Privacy Policy

• Who we are
• Data we collect
• How and why we use it
• What other users can see
• Service providers
• AI-generated suggestions
• Advertising
• In-app purchases
• Moderation and safety
• International transfers
• How long we keep data
• Deleting your account
• Your rights
• Children
• Security
• Changes and contact

1. Who we are

The Red Thread (the “app”) is operated by Stella Darroux and Lara Aranginu, 86 Claude Road, E130QG, London (“we”, “us”). We are the data controller for the personal data described in this policy.

For any question or request about your data, write to threredthreadapp@gmail.com.

This policy covers the mobile app on Android and iOS. Our website uses cookies as described in our Cookie Policy.

2. Data we collect

Account and profile

• Your name, username and email address.
• How you sign in: email and password (your password is stored by Firebase Authentication in hashed form — we never see it), Google, or Sign in with Apple. With Apple, you can hide your real email address; we then receive a relay address.
• Your profile photo, if you add one.

Your social connections

• Friends, friend requests you send and receive, and users you block.
• The journeys, challenges and watchlists you belong to or are invited to.

Content you create

• Journeys and their activities, memories (photos and text), watchlists and the films you add.
• Quest completions, including the proof photos you take, the likes you give, and the reports you submit.
• Before any photo leaves your phone, the app removes its embedded metadata (EXIF), including the GPS position where it was taken.

Game and purchase data

• Your coin balance, experience points, boosts, rewards and rankings in challenges.
• Records of in-app purchases (product, purchase reference, date). We never receive your card or bank details.

Location — only if you allow it

• Spark: when you ask for ideas without typing a place, the app uses your device's precise location for that request, to suggest things to do nearby. It is sent to our server and to Google (Maps and Gemini) to produce the suggestion, and is not saved to your profile.
• Quests: the app turns your location into your town and country only, so that weekly quests fit where you are. Your exact position is not stored.
• When you save an activity or a place, its name, address and map position are stored with that activity.

Device and technical data

• A push notification token, so we can send you notifications.
• App integrity signals from Google Play Integrity (Android) and Apple DeviceCheck (iOS), used to confirm requests come from a genuine copy of the app.
• Your advertising identifier, used by our advertising partner as described in section 7.
• Your language setting, and technical server logs (your user ID, the time of a request, errors).

What we do not collect

• We do not use third-party analytics or crash-reporting tools in the app.
• We do not access your contacts, microphone or calendar. “Add to calendar” simply opens your calendar app or Google Calendar with the event details, and you choose whether to save it.

3. How and why we use your data

• To provide the app — your account, friends, journeys, memories, watchlists, challenges, quests, coins and notifications. Legal basis: performance of our contract with you (our Terms of Service).
• To suggest activities and generate quests, including with AI (section 6). Legal basis: performance of our contract.
• To use your location for nearby suggestions and local quests. Legal basis: your consent, given through your device's location permission, which you can withdraw at any time in your device settings.
• To keep the community safe — reports, blocking, suspension of accounts that post harmful content, and preventing cheating in challenges. Legal basis: our legitimate interest in a safe and fair service.
• To protect the service — app integrity checks, fraud prevention, verifying purchases, and security logs. Legal basis: our legitimate interest in preventing abuse and fraud.
• To show rewarded ads when you choose to watch one (section 7). Legal basis: your consent where the law requires it for personalised ads; otherwise our legitimate interest in funding a free app.
• To keep records required by law, for example for purchases. Legal basis: legal obligation.
• To answer you when you contact us.

We do not sell your personal data, and we do not send marketing emails.

4. What other users can see

• Your name, username and profile photo are visible to other users of the app, for example in leaderboards, challenges and friend lists.
• Your quest proof photos are visible to the members of the challenge they belong to, and to your accepted friends.
• Memories and activities in a journey are visible to that journey's members; a watchlist is visible to its members.
• Your friends list and the users you block are private. We never tell someone that you blocked or reported them.

Anything you share with other people can be seen, and saved, by them. Please only share what you are comfortable sharing.

5. Service providers

We rely on the following companies to run the app. They process data on our behalf and only for the purposes below, unless stated otherwise.

• Google Firebase and Google Cloud — account sign-in, database, photo storage, server functions, push notifications and app integrity checks. All data in section 2 is stored there.
• Google Maps Platform — maps, place search and place details, and turning a location into a town name. Receives the place searches and locations involved in those requests.
• Google Gemini API — generating Spark ideas and quests (section 6).
• Google AdMob — rewarded video ads (section 7).
• Google Play and Apple App Store — processing in-app purchases, which they handle under their own privacy policies.
• Google Sign-In and Sign in with Apple — if you choose them to sign in.
• The Movie Database (TMDB) — film information for watchlists. Your searches go through our server, so TMDB does not receive your identity.

You can read Google's privacy policy at policies.google.com/privacy and Apple's at apple.com/legal/privacy.

We may also disclose data if the law requires it, or to protect the rights and safety of our users.

6. AI-generated suggestions

Spark ideas and weekly quests are written by Google's Gemini AI. To generate them, our server sends Gemini the information needed for the request: the place and mood you enter (or your location, section 2), your language, and for quests your town and country. We do not send your name, email or photos.

We do not store what is sent to Gemini. We store the suggestions and quests it produces, so they appear in the app. AI suggestions are creative ideas, not professional advice: always use your judgement and follow local laws and safety rules.

7. Advertising

The app shows rewarded video ads from Google AdMob, only when you choose to watch one in exchange for a reward. AdMob may collect your device's advertising identifier and information about your device and the ad, to show, measure and — where allowed — personalise ads. Google acts as an independent controller for personalised advertising.

• European Economic Area, United Kingdom and Switzerland: personalised ads are shown only if you agree in the consent message displayed in the app. You can change your choice at any time from the app's settings.
• iOS: the app asks your permission before accessing your advertising identifier (App Tracking Transparency). You can change this in Settings › Privacy & Security › Tracking.
• Android: you can reset or delete your advertising ID in your device settings (Settings › Google › Ads, or Settings › Privacy › Ads).

8. In-app purchases

Coin packs and other in-app products are sold through Google Play or the Apple App Store, which process your payment. We receive a purchase confirmation, which our server verifies with Google or Apple before crediting your account, so that the same purchase cannot be used twice.

9. Moderation and safety

You can block any user and report content you find shocking or inappropriate. Reports are confidential: the reported person is never told who reported them.

Automatic suspension: when three different users report an account for sensitive content, the account is automatically suspended to protect the community. This is a decision taken by an automated system. If your account is suspended and you believe it is a mistake, write to threredthreadapp@gmail.com: a person will review your case, and you can explain your point of view.

10. International transfers

Our data is hosted by Google on servers located in the United States. When your data is transferred outside the European Economic Area, the United Kingdom or Switzerland, it is protected by the safeguards provided in Google's data processing terms, including the European Commission's Standard Contractual Clauses.

11. How long we keep data

• Your account and content: for as long as your account exists. When you delete your account, they are deleted as described in section 12.
• Server logs: up to 30 days.
• Purchase records: kept after account deletion, without your user ID, for as long as needed to prevent fraud and to meet legal and accounting obligations.
• Reports you submitted: kept after account deletion so that moderation decisions remain reliable; the reported person is still never told who reported them.
• Emails you send us: for as long as needed to handle your request, and no more than 3 years after our last exchange.

12. Deleting your account

In the app: go to Profile › Settings › Account › Danger Zone › Delete Account and confirm. Deletion starts immediately.

Without the app: send an email to threredthreadapp@gmail.com from the email address linked to your account, with the subject “Delete my account”. We will delete your account within 30 days and confirm by email. If you signed in with Apple using a hidden email address, tell us so and we will help you identify your account.

What is deleted:

• your profile, profile photo, username and sign-in account;
• your friends, friend requests and block list, on both sides;
• your quest completions and proof photos, and the memory photos you uploaded;
• your coins, experience points, boosts, rewards and transaction history;
• your membership of journeys, challenges and watchlists. A space whose last member you were is deleted; otherwise it stays with the other members, and ownership passes to one of them.

What is kept: anonymised purchase records and reports you submitted (section 11), content that other members created in shared spaces, and server logs for up to 30 days. Google Play and Apple keep their own records of your purchases under their policies.

13. Your rights

Depending on where you live — and in any case if you are in the European Economic Area, the United Kingdom or Switzerland — you have the right to:

• access your data and receive a copy of it;
• correct it (you can edit your profile directly in the app);
• delete it (section 12);
• restrict or object to its use, in particular when we rely on our legitimate interests;
• receive your data in a portable format;
• withdraw your consent at any time — for location, notifications and tracking through your device settings, and for personalised ads through the consent settings in the app — without affecting what was done before;
• ask for human review of an automatic suspension (section 9).

To exercise these rights, write to threredthreadapp@gmail.com from the email address linked to your account. We answer within one month. You can also lodge a complaint with your local data protection authority — for example the CNIL in France or the ICO in the United Kingdom.

14. Children

The Red Thread is not intended for children. You must be at least 13 years old to use it, or older if the law of your country requires it to use such a service without parental consent (for example 15 in France or 16 in Germany). We do not knowingly collect data from children below that age; if you believe a child has created an account, contact us and we will delete it.

15. Security

Data is encrypted in transit and at rest by Google. Access to your data is restricted by strict rules on our servers, so that other users can only see what section 4 describes. Requests to our server must come from a genuine copy of the app, purchases are verified with Google or Apple, and location metadata is removed from photos before upload. No system is completely secure, but we work to protect your data and review our security settings regularly.

16. Changes and contact

We may update this policy, for example when we add a feature. We will change the date at the top of this page, and tell you in the app before any significant change takes effect.

Questions, requests or complaints: threredthreadapp@gmail.com