Privacy Policy

Last updated October 7, 2026

Draft. This policy is under legal review and may change before the app launches.

This policy explains what [COMPANY] (“Tribz”, “we”) collects when you use the Tribz app, why, who we share it with, and the choices you have. We do not sell your personal information and we do not show third-party ads. Our Terms of Service cover your use of the app.

1. What we collect

Account information. When you sign in with Apple, Google, or email, our sign-in provider Clerk gives us your name, email address, a profile photo if you choose one, and a unique account ID. If you use Apple’s Hide My Email, we receive the relay address instead of your real one.

Profile. Your username, display name, bio, and avatar photo. Your avatar is uploaded from your device to our storage.

Content you create. Posts and the photos attached to them, comments, likes, tribe (team) names and memberships, direct messages and tribe chat messages, challenge answers you submit, and reports you file about other content or users.

Challenge activity. Which challenges and steps your tribe has started or completed, when turns were taken, skipped or passed, results, and any perks or passes you earn and redeem.

Location. During a location step, the app reads your device’s current position to check whether you are inside the challenge area. The check happens on our servers using the coordinates sent for that step. We do not run location in the background and we do not build a history of where you have been. You can decline location permission; location steps will then not work.

Camera. During a QR step the camera reads a code. The image is processed on your device and is not uploaded. Photos you attach to posts or set as your avatar come from your photo library only when you choose them.

Device and diagnostics. A push notification token for your device, device model and OS version, app version, and crash and error reports (via Sentry) that may include your account ID and the screen you were on. We also keep standard server logs with IP addresses, request times and endpoints.

Communications. Emails you send us, and in-app reports with the reason you selected and any details you typed.

We do not collect contacts, precise location outside of challenge steps, advertising identifiers, or payment details. We do not use third-party analytics or advertising SDKs.

2. How we use it

• Run the Service: sign you in, show your profile and tribe, rotate turns, check answers and locations, issue passes, and deliver posts, comments and messages
• Check challenge answers, including with an automated AI model (see section 4)
• Send push notifications about your turn, tribe invites, messages, comments, challenge results, and challenges ending. You control these in your device settings
• Show an app-icon badge when it is your turn
• Keep Tribz safe: review reports, enforce blocks, detect cheating, spam and abuse
• Fix bugs and keep the app reliable using crash reports and server logs
• Respond when you contact us
• Comply with law and enforce our Terms

We do not use your content or messages to train AI models.

3. Who sees your content

• Other players see your username, display name, avatar, bio, posts, comments and the tribes you belong to. Tribe chat is visible to your tribemates. Direct messages are visible to the people in the conversation
• Partner venues see a pass when you present it to be scanned: the perk, its validity window and whether it has been used. They do not see your account details
• The public does not see your content unless we add public features in future and tell you first

4. Automated answer checking

When you submit an answer to a question step, we first compare it with the authored answer. If it does not match exactly, we send the step’s question, the authored answer and your answer text to Google’s Gemini model to judge whether it means the same thing and how close it was. Only the answer text is sent, with a length cap, and not your name or account ID. The model’s verdict can only turn a near-miss into a pass, never fail an exact match. Google processes this under its API terms and does not use the data to train its models. If you believe a verdict was wrong, contact us.

5. Service providers

We share data with the companies that run parts of the Service on our behalf. Each is bound by a contract to use the data only to provide its service to us.

We may also share information when the law requires it, to protect the rights and safety of players, partners or the public, or as part of a merger or acquisition, in which case this policy will continue to apply.

6. How long we keep it

• Account and content: for as long as your account is active. When you delete your account, your profile, posts, comments, messages and tribe memberships are permanently deleted within 30 days
• Notifications: inbox notifications are removed after 30 days, except invites and challenge-completed items, which stay until you act on them or delete your account
• Passes: until the perk’s window ends, then deleted
• Location coordinates: processed for the step check and not retained beyond server logs
• Crash and server logs: up to [90] days
• Reports and enforcement records: up to [2 years], so repeat abuse can be recognized, even after the reported account is deleted
• Backups: database backups are overwritten on a rolling basis within [30] days

7. Your choices and rights

• Delete your account from Settings in the app. We confirm the deletion deadline on screen
• Edit your profile at any time in the app
• Block or report any user or piece of content from the app
• Push notifications and permissions: change location, camera, photo and notification access in your device settings
• Access or correct your data: email [CONTACT EMAIL] and we will respond within 30 days

If you live in the European Economic Area, the United Kingdom or California, you also have rights to access, correct, delete, port, and object to processing of your data, and to complain to your local data-protection authority. We rely on performance of our contract with you (running the Service), our legitimate interests (safety, reliability), and your consent (location, camera, notifications) as legal bases. We do not sell or “share” personal information as defined by the California Consumer Privacy Act.

8. Security

Data moves between the app and our servers over TLS. Access to production systems is limited to [COMPANY] staff who need it. Uploaded images are served through time-limited signed links. No system is perfectly secure, so please use a strong device passcode and tell us about any suspected breach at [CONTACT EMAIL].

9. Children

Tribz is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child under 13 has an account, contact us and we will delete it.

10. International transfers

Our servers and providers are in the United States. If you use Tribz from outside the U.S., your information will be transferred to and processed in the U.S. under the safeguards our providers offer, such as standard contractual clauses.

11. Changes to this policy

We will post any changes here and update the date above. For material changes we will notify you in the app or by email before they take effect.

12. Contact

[COMPANY]
[MAILING ADDRESS]
[CONTACT EMAIL]