Três Limões · Tuta

Privacy Policy — TUTA

Last updated: 11/11/2026

Effective date: this policy applies from the date of last update above.

Language: this is a translation of the Portuguese original, published at tuta.treslimoes.com.br/privacidade. The Portuguese version is the legally binding one; if the two ever diverge, the Portuguese text prevails.

1Who processes your data

TUTA is operated by BARBOSA E FOLLE DESENVOLVIMENTO DE SOFTWARE LTDA ("Três Limões", "we"), CNPJ 68.586.378/0001-52, registered at Av. Paulista, 91, Brazil.

For anything to do with your privacy — questions, requests for access, correction or deletion of data — write to us at privacidade@treslimoes.com.br.

Data Protection Officer: in accordance with Art. 41 of the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018), Três Limões appoints Logan Cunha Folle as the officer responsible for personal data processing. The channel is free and direct:

E-mail: dpo@treslimoes.com.br
Hours: Monday to Friday, 9am to 6pm (BRT), except public holidays

2What data we collect

Provided by you:

Data	Required?	What for
E-mail and password	Yes	Creating and accessing your account. The password is never stored in plain text — we keep only a hash (BCrypt), which not even we can reverse. It is also where we send the password-reset code, when you ask for one.
Your account identifier at Apple or Google	Yes, if you sign in with Apple or Google	Recognising your account when you sign in using Apple or Google. It is a code that Apple or Google create for TUTA; it gives no access to anything in your account with them. Along with it we receive your e-mail and, only the first time, your name — which you can change before creating the account. Apple may hand us a relay address instead of your e-mail, if you choose to hide it.
Password-reset code	Only when you ask for "Forgot my password"	Confirming the e-mail is yours before changing the password. We store the code hashed, it is valid for 15 minutes and is deleted after use.
Name	Yes, at sign-up	We ask for your first and last name at sign-up. Personalising your experience in the app and signing your comments: next to each one, other users see your first name and the initial of your surname — never your full name.
Date of birth	Yes, at sign-up	Enforcing the minimum age of 12 (section 6), working out your age, used in the age-sliced rankings (section 3 below), and adjusting ads to your age: for users under 13 and under 18, the app asks Google for child or teen treatment, and does not ask about tracking anyone under 13. We may also use it to wish you a happy birthday.
City	Yes, at sign-up	City- and state-sliced rankings (section 3 below). You pick the city from an IBGE list and can change it in your profile.
Reviews (score, comment, attributes)	—	This is the core use of the app: rating products and helping other people decide. Your comment, when you write one, is shown publicly in the app, with your first name and the initial of your surname, the score and the date.
Reports and blocks	—	Which comments you reported and which people you blocked: used to hide those comments for you alone and to bring a reported comment to moderation. The person who wrote it is never told who reported or who blocked them.
Favourites	—	The list of products you marked to buy next time.
Shopping lists	—	Building your lists and ticking off what you picked up. If you share a list by link, whoever joins it sees and edits that list's items and sees the @username of the other people in it — never their name, e-mail or city.
"Tried it"	—	Marking products you have tried, even without rating them. It only shows as a count on the product ("X people tried it") and, if you make your profile public, in the list on your profile.
Username (@) and public profile	No	The @ identifies you on the public profile and in shared lists. The profile is private by default: it is only visible if you turn the option on in the app, and it shows just the @, your scores (product and stars) and your "Tried it" list. You can turn it off at any time and it disappears immediately. Public profiles can be reported to moderation.
Product/brand/category suggestions	—	Forwarding to our team requests for what is missing from the catalogue.

Generated by your use of the app:

Data	What for
Days on which you used the app	Measuring, in aggregate, whether people come back to the app (for example, how many return in their second week). We keep only the date — one row per day of use — not what you did. It is deleted along with your account. No third-party service receives it.
IP address and timestamp of each request	Application access logs, required by Art. 15 of Brazil's Internet Civil Framework. We keep only the IP and the moment — not the route accessed, the request content, or what you did there. Periods and conditions in section 7.
The device's advertising identifier (IDFA)	Personalising the ads the app shows to people who do not subscribe. It only exists if you allow it in the iOS prompt (section 4); if you decline, it is not collected and ads carry on, without personalisation.
Your subscription status	Knowing whether your account has access to what the subscription includes — rankings by city, state and age group, curation, multiple lists and comparison — and whether it should see ads. It comes from Apple — we never see your payment details (section 4).

Nothing beyond that. TUTA sustains itself in two ways, both described in section 4: subscription, bought inside the app through the App Store, and ads, shown to people who do not subscribe. Neither gives us any data about you that is not in the tables above.

What TUTA does not collect: photos or images uploaded by you; GPS location — the app never asks for location permission, and the only city it knows is the one you tell it yourself; payment data — the subscription purchase happens inside the App Store, between you and Apple, and no card ever passes through us. We also do not send e-mail or push notifications using your contact details.

One honest caveat about location: Google's ad service infers an approximate location from the IP address, as any service on the internet is able to do. That is not the device's GPS, it does not come from a permission the app requests, and it is described in section 4.

3How we use the data — the sliced rankings in particular

City and age group exist only to answer "what is well rated near me" and "what is well rated by people my age". A product with few reviews inside a small slice does not enter that slice's ranking — below three reviews, the number would say more about who opened the app than about the product, and it could even expose the opinion of an identifiable person. That protection is technical, not just a promise: the rule lives in the ranking calculation itself.

4Who we share with

Other people who use TUTA: they see the comments you write, with your first name, the initial of your surname, the score and the date. That is the very purpose of a comment, and it follows the rules in the Terms of Use (section 5). If you turn on your public profile, anyone with the link sees your @, your scores and your "Tried it" list; whoever joins a list you shared sees its items and the @ of everyone in it. Nothing else from your account is shown to anyone: full name, e-mail, city and age stay in the aggregate numbers only, and with a private profile (the default) so do your scores without a comment.
Apple: the TUTA subscription is bought and charged inside the App Store. The payment contract is between you and Apple; from Apple we receive only the subscription status — whether it is active, which plan, and until when — never your card, cardholder name or any billing data. The legal basis is performance of the contract you enter into with us when you subscribe (Art. 7, V). Apple's own processing of your data is governed by Apple's privacy policy.
Google (AdMob): the banner shown to people who do not subscribe is served by Google's ad service, which receives, in order to deliver the ad and curb fraud, technical data about the device and its use: device identifier, approximate location (inferred from the IP, not from GPS), data about the ad itself, app interaction, crash data and performance data. The basis is the legitimate interest in sustaining a free app (Art. 7, IX).

The advertising identifier (IDFA) is a separate case, and it depends on you. The first time a banner loads, iOS asks whether you allow tracking. If you allow it, the IDFA is shared with Google and the ads become personalised — basis: your consent (Art. 7, I), which is also what authorises that specific international transfer (Art. 33, VIII). If you decline — or do not answer — the IDFA is not collected, and ads carry on existing, just without personalisation. You can change that answer at any time in your iPhone Settings, under Privacy & Security → Tracking.
Infrastructure providers: the TUTA application runs on Fly.io, in the São Paulo region (GRU), and the data sits in a Neon database, in the sa-east-1 region, also in São Paulo. Your account, your reviews and your favourites are stored and processed in Brazil: there is no international data transfer (LGPD, Art. 33) in the running of the app. Both companies are foreign and operate regions in several countries — the Brazilian region is our choice, declared here because it is the region, and not the supplier's nationality, that determines where your data sits.
E-mail routing: messages sent to privacidade@treslimoes.com.br and suporte@treslimoes.com.br pass through Cloudflare's infrastructure before reaching our inbox, and that network operates outside Brazil — here there is indeed an international transfer (Art. 33). It happens because you decided to write to us, and delivering your message is precisely answering what you asked for: the basis is Art. 33, IX together with Art. 7, V (performance of a contract or preliminary procedures, at the data subject's own request). When the message is a request under section 5, Art. 33, IX together with Art. 7, II also applies: replying is a legal obligation of ours (Art. 18 of the LGPD), and keeping that channel open is required by Resolution CD/ANPD No. 2/2022. We do not rely on standard contractual clauses (Art. 33, II) — Cloudflare does not offer the clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024), whose adoption deadline closed on 23/08/2025; the ground we use is one of those the resolution itself preserves because it does not depend on further regulation (Art. 1, sole paragraph). The rest of our domain infrastructure (DNS) processes no personal data of app users.
Resend (e-mail sending): when you request "Forgot my password", the e-mail with the code is sent through Resend, a United States company, operating in the São Paulo region. It receives your e-mail and the code, only to deliver the message, and keeps the sending record for its own retention period. We do not enable open or click tracking on this sending, and the code e-mail has no link at all. Because the company is foreign, there is an international transfer (Art. 33): the ground is performance of the request you yourself made (Art. 33, IX, together with Art. 7, V) — without the sending, there is no way to change the password.
Apple and Google (signing in with them): if you choose "Continue with Apple" or "Continue with Google", they are the ones who confirm who you are, and TUTA receives only the identifier, the e-mail and, the first time, the name. Nothing from TUTA goes to them beyond the sign-in request. When you delete your account, TUTA also tells Apple to revoke the access you had granted to TUTA. Apple and Google are United States companies: there is an international transfer (Art. 33) — the ground is performance of the request you yourself made by choosing to sign in with them (Art. 33, IX, together with Art. 7, V).
Website hosting: treslimoes.com.br and tuta.treslimoes.com.br are published on Cloudflare Pages — the websites, not the application. The access log any web server produces stays with Cloudflare, under the same international transfer as the item above; the institutional site's policy details that point.
Website audience measurement: the same Cloudflare, when you allow it, counts visits to treslimoes.com.br and tuta.treslimoes.com.br. It does not involve the app or your account in it, it uses no cookies and it only happens with your consent — the details are in section

5Your rights

Under the LGPD, you may request at any time, by writing to the officer's channel, dpo@treslimoes.com.br (section 1):

Confirmation that we process your data, and access to it;
Correction of incomplete, inaccurate or outdated data;
Anonymisation, blocking or deletion of unnecessary data;
Portability of your data;
Deletion of data processed on the basis of your consent;
Information about who we share your data with;
Correction of your name at any time, from your profile. Like city and date of birth (also correctable in your profile), the name is asked for at sign-up, not on the basis of your consent.

You can also delete your account directly from the app, on the Account screen. That is the fastest route — the address above remains available as an alternative.

What happens when you delete your account: your reviews and favourites are deleted along with the account. Suggestions you sent stay in the system, but stop being linked to you — they concern the catalogue (what is still missing), not your identity.

Deleting your account does not cancel your Apple subscription. They are separate contracts: the subscription is yours with Apple, and only ends in your App Store settings. If you delete the account without cancelling, the billing continues. The app warns you about this on screen, before you confirm the deletion.

6Minimum age and teenagers

You must be at least 12 years old to create an account on TUTA. The rule is checked against the date of birth given, both at sign-up and when editing the profile — at sign-up alone, it would be enough to enter another date and correct it straight afterwards.

Twelve is where Brazilian law separates a child from an adolescent (Statute of the Child and Adolescent, Art. 2), and it is children's data that the LGPD treats most restrictively: Art. 14, §1 requires specific, prominent consent from at least one parent or legal guardian — something TUTA has no way to collect or verify. Enforcing the minimum age is what avoids that processing, rather than merely declaring it in a policy.

Teenagers remain an audience for the app: the content (rating and comparing products) is not unsuitable for that age range, and the "under 18" ranking slice exists for them. Teenagers' data is processed in their best interest.

Accounts created before the rule were not affected by it. If we learn that an account belongs to someone below the minimum age, it will be deleted — write to privacidade@treslimoes.com.br.

7Retention periods

API access logs (IP and timestamp of each request — not its content): kept for 6 months, under confidentiality, in a controlled environment. This is not a choice of ours — it is the minimum required by Art. 15 of the Internet Civil Framework (Law 12,965/2014) for anyone providing an internet application as a legal entity. It may be extended on request from the competent authority before the period ends (Art. 15, §2). Purging of anything past 6 months runs automatically.
Website logs (treslimoes.com.br, tuta.treslimoes.com.br, treslimoes.com): the infrastructure is Cloudflare's, which keeps its own periods — see Cloudflare's privacy policy. We neither collect nor retain those logs independently.
Subscription record (which plan, when it started, when it ended): survives account deletion, unlinked from you wherever possible, for as long as tax and accounting law obliges us to keep proof of a transaction. We keep no payment data at all — it never reaches us (section 4).
Database backups: when you delete your account (section 5), the data disappears from the live database immediately, but it may persist for up to 7 days inside existing backups, until they expire naturally — 3 days of continuous recovery (the workspace's current plan) plus up to 7 days of retention for point-in-time exports, which covers the worse case of the two mechanisms.
Password-reset code: 15 minutes, or until used, whichever comes first.
Link with Apple or Google: for as long as the account exists; it leaves together with it.

8Website audience measurement

The sites treslimoes.com.br and tuta.treslimoes.com.br may use Cloudflare Web Analytics to count visits: how many pages were opened, which country the visit came from, which address brought the person here, and how long the page took to load. It exists to tell us whether the site is being found, and nothing beyond that. Cloudflare already hosts the sites (section 4), so this adds no new supplier.

Measurement only happens if you allow it. On your first visit a notice with two options appears, and the script is only loaded after a yes. If you decline — or close it without answering — it does not load, and the site works exactly the same.

It uses no cookies. Cloudflare Web Analytics writes no cookie and no identifier to your device, and does not follow you across other sites. What it produces are aggregate counts, not a profile of you.
The only thing stored in your browser is your answer to the notice, so that we do not ask again on every page. It sits in the browser's own local storage, is not sent anywhere, and disappears if you clear the site's data.
Legal basis: consent (Art. 7, I). To change your mind, use Measurement preferences, in the footer of any page: the notice reappears and your new answer applies from the next page load. There is no need to clear anything in your browser.
International transfer: Cloudflare's network operates outside Brazil, so authorising measurement is authorising an international transfer (Art. 33). The ground here is Art. 33, VIII: consent is specific to that purpose and to that purpose only, it is requested prominently before any script loads, and the notice itself states in advance that the party counting the visits is Cloudflare, from outside the country. Declining changes nothing in how the site works.
Retention: the aggregate data stays with Cloudflare, under Cloudflare's own periods (section 7).

The TUTA app has no audience measurement. What it collects is in section 2.

9Changes to this policy

We may update this text as the app changes. Material changes will be communicated inside the app itself.

10Contact

BARBOSA E FOLLE DESENVOLVIMENTO DE SOFTWARE LTDA (Três Limões) CNPJ 68.586.378/0001-52 Av. Paulista, 91 E-mail: privacidade@treslimoes.com.br Data Protection Officer: Logan Cunha Folle — dpo@treslimoes.com.br