Privacy Policy

The short version

• We do not sell your personal information. We do not sell your personal information for money or other valuable consideration, and we do not share it for cross-context behavioral advertising (sometimes called targeted or interest-based advertising) as those terms are defined under California and other US state privacy laws.
• We do not sell or share sensitive personal information, including your precise geolocation.
• Location is central to the Service, and it is under your control. You choose whether to grant location permission, whether to allow background location, and you can revoke either at any time in your device settings.
• You decide what is public. Content you post — Moments, Spaces, Events, Thoughts, ratings, and check-ins — may be visible to other users based on the visibility settings you choose.
• The Service is for adults. It is not directed to children under 13, and we do not knowingly collect their personal information.
• You have rights over your data, including access, correction, deletion, and portability — and you can delete your account yourself from inside the app or at therr.com/delete-account.

The rest of this policy is the detail behind those points. If anything here is unclear, email us at info@therr.com.

Who we are

Therr, Inc., 8 The Green STE B, Dover, DE, 19901, United States, is the controller of your personal information for the purposes of the EU and UK General Data Protection Regulation ("GDPR") and the business that collects your personal information for the purposes of US state privacy laws.

Contact: info@therr.com  |  Attn: Privacy, 8 The Green STE B, Dover, DE, 19901, USA.

EEA, UK, and Québec users: we are in the process of appointing a representative under GDPR Article 27 and a person in charge of the protection of personal information under Québec's Law 25. Until that appointment is published here, you may direct any request or complaint to info@therr.com and we will handle it under the same timelines the law requires of a representative.

Information we collect

1. Information you give us

• Account information — email address, username, password (stored hashed, never in plain text), and account type (personal, creator, or business).
• Profile information — first and last name, display name, bio, profile photo, and the privacy and notification settings you choose.
• Phone number — used to verify your account, to enable passwordless sign-in, and to send invites you initiate. Phone verification is optional at sign-up and required only for phone-sensitive actions such as sending bulk invites.
• Date of birth or age confirmation — used to confirm you meet the minimum age for the Service.
• Content you create — Moments, Spaces, Events, Thoughts, comments and replies, messages, photos and videos, ratings, reviews, check-ins, reactions, bookmarks, and drafts.
• Business information — if you claim or create a Space, the business name, address, hours, menu, reservation and ordering links, and any campaign or promotion content you submit.
• Support and survey responses — messages you send us, feedback you submit, and any information you include.

2. Information collected with your permission on your device

Each of the following requires an operating-system permission that you grant, and that you can revoke at any time in your device settings. Revoking a permission disables the feature that depends on it but does not otherwise affect your account.

• Location (precise), in the foreground — used to show you nearby Moments, Spaces, Events, and people; to place content you post on the map; and to enable check-ins. Precise geolocation is treated as sensitive personal information under US state privacy laws and as a special category of risk under GDPR; we handle it accordingly and we never sell or share it.
• Location in the background — optional and off unless you turn it on. If you enable it, the app can detect when you come near a Space, Event, or Moment and send you a notification about it. This is the only purpose for which we use background location. You can turn it off at any time in your device settings or in the app's notification preferences, and the rest of the app continues to work.
• Camera and photo library — used only to capture or select the images and videos you choose to attach to content. We do not scan your photo library, and we do not access photos you have not selected.
• Phone contacts — optional. If you choose to invite friends from your contacts, the app reads your contact list on your device so you can pick who to invite. Names, phone numbers, and email addresses of the contacts you select are transmitted to us to send the invitation you requested and to suggest connections to you. We do not use your contacts to build advertising profiles, we do not sell them, and we do not contact the people in your list for any purpose other than delivering the invitation you asked us to send. You can ask us to delete uploaded contact data at any time by emailing info@therr.com.
  Before you invite someone: you are asking us to send that person a message on your behalf. Please only invite people who you reasonably believe want to hear from you.

3. Information collected automatically

• Device and technical data — IP address, device type and model, operating system and version, browser type and version, app version, language and locale, time zone, and mobile device identifiers.
• Usage data — pages and screens you view, features you use, content you interact with, reactions you give, search terms you enter, session duration and timestamps, referring URLs, and crash and diagnostic logs.
• Approximate location from IP address — used for security, fraud prevention, and to show region-appropriate content when precise location is unavailable.
• Cookies and similar technologies on our websites — see our Cookie Policy.

4. Information from third parties

• Sign-in providers — if you sign in with Google or Apple, we receive your name, email address, and a provider account identifier. We do not receive your password.
• Linked social accounts — if you connect Twitter/X or YouTube, we receive the profile and content data you authorize.
• Payment processors — we receive confirmation of a transaction, the last four digits of a card, and billing status. We never receive or store full payment card numbers.
• Invitations — if another user invites you, we may receive your email address or phone number from them in order to deliver the invitation.

What we do not collect

We do not collect biometric identifiers. We do not run facial recognition, face grouping, voiceprint, or fingerprint analysis on any content you upload. We do not collect government identification numbers, Social Security numbers, health or medical information, precise financial account numbers, or information about your race, ethnicity, religion, sexual orientation, or political affiliation. We do not buy personal information from data brokers.

How we use your information

We use personal information only for the purposes below. The GDPR legal basis for each purpose is shown in brackets for users in the EEA and UK.

• To provide the Service — create and maintain your account, authenticate you, show you nearby and relevant content, deliver messages, process check-ins, and sync your data across devices. [Performance of a contract]
• To operate location features — determine what content is near you and place your content on the map. [Performance of a contract; consent for device location access and for background location]
• To rank and personalize content — order your feed and recommend content and people. See Automated processing and ranking below. [Legitimate interests: providing a useful product; consent where required]
• To operate rewards and achievements — track XP, achievements, TherrCoin, leaderboards, referrals, and redemption requests. [Performance of a contract]
• To process payments and subscriptions — bill and service paid plans and in-app purchases, and keep records required by tax law. [Performance of a contract; legal obligation]
• To send you notifications and messages — service and security notices, activity notifications, and, where you have opted in, marketing emails and proximity notifications. You can adjust or turn off each category. [Performance of a contract; consent for marketing]
• To keep the Service safe — verify accounts, detect and prevent fraud, spam, abuse, and reward manipulation, moderate content, enforce our Community Guidelines, and investigate reports. [Legitimate interests: safety and integrity; legal obligation]
• To improve the Service — measure feature usage, diagnose crashes, run analytics in aggregate, and test improvements. [Legitimate interests: improving our product; consent for analytics cookies where required]
• To provide support — respond to your questions and requests. [Performance of a contract]
• To comply with law and protect rights — respond to lawful requests, enforce our terms, and establish or defend legal claims. [Legal obligation; legitimate interests]

If we ever want to use your personal information for a materially different purpose, we will update this policy and, where the law requires it, ask for your consent first.

We do not sell or share your personal information

We do not sell your personal information, and we have not sold it in the preceding 12 months. We do not share your personal information for cross-context behavioral advertising, and we have not done so in the preceding 12 months. This applies to all categories of personal information we collect, including precise geolocation and other sensitive personal information, and it applies to the personal information of users we know to be under 16.

We also do not use or disclose sensitive personal information for purposes other than those permitted under California Civil Code §1798.121(a) and its implementing regulations — that is, we use it only to provide the Service you requested, to keep the Service secure, and for the other operational purposes described in this policy.

Because we do not sell or share personal information, there is nothing for you to opt out of. We nonetheless honor browser-based opt-out preference signals, including Global Privacy Control (GPC), by disabling non-essential analytics cookies for that browser. You can review and change your cookie choices at any time from the "Cookie settings" link in our website footer, and you can read more on our Your Privacy Choices page.

Who we disclose information to

We disclose personal information only in the situations below. In every case involving a service provider, we have a written contract that limits them to processing the information for us and prohibits them from using it for their own purposes.

Other users, as you direct

Your username, profile photo, bio, and the content you post are visible to others according to the visibility settings you choose. Content you post publicly, and Space and Event pages, may be indexed by search engines and visible to people who do not have a Therr account. Direct messages are visible to the people in the conversation. Anything you post publicly should be treated as public.

Service providers

Provider	What they do for us	Their privacy policy
Google Analytics	Aggregate website and app usage analytics	policies.google.com/privacy
Google Firebase & Firebase Cloud Messaging	App analytics, crash reporting, push notification delivery	firebase.google.com/support/privacy
Google Maps Platform & Places	Maps, geocoding, and place information	policies.google.com/privacy
Stripe	Subscription and payment processing	stripe.com/privacy
Apple App Store / Google Play	In-app purchase processing	apple.com/legal/privacy · policies.google.com/privacy
ImageKit	Image and media storage and delivery (CDN)	imagekit.io/privacy-policy
Brevo	Email newsletter and transactional email delivery	brevo.com/legal/privacypolicy
Our SMS delivery provider	Sending verification codes and invitations you initiate	Named on request at info@therr.com
Cloud hosting and database providers	Running the Service infrastructure	Named on request at info@therr.com

We keep this list current. If you would like the complete, dated list of our subprocessors, email info@therr.com.

Businesses whose Spaces you interact with

If you check in at a Space, rate it, or redeem a promotion, the business that owns that Space may receive aggregate engagement metrics and, for a redemption, the limited information needed to honor the offer. Businesses do not receive your contact information, your location history, or your activity elsewhere on the Service.

Legal and safety disclosures

We may disclose information when we believe in good faith that it is necessary to comply with a law, regulation, subpoena, court order, or other valid legal process; to enforce our terms; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of Therr, our users, or the public. Where we are legally permitted to do so, we will make reasonable efforts to notify you before disclosing your information in response to a legal request.

Corporate transactions

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy, and the acquirer will remain bound by this policy for information collected before the transfer unless you agree otherwise.

With your consent

We will disclose your information for any other purpose only with your consent.

Automated processing and ranking

We use automated systems to order and recommend content. You should know how they work:

• What they use. Your approximate or precise distance from a piece of content, how recently it was posted, how many people have reacted to or replied to it, and which content categories you have engaged with previously.
• What they do not use. We do not rank content based on paid placement in your organic feed, and we do not build advertising profiles about you or sell profile data. Promoted content from businesses is labeled as such.
• Your controls. You can opt out of leaderboards in your settings, turn off the mature-content filter, adjust notification categories, and turn off location permissions. Reactions are the main signal we use for personalization, so choosing not to react limits personalization.
• No consequential automated decisions. We do not use solely automated processing to make decisions that produce legal effects concerning you or similarly significantly affect you — for example, we do not automate decisions about credit, employment, housing, insurance, education, or access to essential services. Account suspensions and content removals that materially affect your account are reviewed by a person, and you may appeal them as described in our Community Guidelines.

How long we keep information

Category	Retention
Account and profile data (name, email, profile information)	For the life of your account. If you delete your account, purged within 30 days except where the law requires retention.
Content you post (Moments, Spaces, Events, Thoughts, media)	Until you delete it or delete your account, then purged within 30 days. Copies other users saved or shared may persist.
Location data (foreground and background)	Up to 30 days for proximity features, then aggregated or deleted.
Uploaded phone contacts	Up to 90 days from upload, or until you ask us to delete them, whichever is sooner.
Usage and analytics data (device info, interaction logs)	Up to 24 months for service improvement and security analysis.
Transaction and payment records	Up to 7 years, to comply with financial and tax regulations.
Rewards ledger (TherrCoin, XP, redemptions)	Up to 7 years, for anti-fraud and tax recordkeeping.
Communications and support records	Up to 3 years after your last interaction with support.
Trust-and-safety records (reports, enforcement actions)	Up to 3 years, so we can act on repeat behavior.
Server and security logs	Up to 12 months.

We may keep information longer where we must do so to comply with a legal obligation, resolve a dispute, or establish or defend a legal claim. When a retention period ends, we delete the information or irreversibly aggregate it so it no longer identifies you.

How we protect information

We use safeguards appropriate to the sensitivity of the information, including: encryption of data in transit using TLS; encryption of sensitive data at rest; password hashing with a modern algorithm; encrypted local storage for credentials and tokens on mobile devices; role-based access controls limiting employee access to what their job requires; separate read and write database credentials per service; multi-factor authentication on administrative accounts; logging and monitoring of access to production systems; and contractual security commitments from our service providers.

No system is perfectly secure. If we become aware of a breach of security affecting your personal information, we will notify you and the applicable regulators as required by law and without undue delay. Please help us by using a strong, unique password and enabling every verification option available on your account.

International transfers

We are based in the United States, and we store and process personal information there. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws differ from those in your country.

For transfers of personal information out of the EEA, the UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with supplementary technical and organizational measures. You may request a copy of the relevant transfer mechanism by emailing info@therr.com. For transfers of personal information outside Québec, we conduct a privacy impact assessment before the transfer as Law 25 requires.

Your rights and choices

Available to everyone, everywhere

• Access and correct most of your information directly in the app under Settings → Profile.
• Delete your account and data from inside the app, or at therr.com/delete-account, or by emailing info@therr.com. We will confirm your identity, then delete your account and purge associated personal information within 30 days, except where retention is legally required. Deleting your account forfeits any unredeemed TherrCoin balance — see the Rewards Program Terms.
• Control notifications per category in the app, and unsubscribe from marketing email using the link in any marketing message or at therr.com/emails/preferences.
• Control device permissions — location, background location, camera, photos, and contacts — in your device settings at any time.
• Request a copy of your data in a portable, machine-readable format by emailing info@therr.com.

We do not charge for exercising a privacy right, and we will never discriminate against you for doing so — we will not deny you the Service, charge you a different price, or give you a lower quality of service because you exercised a right.

If you are in the EEA, the UK, or Switzerland (GDPR)

You have the right to: request access to your personal data; request rectification of inaccurate or incomplete data; request erasure; request restriction of processing; object to processing based on our legitimate interests, and object at any time to processing for direct marketing; request data portability; withdraw consent at any time, without affecting processing already carried out; and not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.

To exercise any of these rights, email info@therr.com. We will respond within one month and may extend that by two further months for complex requests, telling you why. You also have the right to lodge a complaint with your local supervisory authority; a list of EEA authorities is published by the European Data Protection Board, and UK users may contact the Information Commissioner's Office.

If you are in a US state with a privacy law

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia — and of any other state whose comprehensive privacy law takes effect after the date of this policy — have some or all of the following rights, depending on their state:

• To know what categories of personal information we collect, the sources, our purposes, the categories of third parties we disclose it to, and the specific pieces of personal information we hold about you.
• To correct inaccurate personal information.
• To delete personal information we hold about you, subject to legal exceptions.
• To obtain a portable copy of your personal information.
• To opt out of the sale of personal information, of sharing for targeted or cross-context behavioral advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in any of these activities, so there is nothing to opt out of — but the right is yours if that ever changes, and we will tell you before it does.
• To limit our use of sensitive personal information. We already limit our use of sensitive personal information, including precise geolocation, to providing and securing the Service.
• To appeal a decision we make about your request. If we deny a request, our response will tell you how to appeal. Reply to that response, or email info@therr.com with "Privacy Appeal" in the subject line, and a different reviewer will respond within 45 days (60 days in some states). If we deny your appeal, you may contact your state Attorney General.
• Not to be discriminated or retaliated against for exercising any of these rights.

How to submit a request. Email info@therr.com with "Privacy Request" in the subject line, tell us which right you are exercising, and include the email address or phone number on your Therr account. We will verify your identity — for a request about specific pieces of personal information we may ask you to confirm details only the account holder would know — and respond within 45 days, extendable once by another 45 days with notice to you. Disclosures cover the 12 months before your request.

Authorized agents. You may use an authorized agent to submit a request. We will ask the agent for written proof of your permission and may ask you to verify your identity with us directly. In California, an agent registered with the Secretary of State may act on your behalf.

California Shine the Light. Under California Civil Code §1798.83, California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

California minors. Under California Business & Professions Code §22581, California residents under 18 who are registered users may request removal of content they posted publicly. Email info@therr.com from the address on your account. Removal may not be complete or comprehensive — for example, where the law does not require removal, or where other users have already copied the content.

Categories of personal information we collect, using the category names in the California Consumer Privacy Act: identifiers (collected); personal information listed in the California Customer Records statute, Cal. Civ. Code §1798.80(e) (collected — name, phone, and billing status only; we do not collect account numbers, government IDs, or health information); commercial information (collected); internet or other network activity (collected); precise geolocation, which is sensitive personal information (collected with your permission); audio, electronic, or visual information, i.e. the photos and videos you upload (collected with your permission); inferences drawn to personalize content (collected); protected classification characteristics (not collected); biometric information (not collected); professional or employment information (not collected except from job applicants, who receive a separate notice); non-public education information (not collected). We collect these from you directly, automatically from your device as you use the Service, and from the third-party sources listed above. We disclose them for business purposes only, to the service providers and in the situations described in this policy. We do not sell any category of personal information and we do not share any category for cross-context behavioral advertising.

If you are in Québec

In addition to the rights above, you may request that we cease disseminating personal information or de-index a link where dissemination contravenes the law or a court order, and you may request information about how a decision was reached where it was based exclusively on automated processing. You may also file a complaint with the Commission d'accès à l'information du Québec.

Children's privacy

The Service is not intended for or directed to children under 13 (or under 16 in the EEA, the UK, and any other jurisdiction that sets a higher age of digital consent). You must be at least 13 years old — and old enough to consent to the processing of your personal information where you live — to create an account.

We do not knowingly collect personal information from children under 13. We ask for age confirmation at registration and we do not design, market, or promote the Service to children. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete the account and the information promptly.

If you are a parent or guardian and believe your child under 13 has created an account or provided us with personal information, email info@therr.com with the account's username or email address and we will investigate and delete it. You may also request access to, correction of, or deletion of your child's information, and ask us to stop any further collection.

Some features — including location sharing, direct messaging, contact invitations, rewards redemption, and paid plans — are restricted to users 18 and over, or require a parent's or guardian's consent where local law requires it.

Reporting child sexual abuse and exploitation: we prohibit it absolutely, we report it to the National Center for Missing & Exploited Children and to law enforcement, and you can report it to us immediately at therr.com/child-safety.

Cookies and tracking

Our websites use cookies and similar technologies. Strictly necessary cookies are always on. Analytics cookies load only after you consent, and we honor the Global Privacy Control signal. You can change your choices at any time from the "Cookie settings" link in our footer. For the full detail — what each cookie does and how long it lasts — see our Cookie Policy.

Do Not Track. There is still no common industry standard for how to respond to browser Do Not Track signals, so our websites do not respond to them. We do respond to Global Privacy Control, which is a recognized opt-out preference signal.

We do not serve third-party interest-based advertising on our websites or in the app, and we do not permit third parties to collect personal information through the Service for their own advertising purposes.

Links to other sites

The Service contains links to websites and apps we do not operate, including business websites, menu and reservation links, and content other users post. We are not responsible for their content or privacy practices. Review their privacy policies before giving them information.

Changes to this policy

We may update this policy. When we do, we will change the "Last updated" date above and post the new version here. If a change materially reduces your privacy rights or materially expands how we use information you have already given us, we will give you at least 30 days' advance notice by email or through a prominent in-app notice before it takes effect, and — where the law requires it — we will ask for your consent. We keep prior versions available on request at info@therr.com.

Contact us

Questions, requests, or complaints about privacy:

• Email: info@therr.com
• Mail: Therr, Inc., Attn: Privacy, 8 The Green STE B, Dover, DE, 19901, United States

We take complaints seriously. If you are not satisfied with our response, you may contact your data protection authority or state Attorney General, as described above.