Privacy policy

The data controller responsible for your personal information is:

• Thresh
• Inquiries & data protection requests: privacy@jointhresh.com
• Master administrative oversight: privacy@jointhresh.com

1. Threshold-Gated Access: Event details, attendee rosters, group chats, door passes and media capsules are strictly restricted to users who have locked into the event or received host authorization.
2. Secret Location Protection: Sensitive venue addresses and private access instructions remain encrypted and redacted until an event achieves its minimum headcount threshold. If dropouts take attendance below threshold, private venue details are dynamically re-locked.
3. Zero Raw Contact Book Uploads: When you sync contacts to find friends, your phone converts phone numbers into irreversible, salted cryptographic hashes (SHA-256) locally on your device. Only hashes are matched against our database; non-matching contacts are discarded immediately and never stored.
4. Calendar Obfuscation: The Overlap availability engine identifies mutual free time windows without ever reading, ingesting or storing the titles, descriptions, participants or locations of your external calendar events.
5. Sealed Memory Capsules: Shared event photo and video recaps are accessible exclusively to locked-in attendees and automatically seal 96 hours (4 days) after the event ends, transitioning into an immutable archive.

A. Information you provide directly

• Account credentials & profile: your email address, chosen @handle (unique username), display name, password hash, profile avatar and optional bio.
• Badges & account identity: Thresh OG Founding Member status (limited to the first 1,000 registered accounts) and Vibe Scores calculated from event attendance reliability.
• Event data: event titles, planned dates, start/end times, vibe categories, headcount thresholds (minimum attendance targets), capacity caps, dress codes and event announcements.
• Direct & group communications: messages, voice notes, stickers and reactions exchanged within RSVP-gated event chats.
• User-generated content (recaps & memories): photos, video snippets (up to 90 seconds, 720p), captions and poll responses uploaded to active events or the 4-Day Memory Capsule.
• Identity & verification data: mobile phone numbers submitted during one-time web RSVP verification codes or SMS notification onboarding.

B. Information collected automatically

• Device & telemetry: operating system version, device model, IP address, device locale, time zone, push notification tokens (APNs / FCM) and session tokens.
• Event check-in & access data: scan timestamps and door-pass authentications using dynamic rotating QR codes (10-minute refresh cycle) or Web NFC passes.
• Payment & transaction metadata: when you participate in Deposit & Hold splits or ticketed entries, payment tokens, transaction status, share allocations and refund states are recorded via Stripe. We do not collect, process or store raw credit or debit card numbers on Thresh servers.
• Moderation & safety logs: reports submitted regarding objectionable content, harassment or rule violations, along with associated incident audit trails.

C. Information we explicitly do not collect

• Continuous real-time GPS tracking: we never track your passive background geolocation. Arrival estimates are computed on-device or presented as approximate minutes-away ranges during an active event arrival window.
• Biometric & face data: camera colour filters run strictly on your device. Thresh does not scan faces or collect facial landmark data.
• Unrelated calendar content: we do not read personal notes, meeting links or meeting titles from your device calendar.

1. Performance of a contract (Article 6(1)(b)): to create and manage your account, enforce threshold logic, process invitations, gate chat and venue access, manage payments and generate door passes.
2. Legitimate interests (Article 6(1)(f)): to detect and prevent fraud, enforce platform rules, manage anti-passback QR security, verify attendance reliability (Vibe Scores), maintain infrastructure and resolve technical bugs.
3. Consent (Article 6(1)(a)): for optional device permissions including camera, microphone, photo library access, push notifications and on-device contact matching. You may revoke consent at any time via device settings.
4. Legal obligation (Article 6(1)(c)): for accounting, statutory tax records (transaction ledgers), anti-money laundering (AML) compliance and responding to lawful government or law enforcement requests.

• Stories & flash updates: 24 hours, then hard purged from active storage.
• Ephemeral chat media & voice notes: 120 days, then permanently deleted from storage.
• Live arrival ETA broadcasts: Duration of the arrival window (max 4 hours); deleted immediately upon event start.
• 4-Day Memory Capsule (photos/videos): 96-hour open upload window after the event, then sealed permanently and locked to verified attendees only.
• Door host offline cached rosters: 4 hours pre-event through 24 hours post-event; the cryptographic cache key expires and the copy is wiped from the host device.
• Dynamic QR codes: 10 minutes, then rotated and invalidated automatically.
• Deleted accounts (pending purge): 30-day grace period. Reversible upon login; de-indexed immediately from search.
• Deleted accounts (permanent purge): After 30 days: irreversible hard purge — PII destroyed, chat pseudonymised to “Deleted User”, media erased.
• Payment & financial ledgers: Up to 7 years (statutory tax requirement), retained in anonymised format stripped of profile identifiers.

We share data only with verified subprocessors strictly necessary to operate Thresh. All subprocessors are bound by Data Processing Agreements (DPAs):

• Lovable Cloud / Supabase / AWS: Cloud hosting, relational database, user authentication and secure media storage.
• Stripe: Payment processing, split payments, card pre-authorisations and payout disbursements (PCI-DSS Level 1 compliant).
• APNs & Firebase Cloud Messaging: Transactional push notifications, lock-in alerts and door pass updates.
• Twilio / Infobip (SMS gateway): SMS delivery of one-time verification passcodes and urgent At-Risk event replacement broadcasts.
• Google Maps API: Geocoding, map rendering and venue address resolution (subject to Google's Privacy Policy).
• GIPHY: In-chat animated sticker and GIF search (loads directly from GIPHY without account linkage).

We do not sell, rent or trade your personal data to data brokers, ad networks or third-party marketers.

• Exact-handle lookup: by default, users cannot browse a public member directory. Users can only discover you if they know your exact @handle or scan your personal Thresh QR code.
• Contact sync matching: contact matching is strictly opt-in. Phone numbers are hashed locally with a SHA-256 algorithm before querying our server.
• Profile privacy toggle: you can set your profile to “Restricted”, ensuring strangers and non-mutual contacts cannot inspect past attendance stats, mutual friends or upcoming public plans.
• Blocked users: two-way silent blocking prevents blocked users from seeing your profile, viewing your events, appearing in shared group chats or receiving mutual event invitations.

Thresh provides a self-serve, in-app account deletion mechanism under Settings → Privacy → Delete Account:

1. Immediate de-indexing: your profile, handle and avatar are immediately hidden from search, friend lists and upcoming plans.
2. Primary host blocking rule: if you are the active primary host of an upcoming event, you must cancel the event or transfer ownership (“pass the torch”) before deleting your account to protect committed guests.
3. 30-day recovery window: you may log in within 30 days to cancel deletion.
4. Hard purge execution (after 30 days):
   • Profile data, hashed phone numbers and notification tokens are completely destroyed.
   • All media uploaded by you to 4-Day Memory Capsules is deleted from cloud storage, and attendee tags are stripped.
   • Your historical chat messages are irreversibly pseudonymised to display as “Deleted User”.
   • Your username (@handle) is held in quarantine for 30 days before release.
   • Your permanent Thresh OG number (if applicable) is retired and never re-issued to another member.
   • Financial transactions are retained in anonymised format solely for tax, anti-fraud and compliance auditing.

Under UK/EU GDPR and applicable privacy legislation (including CCPA/CPRA), you have the right to:

• Access (subject access request): request a machine-readable export of all personal data held about you.
• Rectification: update or correct inaccurate or incomplete profile data directly in the app.
• Erasure (“right to be forgotten”): request immediate or scheduled deletion of your personal data.
• Restriction & objection: object to processing based on legitimate interests or request restrictions on data processing.
• Data portability: request transfer of your data to another service provider.
• Lodge a complaint: you have the right to lodge a complaint with your supervisory authority (in the UK, the Information Commissioner's Office at ico.org.uk).

To exercise any right, email privacy@jointhresh.com from your verified account email address. Requests are processed free of charge within 30 days.

Questions about your data? Email privacy@jointhresh.com.