Chewly LLC. — TRAY Platform
Last Updated: April 2026
Chewly LLC. ("Company," "we," "us," or "our") is committed to protecting your personal information. This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information through the TRAY platform (the "Service").
By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Service.
1. Information We Collect
1.1 Information You Provide
Required (Registration):
- Email address — account identification, login, communications
- Password — account security (stored using industry-standard hashing and salting methods; we do not store plaintext passwords)
- Nickname — identification and display
- Date of birth — adult verification (18+ only), age-based features
- Gender — profile display, matching preferences, and service personalization
Optional (Profile):
- Profile photos (up to 12)
- Bio / self-introduction
- Location (country, state/province, city, district)
- Physical attributes (height, body type)
- Lifestyle information (occupation, education, drinking, smoking, religion, pets)
- SPECTRUM personality analysis results (Soul Color, personality code, trait scores)
- Social media links (voluntarily provided)
Sensitive Information (Separate Explicit Consent Required):
- Sexual orientation
- Relationship preferences
- BDSM preferences
- Sharing/lifestyle preferences
Sensitive information is collected only with your separate, explicit consent. It is used solely to improve the accuracy of personality-based recommendations and is not displayed on your public profile. You may withdraw consent at any time; upon withdrawal, we will delete this data from active systems without delay, subject to routine backup retention.
1.2 Identity Verification
When you verify your identity, we may collect:
- Full name, date of birth, gender
- A unique verification identifier provided by our identity verification vendor ("CI")
- Mobile phone number — stored only as an irreversible cryptographic hash (the original number is not retained)
Raw identity verification data is deleted immediately after processing. Only the CI hash is retained for duplicate-registration and fraud prevention.
Note: At launch, our identity verification does not involve selfie, facial recognition, or biometric data. If we introduce biometric verification in the future, we will update this Policy and obtain any additional consent required by applicable law.
1.3 Information Collected Automatically
- IP address and inferred access country
- Browser type, operating system, device information
- Service usage records (access logs, activity history, interaction records)
- Essential cookies for authentication, security, and settings (see Section 9)
1.4 Payment Information
Payment card and instrument data is collected and processed exclusively by our third-party payment processors — web payments are processed through PayPal, and in-app purchases are processed through Apple (App Store) or Google (Google Play). We do not collect or store your payment card numbers. We retain transaction records (date, amount, product, status) for purchase history and refund processing.
2. How We Use Your Information
We use your personal information for the following purposes:
- Account Management: Registration, identification, authentication, age verification, fraud prevention, account security, customer support
- Service Delivery: SPECTRUM analysis, profile display, recommendations, Tray operation, chat, events, Discover feed
- Automated Recommendations: We use automated processing and profiling to personalize recommendations, matching, and content ranking. This processing does not produce legal or similarly significant effects such as decisions about employment, housing, credit, insurance, education enrollment, or access to essential services.
- Service Improvement: Usage analytics, feature development, user experience optimization
- Safety and Integrity: Fraud detection and prevention, abuse reporting, dispute resolution, enforcement of our Terms
- Payments: Subscription management, purchase processing, refunds
- Localization: Content and feature availability based on your access country
- Communications: Service-related notices and security alerts. We may send promotional communications with your consent; you may opt out of promotional emails at any time by using the unsubscribe link in the message or contacting us at privacy@tray.at.
3. How We Disclose Your Information
We Do Not Sell or Share for Advertising
We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising or targeted advertising purposes, as those terms may be defined under applicable state privacy laws. We do not use third-party advertising cookies, tracking pixels, or ad networks.
Disclosure to Other Users
When you use the Service, certain information is visible to other users:
- Profile information (nickname, photos, bio, age, location, personality traits, and other profile fields you choose to fill) is visible to other Members in accordance with Service features and your settings.
- Tray content (posts, comments, reactions) is visible to Members with access to that Tray.
- Chat messages are shared with the intended recipients.
- Event participation may be visible to other event participants.
- Activity signals (e.g., online status, last active) may be visible depending on your privacy settings.
You control what profile information you share. Some features (such as Secret Mode, available to Plus subscribers) allow you to limit your visibility.
Service Providers
We disclose personal information to service providers and processors that perform services on our behalf under contractual obligations to protect your data:
- Cloudflare, Inc. — Hosting, data storage, CDN — All service data
- PayPal — Web payment processing — Transaction data (no card numbers stored by us)
- Apple / Google — In-app purchase processing (App Store / Google Play) — Transaction data (no card numbers stored by us)
- Cloudinary — Image optimization — Uploaded images
- Resend, Inc. — Transactional email — Email address
- Identity verification provider — Age/identity verification — Verification data (deleted after processing)
Other Disclosures
We may also disclose personal information:
- With your prior consent
- To comply with legal obligations, court orders, or lawful government requests
- To protect the rights, safety, or property of the Company, our users, or the public
- In connection with a merger, acquisition, or sale of assets (with notice to you)
- In de-identified or aggregated form for research or statistical purposes
4. Data Retention
We retain personal information only as long as necessary for the purposes described in this Policy, or as required by law.
- Profile data (nickname, bio, photos, preferences) — Removed from active systems promptly after account deletion — No longer needed
- Account email — 30 days after deletion — Prevent re-registration abuse
- Phone number hash (CI) — 1 year after deletion — Fraud and duplicate-account prevention
- Access and authentication logs (IP addresses, login timestamps, security events) — 12 months — Security monitoring, abuse investigation
- Payment and transaction records — 7 years — Tax, accounting, and legal compliance
- Fraud/sanction records — 1 year after account deletion — Safety and fraud prevention
- Sensitive information (after consent withdrawal) — Removed from active systems without delay — Consent withdrawn
Backups: Deleted data may persist in encrypted backups for up to 90 days before being permanently purged through routine backup rotation.
Legal holds: Data subject to an active legal hold, dispute, or investigation may be retained until the matter is resolved.
5. Your Privacy Rights
Depending on your jurisdiction, you may have the following rights regarding your personal information:
- Access — request a copy of the personal information we hold about you
- Correction — request correction of inaccurate information
- Deletion — request deletion of your personal information
- Portability — request your data in a structured, commonly used format
- Opt-out of sale/sharing — because we do not sell or share personal information for targeted advertising, there is currently no sale/share opt-out mechanism to invoke. If our practices change, we will update this Policy and offer any required opt-out methods.
- Withdraw consent — withdraw consent for sensitive information processing at any time
- Non-discrimination — we will not discriminate against you for exercising your privacy rights
How to Submit a Request
You may exercise your rights through:
- Settings menu within the Service (for access, correction, deletion, and consent withdrawal)
- Email: privacy@tray.at
We will verify your identity before processing your request using information associated with your account. We aim to respond within 45 days of receiving a verifiable request. If we need additional time (up to an additional 45 days), we will notify you of the extension and the reason.
Appeal
If we decline to take action on your request, we will explain the reason. You may appeal our decision by emailing privacy@tray.at with the subject line "Privacy Appeal." We will review and respond to your appeal within the timeframe required by applicable law (typically 60 days).
Authorized Agents
You may designate an authorized agent to submit a request on your behalf. We may require the agent to provide proof of authorization (such as a signed permission or power of attorney) and may verify your identity directly.
6. Sensitive Information
We collect sensitive personal information (sexual orientation, relationship preferences, BDSM preferences, sharing preferences) only with your separate, explicit consent, and use it solely to improve recommendation accuracy.
- Sensitive data is not displayed on your public profile
- Stored in encrypted form with access restricted to essential personnel
- You may withdraw consent at any time; upon withdrawal, data is removed from active systems without delay (subject to routine backup retention)
- We do not use sensitive information to discriminate against you or for any purpose other than recommendation improvement
- We maintain consent and withdrawal logs for compliance purposes
7. Children's Privacy
The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 in accordance with the Children's Online Privacy Protection Act (COPPA). Additionally, the Service requires all users to be at least 18 years of age. If we learn that we have collected information from anyone under 18, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us at privacy@tray.at.
8. Security
We implement reasonable administrative, technical, and physical safeguards to protect your personal information:
- Password protection: Passwords are stored using industry-standard hashing and salting methods; we do not store plaintext passwords
- Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS
- Phone number hashing: Phone numbers are processed using irreversible cryptographic hashing; original numbers are not retained
- Access controls: Access to personal information is restricted to authorized personnel on a need-to-know basis, with access logging
- Authentication: Secure token-based authentication with cookie security settings
- Image protection: We may apply reasonable technical measures to reduce unauthorized reproduction of profile photos
- Infrastructure: Data is stored on cloud infrastructure operated by service providers that maintain industry-standard security measures and certifications
- Monitoring: Regular security assessments and vulnerability scanning
No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
9. Cookies and Tracking
- We use essential cookies for authentication, security, and settings storage. These are necessary for the Service to function.
- We do not use third-party tracking cookies, advertising cookies, or tracking pixels.
- We do not engage in cross-context behavioral advertising or profiling for third-party ad purposes.
Do Not Track / Global Privacy Control
Because we do not sell or share personal information for targeted advertising, our practices are intended to be consistent with Do Not Track (DNT) and Global Privacy Control (GPC) signals. We will treat a browser-based GPC signal as a request to opt out of any sale or sharing of personal information, where applicable under state law.
10. International Data Transfer
The Service is hosted on Cloudflare's global network, with primary data storage in the United States. Your personal information may be transferred to and processed in countries other than your own.
- Primary processor: Cloudflare, Inc. (United States)
- Purpose: Service hosting, data storage and processing, content delivery
- Safeguards: Cloudflare maintains industry-standard security certifications and contractual data protection obligations
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make changes, we will:
- Post the updated Policy within the Service
- Update the "Last Updated" date
- Provide notice via in-app notification or email for material changes
Where required by law, we will obtain your consent before applying material changes to how we collect, use, or disclose sensitive personal information.
The updated Policy takes effect 7 days after posting, or later if stated. Your continued use of the Service after the effective date constitutes acceptance. If you do not agree to the changes, you may delete your account.
12. Contact Us
If you have questions, complaints, or requests regarding this Privacy Policy or your personal information:
- Company: Chewly LLC.
- Phone: 02-337-3535
- Privacy Contact: Bae Minsung
- Email: privacy@tray.at
- General Support: tray@tray.at
- DMCA / Legal: legal@tray.at
13. State-Specific Privacy Rights
California Residents (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, disclose, and sell/share
- Delete your personal information
- Correct inaccurate personal information
- Opt-out of the sale or sharing of your personal information
- Limit the use of sensitive personal information
- Non-discrimination for exercising your rights
We have not sold or shared personal information in the preceding 12 months.
California residents may request additional information about our use of Sensitive Personal Information and may contact us to exercise any applicable right to limit use or disclosure, to the extent such right applies.
Categories of Personal Information Collected
- Identifiers (email, nickname, IP)
Sources: You, automatic | Purposes: Account management, service delivery | Recipients: Service providers | Retention: See Section 4 - Personal characteristics (DOB, gender)
Sources: You | Purposes: Age verification, personalization | Recipients: Service providers, other users (age/gender on profile) | Retention: See Section 4 - Internet activity (logs, usage)
Sources: Automatic | Purposes: Security, improvement | Recipients: Service providers | Retention: 12 months - Geolocation (country, city)
Sources: You, IP inference | Purposes: Localization, recommendations | Recipients: Service providers, other users (if on profile) | Retention: See Section 4 - Sensory data (photos)
Sources: You | Purposes: Profile display, Connect | Recipients: Service providers, other users | Retention: Until deletion - Sensitive PI (orientation, preferences)
Sources: You (with consent) | Purposes: Recommendation improvement only | Recipients: Not disclosed to third parties | Retention: Until consent withdrawal - Payment data (transaction records)
Sources: PayPal, Apple, Google | Purposes: Purchase history, refunds | Recipients: Payment processor | Retention: 7 years
To exercise your rights, see Section 5 above or contact privacy@tray.at.
Oregon Residents
If you are an Oregon resident, the Oregon Consumer Privacy Act may provide you with additional rights, including the right to access, correct, delete, and obtain a copy of your data, and the right to opt out of targeted advertising, sale, and profiling that produces legal or similarly significant effects, to the extent applicable law provides such right. To exercise these rights, see Section 5 above.
Other State Residents
Residents of Colorado, Connecticut, Virginia, Texas, and other states with comprehensive privacy laws may have similar rights. Please see Section 5 for how to exercise your rights, or contact us at privacy@tray.at.
Effective Date: February 20, 2026