Subplot privacy policy

Subplot gives you one small daily quest and one weekly quest, tracks what you complete, and lets you share that with friend groups you choose to join. To do that we store your account details and your activity. We do not use analytics, we do not advertise, we do not track you across other apps or websites, and we do not sell or share your personal information.

You can delete your account and everything in it at any time, from Settings → Danger zone in the app or by writing to us. See how to delete your account.

Questions? Email [email protected].

Information you give us. When you create an account and use Subplot we collect your name or display name, your email address, your username, and — if you sign up with email rather than Apple or Google — your password. We also store the quests assigned to you, which you completed or skipped, the experience points, streaks and badges derived from them, the groups you belong to, any photos you upload, and any reports or blocks you submit.

Sign-in providers. You can register using your Apple or Google account. If you do, we receive profile information from that provider — typically your name and email address, and with Google your profile picture. We do not receive contact lists or friend lists. See section 5.

Sensitive information. We do not process sensitive personal information.

Device access. Subplot asks permission to use your camera and photo library, so you can attach a photo to a completed quest, and to send you push notifications. You can change or revoke any of these in your device settings. Subplot does not request access to your location, calendar, reminders, contacts, or microphone.

Device data. We collect the device identifiers needed to deliver push notifications, along with your device model, operating system and app version, your time zone, and the IP address recorded in our server logs. This is used to operate and secure the app and to troubleshoot problems. It is not used for analytics, profiling or advertising.

Google APIs. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• To create your account, sign you in, and keep the account working.
• To deliver the app: assign quests, record completions, compute XP, streaks and badges.
• To operate groups and let members of a group see each other’s shared activity.
• To send you push notifications and service email you have not turned off.
• To send administrative messages, such as changes to our terms or this policy.
• To keep Subplot safe: reviewing reports, enforcing our terms, preventing fraud and abuse.
• To comply with legal obligations and to establish or defend legal claims.

We do not process your information to build advertising profiles, to measure marketing campaigns, or for behavioural analytics.

If you are in Canada, we process your information with your express or implied consent, which you can withdraw at any time. In limited cases the law permits processing without consent — for example to investigate a breach of an agreement, to detect fraud, to comply with a subpoena or court order, or where collection is clearly in an individual’s interest and consent cannot be obtained in time.

If you are in the United States, we process your information to provide the service you have asked for and for the purposes described in section 2.

Other members of your groups. Activity you share into a group is visible to that group’s members. See section 12 for exactly what they can see. Subplot has no public feed and no public profiles — nothing you post is visible to the internet at large.

Service providers. We share information with the third-party providers who run our infrastructure — cloud hosting, database and file storage, push notification delivery, and transactional email — each under a written contract that limits them to processing on our instructions.

Business transfers. We may share or transfer your information in connection with a merger, financing, acquisition, or sale of all or part of our business.

Legal reasons. We may disclose information where required by law, or where necessary to protect the rights, safety or property of our users, the public, or us.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Subplot lets you register and sign in with your Apple or Google account. If you do, that provider sends us profile information — generally your name and email address, and with Google your profile picture. If you use Apple’s private email relay, we only ever see the relay address.

We use what we receive only for the purposes described in this policy. We do not control how Apple or Google handle your information on their side; review their privacy policies to understand that and to change your settings with them.

We keep your personal information only as long as you have an account with us, unless a longer period is required or permitted by law. When there is no ongoing need to process it, we delete or anonymise it — or, where that is not immediately possible because it sits in a backup archive, we isolate it from further processing until deletion is possible.

We use appropriate technical and organisational measures to protect your personal information. No transmission over the internet or method of storage is completely secure, so we cannot guarantee that an unauthorised party will never defeat our security. Transmission to and from the app is at your own risk.

Everyone. You can review and change your account information in the app at any time, and you can delete your account and its data from Settings → Danger zone.

If you are in Canada, you have rights of access, correction and withdrawal of consent, and may complain to the Office of the Privacy Commissioner of Canada.

If you are in a US state with a privacy law — California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia — you have the right to know whether we process your personal data, to access it, to correct inaccuracies, to obtain a copy, to request deletion, and not to be discriminated against for exercising those rights. Because we do not sell personal data, share it for targeted advertising, or use it for profiling, there is nothing to opt out of. You may designate an authorised agent to make a request on your behalf; we may ask for proof of that authorisation.

How to exercise any of these rights. Visit https://sunwavehq.com/delete-account/ or email [email protected]. We verify that a request comes from the account holder before acting on it, and we respond within thirty days. There is no charge. If we decline a request, we will tell you why, and where a US state law gives you a right of appeal you can appeal by replying to that email; if an appeal is denied you may complain to your state attorney general.

No uniform standard for recognising Do-Not-Track signals has been finalised, so we do not currently respond to them. California law requires us to say so explicitly. Since Subplot does not track you across other apps or websites in the first place, there is nothing for such a signal to switch off. If a standard is adopted that we must follow, we will say so in a revised version of this policy.

Under several US state privacy laws we must say which statutory categories of personal information we have collected in the past twelve months. We collect:

• Identifiers — your name or display name, username, email address, account identifier, device identifier, and IP address.
• Audio, electronic, visual or similar information — photos you choose to upload to a quest completion or a group feed.
• Internet or network activity — limited to your interactions with the app itself, such as which quests you completed or skipped. Not browsing history, search history, or interactions with other websites.

We do not collect: protected classification characteristics such as race, age or gender; commercial or payment information; biometric information; precise geolocation; professional or employment information; education records; inferences or profiles drawn about you; or sensitive personal information as those laws define it.

We have not disclosed, sold, or shared personal information to third parties for a business or commercial purpose in the preceding twelve months, other than to the service providers described in section 4, and we will not sell or share it in the future.

California “Shine The Light”. California residents may request once a year, free of charge, information about personal information we disclosed to third parties for their direct marketing purposes. We disclose none. Write to us at [email protected].

Your personal information is stored and processed on servers located in the United States by third-party cloud infrastructure providers acting on our behalf under contract. Subplot is offered only in the United States and Canada. If you use Subplot from Canada, your information is transferred to and stored in the United States, where it may be accessible to United States courts, law enforcement and national security authorities under the laws of that country.

If you join a group, its other members can see your display name, your profile photo, the quests you have completed, your experience points and streaks, and any photos you post to the group feed. Groups are joined with an invite code, and anyone holding that code can join — so treat a group feed as visible to everyone your group has shared the code with.

Subplot is not directed at children under 13 and we do not knowingly collect personal information from them. If we learn that a user is under 13 we close the account and delete the data. If you believe a child has given us personal information, email [email protected].

We may update this policy from time to time. The updated version is marked with a new date at the top. If we make material changes we will post a notice or contact you directly.

Email [email protected], or write to Sunwave Studios LLC, Vineyard, Utah, United States.

Privacy questions and requests are handled by our Privacy Officer, reachable at [email protected].

To review, update or delete your personal information, see how to delete your account.