Privacy Policy

Last updated: May 21, 2026.

This policy describes what data AnyExtras collects, why, how we use it, and the choices you have. AnyExtras is operated by Tilted Planet Ltd, an Illinois corporation. Plain English first, lawyer's English never.

What we collect

• Profile. First name, last name, optional display nickname, and either an email address or phone number (your choice). Used to identify you to potential matches and to deliver notifications you've asked for.
• Verification. When you sign up we send a 6-digit code by SMS or email to confirm you control the contact method you provided. Twilio handles delivery.
• Listings & matches. The events you've posted listings for, the tickets you've offered or requested, and the people you've matched with.
• Location, at the moment of action. When you post a listing or send a match for an event, AnyExtras asks for your current location to confirm you're near the venue. We do not track your location in the background, and we don't store the latitude/longitude — only a yes/no result of the proximity check.
• Device attestation (iOS only, coming soon). Once the AnyExtras iOS app ships, it will use Apple's standard device-attestation APIs to give us a signal that you're using a genuine app on a real Apple device. We'll store only an opaque key id; we never see your device serial or any identifier Apple doesn't share. This does not apply to the web version.
• Feedback. After an event, both parties can leave feedback (positive, neutral, negative) and optionally flag the other for admin review. We use this to keep the platform healthy.

What we don't do

• No advertising. No ad networks, no SDKs, no third-party tracking pixels.
• No selling or renting your data, ever.
• No background location, no continuous tracking.
• No analytics service collecting personal data. We may keep aggregate server-side metrics (e.g. how many listings were posted yesterday).

Magic links and proxy invites

If you generate a magic link to access your account on another device, anyone with that URL has full access to your account for 60 minutes. You are responsible for who you give it to. Proxy invites (for letting a friend or family member participate in a specific event's exchange) are single-use and event-scoped; you can revoke an unused one at any time.

In-app tips

Tips are processed by Apple via in-app purchase. We never see your payment details. Apple does charge Apple's standard fee on tips.

Where data is stored

AnyExtras runs on Fly.io with a Postgres database in the United States. Twilio (SMS verification) and SendGrid (email delivery) are subprocessors. Apple (IAPs, future device attestation) will be a subprocessor once the iOS app ships.

Your choices

• You can sign out from the app at any time, which revokes your session on the device.
• You can delete your account by emailing support@anyextras.com. Active listings and your profile are removed; we keep a hashed record of past matches for fraud prevention.
• You can decline location access. AnyExtras will let you browse but won't let you post or commit matches.

Children

AnyExtras is for users 13 years and older. We don't knowingly collect data from anyone younger.

Changes

If this policy changes materially we'll surface it in the app on next launch. The most recent version always lives at this URL.

Contact

Questions: support@anyextras.com.