff by email.
Changes to this notice
We will date material revisions and give additional notice or obtain consent where required before introducing a materially different use of information.
Privacy questions: [email protected]. Account help: [email protected].