Privacy Policy
Introduction
Welcome to TheAppThat ("Platform," "we," "us," or "our"). We are committed to protecting your privacy and providing a secure, transparent environment for our platform. This Privacy Policy explains in detail how we collect, use, process, share, and protect your personal information when you use our Services, including our website, mobile applications, and related services.
By creating an account or using our Services, you consent to the data practices described in this policy. If you do not agree with this Privacy Policy, please do not use our Services.
1. Information We Collect
1.1 Account Information
When you create an account, we collect:
- Identity Information: Name (first and last), username, email address, password (encrypted)
- Authentication Data: Secure authentication credentials, security tokens
- Account Security: Two-factor authentication settings, account security data, login history
- Contact Information: Phone number (optional), email verification status
1.2 Invite and Referral Data
Our platform is invite-only. When you join through an invitation, we collect:
- Invite Token: The unique invitation identifier used to create your account
- Referral Relationship: A record linking your account to the user who invited you, used to establish initial connections on the platform
While you may use a pseudonym or display name on the platform, we retain your account email address and authentication credentials internally. Your chosen display name is visible to other users, but your email address is not shared with other users unless you choose to share it.
1.3 Automatically Collected Information
We automatically collect technical and usage data:
- Device Information: Browser and device type
- Network Data: IP address and connection information
- Usage Information: How you use and interact with our platform
- Performance Data: System performance and service quality metrics
- Security Information: Login activity and security events
1.4 Location Data
We collect location information when you use certain features:
- Precise Location: Exact location for location-based features (with your permission)
- General Location: City, region, and country information
- Saved Locations: Locations you save for activities
- Approximate Location: General location for security and service quality
Sky community observations: If you choose to submit an observation, we collect the state or DC you select, the observation time, your text, and your account identity for private ownership and review. The public list shows only the state or DC label, text, and observation, submission, review, and expiry times. It does not show your account identity or precise coordinates. Complaint details and the reporter's identity remain private. This feature does not collect your device location for an observation.
1.5 Cookies and Tracking Technologies
We use the following technologies to enhance your experience:
- Authentication Cookies: Secure session management for account security
- Session Storage: Secure session state management for performance
- Local Storage: Browser storage for UI preferences and layout configurations
- Analytics Tools: Performance monitoring and diagnostics for service improvement
2. How We Use Your Information
We use your information for the following purposes:
2.1 Core Platform Operations
- Create and manage your account
- Authenticate your identity and secure your account
- Process and deliver communications
- Enable profile customization and content uploads
- Maintain content engagement metrics
2.2 Security & Safety
- Detect and prevent fraud, abuse, and unauthorized access
- Enforce rate limits to prevent abuse and ensure service quality
- Maintain security measures to block malicious activity
- Monitor failed login attempts and enforce account lockouts for protection
- Log security events for audit and compliance
2.3 Analytics & Improvement
- Analyze usage patterns to improve service quality
- Monitor system performance and reliability
- Evaluate feature effectiveness
- Enhance platform functionality and user experience
2.4 Legal Compliance
- Comply with legal obligations and enforce our Terms of Service
- Respond to law enforcement requests and court orders
- Protect our rights, privacy, safety, or property
- Resolve disputes and enforce agreements
3. Legal Basis for Processing (GDPR Compliance)
For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process your personal data based on the following legal grounds:
- Consent: Location data, photo uploads, and optional features require explicit consent
- Contract Performance: Account creation, communications, connections, and core platform features
- Legitimate Interests: Security monitoring, fraud prevention, service optimization, and analytics (balanced against your rights)
- Legal Obligations: Compliance with applicable laws, regulations, and legal requirements
You have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.
4. Data Storage & Security
4.1 Where We Store Your Data
- Secure Databases: User profiles, content, and platform data
- File Storage: Images, videos, and user-uploaded files
- Secure Cache: Session state and temporary data
- Encrypted Storage: Security credentials and sensitive configuration
- Analytics Systems: Service metrics and logs
4.2 Security Measures
- Encryption in Transit: Industry-standard encryption protocols for all data transmission
- Encryption at Rest: Enterprise-grade encryption for stored data
- Authentication Security: Secure authentication systems, strong password requirements, multi-factor authentication support
- Data Protection: Cryptographic key management and data protection systems
- Secure Cookies: Industry-standard security flags on authentication cookies
- Content Security Policy: Advanced security headers to prevent common web attacks
- Network Security: Multiple layers of network security protections
- Access Controls: Role-based authorization and secure connection validation
4.3 Data Residency
Your data is stored in secure, enterprise-grade data centers. The specific region depends on your account configuration and may include United States, European Union, or other regions. We implement appropriate safeguards for international data transfers in compliance with applicable regulations.
6. Data Retention
We retain your personal information for as long as necessary to provide our Services and comply with legal obligations. Specific retention periods are as follows:
- Account Data: Retained while your account is active, plus 30 days after account deletion to allow for recovery and comply with legal requirements
- Security & Authentication Logs: Retained for 90 days for security monitoring, fraud prevention, and incident investigation
- Chat Messages: Retained until you delete them or your account is deleted, plus 30 days in backups
- Community Content: Retained until you delete the content or your account is deleted, plus 30 days in backups
- Sky Community Observations: Pending submissions expire after 48 hours without review. Approved observations expire no later than 48 hours after the observation time. Private text and revisions are purged seven days after rejection, expiry, or withdrawal. Account deletion removes owner text and revisions and unpublishes the observation immediately. Closed complaint snapshots and details are purged after 30 days; minimal content-free decision and security audit is retained for 90 days. Unresolved complaints remain private until resolved. The rolling backup purge and legal-hold terms below also apply.
- Analytics & Usage Data: Retained for 12 months, then permanently anonymized for aggregate service improvement
- Payment & Transaction Records: Retained for 7 years as required by tax and financial regulations
- IP Addresses in Logs: Retained for 90 days, then deleted
- Backup Data: Rolling 30-day retention, automatically purged after expiry
- Legal Hold: Data subject to legal proceedings or government requests retained as required by law, regardless of standard retention periods
You may request deletion of your account and associated data by contacting us at support@email.theappthat.com. Upon deletion, we will remove or anonymize your data within the retention periods specified above, except where retention is required by law or legitimate business purposes.
7. Your Rights and Choices
Depending on your location, you have the following rights regarding your personal data:
7.1 Access & Portability
- Request a copy of your personal data in a structured, machine-readable format
- Download your profile information and content
7.2 Correction & Updating
- Update your profile information, preferences, and settings directly through the platform
- Request correction of inaccurate or incomplete data
7.3 Deletion
- Delete your account and associated data (subject to legal retention requirements)
- Remove specific content you've posted
7.4 Restriction & Objection
- Object to processing based on legitimate interests
- Request restriction of processing in certain circumstances
- Opt-out of marketing communications and non-essential emails
7.5 Withdrawal of Consent
- Withdraw consent for location tracking and optional features
- Disable features that require specific consent
7.6 Complaints
- Lodge a complaint with your local data protection authority if you believe we have violated your privacy rights
- Contact us directly to resolve privacy concerns
7.7 Data Protection Officer
For all data protection inquiries, you may contact our Data Protection Officer directly:
Email: dpo@email.theappthat.com
Our DPO oversees compliance with applicable data protection laws, including GDPR, and is available to address your privacy concerns.
To exercise these rights, contact us at: support@email.theappthat.com
8. Children's Privacy
Our Services are not intended for children under the age of 18, and we do not knowingly collect personal information from minors. Age verification is enforced during account creation.
If you believe that we have inadvertently collected data from a child under 18, please contact us immediately at support@email.theappthat.com, and we will take prompt action to delete such information.
9. International Data Transfers
Your information may be transferred to, stored in, and processed in countries outside your country of residence, including the United States and other regions where our infrastructure is located. These countries may have different data protection laws than your country.
For EEA, UK, and Swiss users, we ensure appropriate safeguards are in place, including:
- EU Standard Contractual Clauses with our service providers
- Industry-standard compliance certifications (ISO 27001, SOC 2, GDPR)
- Data processing agreements with all third-party processors
10. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
- Right to Know: Request disclosure of categories and specific pieces of personal information collected
- Right to Delete: Request deletion of personal information (subject to exceptions)
- Right to Correct: Request correction of inaccurate personal information we hold about you
- Right to Opt-Out: We do not sell or share personal information for cross-context behavioral advertising, so no opt-out is necessary
- Right to Limit Use of Sensitive Personal Information: You may request that we limit the use of sensitive personal information to purposes necessary to provide the Services
- Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
To exercise these rights, contact us at support@email.theappthat.com with "California Privacy Rights" in the subject line. We will respond to verified consumer requests within 45 days as required by law.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Effective Date" and "Last Updated" at the top of this policy
- Notify you via email or prominent notice on our platform
- In some cases, obtain your consent for significant changes
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
12. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:
- Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33
- Notify affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Article 34
- Document the breach including the nature of the breach, categories and approximate number of individuals affected, likely consequences, and measures taken to address and mitigate the breach
Notifications will be sent via email to affected users and, where appropriate, through a prominent notice on our platform. We maintain internal breach detection, investigation, and reporting procedures to ensure timely response.
13. Contact Us
13.1 Data Controller
The data controller responsible for your personal information is TheAppThat.
Email: support@email.theappthat.com
13.2 Data Protection Officer
Email: dpo@email.theappthat.com
Our Data Protection Officer can assist with any privacy-related inquiries, data subject access requests, or complaints under GDPR and other applicable data protection laws.
13.3 EU Representative
We are currently evaluating the appointment of an EU representative pursuant to Article 27 of the General Data Protection Regulation (GDPR). In the meantime, data protection inquiries from residents of the European Economic Area may be directed to our Data Protection Officer at dpo@email.theappthat.com.
13.4 General Inquiries
If you have any questions, concerns, requests, or complaints regarding this Privacy Policy or our data practices, please contact us:
Email: support@email.theappthat.com
Subject Line: "Privacy Inquiry" or "Data Rights Request"
We will respond to your inquiry within 30 days for GDPR requests or 45 days for CCPA/CPRA requests, or as otherwise required by applicable law. If we need additional time, we will notify you of the extension and the reason.