OutOut Privacy Policy

1. Introduction

This Privacy Policy explains how OutOut ("we," "us," or "our") collects, uses, and protects your information when you use our mobile application (the "App"). OutOut is a social messaging app that allows users to create temporary group chats called "OutOuts" with defined start and end times.

By using OutOut, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Username, display name, email address, and password (encrypted)
• Profile Information: Profile pictures and any other information you choose to add to your profile
• User Content: Messages, photos, videos, location data, audio recordings for song recognition, poll responses, message reactions, and other content you share in OutOuts
• Purchase Information: Transaction records for Memory preservation purchases (processed through Apple App Store or Google Play Store)

2.2 Information Collected Automatically

• Device Information: Device type, operating system version, unique device identifiers
• Usage Information: How you interact with the App, features you use, time spent in the App, and crash reports
• Location Information: When you choose to share your location in messages, we collect GPS coordinates. We do not track your location in the background.
• Push Notification Tokens: To send you notifications about messages, friend requests, and OutOut invitations

2.3 Third-Party Services

We use the following third-party services that may collect or process your data:

• Supabase: Backend infrastructure for storing messages, photos, videos, and user data
• Firebase Cloud Messaging: Push notification delivery for Android devices
• Apple Push Notification Service (APNs): Push notification delivery for iOS devices
• ACRCloud: When you use song recognition features, audio data is sent to ACRCloud for identification. ACRCloud's privacy policy applies to this data processing.
• RevenueCat: In-app purchase management and subscription tracking for Memory preservation
• Expo: Mobile app development and deployment infrastructure

3. How We Use Your Information

We use the information we collect to:

• Provide and maintain the OutOut service
• Create and manage your user account
• Enable real-time messaging and communication features
• Send push notifications about messages, friend requests, and OutOut invitations
• Facilitate location sharing when you choose to share your location
• Identify songs through ACRCloud's recognition service
• Process in-app purchases for Memory preservation
• Manage Memory fading and deletion schedules
• Improve and optimize the App's performance and features
• Ensure the security and integrity of the App
• Provide customer support
• Comply with legal obligations

4. How We Share Your Information

4.1 With Other Users

• Your username and display name are visible to other OutOut users
• Profile pictures are visible to your friends and OutOut members
• Messages, photos, videos, locations, and other content are shared with members of the specific OutOuts you participate in

4.2 With Service Providers

We share data with the following service providers necessary to operate the App:

• Supabase: Our backend database provider that stores your account information, messages, and media
• ACRCloud: For song recognition services when you use that feature
• Firebase Cloud Messaging & Apple APNs: For delivering push notifications
• RevenueCat: For managing in-app purchases and Memory preservation subscriptions
• Expo: For app deployment and update infrastructure

We do not sell your personal information to third parties.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal requests by public authorities.

5. Data Storage and Security

5.1 Data Storage

• Your data is stored securely using Supabase's cloud infrastructure
• Messages, photos, videos, and user data are encrypted in transit and at rest
• We implement industry-standard security measures to protect your information
• Passwords are hashed and encrypted

5.2 Data Location

Your data is processed and stored on servers that may be located in countries other than your own, including through our service provider Supabase. We ensure appropriate safeguards are in place for international data transfers.

6. Data Retention

• Active Accounts: We retain your account information and messages for as long as you maintain an active account
• Active OutOuts: Messages remain accessible during the OutOut's active period (before end time)
• Memories (Archives): After an OutOut ends, it becomes a read-only Memory:
  • Days 0-24: Normal accessibility (active Memory)
  • Days 25-29: Visual fading begins (90% opacity) with "Fading Soon" notifications
  • Day 30: Heavy fade (70% opacity) with "Last Day" notification
  • Day 31+: Unpaid Memories are deleted and moved to cold storage (can be revived with payment)
• Preserved Memories: Paid Memories are retained indefinitely
• Deleted Messages: Soft-deleted messages are permanently removed after 30 days
• Deleted Accounts: After you delete your account, we retain your data for 30 days in case you want to recover your account, then permanently delete it
• Purchase Records: Transaction records for Memory preservation are retained for accounting and tax purposes as required by law

7. In-App Purchases and Payments

When you purchase Memory preservation:

• Payment processing is handled exclusively by Apple App Store or Google Play Store
• We receive transaction confirmation but do not process or store payment card details
• Purchase information is managed through RevenueCat for tracking preservation status
• Pricing: Individual Memory preservation (£1.99), Group Memory preservation (£4.99), Revival after deletion (£2.99)
• Refunds are subject to Apple App Store or Google Play Store refund policies

8. Your Privacy Rights

8.1 Access and Control

• You can view and edit your profile information within the App
• You can delete individual messages and OutOuts
• You can manage notification preferences through your device settings
• You can control camera, microphone, photos, and location permissions through your device settings
• You can request account deletion through the App settings or by contacting us

8.2 GDPR Rights (for EU and UK residents)

If you are in the European Union or United Kingdom, you have the right to:

• Access your personal data
• Correct inaccurate personal data
• Request deletion of your personal data (right to be forgotten)
• Object to processing of your personal data
• Request data portability (receive your data in a structured format)
• Withdraw consent at any time for processing based on consent

Legal Basis for Processing:

• Contract performance: To provide the App services you've requested
• Consent: For optional features like location sharing, photo uploads, and microphone access
• Legitimate interests: To improve our App and provide customer support

8.3 CCPA Rights (for California residents)

If you are a California resident, you have the right to:

• Know what personal information we collect about you
• Request deletion of your personal information
• Opt-out of the sale of personal information (we do not sell personal information)
• Non-discrimination for exercising your privacy rights

To exercise these rights, contact us at [email protected] with "Privacy Inquiry" in the subject line.

9. Children's Privacy

OutOut is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected].

The minimum age to use OutOut is 13 years old.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers in accordance with GDPR and other applicable data protection laws.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by:

• Posting the new Privacy Policy in the App
• Sending you a notification through the App
• Updating the "Last Updated" date at the top of this policy

Your continued use of OutOut after any changes indicates your acceptance of the updated Privacy Policy.

12. Data Controller and Contact Information

For data protection inquiries, please include "Privacy Inquiry" in your email subject line.

Additional Platform-Specific Disclosures

Apple App Store Data Types Collected:

• Contact Info: Email address
• Identifiers: User ID, device ID
• User Content: Messages, photos, videos, audio, location
• Purchases: Purchase history for Memory preservation
• Usage Data: Product interaction, app functionality
• Diagnostics: Crash data, performance data

Google Play Store Data Safety:

This app collects the following data types:

• Personal info: Email address, username
• Photos and videos: Photos, videos
• Audio: Audio recordings (for song identification only)
• Location: Precise location (when you choose to share)
• Messages: Text messages and reactions
• Device or other IDs: Device identifiers
• App activity: In-app actions, crash logs

Data Security Practices:

• Data is encrypted in transit using HTTPS/TLS
• Data is encrypted at rest in Supabase storage
• You can request that data be deleted
• Data is collected for app functionality as described in this Privacy Policy

Data Sharing:

• Data is shared with Supabase, Firebase, ACRCloud, and RevenueCat as described in Section 4.2
• No data is sold to third parties
• All data collection is clearly disclosed and used only for app functionality as described in this Privacy Policy