Draft pending legal review. Last updated 4 October 2026 (draft).
Scorchly is run by Farasu Holdings LLC, a Delaware limited liability company [Delaware file number and registered address - to confirm with counsel] ("we"), the controller of your personal data. This policy covers the Scorchly website, web app and mobile apps. The waitlist has its own short notice at /privacy-waitlist.
| Data | Why | Kept for |
|---|---|---|
| Photos you upload | To write the roast. Sent to our AI provider (Anthropic) and processed in memory on our servers. | Not stored by us. Deleted the moment the roast is returned. The provider may keep a copy for up to 30 days only to check for misuse, then deletes it. |
| Messages you paste for comebacks | To write the comebacks. Sent to our AI provider. | Not stored by us. |
| Roast and comeback lines we generate | Shown to you; kept, with the comedian, heat and settings used, to learn which jokes land. Lines you turn into a share card are also shown on the card's public page. | Lines: 180 days, or until you delete your account. Cards: until you delete your account (or we take a card down after a report; taken-down cards are kept hidden for up to 12 months as a moderation record). |
| What you do with a line (Funny, Meh, Too mean, copy, save, share, "roast me again") | To learn which jokes land and which go too far. The best-rated lines, with no negative feedback, may be shown to our AI as examples of the standard (never with anything that identifies you). | 180 days, or until you delete your account. |
| Your agreement to AI processing | Before your first roast we explain that your photo or message goes to our AI provider and ask you to agree; we record when you did. | Until you delete your account. |
| Explicit mode confirmation | That you confirmed you are 18 or over and that anyone pictured agreed, and when. | Until you delete your account. |
| An anonymous account id and invite code | To run your daily allowance, referrals and Pro status. Set in a cookie on the web. | Until you delete your account. Anonymous accounts with no cards, no purchases and no use in the last 90 days are deleted 24 months after they were created. |
| Your email address (only if you sign in) | To sign you in by link, keep Pro across devices, unlock referral rewards, and send the emails listed in section 3. | Until you delete your account. |
| Subscription status and store transaction ids | To know who is Pro and to handle refunds. Payments are taken by Stripe, Apple or Google; we never see card numbers. | As long as accounting law requires (up to 7 years for payment records). |
| Usage events (e.g. roast generated, card shared, paywall viewed) | To see what works and fix what does not. Events hold ids and category values only, never photos, text or emails. | 24 months. |
| A salted hash of your connection address | To stop abuse (daily caps, spam sign-ups). We do not keep your IP address. | Usage rows: 90 days. |
| Reports you file and reports about your cards | To keep Scorchly safe and to review moderation decisions. | 12 months. |
We do not send marketing emails without asking first.
Only the providers that run the service, under contracts that limit what they can do with it:
We may also disclose data if the law requires it, or to protect someone's safety. We do not sell personal data and we do not share it for cross-context behavioural advertising.
We are based in [country]. Our providers process data in the United States and elsewhere. For UK and EU users we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses with each provider. [Confirm per provider.]
Depending on where you live (UK and EU GDPR; California and other US state laws), you can ask to access, correct, delete or export your data, object to or restrict some processing, withdraw consent, and complain to your regulator (in the UK, the ICO). To exercise these rights, use Delete my account on the Invite tab in the app, or email hello@scorchly.app. We answer within 30 days. We do not discriminate against you for exercising your rights.
Scorchly is not for children under 13, and we delete data we learn came from a child under 13. Community features are for adults (18+). Photos that appear to show anyone under 18 are refused by the roast engine and must not be uploaded.
Upload only photos of yourself, or of adults who have agreed to be roasted. If you appear in a shared card you did not agree to, use the report control on the card or email hello@scorchly.app and we will take it down.
Encryption in transit and at rest, signed session cookies, server-side API keys, and access limited to people who need it. No system is perfectly secure; tell us at hello@scorchly.app if you think something is wrong.
The web app uses two strictly necessary cookies: your session (sc_uid) and, before launch, a preview pass. If you arrive through a friend's invite link we store the invite code (sc_ref) for 30 days so your free week is honoured. There are no advertising or third-party analytics cookies.
We will tell you about material changes by email (if we have your address) or in the app before they take effect.
hello@scorchly.app - Farasu Holdings LLC, a Delaware limited liability company [Delaware file number and registered address - to confirm with counsel]. [If required: EU/UK representative details.]