Privacy Policy

1. Introduction

This Privacy Policy explains how Colla (“we,” “us,” or “our”) collects, uses, stores, and shares your information when you use the Colla platform (“Platform”). Colla is currently operated by an individual based in New York, United States of America.

By using Colla, you agree to the practices described in this policy. If you do not agree, please do not use the Platform.

2. Information We Collect

2a. Information from third-party platforms

When you sign in via Google (YouTube) or Twitch OAuth, we receive and store the following information from those platforms, and here is how each piece is used:

• Your display name and profile picture — used to create and display your Colla profile to other users.
• Your handle — used to identify your channel and link your profile to your platform presence.
• Your follower or subscriber count — displayed on your profile so potential collaborators can assess your reach.
• Your average view or performance statistics — displayed on your profile as a creator metric to facilitate informed collaboration decisions.
• OAuth tokens — stored securely to keep your platform account connected until you disconnect it. OAuth tokens are never displayed publicly and are not shared with other users.

Depending on the permissions you authorize during the OAuth consent process, Colla may also access other account information explicitly granted at that time. We only access data that is necessary to provide the Platform's features.

You may disconnect your Google or Twitch account at any time through your Colla account settings, or by revoking Colla's access directly in your Google Account security settings at myaccount.google.com/permissions.

2b. Information you provide directly

When you set up or update your Colla profile, we collect and store information you provide, including:

• Your display name — used to identify you on the Platform to other users.
• Your bio — displayed on your public profile to help other creators understand your content style and collab goals.
• Your content niche or category — used to display on your profile and as a signal in the matching algorithm to suggest relevant collaborators.
• Your location (country and city) — optionally provided during onboarding. Used as a signal in the matching algorithm to surface geographically relevant collaborators. Displayed on your public profile.
• Profile pictures and post media — images, videos, and audio files you upload are stored on Google Cloud Storage and served via public URLs. Profile pictures are displayed on your profile. Post media is displayed alongside your posts.

Information you post publicly on Colla — including posts, replies, profile details, and public media — is visible to other users and may be used by Colla for marketing purposes.

2c. Activity data

Colla stores activity generated through your use of the Platform. Some of this activity is public and may be used for marketing purposes — specifically, your posts, replies, and public profile information.

The following activity is private and will never be shared publicly or used for marketing: direct messages, swipe decisions, match relationships, and notifications. Direct messages may be reviewed by Colla staff if reported, as described in our Terms & Conditions.

2d. Analytics data

Colla uses Google Analytics to understand how users interact with the Platform. Google Analytics may collect data such as pages visited, time spent on the Platform, and general usage patterns. This data is collected via cookies and is governed by Google's own Privacy Policy.

3. Cookies

Colla uses cookies for the following purposes:

• Session cookies — to keep you logged in while you use the Platform
• Analytics cookies — set by Google Analytics to track usage patterns such as pages visited and time spent on the Platform
• Advertising cookies — set by Google AdSense, which is integrated into the Platform. Even where ads are not yet being displayed, the AdSense script may set cookies and collect browsing data for the purposes of ad personalisation and measurement. This is governed by Google's own Privacy Policy.

When you first visit Colla, you will be shown a cookie consent notice. By continuing to use the Platform after seeing this notice, you consent to the use of cookies as described above. You may disable cookies in your browser settings, but doing so may affect your ability to use certain features of the Platform.

4. How We Use Your Information

We use the information we collect to:

• Operate and improve the Platform
• Display your profile to other users
• Facilitate connections and collaborations between creators
• Market Colla using public profile content, posts, and replies (see Section 2b)
• Respond to reports and moderate content
• Comply with legal obligations and enforce our Terms & Conditions

Colla uses an algorithmic matching system to suggest relevant collaborators in the collab discovery experience. This system uses your profile data and Platform activity — such as your content niche, audience size, connected platforms, location, and community engagement — to generate a match score. The exact formula is not publicly disclosed. For more detail, see the Terms & Conditions.

Colla also maintains a reliability score for each user, derived from their history of following through on collaborations confirmed through the Platform. This score is visible on your public profile and is used as a signal within the matching system. For more detail, see Section 8 of the Terms & Conditions.

Colla does not sell your personal data to third parties.

5. Google API Services — Limited Use

Colla's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, Google user data obtained through Google APIs is used only to provide and improve Colla's creator collaboration features — namely, displaying your YouTube channel statistics and profile on the Platform so other creators can make informed collaboration decisions. Colla does not:

• Sell Google user data to any third party
• Use Google user data for advertising or ad targeting purposes
• Transfer Google user data to third parties except as strictly necessary to operate the Platform or comply with legal obligations
• Use Google user data for any purpose not disclosed in this Privacy Policy

6. Data Sharing

Colla shares your data only in the following limited circumstances:

• Google Cloud services (including Firebase and Cloud SQL) — used to securely store and process application data. Google Analytics is used to collect aggregated usage analytics.
• Other users — your public profile information is visible to other Colla users as a core part of how the Platform works, similar to a public profile on any other social platform
• Stripe, Inc. — when premium billing is active, payment processing is handled by Stripe. Colla does not store your payment card details; they are collected and stored directly by Stripe, subject to Stripe's own Privacy Policy and Terms of Service
• Resend — transactional and contact emails are sent via Resend, a third-party email delivery service. Your email address is shared with Resend solely for the purpose of delivering emails to you, and is subject to Resend's own Privacy Policy
• Legal compliance — if required by law, court order, or to protect the rights and safety of Colla or its users

7. Data Retention & Deletion

Your data is stored for as long as your account is active. If you request deletion of your account or data, Colla will process that request and remove your data from the active database. However, due to a 7-day rolling backup retention policy, your data may persist in backup systems for up to 7 days after deletion before being fully purged.

Some data may be retained beyond this period where required for legal compliance, including ban records and data relevant to unresolved reports or disputes.

When you delete your account, the following data is permanently deleted: your profile, all posts you authored (including their likes and replies), likes you gave to others' posts, swipes, matches, blocks, and notifications addressed to you.

The following data is retained after account deletion to preserve context for other users:

• Your replies — content is kept, but your name and profile picture are replaced with "Deleted User" and a generic icon
• Direct messages — conversations remain accessible to the other participant, with your identity replaced by "Deleted User"
• Notifications you sent to other users — your identity will appear as "Deleted User"; any pending collab requests you sent will be marked as resolved

Note that direct messages and swipe decisions cannot be edited or deleted by users individually. These limitations are disclosed here so you can make informed decisions about what you share on the Platform.

To delete your account, use the Delete Account option in your Colla account settings.

8. Your Rights

You have the following rights regarding your data:

To exercise any of these rights, please use our contact page.

9. Children's Privacy

Colla is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that a user is under 18, we will make every reasonable effort to delete their data and close their account.

However, we acknowledge that in some cases data may have already propagated — for example, if other users have interacted with or shared content from the underage account. In such cases, complete removal may not be fully possible, but we will make a best-effort attempt.

If you believe a user under 18 has an account on Colla, please contact us.

10. Security

Colla takes reasonable technical measures to protect your data, including:

• All data is transmitted over HTTPS
• Authentication is handled exclusively via OAuth — Colla never stores passwords
• HTTP security headers are set on all responses, including Content Security Policy, HSTS, and X-Frame-Options
• Database access is restricted and managed through Google Cloud infrastructure

No system is completely secure. In the event of a data breach, Colla will notify affected users via a notice posted on the Platform homepage — accessible without login — within 3 days of becoming aware of the breach.

11. Changes to This Policy

Colla may update this Privacy Policy from time to time. When changes are made, you will be notified via an in-app notification that clearly states what has changed and the new effective date. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.

If you do not agree to the updated policy, you should stop using the Platform before the effective date of the changes.

12. Contact

For privacy-related questions, data requests, or concerns, please contact: