Privacy Policy

This Privacy Policy explains how ComeThru App, Inc. ("Comitiva," "we," "us," or "our") collects, uses, discloses, and protects information when you use the Comitiva mobile application and related websites and services (the "Service"). The Service is offered to U.S. residents. Capitalized terms not defined here have the meaning given in our Terms of Service.

1. Information We Collect

A. Information you provide

• Account identifiers. A U.S. phone number in E.164 format, required email address, Firebase user ID, display name, and username. Phone/SMS is the only sign-in method; the email is account information, not a sign-in method.
• Profile and business information. Profile photo, biography, banner, vibe, rep, awards, optional home-area location, and friendship or group relationships. If business features are enabled, we also collect business name, handle, description, avatar and cover, categories, venue, website and social links, team roles, follows, blocks, and business activity.
• Date of birth. We send your date of birth to a server-side age-validation function to confirm you are at least 16. If eligible, it is stored in an owner-only private user record. If not eligible, the date of birth is not retained; the phone number and any authentication email are blocklisted for 90 days and the attempted account is deleted.
• Hangs and interactions. Hang titles, descriptions, dates and times, invitation and visibility lists, selected venue name and physical address, precise coordinates, place ID, city and broad venue class, cover image, RSVP, reminders, chat text, voice messages, GIF URL and dimensions, mentions, reply references, reactions, Gallery uploads, comments, awards, and related activity.
• Photos, videos, audio, and metadata. Avatars, covers, Gallery images and videos, thumbnails, voice messages you record in a Hang chat (stored as audio files), and related technical metadata. Videos may contain audio. The app usually compresses or resizes uploads and creates thumbnails, but processing can fall back to the original file and is not guaranteed to remove all embedded metadata.
• Hang Memories and Recap media-sharing choices. An owner-only private record holds two settings: whether friends may add your photos and videos to their Hang Memories without asking, and whether friends may use them in Recaps (and, for accounts that chose before September 28, 2026, any Hang-by-Hang Recap choices already made), plus the time of your last Hang Memories choice. Members are asked one question that sets both, right after they first pick photos or videos to add to a Hang Gallery, and can change each one separately anytime in Preferences. The question never blocks an upload or other Hang activity.
• Hang Memories. When you save a Hang Memory, we store the photos and videos you chose, their order, your caption, likes and comments on it, and a privacy-limited copy of the Hang's details described in Section 6. We also store photo requests you send or receive (the requested media, who asked, when, and the answer) and media removed from a Memory so it is not offered again.
• Customer support. Information you send to support. An in-app bug report includes your description, current screen, signed-in user ID and username when available, device and app/build information, and up to the last 200 in-memory log entries. The report also sends the description and a smaller recent-log set to Sentry for debugging.
• Safety reports. Report reason and optional description, reporter and target identifiers, and a server-created snapshot. Depending on the target, that snapshot can include Hang title/description, message text and GIF URL, Gallery media URL/type, or Gallery-comment text/GIF plus its parent media ID. User-only reports do not include a profile-content snapshot.
• Subscription and consumer purchase information. Product and transaction identifiers, receipt or purchase token, subscription and entitlement state, store, and limited device/app/storefront information received through Apple, Google, and RevenueCat. Apple and Google process the payment instrument; Comitiva does not receive your full card or bank-account number for a subscription.
• Business advertising and billing information. New advertiser purchasing is disabled for the initial public launch; the native link is hidden and the portal cannot create a new draft or checkout. Existing promotion and billing records remain in scope. When purchasing is enabled in a later reviewed release, the web advertising portal stores promotion drafts and creative, line items and totals, the selected business and Hang, the initiating member's user ID, order and Stripe object identifiers, and authorization, capture, cancellation, refund, dispute, and delivery status. At the first checkout, Comitiva creates a persistent Stripe customer linked to the business name and business ID, stores that Stripe customer ID in the business's private billing record, and reuses it for later checkout, bounded invoice summaries, and authorized payment-method management. Card and other billing details are entered on Stripe-hosted pages and processed by Stripe; Comitiva receives customer, transaction, invoice, and status information but not the full card or bank-account number. Checkout first authorizes the displayed total. Comitiva captures it only after human review approves the promotion, or voids/cancels the authorization when the promotion is rejected or the authorization expires.
• Advertising choices and events. For eligible adults, in-app personalization choices (on iPhone, choosing Allow in Apple's tracking prompt also turns on personalized ads inside Comitiva; you can turn it off anytime in Preferences → Advertising & Privacy) and, if visible, separate off-platform audience choices. We also record house-ad or third-party-ad impressions and clicks if those placements run. These choices default off unless the app clearly presents otherwise.

B. Information collected automatically

• Foreground location. With device permission, Comitiva reads precise or approximate foreground location for nearby sorting, distance, map display, location picking, and Places ranking. The app generally keeps the feed/map fix in memory, but exact coordinates can be transmitted transiently to Comitiva's Places proxy and Google Places as an origin or bias. A Hang's selected address and exact coordinates are stored with the Hang.
• Live location. If an eligible creator or confirmed participant expressly turns on location sharing for a Hang, Comitiva collects that device's precise location during the Hang's sharing window—from one hour before the Hang starts through 30 minutes after its effective end—including while Comitiva is in the background. On iPhone this uses the “Always” location permission and the system location indicator; on Android a persistent notification shows while sharing runs. A paired watch can start or stop sharing through your phone. Comitiva stores exact latitude/longitude, sample time, speed, heading, accuracy, publishing mode and interval, and profile display fields. The pin is readable only during that window, by the sharing user and friends participating in that Hang. Turning sharing off stops collection and deletes the pin. Any pin left behind is deleted automatically within a day after the window closes, and security rules close access as soon as the window ends.
• Approximate map location. If a user chooses a map in a Recap, the server rounds the Hang coordinate to two decimal places (approximately a 1.1-kilometer cell) before requesting a static image from Mapbox. When a Hang share link is created, the server sends the Hang's coordinates to Google's Geocoding service to derive a general-area name (such as a neighborhood or city). Public Hang share pages and their link-preview images can show a neighborhood-level Mapbox map generated from that area name, never from the Hang's coordinates; for a business Hang whose business chose to share its location, they can show the business's exact spot.
• Device and service identifiers. Expo push token, Firebase/App Check or installation identifiers, RevenueCat identifiers, and, if third-party ads run, advertising ID, App Set ID, and other Google Mobile Ads identifiers where available.
• Diagnostics. In production, Sentry receives errors, stack traces, breadcrumbs, device/app data, signed-in Firebase UID and username, and sampled performance traces. The client samples approximately 20% of performance transactions, and Cloud Functions sample approximately 10%. Central redaction attempts to remove common phone, email, token, and authorization values, but information intentionally typed into a bug report is included.
• Usage data (Comitiva analytics). We record app opens, completed sign-ups, sign-ins, Hang creations and views, RSVPs, messages sent (including whether a GIF was used), gallery uploads (including media type), friend requests, profile views, your answer to the phone's notification permission prompt, and ad impressions/clicks. Backend services replace your user ID with a keyed pseudonym before writing an analytics event. We also count account deletion requests, cancelled requests, and completed deletions; those counts are recorded without your user ID or its pseudonym. We also receive daily install and uninstall totals from Apple and Google; these are aggregate counts that do not identify you. Before you have an account, the app counts which sign-up steps a newly installed copy reaches (for example, seeing the welcome screen, entering a phone number, receiving the text code, or why a code could not be sent); each step is reported once per installation as an anonymous daily count with the platform, never with your phone number or any account or device identifier. These records do not contain your name, contact information, Hang title or ID, exact venue/place ID/address/coordinates, message text, or media URL. Routine product-admin tools cannot read raw or per-user analytics; admin reports suppress any daily row representing fewer than 10 pseudonymous users. Privileged cloud-infrastructure access is restricted to an audited break-glass path.
• Usage data (Google Analytics). Production app builds and the public website also send aggregate product-interaction events to Google Analytics. App data includes automatically collected app/session/device information, route-pattern screen views, and selected low-cardinality product events. Website data includes page views and App Store or Google Play link selections. Comitiva does not send a Firebase user ID, name, contact information, Hang or content identifier, share token, username, business handle, query string, or message/media content to Google Analytics. Public-link routes are reduced to patterns such as /h/:share before collection. We disable advertising storage, advertising user data, advertising personalization, and Google signals; the iOS Analytics SDK is linked without AdSupport.
• Ad measurement (Meta). To learn whether Comitiva's ads on Instagram lead people to our website or app, we use Meta's Pixel on the comethruapp.com home page and Meta's App Events SDK in the app. The Pixel sends Meta the page address, browser and device information, cookies Meta sets, a page-view event, and whether you tapped an App Store or Google Play button. The SDK sends Meta app install and app-open events, device and app information, and—for accounts whose date of birth shows they are 18 or older—events for completing sign-up, creating a Hang, tapping Coming Thru, opening the invite share sheet, and starting a Premium subscription or free trial (the product, price, and currency, as reported by the App Store or Google Play). On iPhone, the device advertising identifier is included only if you allow tracking in Apple's prompt or Settings; on Android, the device advertising identifier is included for 18+ accounts unless you opt out or delete it in device settings. Comitiva does not send your name, phone number, email, username, contacts, location, messages, media, or any Hang, share-link, or invite identifier to Meta. Pages with invite, share, or account links do not load the Pixel. Before an account's age is known (the first app launch), an install or app-open event can be sent without any Comitiva account information.
• Venue category. When you select a Google Places result for a Hang, our server automatically converts Google's detailed place type into a broad Comitiva venue class, such as food and drink, nightlife, arts and entertainment, outdoors and recreation, shopping, sports and fitness, travel and lodging, community and events, faith and community, health and wellness, education, civic and services, or residential. The detailed Google place type is discarded from analytics. These categories describe the setting of a Hang, not your identity, beliefs, diagnosis, financial state, or political affiliation. We do not infer religion or political affiliation from venue data.
• Advertising SDK data. The Google Mobile Ads SDK is present in the native app and contributes native privacy disclosures, but a hard production-code gate prevents Comitiva from loading or initializing it for this public release; remote configuration cannot bypass that gate. The checked-in native configuration uses Google's test app IDs and delays app measurement until a reviewed ad request. Comitiva must update this Policy and its store disclosures before a later release enables third-party ad requests. Google's published SDK disclosures state that, when used, the SDK can collect and share IP-derived general location, product interactions, diagnostics, and advertising, App Set, or other device/account identifiers for advertising, analytics, and fraud prevention. House promotions may appear without sending an ad request to Google.

C. Information from your device (with permission)

• Contacts. If you grant Contacts permission, the app reads phone numbers and email addresses (up to bounded limits) but does not upload contact names or complete address-book records. Normalized identifiers are sent to a Comitiva Cloud Function, compared using keyed digests, and not persisted by that matching function. The app keeps match-to-user results in a local device cache while signed in; matches currently do not expire, misses are retried after 30 days, and the cache is cleared at sign-out.
• Camera & microphone. Used only when you capture photos or videos in the app or scan a QR code. Captured media is not sent anywhere until you choose to upload it.
• Photo library. Used only when you pick existing photos or videos to upload.
• Calendar. Used only when you export a Hang to your device calendar; the calendar event is written locally to your device.
• Notifications. Required to deliver push notifications about Hangs, RSVPs, messages, friend requests, reminders, and similar events.

D. Information from other sources

• Other members. Members can invite you, mention you, send you messages, upload photos or videos that show you, report you, or have your phone number or email address in their contacts, which lets Comitiva suggest you to them if you have an account.
• Referral phone check. When someone joins through a referral invite, Comitiva sends the new member's phone number to Twilio's Lookup service, which returns the line type (for example mobile or VoIP) and carrier. Comitiva uses the result to decide whether the invite qualifies for a referral reward and to prevent referral abuse.
• Stores and subscription services. Apple, Google, and RevenueCat tell us whether a purchase or subscription is active.
• Places data. Google provides venue names, addresses, coordinates, and place types when you pick a place.

2. Information We Do Not Collect

We want to be clear about what we don't do:

• We do not integrate third-party attribution SDKs such as AppsFlyer, Adjust, or Branch. The only advertising measurement tools we use are Meta’s Pixel and App Events SDK, as described in Section 1, and you can opt out as described in Your Privacy Choices.
• We do not sell personal information for money. Advertising-related processing and opt-out rights are described in this Policy and the consent controls presented in the app.
• We do not collect biometric identifiers or biometric information.
• We do not retain dates of birth submitted by users who fail the age gate.
• We do not upload contact names or complete address-book records; normalized phone and email identifiers are transmitted for server-side matching as described above.

3. How We Use Your Information

We use the information described above to:

• Operate, maintain, and provide the Service — including authenticating users, creating and displaying Hangs, sending messages, posting to galleries, syncing friendships, fanning out push notifications, computing awards, and powering the rest of the app's features.
• Enforce eligibility — validating that you are at least 16 at signup, maintaining a 90-day blocklist of phone numbers and email addresses that have failed the age gate (to prevent immediate re-registration), and acting on reports of suspected underage users.
• Moderate content — using Google Cloud Vision safety findings as advisory triage for Gallery media, personal avatars, and business-profile images; reviewing automated and user-submitted reports; and allowing human moderators to remove or restrict content that violates our Terms. Automated findings do not automatically hide or remove media.
• Provide customer support — responding to your messages, bug reports, and reports of content or users.
• Improve the Service — analyzing aggregated usage and crash data to find and fix bugs, prioritize features, and improve reliability.
• Communicate with you — sending SMS verification codes during sign-in, push notifications about Service activity (subject to your notification preferences), and support, security, legal, or operational email where needed.
• For eligible adult users, select advertising inside Comitiva according to their personalization choice. Sensitive venue classes are excluded from behavioral targeting, and nightlife affinity requires age 21 or older.
• Operate business advertising and billing — authorizing business roles, maintaining promotion drafts and orders, creating and reusing a business-linked Stripe customer, requesting and later capturing or voiding a card authorization, providing invoices and Stripe-hosted payment-method management, handling refunds and disputes, and preventing billing fraud.
• Protect safety and prevent abuse — enforcing blocks, processing reports, detecting fraud, and protecting users and third parties.
• Comply with legal obligations — responding to lawful requests, enforcing our Terms, and complying with applicable child-safety and consumer-privacy law.

4. Legal Bases & Why We Process

For users in the United States, the legal bases on which we process your information include:

• Performance of the agreement between you and Comitiva — processing necessary to provide the Service you signed up for.
• Our legitimate interests — operating, securing, debugging, and improving the Service; preventing fraud and abuse; defending legal claims.
• Your consent — for location, contacts, camera, microphone, photo library, calendar, push notifications, personalized in-app ads, and off-platform audience matching if that dormant feature is ever activated, revocable through the applicable in-app control or device setting.
• Compliance with legal obligations — including applicable child-safety and consumer-privacy laws.

5. How We Share Your Information

We share your information with the following categories of recipients, for the purposes described:

Advertiser analytics and targeting. Comitiva's first-party ad-event pipeline can record pseudonymous impressions and clicks, but the app does not currently expose an advertiser reporting product or activate off-platform audience transport. Any future advertiser reporting must use aggregate cohorts and comply with the safeguards described in the current Service. Sponsored placements are restricted to users established as age 18 or older; alcohol-related delivery is not activated. Faith/community, health/wellness, education, civic/services, residential, and unknown venue history are not used to build behavioral advertising affinity. Nightlife affinity is restricted to eligible users age 21 or older for a first-party Comitiva campaign and is not exported as an advertiser-curated audience.

We do not sell your personal information for money. We share the limited ad-measurement data described above with Meta, which can be “sharing” under California law, and you can opt out at any time. We do not currently activate off-platform audience matching or a provider transport that sends phone-derived match keys to an advertising platform. Code and default-off controls for that possible feature are present but dormant. We will update this Policy, store disclosures, and required privacy choices before activating such a transfer. Hashing a phone number for matching would not make it anonymous.

6. Visibility, Sharing & Public Links

Personal Hangs. In-app access is invitation-based. Server-side rules limit a personal Hang to:

• The Hang's creator,
• Users who have selected ComeThru,
• Users the creator has explicitly invited,
• Members of friend groups the creator has invited, and
• Friends of the creator, only if the creator has set visibility to "all" (their friends).

Hang content. Chat, Gallery, and comments are visible to the authorized Hang circle, except for media that appears in Recaps or Hang Memories as described below. Live-location pins have a narrower rule: only the sharing user and eligible friends participating in the Hang can read the pin during the limited time window.

Businesses. Active business profiles can be searched by signed-in users. Surfaced business Hangs are public listings inside the signed-in Service and may be shown to followers and business-profile visitors. When a signed-in user blocks a business, Comitiva prevents direct access/follow/join actions and filters that business from normal discovery for that account.

Following a business. When you follow a business, its owners, admins, and managers can see you in its follower list: your name, username, profile photo, and the date you followed. They never see your phone number or email address through Comitiva. Other people see only the business's follower count, and your friends may see that you follow it on that business's profile. Other followers cannot see the list. Unfollowing removes you from the list; a business that blocks you also removes your follow. Some businesses are private: following one sends a request that its owners, admins, and managers see (your name, username, profile photo, and when you asked) until they accept or decline it, and you can withdraw it at any time. A private business's Hangs are shown only to its approved followers and people it invites, and if you unfollow, you stop seeing its upcoming Hangs unless you joined or were invited to them.

Business groups. A business can create groups for its followers. Open groups are listed on the business's profile and any follower can join; invite-only groups are visible only to their members and the people invited. Anyone who can see a group sees its name, description, how many people are in it, and which of their own friends joined (people you have blocked, or who have blocked you, are not shown to you), but not the full list of members. The business's owners, admins, and managers can see who is in each group and can invite followers or remove members. A business can send a Hang to just the members of selected groups. You can leave a group at any time, and unfollowing a business removes you from its groups.

What a business sees about its followers. A business's owners, admins, and managers can see a short summary of what each follower did with that business only, over the last 12 months: how many of its Hangs you said you'd come to, how many of its Hangs you were checked in at (a coupon or giveaway pass scanned there), how many of its coupons you redeemed, and how many people joined its Hangs through your share link (a number, never who). They never see your activity with other businesses, your friends, your location, your age, or anything else. A business can also keep private lists of its followers, by hand or from those counts, to send a Hang to just those people. Lists are visible only to the business's team, and you are not told which lists you are on. Unfollowing a business removes you from all of its lists and deletes this summary. No summary is kept about followers under 18, so they are never on a list built from these counts.

Profiles. Any signed-in member can view your display name, username, profile photo, bio, banner, vibe, rep, award counts, and Hang Memories, and can find you by name or username. Other members can see friends you have in common and counts behind your reps and awards. Your full friends list, the members you have attended Hangs with, the places and cities of those Hangs, and the list of businesses you follow are not shown to other members. Your friends may see that you follow a particular business when they open that business's profile (see "Following a business" above).

Public profile links. A comethruapp.com/user/... URL can be opened without a Comitiva account, but it now returns only a generic Comitiva deep-link bridge and does not fetch or display the user's name, username, avatar, or other profile data. The Firebase UID remains part of the URL itself.

Hang share pages. Where a valid opaque share token has been created, a public comethruapp.com/h/... page and its link-preview image can show the Hang title, host name/avatar, date/time, categories, general area, and a neighborhood-level map generated from the area name. They do not show the Hang's coordinates or exact venue address, except that a business that chooses to share its location can show its exact spot. Anyone who receives the link can view the page until it is revoked. In the app, a live link works as an invitation from the person who shared it: a signed-in member who opens it can join the Hang, subject to blocks, the host's invite settings, the Hang not having ended, and a limit of 1,000 people, and then sees the full Hang, including the exact place. The host can remove anyone who joined this way.

Recaps. Hang access alone is not permission to publish another member's personal media. A current owner-controlled Hang Recaps choice allows future Recaps to include personal Gallery photos/videos that member uploaded and a personal Hang cover they own, either across eligible Hangs or, for choices made before September 28, 2026, only for a separately approved Hang. Missing, denied, Off, invalid, or revoked choices remain excluded. Choosing Off invalidates earlier Hang grants. A server-generated manifest enforces the current choice before export; business-attributed media and business covers are excluded. Aggregate attendance and frozen award facts—including the winner's name and profile photo—can appear, but other attendees and a different personal host remain anonymous. The media-sharing preference does not control award identity. The operating-system share sheet can send the finished image outside Comitiva. Changing a choice controls future media exports but cannot recall a copy already exported or held by a recipient.

Hang Memories. A member who hosted a personal Hang or confirmed attending it can save up to 10 of its photos and videos, with a caption, as a Hang Memory on their profile after the Hang ends: their own, their friends', and media posted as a business in that Hang's Gallery. A Hang Memory can be seen, liked, and commented on by any signed-in Comitiva user who can open that profile; blocks apply in both directions, and Hang Memories are not shown on the public web. Each one carries a privacy-limited copy of the Hang's details—title, date and time, city, up to five categories, the number of attendees, and the business name for a business Hang—never the address, coordinates, or other attendees' identities, and it remains after the Hang's own content expires until it is deleted. A friend's personal photos and videos appear in it only when that friend's Hang Memories setting is on (they are notified and can remove them) or after the friend approves a photo request. Until then, requested media is visible only to the member who asked and the friend who was asked; a request not answered within 14 days is treated as declined, and a decline is not announced. Media posted as a business may be added without a request, and the business's team can remove it. A business can also save a Hang Memory from one of its own Business Hangs using photos and videos that members 18 or older added to that Hang's Gallery under the business media license in our Terms of Service; a Memory from a Hang shown only to one of the business's groups appears only on that group's page, to its members. The member is notified, credited by name and profile photo, and can remove their media at any time. That license also lets the business use those items in its Hang Recaps and on its own organic channels outside Comitiva, but never in paid advertising, while they remain in the Gallery. Media from someone blocked either way is never available. Contributors are credited by name and profile photo. A contributor can remove their media from someone else's Hang Memory at any time, and it is then not offered for that Memory again. If a member turns their Hang Memories setting off, media friends added without asking comes out of their Hang Memories; media the member approved in a request stays until they remove it. Media also comes out when it is deleted or loses approval in the Gallery, or when a block is created. A member who let friends use their media in Recaps for all Hangs before Hang Memories had its own setting starts with that setting on, but adding without asking begins October 8, 2026, unless the member confirms sooner in the app's notice; until then, friends send requests. Hang-by-Hang Recap choices do not carry over to Hang Memories.

7. Children & Age Policy

The Service is intended for users 16 years of age or older. We do not knowingly collect personal information from anyone under 16. We enforce the age requirement through a server-side validation Cloud Function that runs at signup; users who do not qualify are not allowed to create an account, and their submitted date of birth is not retained. Phone numbers and email addresses associated with a rejected signup are added to a blocklist with a 90-day time-to-live to prevent immediate re-registration. Any user can report another user they suspect is under 16, and we may investigate and take action. We do not send ad-measurement events to Meta for accounts whose date of birth shows they are under 18.

Users aged 16–17 may use the core Service but are not eligible to receive sponsored Comitiva or Google Mobile Ads placements, and businesses they follow get no summary of their activity with that business. Advertising eligibility fails closed if the stored date of birth is missing or invalid.

If you believe we have collected information from a person under 16, please use the in-app report control or email hello@comitiva.app. We may investigate, restrict the account, remove content, preserve evidence, and make legally required reports. Comitiva prohibits child sexual abuse and exploitation, grooming, sextortion, trafficking for sexual exploitation, and child sexual abuse material. We remove confirmed prohibited material when we obtain actual knowledge and report it where required by law. See our Child Safety Standards.

8. Data Retention & Deletion

While your account is active

• Free-tier Hang cleanup. A Hang reaches its expiration point one week after its effective end. Free creator and confirmed Comitiva participants may receive a reminder 24 hours before that point. At the retention decision, if neither the Hang creator nor any confirmed Comitiva participant has Premium, the scheduled cleanup removes chat, voice-message audio, Gallery documents and comments, live-location records, related notifications/reminders/coordination records, and unprotected Gallery storage objects. Basic Hang metadata and final awards remain. If an eligible creator or confirmed participant has Premium at that decision, the shared Hang content is preserved; a later cancellation does not retroactively delete it. Invited-only or chat-only viewers do not preserve it. Deleted content cannot be restored by buying Premium later. Business Hangs (Hangs posted by a business profile) are not subject to this cleanup.
• Contest and Hall of Fame media. An exact media object submitted with the separate contest/promotion consent can be retained for that entry even if ordinary Hang cleanup otherwise removes the Gallery copy.
• Live location. Turning live sharing off deletes the current pin. Security rules end access after the live window even if a stale record remains; ordinary Hang cleanup later removes the collection for an eligible free-tier Hang.
• Public links. Public profile URLs return a generic deep-link bridge without profile data. Opaque Hang share tokens have no automatic expiration in the current implementation and remain resolvable until revoked or the backing data is unavailable.
• Contact matches. The matching service does not retain submitted address-book identifiers. The signed-in app's local device cache retains successful identifier-to-user matches without a fixed expiration, retries misses after 30 days, and clears the cache at sign-out.
• Bug and safety reports. Signed-in bug reports are deleted in the account-deletion cascade. Anonymous bug reports cannot be associated with an account for automatic deletion. Safety reports are retained for moderation, evidence, abuse prevention, and legal purposes and are anonymized when an associated account is deleted.
• Age-gate blocklist entries are retained for 90 days; no date of birth is stored.
• Backups. Our database backups are kept for up to 35 days (7-day point-in-time recovery, daily backups kept 7 days, weekly backups kept 28 days), so deleted data can remain in a backup until it expires. We do not restore deleted accounts from backups.
• Analytics events. Pseudonymous raw events are retained for up to 90 days, daily uniqueness markers for up to 32 days, and non-identifying daily aggregate counters for up to 400 days. Beginning November 1, 2026, per-day lists of the pseudonymous identifiers that completed sign-up or opened the app on each day are retained for up to two years, so we can calculate aggregate active-user and returning-user (retention) counts over longer periods. These lists contain no names, contact details, locations, or content, are used only to produce those aggregate counts, and are deleted when your account is deleted. Firestore time-to-live deletion is asynchronous, so an expired record can remain briefly while deletion is processed.
• Google Analytics data. Aggregate app and website analytics are retained according to the Comitiva Google Analytics property's configured data-retention settings and Google's service-provider retention and deletion processes. Comitiva does not set the Google Analytics User-ID feature, so those SDK/browser instance records are not keyed by your Comitiva account ID.
• Meta ad-measurement data. Data received by Meta is retained under Meta's own terms and data policy. Your opt-out choice is stored on your device (app) or in your browser (website) until you change it or clear the app's or browser's data.
• Advertising choices. Your current choices remain with your active account. Pseudonymous consent-audit entries expire after up to 400 days and may remain briefly while asynchronous deletion is processed. Provider queue records do not store your phone number or provider match hash.
• Sentry error and performance data are retained under Comitiva's configured Sentry project retention, currently up to 90 days.
• Purchase and subscription records may be retained by Apple, Google, RevenueCat, and Comitiva for as long as needed to provide subscription access, handle disputes and refunds, prevent fraud, satisfy accounting and legal obligations, and maintain an audit trail.
• Business advertising and billing records may be retained by Comitiva and Stripe for promotion delivery, payment-method management, invoicing, accounting, fraud prevention, authorizations, refunds, disputes, and legal or audit obligations. Promotion drafts have a 30-day cleanup timestamp, but that cleanup is not the authority for active or historical orders; Stripe's separate retention is governed by its terms and applicable law.

When you delete your account

You can delete your account at any time from the in-app Profile screen.

1. You are signed out immediately. Your push token is cleared and your refresh tokens are revoked.
2. Your account enters a 30-day grace period. You can reinstate the account during that period by signing back in and confirming.
3. After the grace period, a daily process handles up to a bounded number of accounts, so final processing can occur after the exact 30-day point. It then performs a permanent deletion and anonymization cascade:
   • Your Firebase Authentication record and your user document are deleted.
   • Your profile photo is deleted from Cloud Storage.
   • Your friendships, business follows and blocks, friend/group/Hang memberships, reactions, reminders, referral claims, advertising choices and queues, and other private relationships are deleted or disconnected.
   • Notifications you received are deleted.
   • Personal Hangs you created, chat messages you sent, comments, awards, safety reports, and notifications you triggered for others are anonymized — personal identifying fields are replaced with "Former member" or a deleted-user sentinel.
   • Ordinary personal Gallery files, their thumbnails, personal Hang covers you uploaded, voice messages you recorded, and friend-group images you uploaded are deleted from Cloud Storage. Their Gallery records are anonymized and hidden. An exact media object protected by a separate promotion/Hall of Fame submission can remain, as can business-attributed media and records retained for safety, legal, dispute, audit, or backup purposes.
   • Hang Memories you saved are deleted with their likes and comments, photo requests you sent or received are withdrawn, and your photos and videos are removed from other members' Hang Memories.
   • Your business memberships are removed. If another business owner remains, ownership and retained management records transfer to a remaining owner. If you are the only owner, the business is closed, its public identity fields and listings are cleared or disabled, its memberships are deleted, and its business-profile images are removed.
   • Business-attributed promotion, order, invoice, refund, dispute, and audit records may remain as needed for delivery, accounting, fraud prevention, disputes, and legal obligations. Those records can retain the initiating account or deleted-user sentinel as an audit identifier. If a business closes, Comitiva deletes its private Firebase billing record, but Stripe may separately retain its customer and transaction records under Stripe's terms and applicable law.
   • Your username, phone number, and email are released for reuse.
   • Your pseudonymous raw analytics events, per-day sign-up and app-open lists, daily uniqueness markers, legacy user-level ad events, advertising-consent audit, and audience queue or membership records are deleted. Non-identifying aggregate counters remain.
   • A deletion-audit record remains with a SHA-256 hash of the former Firebase UID, completion time, and deletion/anonymization counts. It does not contain your phone, email, username, or content.

The automated account-deletion cascade removes ordinary personal Gallery files and personal Hang covers after the grace period; a separate full-media request is not required for those objects. You may email hello@comitiva.app to identify other media you believe remains. Comitiva cannot remove Recap exports or copies held by other users, and promotion/Hall of Fame, business, safety, legal, dispute, audit, or backup exceptions can apply.

9. Security

We take security seriously and use a range of safeguards, including:

• Encryption in transit (TLS) for all client–server traffic.
• Encryption at rest for data stored in Firebase / Google Cloud.
• Authentication via Firebase Authentication, including SMS verification.
• Firestore security rules that enforce per-user access controls, Hang visibility, and admin role checks via Firebase Auth custom claims.
• Cloud Storage rules that enforce file size and content-type limits.
• Sensitive operations (such as profile-cascade updates, push fan-outs, account deletion, and content moderation) running server-side as privileged Cloud Functions rather than from client devices.
• Centralized scrubbing of phone numbers, email addresses, verification IDs, push tokens, authorization values, and share-link bearer tokens from diagnostic logs and Sentry context before transmission.

No system is 100% secure. We encourage you to protect your device with a passcode or biometric lock and to notify us promptly at hello@comitiva.app if you believe your account has been compromised.

10. Your Choices & Rights

• Ad measurement. See Your Privacy Choices below.
• Location. Revoke the location permission in your device settings at any time. Live location sharing inside a Hang is opt-in and can be turned off at any time.
• Notifications. Manage push notification categories in the in-app Preferences screen (including a master "Pause All" toggle and per-category toggles for invites, RSVPs, reminders, friend requests, chat messages, and gallery uploads). Disable notifications system-wide in your device settings.
• Hang Memories and Recap media sharing. In Preferences, turn “Hang Memories” and “Hang Recaps” on or off separately; the one sharing question the app asks sets both. Hang Memories on lets friends add your photos and videos to their Hang Memories without asking; off removes media friends added without asking, and friends then send a request you can approve or decline. Hang Recaps on lets friends use personal Gallery photos/videos you upload, and a personal Hang cover you own, in Recaps; off makes earlier Hang-by-Hang grants ineligible. These choices apply to future media exports, do not control frozen award identity, and cannot recall an image already exported or held by a recipient.
• Your Hang Memories. Edit a Hang Memory's photos, videos, or caption, or delete it, from its menu. Answer friends' photo requests from Activity, and remove your own photo or video from someone else's Hang Memory from that Memory's menu.
• Contacts. Revoke Contacts permission in device settings. Contact names and complete address-book records remain on-device; normalized identifiers are transmitted transiently and not stored by the matching function. Sign out to clear Comitiva's local contact-match cache.
• Profile. Edit your display name, bio, avatar, banner, vibe, and rep in the app.
• Block other users or businesses. Blocking is available where supported, with the limits described in the Terms and Section 6.
• Report. Report content or users using the in-app reporting feature.
• Delete your account. Use the in-app account-deletion flow (see Section 8), or follow the web instructions at comethruapp.com/delete-account.
• Access & portability. Request a copy of the personal information we hold about you by emailing hello@comitiva.app. We will respond within the time period required by law (45 days under CCPA). Automated data export is not yet available; we provide exports manually upon request.
• Correction. Most profile fields are editable in the app. Your date of birth, once submitted, cannot be self-edited; to request a correction, email hello@comitiva.app.

Your Privacy Choices (opt out of ad-measurement sharing)

You can stop Comitiva from sharing ad-measurement data with Meta in any of these ways:

• In the app: Preferences → Advertising & Privacy → turn off Help measure our ads. This applies to every account on that device, including after you sign out, until you turn it back on.
• On iPhone: choose Ask App Not to Track, or turn off tracking for Comitiva in Settings → Privacy & Security → Tracking. This stops the advertising identifier from being shared; use the in-app setting to stop all ad-measurement events.
• On the website: use the button below, or turn on Global Privacy Control in your browser, which we treat as an opt-out. The choice is stored in that browser.
• By email: write to hello@comitiva.app with the subject line “Do Not Sell or Share.”

11. California Privacy Rights (CCPA / CPRA)

This Section applies to California residents and supplements the rest of this Privacy Policy.

Categories of personal information we collect

In the last 12 months, we have collected the following CCPA/CPRA categories of personal information:

• Identifiers — name, username, phone number, email address, user ID, device identifiers, and, where allowed, device advertising identifiers and Meta cookies.
• Personal records (Cal. Civ. Code § 1798.80(e)) — phone number, email.
• Protected classification characteristics — age (derived from your date of birth at signup to confirm eligibility); the underlying date of birth itself.
• Commercial information — subscription product, transaction, purchase, restore, and entitlement status; business promotion drafts, orders, card-authorization/capture status, invoice summaries, refunds, and disputes.
• Internet or other electronic network activity — analytics events, crash reports, performance traces, and the website and app ad-measurement events described in Section 1.
• Geolocation data — precise or approximate foreground location, Hang address/coordinates, opt-in live location, and rounded map coordinates.
• Audio, electronic, visual — photos and videos you capture or upload.
• Inferences — friend-suggestion outputs, "people you may know" matches.

Sources, purposes, and recipients

Sources, purposes, and recipients of each category are described in Sections 1, 3, and 5 of this Privacy Policy.

Sensitive personal information

We collect precise geolocation only when you grant permission, and only as described in Section 1. We use sensitive personal information only for the purposes permitted by Cal. Civ. Code § 1798.121(a) and do not use or disclose it to infer characteristics about you.

Sale and sharing

We do not sell personal information for money. When ad measurement is active, we share the following categories with Meta for cross-context behavioral advertising (ad measurement): identifiers (device advertising identifiers and Meta cookies, where allowed), commercial information (Premium subscription and trial starts), and internet or other electronic network activity (the website and app events described in Section 1). We do not sell or share the personal information of consumers we know are under 16, and we do not send ad-measurement events for accounts under 18. Off-platform audience matching remains dormant. You have the right to opt out of this sharing; see Your Privacy Choices. We honor Global Privacy Control signals as an opt-out on our website.

Your rights

• Right to know what personal information we have collected, used, disclosed, sold, or shared.
• Right to delete personal information we hold about you, subject to permitted exceptions.
• Right to correct inaccurate personal information.
• Right to portability — receive your personal information in a portable format.
• Right to opt out of the sale or sharing of personal information — see Your Privacy Choices.
• Right to limit use of sensitive personal information (we already limit use of sensitive PI as described above).
• Right to non-discrimination for exercising your CCPA/CPRA rights.

How to exercise your rights

Submit a request by emailing hello@comitiva.app with the subject line "California Privacy Request." We will verify your identity by reference to information you have already provided to us (such as your registered phone number or email). We will respond within 45 days, with the possibility of one 45-day extension where reasonably necessary, as permitted by law. You may use an authorized agent to submit a request by providing the agent with signed written authorization; we may also require the agent to verify their own identity.

Notice of financial incentive

Comitiva may offer referral or promotion rewards for qualifying actions under terms presented with the program. We do not offer those rewards in exchange for selling personal information. If a program is treated as a financial incentive under applicable law, we will provide any additional notice required for that program.

12. International Users

The Service and its subscription offering are intended for United States residents and are hosted in the United States through Google Cloud / Firebase and other providers. If you access the Service from elsewhere, you do so on your own initiative and are responsible for local law. We will update this Policy before intentionally expanding availability.

13. Third-Party Links & Services

The Service may link to, embed, or otherwise interact with third-party content and services, including Google maps and Places content, Mapbox static maps, Giphy GIFs, Apple and Google store interfaces, Stripe-hosted Checkout and billing management, and operating-system share sheets. Those third parties have their own terms and privacy practices. Once you direct information or an exported Recap to a third party, its handling is also governed by that third party.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service, by email, or by other reasonable means at least seven (7) days before the changes take effect, except where a shorter period is required by law or by an urgent security or compliance need. The "Last updated" date at the top of this Policy reflects the most recent revision. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

15. Contact

Questions or requests about this Privacy Policy? Contact us at:

ComeThru App, Inc.
Email: hello@comitiva.app
California, United States