Privacy & Terms

Last updated: October 9, 2026

Ashtray is a worldwide artist network. The network is built to connect real-world people with each other safely. This page is the agreement between you and Ashtray Archive OÜ, registry code 17103266, L. Tolstoi tn 11-5, 50106 Tartu, Estonia – and the statement of what we store and why, under the EU General Data Protection Regulation (GDPR). By creating a profile you accept it.

What Ashtray is

Everyone in the app appears as a tile in their city: one photo, a tappable Instagram username, a 28-character bio. Instagram is not connected – the username is just a name you type.

There is one gesture between people: connect. The right to send a connect belongs to owners of the physical Ashtray. A connect works only by consent: it becomes a connection when the other person accepts it or replies in the chat. No cold DMs. Silence is an answer too: an unanswered request expires after 30 days. Chats are text only, and a connection stays until either side removes it.

Cities

The globe holds a fixed set of cities – thirty today, the cities artists actually move between. They are picked by the team: this is the starting map, and it grows deliberately, city by city, not by request. Your city is one of these names – never your location:

kyiv, madrid, berlin, paris, milan, rome, london, new york, montreal, tokyo, seoul, shanghai, guangzhou, hong kong, barcelona, antwerp, amsterdam, copenhagen, stockholm, warsaw, athens, istanbul, tbilisi, tel aviv, lisbon, rio de janeiro, los angeles, mexico city, lagos, melbourne.

If you are not in any of them, pick other: you keep your profile and stay in world – one grid of everyone in Ashtray, owners first, newest arrivals on top, with shuffle to redeal the order.

18+

Ashtray is 18+. You confirm your age with a checkbox when you create a profile – we do not collect your date of birth. We do not knowingly hold data of anyone younger; if you believe someone underage has a profile, report it or write to us.

Your profile

• One person – one profile, under your own Instagram username.
• The photo must be of you and the username must be yours.
• What you put in your profile remains yours.
• You give us permission to display it inside the app. The permission ends when you delete the profile.

The rules

• No harassment.
• No impersonation, no fake profiles.
• No illegal content, no hate, no threats, nothing sexual involving minors – this one ends the account immediately and may be reported to authorities.
• No spam, no scraping, no automated access.
• No attempts to break, probe or overload the service.

Block and report are available with a long press on any tile. We act on reports quickly: content that breaks these rules can be removed; accounts that do can be suspended or deleted.

The Ashtray

The app is free. Without a badge you can create a profile, appear in your city and in world, browse the globe and the grids, receive and accept connects, chat inside accepted connections, use hide, block and report, and write to Ashtray in the app.

A purchase of the physical Ashtray adds the badge. The badge means the purchase was verified, and it confirms that the profile – and the Instagram username on it – belongs to its owner. Ashtray as a physical object, ordered online and received offline, serves as the hardest filter to fake. With a badge you can also:

• Send connects.
• Switch your profile offline and back. An offline profile is hidden from the grids until you return online.

Orders are placed in our Shopify shop under its own terms of sale; the connect right attaches to the account that made the purchase and is not transferable. Ownership is confirmed by the order number and email from your purchase, or manually by the team. There are no gift codes.

People

Profiles are created by people; beyond what the badge confirms, we do not verify anyone's identity. Use your judgment – especially if you decide to meet in person.

What we store

• Your profile: the photo, the Instagram username, the bio, the city.
• Your badge, and whether your profile is online or offline.
• If you ask us to verify a purchase: the order number and email you send, and the result of the check.
• Your connects and chats: who you connected with, when, and the messages.
• Your hides, blocks and reports.
• Your sign-in identity from Apple (an account identifier and, if you share it, an email address).
• If you allow notifications: a device token, so Apple can deliver them.

What we don't store

• No GPS, no location tracking of any kind.
• No analytics and no advertising identifiers on our servers. Our ads on Instagram and Facebook are measured only if you allow it – see below.
• Nothing from your Instagram beyond the username you typed.

We don't sell your data – and the app is built so there is barely any to collect.

Why we store it

To run the service you asked for (Article 6(1)(b) GDPR): showing your profile in your city, delivering connects and chats, keeping your badge attached to your account, checking a purchase when you ask us to verify it. Hides, blocks, reports and moderation rest on our legitimate interest in keeping Ashtray safe (Article 6(1)(f)). Anything the law requires us to keep, we keep for as long as it requires (Article 6(1)(c)).

Where it lives

Everything is stored with Supabase on servers in the European Union (AWS eu-west-1, Ireland), under a data processing agreement. Apple processes your sign-in and, if you allow them, your notifications. Shopify processes your order and the order lookup when we verify a purchase, under its own privacy policy.

Our ads on Instagram and Facebook

We advertise Ashtray on Instagram and Facebook. To see which ads bring people here, the app includes the Meta SDK by Meta Platforms Ireland Ltd.

It stays off until you tap Allow in the iOS window that asks whether Ashtray may track your activity. Only then does it tell Meta when the app is installed and opened, when you create an account, finish onboarding or get the badge – together with your device's advertising identifier, basic device information (such as model, iOS version, language and time zone), an identifier the SDK creates for this installation, and your IP address.

• Never sent to Meta: your name, email, Apple account, Instagram username, photo, bio, city, connects or chats.
• If you don't allow it, the app sends nothing to Meta. Apple's own SKAdNetwork may still let Meta count, without any identifier, that one of its ads led to an install.
• You can change your answer at any time: iOS Settings → Privacy & Security → Tracking → Ashtray.

This rests on your consent (Article 6(1)(a) GDPR); withdrawing it doesn't affect what was sent before. Meta handles this data under its own privacy policy and may transfer it to the United States under the EU–US Data Privacy Framework.

How long

• Profile, photo, badge, connects, chats, hides, blocks, verification requests: while your account exists.
• Unanswered connect requests: 30 days.
• Notification token: until you disable notifications or delete the account.
• Reports: as long as needed to act on them.

Deleting your account

you → profile → menu → delete account. Deletion is immediate and complete – profile, photo, connects, chats, hides, blocks, verification requests, the notification token. A deleted account cannot be restored.

Your rights

Under the GDPR you can ask us for access to your data, a copy of it, correction, erasure, restriction of processing, or object to processing. Most of this you can do directly in the app: your profile is editable and deletable. For the rest, write to us. You can also complain to your local data protection authority.

The service, as is

Ashtray is provided as is. We do not promise it will always be available, uninterrupted or free of faults, and – to the extent the law allows – we are not liable for indirect damages or for what people do to each other. Nothing here limits liability that cannot legally be limited.

Changes

If this page changes in a way that matters, we will say so in the app. Continuing to use Ashtray after that means you accept the new version; the date at the top always reflects the current one.

Law

This agreement is governed by the law of Estonia; disputes go to Harju County Court in Tallinn, unless mandatory consumer law of your country of residence says otherwise.

Contact

mykola@ashtray.cc