Privacy Policy for Wallaby: Social AR Graffiti

2.1 Account Information

• Sign in with Apple: We use Sign in with Apple as our sole authentication method, processed through our authentication provider (Clerk). Depending on the choices you make with Apple's sign-in flow, we may receive a unique identifier, your name, and/or a private relay or real email address.
• Generated Username: All users are automatically assigned a generated username.
• Custom Username (Subscribers only): If you subscribe to Wallaby Pro, you may choose a custom username.
• Avatar: An avatar image may be associated with your account (via our authentication provider) and is currently displayed only in Settings. We may expand its use in the future, and if so, we will update this Policy accordingly.

2.2 Location Information

• Precise Location Data: We collect precise GPS coordinates each time you place a piece of graffiti, so the artwork can be anchored to and rediscovered at that real-world location. Location data is used solely for graffiti placement, identification, and retrieval, and is not used for background tracking, advertising, or profiling.
• We do not collect your location in the background or when you are not actively placing or viewing graffiti in the App.

2.3 Graffiti Content and Photos

• Graffiti Artwork Data: When you make a piece of graffiti public, the artwork data (stored as text/vector data describing the drawing) and its associated location are stored on our servers (via Convex) so other users can view it.
• Private Graffiti: When you mark a piece of graffiti private, the artwork data is stored only on your device and is not uploaded to our servers. We plan to add the ability to share private graffiti with specific friends in a future update, which will be reflected in an updated Policy.
• Site Reference Photo: When you place graffiti, the App captures a photo of the physical location as a reference image so that you and other users can visually locate the AR anchor point again later.
• Moderation Photo: A photo of the graffiti itself is captured and submitted for content moderation purposes, to help us enforce our content guidelines and detect prohibited or harmful content.
• AR Camera Captures for Sharing: The App lets you take a photo or record a video of your graffiti in AR to share externally (e.g., via the iOS share sheet) or save to your device's photo library. These photos/videos are processed on your device only—we do not upload or store them on our servers or in our database.

2.4 Social Information

• Follows: Information about who you follow and who follows you.
• Likes ("thumbs up"): Information about which graffiti pieces you have liked.
• Wallaby does not currently have text comments or direct messaging features.

2.5 Subscription and Payment Information

Subscriptions (Wallaby Pro, which unlocks custom usernames, special paint brushes, and shape tools) are processed through RevenueCat and Apple's In-App Purchase system. We receive subscription status and transaction information from RevenueCat, but we do not receive or store your full payment card details—those are handled directly by Apple.

2.6 Information We Do Not Collect

• We do not use advertising SDKs or ad networks.
• We do not use analytics or crash-reporting tools at this time.
• We do not send push notifications and do not collect push tokens.
• We do not collect background location data.

6.1 All Users

• Access/Update: You can view and update certain account information within the App's Settings.
• Delete Graffiti: You may delete your own public or private graffiti at any time.
• Delete Account: You can permanently delete your account and associated Wallaby data from the App's Settings. You may also contact support@puzzaholics.com with a deletion or privacy request.
• Location Permission: You can control location access through your iOS device Settings. Note that denying location access will prevent core App functionality (placing and finding graffiti).
• Camera Permission: You can control camera access through your iOS device Settings. Denying camera access will prevent you from placing graffiti or using AR features.

6.2 EU/UK/EEA Users (GDPR)

If you are located in the EU, UK, or EEA, you have the right to:

• Access, correct, or delete your personal data;
• Restrict or object to our processing of your data;
• Request a portable copy of your data;
• Withdraw consent at any time (where processing is based on consent);
• Lodge a complaint with your local data protection supervisory authority.

Legal bases for processing include: performance of a contract (providing the App's core functionality), your consent (e.g., location and camera access), and our legitimate interests (e.g., content moderation, App security), as applicable.

International Transfers: Because our service providers (e.g., Convex, Cloudflare, OpenAI, RevenueCat) may process data outside your country of residence, including in the United States, we rely on appropriate safeguards such as Standard Contractual Clauses where required by law.

6.3 California Residents (CCPA/CPRA)

California residents have the right to:

• Know what personal information we collect, use, and disclose;
• Request deletion of personal information;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information (we do not sell or share personal information as defined by the CPRA);
• Not be discriminated against for exercising these rights.

To exercise any of these rights, contact support@puzzaholics.com.