Effective: September 20, 2026

Last updated: September 20, 2026

Qrewlinq Privacy Policy#

Summary (for convenience only; the full text governs)

• Who we are. Qrewlinq is a private, invite-based group trip-planning app operated by Capital Grove Collective LLC. We decide why and how the personal information described here is processed.
• What we collect. Your email, username, and display name; limited age-eligibility information; profile and qrew cover photos; your chat messages, trip and itinerary plans, RSVPs, and travel details (planned arrival/departure times and the free-text locations you type); your qrew memberships and invitations; reports, preserved report evidence, moderation decisions, and feedback you send; technical identifiers (your user ID, your device push token, a device ID); and limited technical and usage data, including your IP address used briefly for rate-limiting and optional crash diagnostics. If we terminate an account for abuse, we may retain its current and report-time email addresses on a denylist to prevent re-registration. You type your travel locations as text. We do not collect your exact birth date, device GPS location, contacts, microphone, calendar, or camera.
• How we use it. To run the Service and let you coordinate trips with the people you invite, to deliver chat and photos, to triage feedback and improve the Service, to send push notifications, and to keep the Service secure and abuse-free.
• No ads, no tracking, no selling. We use optional, consent-based product analytics to understand whether core planning features are working. We do not use advertising, marketing, or cross-app attribution tools. We use Firebase Crashlytics only for crash diagnostics in distributed app builds, subject to your in-app setting. We do not sell your personal information and do not share it for cross-context behavioral advertising. We do not track you across other apps or websites.
• Who sees it. Other members of a qrew you join see your messages, photos, RSVPs, and travel details, by design. Behind the scenes, we use Amazon Web Services (US) to host the Service, Apple Push Notification service to deliver notifications, Geoapify (a Germany/EU-based company) and Foursquare (a US-based company) for place autocomplete (these receive only the text you type, not your IP address), and private GitHub issues for limited moderation-task metadata and for the production feedback fields described in Section 5.2. GitHub does not receive report evidence, report details, reported message or photo content, or evidence links, and we do not deliberately add your account user ID or account email address, screenshots, feedback context, network state, or client timestamp to a feedback issue. Feedback text itself may contain information you choose to provide.
• Deletion is immediate and permanent. You can delete your account in the App (Account screen, then Delete Account). Deletion takes effect immediately and cannot be undone: we remove you from your qrews and delete your personal data records right away, and your email and username become available again. Chat messages you sent in qrews that continue to exist are not deleted with your account; they remain visible to the members of those qrews (see Section 7). Stored photo files and noncurrent photo versions are handled as described in Section 7. A GitHub feedback issue that was already created, or is created from an event queued before deletion, is not automatically deleted or redacted. If we terminate an account for abuse, limited moderation records and banned email addresses may be retained as described in Section 7 to enforce our Terms and protect the Service.
• Your rights. Depending on your U.S. state of residence, you may have rights to access, correct, delete, or obtain a copy of your information and to appeal certain decisions. Contact us at legal@qrewlinq.com.

This summary is informational only. The numbered sections below are the legally operative text.

This Policy is accessible inside the App and from our App Store listing, and will be published at https://qrewlinq.com/privacy.

1. Introduction and Scope#

1.1 Who we are and our role#

Qrewlinq is a private, invite-based group trip-planning social application, available as a native iOS app and through our website (currently a marketing site). It is operated by Capital Grove Collective LLC, a company organized under the laws of the District of Columbia, United States, with its registered business address at 1820 Burke Street SE, Washington, DC 20003 ("Qrewlinq," "we," "us," or "our"). The Service is currently offered only to residents of the United States. When we refer to "you," we mean an individual who uses the Service.

Qrewlinq determines the purposes and means of processing the personal information described in this Privacy Policy (the "Policy"). For purposes of U.S. state privacy laws that apply to us, Qrewlinq is the "business" or "controller" responsible for that information.

1.2 What this Policy covers#

This Policy explains what personal data we collect, how and why we use it, with whom we share it, how long we keep it, how we protect it, where it is stored, and the rights and choices available to you. It applies to:

• the Qrewlinq iOS application (the "App");
• the Qrewlinq website and related online services; and
• all related features, including account creation, qrews, linqs, itineraries, chat, photos, RSVPs, invitations, and notifications

(collectively, the "Service").

This Policy does not apply to third-party services, websites, or content that you may access through links you or others paste into the Service, or to the platforms (such as Apple) through which you obtain the App, which have their own privacy practices. See Sections 5 and 14.

1.3 Key terms#

In this Policy: a "qrew" is a closed trip group; a "linq" is a destination within a trip; an "itinerary item" is a planned stay or activity within a linq. "User Content" has the meaning given in our Terms of Service and includes the chat messages, photos, feedback, and qrew, linq, and itinerary-item details you provide (see Section 2.2). "Personal data" and "personal information" mean information that identifies, relates to, or could reasonably be linked to you, as defined under applicable law. The defined terms "qrew," "linq," and "itinerary item" are used with the same meaning in our Terms of Service.

1.4 Effective date and changes#

This Policy is effective as of September 20, 2026 and was last updated on the date shown at the top. If we make material changes, we will notify you by reasonable means before the changes take effect, which may include in-app notice, a notice on our website, or email to the address associated with your account. See Section 16.

2. Information We Collect#

We collect only the categories of data described below. We do not collect anything beyond this list. In particular, we do not collect device GPS or precise device location, contacts or address book data, microphone audio, camera input, or calendar data.

2.1 Account and profile information#

• Email address. Used as your login identifier and as the channel to which we send your one-time passcodes ("OTP") and transactional email.
• Username. Your unique handle, used for sign-in and for invitations and search.
• Display name. The name shown to others in your qrews.
• Age eligibility. During signup, you must check an initially unchecked box next to this single statement: “By creating an account, you represent that you are at least 13 years old, agree to the Terms of Service, and acknowledge the Privacy Policy.” Immediately before sending the signup request, the App requests Apple's Declared Age Range only when iOS regulatory signals call for it. On versions of iOS that expose a specific required-feature signal, the App requests a range only when that signal is present; on earlier versions that expose only general eligibility for age features, the App conservatively requests a range for eligible users. Any range Apple provides is evaluated on your device. If a required system check indicates that signup is not permitted, or if it is declined or cannot be completed, the App does not send the signup request. For a permitted signup, we receive and retain only an eligibility attestation, the assurance method, and server timestamps; we do not receive or store an exact birth date, the age range Apple provides, or a raw Apple response. We do not currently collect or store a parental-authorization status; before doing so, we will implement the required authorization handling and update this Policy.
• Profile photo and qrew cover photos. Images you upload for your profile and for qrews you create.
• Discoverability setting. A flag indicating whether you can be found by your display name in search. Display-name discoverability is on by default and can be turned off in Settings (you are always findable by your exact @username; you are findable by display name only while this setting is on).
• Account timestamps and status, such as account creation and update times.

2.2 User Content#

• Chat messages. The free-text messages you send in qrew chat, including emoji reactions (mapped to user IDs) and quoted or replied-to messages.
• Link-preview metadata. When you paste a URL into chat, we generate a preview that may include the linked page's title, site name, description, and image reference (Open Graph metadata).
• Read receipts. A per-qrew record of the last message you have read, used to compute unread indicators for you and other members.
• Photos. Profile photos and qrew cover photos you upload (see also Section 2.1).
• Trip and itinerary content. Qrew names and descriptions; linq destinations and dates; and itinerary-item names, free-text notes, free-text location text, URLs, costs, and dates.
• Feedback. If you use Send feedback, we collect a random feedback ID, feedback type and text, optional screen/qrew/itinerary context, and client diagnostic data: app version, build number, iOS version, device model, locale, time zone, network state, and client timestamp. Internal builds may also attach an optional screenshot. Feedback may contain personal information you choose to include.

2.3 Travel and participation details#

• RSVP and participation status (for example, going or not going).
• Planned arrival and departure times that you enter.
• Free-text arrival and departure locations that you type (for example, an airport name or an address).
• Interest responses and time-slot proposals and votes, reflecting your preferences and availability.

This travel-related information is personal data that you type as text. We do not derive it from your device location, and we do not access your device's GPS.

2.4 Social graph#

• Memberships. Which qrews you belong to, who invited you, and when you joined.
• Invitations and invite links. Directed invitations (by @username) and shareable invite-link tokens, which may include denormalized display fields (such as usernames, display names, and photos) of the people involved.
• Search exposure. You are findable by other users by your exact @username at all times, and by your display name unless you turn off discoverability in Settings (discoverability is on by default).

2.5 Identifiers#

• User ID. An internal identifier we assign to your account.
• APNs device push token. A token issued by Apple Push Notification service that lets us deliver push notifications to your device.
• Client device ID, platform, and environment. A client-generated identifier for your installation and basic platform information (for example, that you are on iOS).
• Authentication artifacts. One-time passcodes (stored only as a cryptographic hash; see Section 8) and session credentials (access tokens and refresh tokens; refresh tokens stored only as a hash). The iOS app stores your tokens in the device Keychain.

2.6 Moderation and safety records#

• Content reports. A report includes an internal report ID, the reporter's and reported member's user IDs, the reported member's normalized email address at the time of the report, the selected reason and optional details, timestamps and status, and a snapshot of the reported profile, message, or photo sufficient for us to review the report even if the original or account changes or is deleted. The email snapshot remains private in AWS and is used only for safety review and enforcement; it is not sent to GitHub.
• Moderation decisions and actions. We keep an audit record of operator decisions and actions, including the report and subject user IDs, action, reason, operator identity, status changes, and timestamps.
• Banned email addresses. If we terminate an account for violating our Terms, we may store its normalized current and report-time email addresses directly on a denylist so that the terminated member cannot immediately register another account with those addresses.

2.7 Technical and usage data#

• IP address. Used transiently as a rate-limiting key (stored briefly, for roughly five minutes, and unhashed during that window) to protect the Service from abuse. Our content delivery network and gateways also process your IP address as a necessary part of routing your requests. We use your IP address only for these security and routing purposes; we do not use it to determine or infer your location.
• Crash diagnostics. In TestFlight and App Store builds, if "Send crash reports" is enabled in Settings, the App may send crash reports and selected non-fatal diagnostic events to Firebase Crashlytics. These reports may include, for example, app version and build, API environment, iOS version, device model, authenticated yes/no, last screen identifier, a random app-scoped crash-install ID, and (for non-fatal diagnostic events) a few non-identifying categorical keys such as the operation, error type, server error code, and recovery outcome. We do not include your email, username, display name, auth tokens, qrew names, itinerary content, chat content, invite links, screenshots, request or response bodies, headers, or raw URLs in crash diagnostic metadata.
• WebSocket connection and presence records. Records linking your connection to your account and qrews so that real-time chat and online-presence indicators work.
• Service logs. Our backend writes structured operational logs of requests to the Service. Log entries include request metadata (such as the route called, a request identifier, timing, and status) and your user ID. For authentication events (sign-up, sign-in, code verification, and email change), log entries also include a cryptographic hash derived from your normalized email address (never the address itself) so that we can investigate sign-in problems, abuse, and security incidents. We do not log your message contents or OTP codes. See Section 7 for log retention.
• Timestamps and activity metadata, such as creation and update times, last-message and last-seen times, and similar event times.

2.8 Selected destinations and place data#

• Selected destinations and place IDs. When you choose a destination or point of interest, we store your selection and may store associated reference data (such as a place identifier, address, city, and country) returned by our place-autocomplete vendors. Your selection can reveal an intended travel destination.

2.9 Federated login (not active)#

Our data model can support linking a Sign in with Apple or Google account. This federated login is not active today. If we enable it, we will update this Policy to describe the additional data (such as the provider's subject identifier) we would receive.

3. How We Collect Information#

3.1 Directly from you#

We collect most information directly from you when you make the signup attestation, create an account, set up your profile, upload photos, create or join qrews, add linqs and itinerary items, send chat messages, respond to RSVPs and proposals, send invitations, type place searches, or send feedback.

3.2 Automatically through the App and your device#

Some information is generated automatically when you use the Service, including your IP address (for rate-limiting and routing), your APNs push token and client device ID, WebSocket connection and presence records, timestamps and activity metadata, and the service logs described in Section 2.7. When iOS regulatory signals call for a system age check, the App requests an age range from Apple immediately before sending the signup request. The App evaluates that range on the device and sends us only the eligible result and assurance method described in Section 2.1; it does not send us the range or Apple's raw response.

3.3 Derived or denormalized information#

To make the Service fast and reliable, we copy and store certain display fields in more than one place. For example, your display name and profile photo reference may be denormalized onto your membership and invitation records, and place reference data may be stored alongside your selections. We do not create new categories of personal data through this; we only reorganize the information already described above.

4. How We Use Your Information#

We use personal information only for the purposes described below.

No automated decision-making with legal or similarly significant effects. We do not use your personal data for profiling, scoring, or automated decision-making that produces legal effects concerning you or similarly significantly affects you. We do not engage in behavioral or targeted advertising.

5. How We Share and Disclose Information#

We do not sell your personal information, and we do not share it for cross-context behavioral advertising (see Section 5.5). We disclose personal data only as described below.

5.1 With other members of your qrews (by design)#

The Service is collaborative. When you join or participate in a qrew, the other members of that qrew can see information you contribute to it, including your display name and profile photo, your chat messages and reactions, photos you upload, your qrew/linq/itinerary content, your RSVP and travel details (planned arrival and departure times and the locations you type), your interest and time-slot responses, and your read-receipt and activity indicators. People you invite, and people who hold a valid invite link, can see the relevant invitation details. Please share in a qrew only what you are comfortable letting the other members see. We apply automated pattern-based safety filters to certain text intended for display to other users when it is submitted, but do not routinely have people read private qrew communications. Safety-report details follow separate review paths. Authorized reviewers may access content that is reported or associated with a suspected violation, as described in our Terms of Service.

5.2 Service providers#

We use a small number of trusted providers that help us operate the Service. Most process personal data on our behalf, under contract and only on our instructions; our place-autocomplete vendors act subject to each vendor's terms and our data-minimization design, as noted below:

• Amazon Web Services (AWS), in the US (region us-east-1). Provides our entire hosting infrastructure and stores data at rest, including databases (DynamoDB), photo and file storage (S3), a content delivery network for photos (CloudFront), transactional and OTP email delivery (SES, sending from noreply@qrewlinq.com), our APIs and real-time messaging (API Gateway HTTP and WebSocket APIs and Lambda), key management and encryption (KMS), secret storage (Secrets Manager), configuration (AppConfig), logging (CloudWatch), and DNS and certificates (Route 53 and ACM). AWS may process your IP address at the network edge as a necessary part of routing.
• GitHub, in the US. Provides our private operational issue tracker. For a new content report, GitHub receives only a random internal report ID, report category, target type, creation time, response deadline, and workflow status. For production Send feedback, we create a separate triage issue containing a random feedback ID, feedback type, the fixed production environment, the feedback text (cleaned of certain markup and limited to 4,000 characters), and app version, build number, iOS version, device model, locale, and time zone. Feedback text may contain personal information you choose to provide. We do not send GitHub report evidence, free-text report details, reported message or photo contents, or evidence links, and we do not deliberately add your account user ID or account email address, screenshots or screenshot keys, screen/qrew/itinerary context, network state, client timestamp, or presigned links to a feedback issue.
• Apple Push Notification service (APNs). Receives your device push token and the content of the notifications we send (which may include a message preview) in order to deliver them to your device.
• Geoapify (a Germany/EU-based company). Provides city and destination autocomplete, subject to Geoapify's terms and our data-minimization design. It receives the text of your search query only. It does not receive your IP address.
• Foursquare Places (a US-based company). Provides point-of-interest autocomplete, subject to Foursquare's terms and our data-minimization design. It receives the text of your search query and an optional coordinate reflecting the trip's destination area (never your device location or GPS). It does not receive your IP address. This optional destination-area coordinate is the only place where a coordinate leaves the Service.
• Firebase Crashlytics (Google LLC, US). Receives crash reports and selected non-fatal diagnostic events from distributed App builds when you enable "Send crash reports" in Settings, so we can diagnose and improve reliability.

We use PostHog as an optional product-analytics provider only when you opt in to "Share Usage Analytics." These events are generated on our servers from your account activity; the App itself contains no product-analytics SDK. Our servers send minimal, versioned event names and categorical properties tied to your account ID or qrew ID. We do not send messages, trip titles, destinations, notes, URLs, invite tokens, names, email addresses, usernames, contacts, precise location, advertising identifiers, or cross-app activity to PostHog. Turning the setting off stops future product-analytics capture. We use Firebase Crashlytics as a crash-reporting provider only for crash diagnostics in distributed app builds, subject to your in-app "Send crash reports" setting.

5.3 Legal, safety, and enforcement#

We may disclose personal data if we believe in good faith that doing so is reasonably necessary to: comply with a law, regulation, legal process, or enforceable governmental request; enforce our Terms of Service and other agreements; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of you, our users, us, or the public.

5.4 Business transfers#

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, personal data may be transferred as part of that transaction. We will require the recipient to honor this Policy or will notify you of any material change to how your data is handled, consistent with applicable law.

5.5 We do not sell or share for advertising#

We do not sell your personal information for money or other valuable consideration, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA and other US state privacy laws. We have no third-party advertising partners, and our optional product analytics are not used for advertising, attribution, or cross-context behavioral profiling. We do not use App Tracking Transparency permissions because we do not track you across other companies' apps or websites.

6. Cookies, SDKs, and Tracking Technologies#

The Qrewlinq App does not contain any third-party product-analytics SDK. Optional product analytics are generated on our servers from your account activity when you opt in, and do not use autocapture, automatic screen views, lifecycle analytics, session replay, surveys, advertising, marketing, or attribution. Distributed iOS builds include Firebase Crashlytics for crash diagnostics only. You can turn off usage analytics and crash reporting separately in Settings. We also use the technical mechanisms necessary to operate the Service, such as authentication tokens (held on your device, including in the device Keychain) and the WebSocket connections that power real-time chat and presence.

Our marketing website may use strictly necessary cookies or similar technologies required for the site to function. We do not use the website to build advertising profiles. If we add any non-essential cookies in the future, we will update this Policy and provide any consent mechanism required by law.

We disclose how we respond to opt-out preference signals (such as the Global Privacy Control) and to "Do-Not-Track" signals in Section 10.5. Because we do not sell or share personal information and do not track you across other apps or websites, there is no targeted-advertising activity for these signals to stop.

7. Data Retention#

We keep personal data only for as long as needed for the purposes described in this Policy, unless a longer period is required or permitted by law. We apply the following category-based criteria and periods:

• Account and profile data, user content, travel details, social graph, and photos. Retained for as long as your account is active and you remain a member of the relevant qrews, so that the Service functions for you and the other members. The database records in these categories are deleted when you delete your account, with the exceptions described below for chat messages in continuing qrews, GitHub feedback triage issues, stored photo-file versions, caches, logs, and backups.
• Account deletion (immediate and permanent). When you delete your account, deletion takes effect immediately and cannot be undone. There is no reactivation or grace period; if you return later, you sign up as a new user. Concretely: we stop push notifications to your devices and delete your device tokens; we remove you from your qrews; qrews that you lead and that have no other members are deleted entirely (including their chat messages and trip content); qrews with other members continue without you, and trip content you created in them is handed off to the remaining members; and we delete your memberships, RSVPs and travel details, interest and time-slot responses, invitations, read receipts, notification settings, connection records, sessions, feedback records stored in our AWS systems, and your identity record. Your email address and username become available again immediately.
• Eligibility records. We do not receive raw age-assurance responses. We retain the minimum eligible result, assurance method and time, and Terms version and acceptance record while the account is active and afterward only as long as reasonably necessary to document legal compliance, resolve disputes, enforce our Terms, or satisfy law. We do not retain an exact birth date or age range. We do not currently retain a parental-authorization status.
• Chat messages you sent in continuing qrews. Chat messages are part of the shared conversation of a qrew. When you delete your account, messages you sent in qrews that continue to exist are not deleted; they remain visible to the members of those qrews, attributed to the display name shown at the time of sending, until the message or the qrew itself is deleted. You can delete your own individual messages in the App before deleting your account.
• Photo files. When you delete or replace a photo, we remove the file and all its size variants from our storage and purge them from our content-delivery network immediately, so the photo is no longer served to other users. A copy already downloaded to someone's device may remain in that device's own local cache for up to a year (we cannot reach another device's cache), but we do not serve the deleted photo to new viewers. Because the photo storage bucket is versioned, noncurrent versions may remain in our storage for up to 30 days before automatic expiry.
• Deleting qrews, linqs, and itinerary items. When a qrew is deleted, its destinations, itinerary items, votes and responses, memberships, and chat messages are deleted immediately and permanently. The same applies to individual linqs and itinerary items you delete.
• One-time passcodes (OTPs). Stored only as a cryptographic hash and automatically expired after approximately 10 minutes.
• Session credentials. Refresh tokens are stored only as a hash and expire after their time-to-live, which is 30 days on mobile and 7 days on the web (these are the engineering-confirmed values). Access tokens are short-lived and are not stored on our servers; your device holds your tokens in the Keychain until you sign out or delete your account.
• IP address used for rate-limiting. Stored transiently and automatically expired after approximately 5 minutes.
• Product analytics. If you opt in, account-linked product analytics are retained only as long as needed to understand feature adoption and reliability. When you delete your account, we request deletion of the PostHog person and user-linked analytics events within the disclosed deletion window. Qrew-level aggregate facts that are not tied to your account may remain.
• Feedback and GitHub triage issues. We delete feedback records in our AWS systems when you delete your account. A GitHub triage issue created for production feedback is not automatically deleted or redacted when you delete your account, and an event queued before deletion may create an issue afterward. That issue contains only the fields described in Section 5.2 and may remain separately in our private operational tracker. You may submit an access, deletion, or correction request for personal data in feedback or a GitHub triage issue under Section 10.1; we handle requests as required by applicable law.
• Content reports, preserved evidence, and moderation audit records. Pending reports are retained until reviewed. Resolved reports and preserved evidence are normally retained for 180 days after resolution, then deleted through our reviewed moderation-purge process. Each append-only moderation audit event is normally retained for 180 days after it is recorded. We may retain these records longer when reasonably necessary for safety, dispute resolution, enforcing our Terms, or a legal obligation.
• Banned email addresses. If we terminate an account for abuse, we retain its normalized current and report-time email addresses on our denylist for as long as reasonably necessary to enforce the termination, prevent repeat abuse, protect members, and enforce our Terms. We review and remove denylist entries when they are no longer necessary or when a termination is reversed.
• WebSocket connection and presence records. Transient; retained only for the duration of the connection and short-lived operational windows.
• Service logs. The structured operational logs described in Section 2 (which include your user ID, and a cryptographic hash of your normalized email address on authentication events) are retained for up to 12 months in our production environment, and for shorter periods in non-production environments, after which they expire automatically.
• Backups and point-in-time recovery. Production DynamoDB point-in-time recovery is enabled for auth-sensitive tables and may retain restorable versions for up to 35 days. Noncurrent versions of stored photo files expire after 30 days as described above. Production service logs are retained for up to 12 months. After the applicable retention window, routine backups, noncurrent versions, and logs are overwritten or deleted on a rolling basis.

When you delete your account, the records listed above as tied to your account are deleted immediately (subject to the chat-message, GitHub-feedback-issue, report/moderation, banned-email, and photo-file items noted above, and to log and backup expiry), except where we must retain limited data to comply with a legal obligation, protect members, prevent repeat abuse, resolve disputes, or enforce our agreements.

8. Data Security#

We implement technical and organizational measures designed to protect personal data, including:

• Encryption in transit. Data exchanged between the App and our servers is protected using industry-standard transport encryption (TLS).
• Encryption at rest. Data stored in our AWS infrastructure is encrypted at rest using AWS-managed server-side encryption (for example, DynamoDB's default encryption and S3-managed keys).
• Hashed authentication secrets. One-time passcodes and refresh tokens are stored only as cryptographic hashes, not in plain text. Access tokens are signed using keys managed by KMS.
• Device-side protection. On iOS, your session tokens are stored in the device Keychain.
• Access controls. We restrict access to personal data to those who need it to operate the Service, and we use the access-control, isolation, and logging features of our AWS infrastructure.
• Vendor diligence. Our service providers are bound by contract to maintain appropriate security.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We describe our measures accurately and do not promise that the Service is impenetrable. If we become aware of a personal-data breach that legally requires notification, we will notify affected users and regulators as required by applicable law.

9. Where We Process Information#

We are based in, and store data at rest in, the United States (AWS, region us-east-1). GitHub, which receives the limited moderation-task metadata and production feedback fields described in Section 5.2, is in the United States. Our place-autocomplete vendors are headquartered as follows: Geoapify is a Germany/EU-based company, and Foursquare is a US-based company.

The Service is offered only to U.S. residents, but a provider may process limited information in another country as described in Section 5. If you use the Service while temporarily traveling outside the United States, your information will continue to be processed in the United States and by the providers identified in Section 5. The privacy laws of those places may differ from the laws where you are physically located.

10. Your Privacy Rights and Choices#

Depending on your U.S. state of residence and the law that applies to us, you may have some or all of the following rights regarding your personal information:

• Access to the personal data we hold about you and information about how we process it.
• Correction of inaccurate or incomplete personal data (you can edit much of your profile directly in the App).
• Deletion of your personal data (you can delete your account in the App on the Account screen, then Delete Account; see Section 7).
• Portability, to receive certain personal information in a portable format.
• Opt out of the sale of personal information, targeted advertising, or certain profiling where applicable. We do not engage in these activities, so there is currently no such processing to opt out of.
• Withdraw an optional permission, such as push notifications, through your device settings.

10.1 How to exercise your rights#

You can exercise several rights directly in the App: editing your profile and discoverability setting, managing notifications, and deleting your account (Account screen, then Delete Account). For other requests, contact us at legal@qrewlinq.com. We handle access and portability requests on an individual basis and will provide the data we can reasonably compile about you within the applicable timeframe.

10.2 Verification and authorized agents#

To protect your data, we will take reasonable steps to verify your identity before fulfilling a request, typically by confirming control of the email address associated with your account. You may use an authorized agent to submit a request where the law permits; we may require the agent to provide proof of authorization and may require you to verify your identity directly.

10.3 Response timelines#

Where a U.S. state privacy law applies, we will respond within the period that law requires, generally 45 days, subject to any permitted extension and notice.

10.4 No discrimination and appeals#

We will not discriminate against you for exercising your privacy rights. If we decline your request, we will tell you why. Where US state law provides an appeal right, you may appeal our decision by replying to our response or contacting legal@qrewlinq.com; we will respond to your appeal within the timeframe required by your state's law, and you may also contact your state Attorney General.

10.5 Global Privacy Control and Do-Not-Track#

As required by California's Online Privacy Protection Act (CalOPPA), we disclose how we respond to "Do-Not-Track" signals: our Service does not change its data practices in response to Do-Not-Track browser signals, because we do not track users over time and across third-party services. We honor recognized opt-out preference signals, such as the Global Privacy Control, to the extent legally required. Because we do not sell or share personal information for cross-context behavioral advertising and do not engage in cross-context tracking, there is currently no sale, share, or targeted-advertising activity for these signals to disable.

11. California Privacy Disclosures#

This section provides additional disclosures required by the CCPA/CPRA for California residents. The personal information we collect and our purposes and recipients are described throughout this Policy. In the categories defined by the CCPA, we collect the following:

Sensitive personal information. Under the CPRA, the contents of your private messages (chat), feedback text when it contains sensitive information, and your account credentials are "sensitive personal information." We use sensitive personal information only to provide the Service you request, to secure your account, and for the other purposes permitted by Cal. Civ. Code 1798.121(a) (for example, to provide the chat feature itself). We do not use or disclose sensitive personal information for purposes that would give you a right to limit that use, so we are not required to post a "Limit the Use of My Sensitive Personal Information" link.

No sale and no sharing. We do not sell your personal information and do not share it for cross-context behavioral advertising. Because we neither sell nor share, we are not required to provide a "Do Not Sell or Share My Personal Information" link, and there is no such activity to opt out of.

Sources and purposes. The sources from which we collect, and the business and commercial purposes for which we use, each category are described in Sections 2, 3, and 4. The recipients are described in Section 5.

Non-discrimination. We will not discriminate against you for exercising your CCPA/CPRA rights.

Your California rights. California residents have the rights to know, access, correct, and delete their personal information, to data portability, and to limit certain uses of sensitive personal information (not applicable here, as explained above). To exercise these rights, see Section 10.

Shine the Light. California Civil Code 1798.83 permits California residents to request information about disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing.

12. Other U.S. State Disclosures#

Residents of U.S. states with comprehensive privacy laws may have rights to access, correct, delete, and obtain a portable copy of their personal information and, where applicable, to consent before certain processing of sensitive data. Several states also provide a right to appeal a denied request. We do not sell personal information, process it for targeted advertising, or engage in profiling that produces legal or similarly significant effects, so the corresponding opt-out rights have no activity to apply to. To exercise a right or submit an appeal, see Section 10.

13. Children's Privacy#

The Service is a general-audience service intended for U.S. residents who are 13 years of age or older. It is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. We use the limited eligibility information described in Sections 2 through 4 to apply this rule. A user who is under the age of majority must have a parent or legal guardian's permission and any authorization required by applicable law or the App Store. We do not currently process a parental-authorization status; we will implement and disclose that handling before offering accounts where it is required.

We do not permit signup unless the user makes the 13+ representation described above. If a required system check indicates that a person is under 13, or if it is declined or cannot be completed, the App does not send the signup request or permit account creation. If we later learn that an Account belongs to a person under 13, or that legally required parental authorization has not been provided or has been withdrawn, we will restrict or terminate the Account and delete the associated information on the same basis as the account deletion described in Section 7, including its exceptions for shared chat messages, photo-file handling, logs, and backups. If you believe a child under 13 has provided us personal information, contact legal@qrewlinq.com.

14. Third-Party Links and Services#

The Service relies on the limited third-party services described in Section 5 (AWS, APNs, GitHub for limited moderation-task metadata and production feedback triage, Geoapify, Foursquare, and Firebase Crashlytics for crash diagnostics). These providers process data on our behalf or to deliver a specific feature you request; their handling of data is governed by their own terms and privacy practices in addition to any contracts we have with them.

In addition, users may paste links into chat, and link previews may load content from third-party websites. We do not control, and are not responsible for, the privacy practices or content of third-party websites or services that you or others link to. We encourage you to review the privacy policies of any third-party site you visit through a link in the Service. The platform through which you obtain the App (Apple) also has its own privacy practices that apply to your use of that platform.

15. Communications and Notification Preferences#

• Push notifications. With your permission, we send push notifications for chat messages, invitations, and activity. You can turn push notifications on or off at any time in your device's system settings, and you can mute notifications on a per-qrew basis in the App. The Service remains fully usable if you decline or disable push notifications; push is for alerts, not a gate to functionality.
• Email messaging. We send transactional emails that are necessary to operate the Service, such as your OTP and certain account notices, from noreply@qrewlinq.com. Invitation alerts are delivered by push notification, not email. Because these emails are required to provide the Service you requested, they are not promotional and cannot be opted out of separately while you maintain an account; you can stop receiving them by deleting your account.
• In-app controls. You can manage your discoverability setting, mute individual qrews, and use Report and Block tools as described in our Terms of Service.

We do not send marketing or promotional email unless you separately opt in, and we will provide an unsubscribe mechanism in any such message.

16. Changes to This Privacy Policy#

We may update this Policy from time to time. When we make material changes, we will provide reasonable advance notice by appropriate means, which may include in-app notice, a notice on our website, or email to the address associated with your account, and we will update the "Last updated" date at the top. Changes become effective on the date stated in the notice or, if none is stated, when posted. Your continued use of the Service after a change becomes effective means you have read the updated Policy. If a change requires your consent under applicable law, we will obtain it before the change applies to you.

17. Contact Us and Privacy Inquiries#

If you have questions about this Policy or our handling of your personal data, or wish to exercise your rights, contact us:

• Privacy inquiries: legal@qrewlinq.com
• Legal inquiries: legal@qrewlinq.com
• General support: support@qrewlinq.com
• Mailing address: Capital Grove Collective LLC, 1820 Burke Street SE, Washington, DC 20003
• Policy URL: https://qrewlinq.com/privacy (also available in the App and on our App Store listing)

Responsible business/controller: Capital Grove Collective LLC, organized in the District of Columbia, United States.

U.S. residents may also contact their state Attorney General about privacy concerns. We ask that you contact us first so we can try to resolve your concern.