PrivacyPolicy

1. Who We Are

Cap-it is a mobile social storytelling application and the website at cap-it.app. For the purposes of applicable data protection law — including the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA) — the data controller is:

If you have questions about this policy, your data, or your rights, contact us at privacy@cap-it.app.

2. Information We Collect

2.1 Information you provide directly

• Account information: name, username, email address, phone number (if provided), date of birth, gender.
• Authentication data: hashed passwords and authentication tokens from Firebase Authentication (email, Google, Apple, or phone sign-in).
• Profile content: profile photo, banner image, bio, custom family names.
• User-generated content: moments (photos, videos, text), storybooks, chat messages, voice notes, comments, and reactions you create in the app.
• Support communications: messages you send to our support team.

2.2 Information collected automatically

• Device information: device model, operating system version, and unique push notification token (Firebase Cloud Messaging).
• Usage data: timestamps of activity, last-seen information, and app-level interaction events used for feature functionality.
• Diagnostic data: crash logs and error reports when the app encounters a problem.

2.3 Information we do NOT collect

• We do not collect precise location data unless you explicitly attach it to a moment.
• We do not use advertising identifiers or track you across other apps or websites.
• We do not sell or share your personal information as defined by the CCPA/CPRA.

3. Legal Bases for Processing

Where the GDPR applies, we rely on the following lawful bases under Article 6 for each processing activity:

• Performance of a contract (Art. 6(1)(b)): creating and managing your account, storing your moments and storybooks, delivering chat and calling features, and providing the core service you signed up for.
• Consent (Art. 6(1)(a)): push notifications, optional profile enhancements, and any marketing communications. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, abuse detection, platform security, and improving the service through aggregated usage analysis. We balance these interests against your rights and freedoms.
• Legal obligation (Art. 6(1)(c)): retaining records where required by applicable law, responding to lawful requests from authorities.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Cap-it service.
• Authenticate you and secure your account.
• Deliver push notifications you have opted into.
• Enable chat, calling, and real-time collaboration features.
• Enforce our Terms of Service and prevent abuse.
• Respond to support requests and comply with legal obligations.

5. Third-Party Services & International Transfers

Cap-it relies on the following third-party providers. Each processes data under their own privacy policies, and each is bound by data processing agreements that include the European Commission's Standard Contractual Clauses (SCCs) where applicable:

• Firebase (Google LLC, United States): authentication, phone verification, and push notification delivery. Firebase Privacy
• Apple Inc. (United States): Sign in with Apple.
• Google LLC (United States): Sign in with Google.
• Cloudflare, Inc. (United States): HTTPS termination and content delivery.
• Oracle Cloud Infrastructure (United States): self-hosted backend infrastructure running MongoDB, Node.js, and Socket.IO. Media and user data are stored on servers we operate.

5.1 International Data Transfers

Your personal data may be transferred to and processed in the United States and other countries where our service providers operate. Where data originating in the European Economic Area (EEA), the United Kingdom, or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs) — and where applicable, the UK International Data Transfer Addendum — as the legal mechanism for the transfer. You can request a copy of the relevant safeguards by contacting us at .privacy@cap-it.app.

6. Data Retention

We retain your personal information for as long as your account is active. When you delete your account, we permanently erase your profile, moments, storybooks, messages, and associated media from our servers within 30 days, except where retention is required by law.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access: the personal data we hold about you.
• Correct: inaccurate information through your in-app profile.
• Delete: your account and associated data at any time via Profile → Settings → Delete Account.
• Export: your content by requesting a data export through support@cap-it.app.
• Object: to certain processing activities.
• Withdraw consent: at any time for processing based on consent, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint: with your local data protection supervisory authority.

California residents (CCPA/CPRA): You have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as defined by the CCPA. To exercise any of these rights, contact . We will respond within 45 days. You will not be discriminated against for exercising your privacy rights.privacy@cap-it.app.

EU/UK residents (GDPR): You have the rights listed above under Articles 15–22 of the GDPR. To exercise any of them, contact . You also have the right to lodge a complaint with your national data protection authority.privacy@cap-it.app.

8. Security

We encrypt all data in transit using HTTPS/TLS. Passwords are hashed and never stored in plaintext. Access to production infrastructure is strictly limited and audited. Media files are stored on servers we operate and served through encrypted connections. While no system is perfectly secure, we take reasonable and industry-standard measures to protect your information.

9. Children's Privacy

Cap-it is not intended for children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. During signup, we ask for your date of birth and block registration for users below the minimum age. If we learn we have inadvertently collected data from a child, we will delete it promptly.

10. Languages

Cap-it is available in five languages: English, Spanish, French, Arabic, and Hindi. This Privacy Policy is provided in English as the authoritative version. Where translations are made available for convenience, the English version controls in the event of any conflict.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification or email at least 14 days before they take effect. Continued use of Cap-it after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

Questions about this policy or your data? Reach us at or through the Support page in the app.privacy@cap-it.app.