Privacy Policy

1) Who Can Use the App

The App is intended for users 13 years and older. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal data, please contact us and we will delete it.

2) Information We Collect

A. Information You Provide

• Account & Profile: your name, phone number (for sign-in/verification), and any profile details you add.
• Contacts: with your permission, we upload raw contact names and phone numbers from your device to our servers solely to help you find friends and enable sharing.
• Photos & Media: with your permission, we access your camera roll. We only upload a subset of photos—those our system identifies as likely including your friends and appropriate to share. We may retain photo metadata (e.g., creation time, dimensions) and geotags if present.
• In-App Content: captions, comments, and other content you submit.

B. Information Collected Automatically

• Usage & Events: screens viewed, taps/flows, session duration, and other in-app events (via analytics).
• Device & App Info: device model, OS, app version, language/region, timezone, and IP-derived approximate location.
• Diagnostics: crash logs and error reports (e.g., Sentry).

C. Derived/Technical Data

• Face Embeddings: to power friend detection and grouping, we compute numerical feature vectors (“face embeddings”) from images. These embeddings help match similar faces within the App and are not used to identify you across unrelated services.
• Safety Signals: content safety/NSFW scores to avoid unwanted sharing.

D. From Others

We may receive your information if other users upload/share photos containing you or sync contacts that include your number.

3) How We Use Information

• Core Features: phone sign-in, friend discovery via contacts, organizing and auto-sharing eligible photos, and notifying you of activity.
• Smart Features: face detection/grouping and suggestions that improve sharing relevance.
• Security & Integrity: prevent abuse, troubleshoot, and protect our users.
• Analytics & Improvement: understand usage and improve performance and features.
• Communications: send service updates, policy changes, and support messages.
• Legal: comply with law and enforce our Terms.

Legal bases (EEA/UK): performance of a contract (providing the App), legitimate interests (security, analytics, improvement), and consent (access to contacts/photos, notifications).

4) Auto-Sharing

Auto-sharing is ON by default so the App can deliver its core experience. We upload/share only the subset of photos our system marks as likely to include friends and be appropriate to share. An in-app control to turn auto-sharing off is being rolled out; until that control is available, you can request account-level disablement at help@downloadpeep.com.

5) How We Share Information

We do not sell personal information. We share data only as described below:

• Service Providers/Processors: Supabase (authentication, database, storage), Google Cloud (infrastructure/hosting), MongoDB (database), PostHog (product analytics), and Sentry (crash/error monitoring). These parties process data on our instructions and are bound by appropriate protections.
• People You Share With: content you share is visible to recipients consistent with your settings.
• Legal & Safety: when required by law or to protect rights/safety.
• Business Transfers: in connection with a merger, acquisition, or asset sale (we will notify you where required).

We do not share data for cross-context behavioral advertising and we do not use IDFA-based ad tracking.

6) Data Retention

We retain data only as long as needed for the purposes above, then delete or de-identify it.

• Account & Profile: while your account is active and for a reasonable period after deletion to comply with law/resolve disputes.
• Contacts Index: while friend discovery is enabled or until you request deletion.
• Photos & Uploaded Media: until you delete them or delete your account.
• Face Embeddings: while features are enabled or until you request deletion/account deletion.
• Analytics & Logs: generally up to 12 months.
• Backups: generally roll off within ~30 days.

For exact durations for a specific dataset, contact privacy@downloadpeep.com.

7) Your Choices & Rights

• Permissions: revoke Contacts, Photos, Camera, Notifications, and Location in device settings.
• Auto-Sharing Controls: an in-app switch is being rolled out; until then, request disablement at help@downloadpeep.com.
• Manage Content: delete shared items you control at any time.
• Access/Export/Correction/Deletion: email privacy@downloadpeep.com to request a copy of your data, correct it, or delete your account (we’ll delete associated embeddings; content others control may persist per their settings). We may take steps to verify your identity.
• Analytics: request analytics opt-out at privacy@downloadpeep.com; we can disable event collection for your account.

8) Security

We use administrative, technical, and physical safeguards appropriate to the data, including encryption in transit and at rest, access controls, and monitoring. No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact help@downloadpeep.com.

9) International Transfers

We may process data in the United States and other countries. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses) for cross-border transfers.

10) Region-Specific Notices

California (CCPA/CPRA)

• We do not sell or share your personal information (as those terms are defined by CPRA).
• You may request to know, access, correct, delete, and limit the use of sensitive personal information, and you have the right to non-discrimination.
• Submit requests at privacy@downloadpeep.com. Authorized agent requests may require proof of authorization.

EEA/UK (GDPR)

• Controller: DDL Lab, Inc., 1035 Campus Dr., Stanford, CA.
• Your Rights: access, rectification, erasure, restriction, objection, and portability; and the right to withdraw consent (e.g., contacts/photos access) at any time.
• Complaints: you may lodge a complaint with your local supervisory authority.

Biometric/Sensitive Information

Face embeddings are used only to group photos and improve sharing within the App. Where required by local law (e.g., certain U.S. states with biometric laws), we obtain consent and honor deletion requests. We do not sell or disclose face embeddings for third-party advertising and do not use them to identify you across unrelated services. We maintain a retention schedule as described in Section 6.

11) Third-Party Services We Use

We rely on the following processors to operate the App. Their use is limited to providing services to us under contract; they are not authorized to use your information for their own purposes.

• Supabase — authentication, database, storage
• Google Cloud — infrastructure/hosting
• MongoDB — database
• PostHog — product analytics (events, device/app metadata, coarse location)
• Sentry — crash/error monitoring

12) SMS & Notifications

We use SMS only for account security (e.g., verification/OTP). We do not send marketing SMS. Push notifications are optional and can be turned off in device settings.

13) Changes to This Policy

We may update this Policy from time to time. We will revise the “Last Updated” date above and, if changes are material, provide additional notice in the App or by email.

14) Contact Us

Privacy Requests: privacy@downloadpeep.com
Security/Incident Reports & Auto-Share Disable Requests: help@downloadpeep.com
Mailing Address: DDL Lab, Inc., 1035 Campus Dr., Stanford, CA