Privacy Policy

Welcome to GeoToken. We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (“Services”). Please read this policy carefully. If you have questions, contact us at support@geotoken.world.

1. Information We Collect

1.1 Information You Provide

• Account Information: Email address, display name, profile photo (optional), bio, area, social links, and other profile details you choose to share.
• User Content: Photos, videos, captions, stories, and other content you upload to token journeys.
• Location Data: GPS coordinates when you place, find, or place a token again (with your explicit permission). Where you place a token is public: the placement location, including a street-level address label where one is available, is shown on the map, on the token's journey, on public web pages, and on collection Activity pages. Where you find a token is shown only as a coarse locality (a city or area), never as a precise point or address.
• Communications: Support inquiries and feedback, and direct messages you send through the in-app messaging system, including photos you attach to them.
• Community Content: Comments and reactions on token journeys, community discussion posts, and any reports you file about content or people.
• Organization and Collection Information: Business names, location labels, website links, logos, cover photos, gallery images, customer portal login records, and Activity-link settings for organization-backed collections.
• Payment Information: When purchasing physical tokens, payment details are processed by our payment provider. We do not store full credit card numbers.

1.2 Information Collected Automatically

• Device Information: Device type, operating system, unique device identifiers, mobile network information.
• Usage Data: App features used, interaction patterns, session duration, crash reports, performance metrics. In the mobile app these usage events are recorded by GeoToken itself and stored in our own database (first-party analytics); the app does not embed a third-party analytics SDK.
• Log Data: IP address, access times, app version, referring/exit pages.
• Push Notification Tokens: Device tokens to deliver token activity and account alerts, plus optional social alerts when social features are enabled.

1.3 Information from Third Parties

• Social Login: If you sign in with Google or Apple, we receive basic profile information (name, email, profile photo) as permitted by the provider.
• Website Analytics: Our website (not the mobile app) uses Google Analytics with IP anonymization to understand website usage. See Section 9.

2. How We Use Your Information

We use collected information for the following purposes:

• Provide Services: Create and manage your account, display token journeys, enable QR scanning and token journey features.
• Collection Activity Pages: Show organization-backed collection activity, including token movement, photos/videos, usernames, avatars, location labels, stats, and map points on public or private customer Activity pages.
• Social Features: When enabled, connect with other people, follow activity, and interact with shared journeys.
• Notifications: Send push notifications about token finds, placed-again updates, account activity, and optional social alerts when enabled.
• Improve Experience: Analyze usage patterns, debug issues, optimize performance, develop new features.
• Safety & Security: Detect fraud, enforce terms of service, protect against abuse and unauthorized access.
• Communications: Send service announcements, respond to support requests, provide updates about policy changes.
• Legal Compliance: Comply with legal obligations, respond to lawful requests, protect our rights and property.
• Marketing: With your consent, send promotional communications about new features or products (you can opt out anytime).

3. How We Share Your Information

We do not sell your personal information. We may share information in the following circumstances:

3.1 With Other Users

Content you post to a token's journey (photos, videos, stories, comments, and reactions), together with your username and avatar, is public: it is visible to anyone who opens that token in the app or on a public GeoToken web page, not only to people who have found the token. Placement locations are public and find locations are shown as a coarse locality, as described in Section 1.1. Your profile (username, avatar, bio, and any interests you add) is visible to other users, and when you join, your username and avatar appear in the Community feed as a new explorer. Private GeoJournal memories on a journal-mode token are visible only to you until you release them into the public journey. Direct messages are visible only to the people in that conversation. If a token belongs to an organization-backed collection, the collection's Activity page may also show that token activity to authorized organization portal users or, when the Activity link is public, to anyone with the public link.

3.2 With Organization and Collection Portal Users

Organization-backed collections may include customer Activity pages. Depending on the access setting selected by GeoToken or the collection administrator, those pages may be private, public, or turned off. Private pages require a portal login. Public pages can be viewed by anyone with the link and may display collection-level token activity, map movement, photos/videos, user display names, avatars, token codes, stats, and timestamps.

GeoToken does not provide Activity pages as private employee monitoring or personal tracking tools. They are intended to summarize token journeys and memories connected to a collection.

3.3 With Service Providers

We share information with trusted third-party providers who help us operate GeoToken:

• Supabase: Database hosting, authentication, file storage
• Expo: Push notification delivery
• Google Maps Platform: Map rendering and geocoding services
• Sentry: Error monitoring and crash reporting
• Vercel: Web hosting and content delivery
• Resend: Transactional email delivery and handling of email you send to our support address
• Google Analytics: Website usage analytics only (IP anonymized); not used in the mobile app
• Payment Processors: Secure payment processing for token purchases

These providers are contractually obligated to protect your data and use it only for the services they provide to us.

3.4 For Legal Reasons

We may disclose information if required by law or in response to:

• Legal process (subpoenas, court orders, government requests)
• Enforcement of our Terms of Service
• Protection of our rights, property, or safety, or that of our users
• Investigation of fraud, security issues, or illegal activity

3.5 Business Transfers

If GeoToken is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you via email and/or prominent notice in the app before your data is transferred and becomes subject to a different privacy policy.

4. Data Retention

We retain your information as follows:

• Account Data: Retained while your account is active. Completing the in-app Delete Account flow removes your profile and sign-in account.
• Journey Content: Account deletion anonymizes journey entries so shared token history remains, while removing their personal text, photos, and media.
• Log Data: Used for security and debugging purposes.
• Legal Obligations: Some data may be retained longer if required by law or to resolve disputes.

5. Your Rights and Choices

5.1 Account Management

• Update Information: Edit your profile, name, bio, and preferences in app settings.
• Delete Content: Remove journey entries, photos, and stories at any time.
• Delete Account: Permanently delete your account in-app from Profile -> Settings -> Delete Account.
• Privacy Requests: Contact support@geotoken.world if you need help with deletion, data export, or another privacy-rights request.

5.2 Privacy Controls

• Location Permissions: Control location access through device settings. Deny or revoke at any time.
• Push Notifications: Toggle token-event notifications and any available social categories in app settings.
• Marketing Communications: Opt out of promotional emails via unsubscribe links.
• Blocking and Reporting: Block people and report content or accounts from inside the app. People you block cannot message you, and reports are reviewed by GeoToken.

5.3 Legal Rights (Region-Specific)

For EU/UK Users (GDPR):

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate information
• Erasure: Request deletion (right to be forgotten)
• Portability: Receive your data in machine-readable format
• Restriction: Limit how we process your data
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Revoke consent for data processing

For California Users (CCPA/CPRA):

• Right to Know: Request disclosure of data collected, used, shared
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: Opt out of data “sales” (we do not sell data)
• Right to Non-Discrimination: Equal service regardless of privacy choices
• Right to Correct: Request correction of inaccurate data
• Right to Limit: Limit use of sensitive personal information

To exercise these rights, email support@geotoken.world with your request. We will respond within 30 days (or as required by applicable law).

6. Security

We implement industry-standard security measures to protect your information, including:

• Encryption in transit (TLS/SSL) and at rest
• Secure authentication with password hashing
• Row-level security policies on database access
• Regular security audits and penetration testing
• Access controls limiting employee data access
• Automated backups with encryption

However, no system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. Use strong passwords and do not share your account credentials.

7. Children's Privacy

GeoToken is not intended for children under 13 years old (or 16 in the EU). We do not knowingly collect personal information from children. If we discover we have collected data from a child without parental consent, we will delete it promptly. Parents who believe their child has provided information should contact us at support@geotoken.world.

8. International Data Transfers

GeoToken operates globally. Your information may be transferred to and processed in countries other than your own, including the United States and Canada. These countries may have data protection laws different from your jurisdiction.

For EU users: We ensure adequate safeguards through Standard Contractual Clauses (SCCs) approved by the European Commission when transferring data outside the EEA.

9. Cookies and Tracking Technologies

Our website uses cookies and similar technologies:

• Essential Cookies: Required for website functionality (authentication, security)
• Analytics Cookies: Google Analytics to understand website usage (anonymized IP)
• Preference Cookies: Remember your settings and choices
• Local Storage: Browser localStorage to remember your preferences (e.g., whether you've seen the token intro modal). This data stays on your device and is not transmitted to our servers.

You can control cookies through browser settings. Note that disabling cookies may affect website functionality.

10. Do Not Track Signals

We do not currently respond to “Do Not Track” browser signals, as there is no industry consensus on how to interpret them. You can use the privacy controls described above to manage data collection.

11. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be announced via:

• In-app notification
• Email to registered users
• Prominent notice on our website

The “Last Updated” date at the top will always reflect the most recent version. Continued use after changes become effective constitutes acceptance of the updated policy. If you disagree with changes, discontinue use and delete your account.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us:

For EU/UK Users: You have the right to lodge a complaint with your local data protection authority if you believe we have not addressed your concerns adequately.

By using GeoToken, you acknowledge that you have read and understood this Privacy Policy.