Privacy Policy

1. Introduction, Scope, and Agreement

Thumbkiss ("Company," "we," "our," or "us") is unwaveringly dedicated to protecting the privacy, confidentiality, and security of our users' ("user," "you," or "your") personal and non-personal information. This Comprehensive Privacy Policy constitutes a legally binding agreement between you and Thumbkiss regarding the collection, use, processing, storage, sharing, and protection of your data when you access, download, install, or use the Thumbkiss mobile application, website (https://thumbkiss.app), servers, APIs, and associated services (collectively, the "Service").

We operate in strict compliance with applicable global data protection frameworks, statutes, and regulations, including but not limited to the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") for users within the European Economic Area (EEA), the California Consumer Privacy Act of 2018 ("CCPA") and California Privacy Rights Act ("CPRA") for users in California, and the Personal Data Protection Law No. 6698 ("KVKK") for users within the Republic of Turkey.

By accessing or using the Service in any manner, you expressly acknowledge and affirm that you have thoroughly read, fully understood, and unequivocally agreed to be bound by the practices, terms, and conditions described in this policy. This policy applies to all visitors, users, and others who access the Service. If you do not agree with any part of this policy, you are strictly prohibited from using the Service and must immediately discontinue use and uninstall the application.

2. Data Collection Methodology, Categories, and Sources

To facilitate the seamless functionality of the Service, ensure robust security, and provide an optimized user experience, we collect and process specific categories of data through automated and non-automated means. The collection of this data is strictly limited to what is necessary, adequate, and relevant for the performance of the contract between you and us and to provide you with the full features of the Service.

2.1 Personally Identifiable Information (PII)

Upon registration, account creation, and throughout your continued use of the Service, we may collect data that can be used to specifically identify, contact, or locate you. This includes, without limitation:

• Identity Data: This encompasses your chosen display name, username, unique user ID (UUID) assigned by our system, profile URL, and any other unique identifiers you voluntarily provide to personalize your account identity within the ecosystem.
• Contact Data: We collect your electronic mail (email) address, which is utilized primarily for authentication (login), account recovery, multi-factor authentication (if enabled), security notifications, and critical service-related communications.
• Profile Content: Any photographic imagery, avatars, biographical text, status messages, or other content you choose to upload to your public or private profile to personalize your experience.

2.2 User-Generated Content (UGC) and Private Communications

The fundamental purpose of the Service is to facilitate private, secure connection between paired users. In this capacity, we process, transmit, and securely store the following categories of user-generated content:

• Private Communications: End-to-end or server-encrypted textual messages, emojis, stickers, GIFs, and other forms of written correspondence exchanged securely within the instant messaging feature.
• Visual Media Assets: Photographic images, digital drawings, sketches, canvas collaborations, voice notes, and other visual or audio media uploaded, created, or transmitted through the Service.
• Haptic and Sensory Telemetry: Records of "Thumbkiss" interactions, including timestamped vibration patterns, synchronous touch events, duration of touch, and haptic feedback telemetry used to simulate virtual touch.
• Real-Time Status Indicators: Real-time or periodic information regarding your device's battery status, charging state, network connectivity type/quality, and "Song of the Day" selections shared with your authorized partner.

2.3 Technical, Usage, and Telemetry Data

When you access the Service, our systems automatically collect certain technical and behavioral data to ensure stability, security, and performance optimization:

• Device Fingerprinting: Unique device identifiers (UUID), advertising IDs (IDFA/GAID where applicable and permitted), operating system type and version, device model, screen resolution, language settings, time zone, and manufacturer information.
• Log Files and Analytics: Server logs that may automatically record IP addresses, browser type, referring/exit pages, access times, app features utilized, session duration, and crash reports (stack traces) to assist in debugging and service improvement.
• Network Information: Information regarding your internet service provider (ISP), connection type (e.g., Wi-Fi, 4G, 5G, LTE), and signal strength to optimize real-time data transmission protocols.

2.4 AI Feature Inputs and Outputs

When you voluntarily choose to use our optional artificial-intelligence features ("AI Features"), such as AI image generation and the AI-assisted "Conflict Solver," we collect and process the inputs you provide and the outputs generated in order to deliver the feature. This includes, without limitation:

• Generation Inputs: The text prompts, instructions, parameters, and any images or media you upload or select as the basis for AI image generation.
• Conflict Solver Content: The written descriptions, perspectives, and statements that you and your paired partner each submit regarding a disagreement or situation, which are processed to generate a neutral, mediating summary or suggestion. You should be aware that content you submit to the Conflict Solver is used to generate an output that is shared within your pairing.
• AI Outputs: The images, text, summaries, or other content generated by the AI Features in response to your inputs.
• Usage Metadata: Records relating to your use of AI Features, such as timestamps, the number of Credits consumed, feature type, and whether a generation succeeded or failed, used for billing reconciliation, abuse prevention, and service improvement.

To generate outputs, your AI Feature inputs are transmitted to and processed by third-party AI service providers acting as our sub-processors, as further described in Sections 4, 7, and 8A. Please do not submit sensitive personal information to AI Features that you do not wish to be processed for this purpose.

3. Detailed Purposes and Legal Basis of Data Processing

We process your personal data based on lawful grounds and for specific, legitimate business purposes. We do not process your data in a manner that is incompatible with these purposes:

• Service Provision and Contractual Performance: To operate, maintain, and provide the core features of the Thumbkiss application, including the real-time transmission of messages, touch interactions, and status updates between paired devices, as per our Terms of Service.
• Authentication and Account Security: To verify your identity, manage sessions, prevent unauthorized access, secure your account against brute-force attacks, credential stuffing, and other security threats.
• Analytics, Research, and Development: To analyze usage trends, user retention, feature popularity, and interaction patterns in order to enhance user experience, optimize application performance, fix bugs, and develop new features or services.
• AI Feature Provision and Credit Management: To operate the optional AI Features you choose to use, including transmitting your inputs to third-party AI providers to generate outputs, returning those outputs to you and (for the Conflict Solver) your paired partner, and to administer, meter, and reconcile the virtual Credits consumed by such features. The legal basis for this processing is the performance of our contract with you and your consent in choosing to use these optional features.
• Customer Support and Dispute Resolution: To respond to your inquiries, troubleshoot technical issues, resolve disputes, manage refunds (if applicable), and provide assistance when specifically requested by you.
• Safety, Integrity, and Fraud Prevention: To monitor for and prevent fraudulent activity, abuse, harassment, spam, security breaches, bot activity, and other malicious behavior that could harm the Service, its users, or the public.
• Legal Compliance and Enforcement: To comply with applicable legal obligations, court orders, subpoenas, or valid governmental requests, and to enforce our Terms of Service and other legal agreements.

4. Infrastructure, Data Storage, and International Transfers

We utilize enterprise-grade cloud infrastructure to ensure the high availability, integrity, and confidentiality of your data.

4.1 Cloud Infrastructure and Hosting

Your personal data and content are securely hosted, stored, and processed using Google Firebase, a globally scalable cloud platform provided by Google LLC. Firebase employs robust physical, environmental, and logical security measures to protect data. Data is stored in state-of-the-art data centers that adhere to ISO 27001, SOC 1, SOC 2, and SOC 3 compliance standards.

4.2 International Cross-Border Data Transfers

Due to the global nature of the internet and cloud computing, your data may be transferred to, stored, and processed on servers located in various countries, including the United States and other jurisdictions where Google operates facilities. These countries may have data protection laws that differ from the laws of your country of residence. By using the Service, you unambiguously consent to the transfer of your information to countries outside your country of residence. We rely on mechanisms such as Standard Contractual Clauses (SCCs) approved by the European Commission and other relevant legal frameworks to ensure appropriate safeguards for international data transfers are in place.

5. Comprehensive Security Measures and Protocols

We implement a rigorous, multi-layered approach to security, utilizing appropriate technical, administrative, and organizational measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure.

• Encryption Standards: All data is encrypted while in transit using robust Transport Layer Security (TLS) 1.2/1.3 protocols (HTTPS) and at rest on our servers using industry-standard AES-256 encryption algorithms.
• Strict Access Control Policies: We maintain strict access controls based on the principle of least privilege. Data access is limited to authorized personnel, developers, and systems strictly necessary for service operation, maintenance, and security monitoring.
• Authentication Mechanisms: Secure token-based authentication (OAuth 2.0 / OpenID Connect) mechanisms are employed to ensure that only you and your explicitly authorized partner can access your shared private content.
• Regular Security Audits: We conduct periodic security reviews, vulnerability assessments, and audits of our data collection, storage, and processing practices to guard against unauthorized access and ensure system integrity.

Notwithstanding these robust measures, you acknowledge that no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute, unbreakable security.

6. Data Retention, Archiving, and Deletion Policies

We adhere to strict data retention policies to ensure we do not hold your data longer than is necessary for the purposes outlined in this policy.

• Active Account Retention: We retain your account profile, preferences, settings, and user-generated content for as long as your account remains active and in good standing to provide continuous service.
• Voluntary Deletion Process: You have the absolute right to request the deletion of your account at any time through the application settings. Upon such request, your personal data will be scheduled for permanent deletion from our active databases. This process typically completes within 30 days, subject to technical latency and backup cycling protocols.
• Legal and Safety Retention: Notwithstanding a deletion request, we may retain certain aggregated or specific information if required to do so by law (e.g., for tax, accounting, or audit purposes), to resolve disputes, enforce our agreements, or for legitimate business interests such as fraud prevention or safety.

7. Third-Party Disclosures, Sharing, and Service Providers

We maintain a strict policy regarding the sharing of your data. We do not sell, trade, rent, lease, or otherwise exploit your personal identification information to third parties for marketing, advertising, or commercial purposes.

However, we may disclose information in the following limited circumstances:

• Authorized Third-Party Service Providers: We engage trusted third-party companies and individuals to facilitate our Service ("Service Providers"), to provide the Service on our behalf, to perform Service-related services (e.g., hosting, database management, analytics, payment processing, email delivery), or to assist us in analyzing how our Service is used. These third parties have access to your Personal Data only to perform these specific tasks on our behalf and are contractually obligated not to disclose or use it for any other purpose.
• Third-Party AI Providers: To provide the optional AI Features, we transmit the inputs you submit (such as prompts, uploaded images, and Conflict Solver text) to third-party artificial-intelligence providers who process that data on our behalf as sub-processors and return the generated output. Your use of AI Features, and the associated processing by these providers, is also subject to the providers' own terms and privacy practices. We share only the data necessary to generate the requested output.
• Legal Obligations and Safety: We may disclose your Personal Data if required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, court order, or subpoena; (ii) protect and defend the rights, property, or safety of Thumbkiss, its users, or the public; (iii) prevent or investigate possible wrongdoing in connection with the Service; or (iv) protect against legal liability.
• Business Transfers and Corporate Transactions: If Thumbkiss is involved in a merger, acquisition, asset sale, reorganization, bankruptcy, or liquidation, your Personal Data may be transferred as part of that transaction. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

8. Children's Privacy and Age Restrictions

The Service is strictly not intended for individuals under the age of 13 (or the applicable age of digital consent in your jurisdiction, such as 16 in certain EU member states). We do not knowingly solicit, collect, or process personal information from children under these age limits. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us immediately. If we become aware that we have collected Personal Data from a child without verification of parental consent, we will take immediate steps to remove that information from our servers and terminate the associated account.

8A. AI-Powered Features and Automated Processing

This section provides additional transparency regarding our optional AI Features, including AI image generation and the AI-assisted "Conflict Solver." Use of AI Features is entirely voluntary; you are not required to use them to use the core Service.

8A.1 How AI Processing Works

When you invoke an AI Feature, the inputs you provide (for example, text prompts, uploaded images, or the perspectives you and your partner submit to the Conflict Solver) are transmitted to and processed by third-party AI service providers acting as our sub-processors, in order to computationally generate an output that is returned to you. This processing may occur on servers located outside your country of residence, including in the United States, subject to the international transfer safeguards described in Section 4.

8A.2 Nature and Limitations of AI Outputs

AI Outputs are generated automatically by machine-learning systems and are inherently probabilistic. They may be inaccurate, incomplete, unexpected, or otherwise unsuitable, and they do not represent the views, advice, or endorsement of Thumbkiss. In particular, the Conflict Solver is an automated tool provided for general informational and entertainment purposes only and does not constitute relationship, psychological, medical, legal, or other professional advice. You should not rely on AI Outputs for important decisions. Your use of AI Features and any reliance on AI Outputs is governed by, and subject to the disclaimers and limitations of liability in, our Terms of Use.

8A.3 Data Sharing Within Your Pairing

The Conflict Solver is a shared feature. Content you submit to it, and the resulting AI Output, may be made visible to your paired partner as an inherent part of the feature's function. Please exercise discretion regarding the information you choose to include.

8A.4 Use of Inputs for Model Training

We do not use your AI Feature inputs or outputs to train our own general-purpose AI models. The use of data by third-party AI providers is governed by their respective terms; we endeavor to engage providers under terms that limit the use of submitted data to providing the service and do not use your content to train the providers' foundation models, but we cannot guarantee the internal practices of every provider. Where required by law, processing of your inputs is carried out on the basis of your consent, which you may withdraw by discontinuing use of the AI Features.

8A.5 Retention of AI Data

AI Feature inputs, outputs, and associated usage metadata are retained in accordance with the retention principles in Section 6 for as long as necessary to provide the feature, reconcile Credit usage, prevent abuse, and comply with legal obligations, after which they are deleted or anonymized. Generated content that you save within the Service is retained as part of your user-generated content until you delete it or your account.

8A.6 No Solely-Automated Decisions with Legal Effect

The AI Features do not make decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of applicable data protection law. AI Outputs are suggestions and creative content only and carry no binding effect.

9. User Rights, Control, and Data Subject Requests

Depending on your jurisdiction, you are afforded specific rights regarding your personal data. We are committed to facilitating the exercise of these rights to the fullest extent required by law.

9.1 Rights Under GDPR (EEA Users)

If you are a resident of the European Economic Area (EEA), you have the right to access, update, or delete the information we have on you. Additionally, you have the right of rectification (correction of inaccurate data), the right to object to processing, the right of restriction of processing, the right to data portability (receiving a copy of your data), and the right to withdraw consent at any time where we relied on your consent to process your personal information.

9.2 Rights Under KVKK (Turkish Users)

In accordance with Article 11 of the Personal Data Protection Law (KVKK), users in Turkey have the right to learn whether personal data is processed, request information if processed, learn the purpose of processing and whether data is used in accordance with its purpose, know the third parties to whom data is transferred domestically or abroad, request correction of incomplete or inaccurate data, request deletion or destruction of data under the conditions set forth in Article 7, request notification of the operations made pursuant to correction and deletion rights to third parties to whom personal data has been transferred, object to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems, and claim compensation for the damage arising from the unlawful processing of personal data.

9.3 Rights Under CCPA/CPRA (California Residents)

If you are a resident of California, you have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting or selling personal information, and the categories of third parties with whom we share personal information. You also have the right to request the deletion of your personal information and the right not to be discriminated against for exercising these rights.

10. Cookies, Tracking Technologies, and Do Not Track

We and our third-party partners may use cookies, beacons, tags, and scripts to collect and store information about your use of the Service. These technologies are used for analyzing trends, administering the site, tracking users' movements around the site, and gathering demographic information about our user base as a whole. You can control the use of cookies at the individual browser level. If you reject cookies, you may still use our Service, but your ability to use some features or areas of our Service may be limited. We do not currently respond to "Do Not Track" (DNT) signals from web browsers.

11. Severability and Changes to Policy

If any provision of this Privacy Policy is found to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary so that this Privacy Policy will otherwise remain in full force and effect and enforceable. We reserve the right, at our sole discretion, to modify, update, or replace this Privacy Policy at any time to reflect changes in our practices or for other operational, legal, or regulatory reasons. If a revision is material, we will make reasonable efforts to provide at least 30 days' notice prior to any new terms taking effect. What constitutes a material change will be determined at our sole discretion. By continuing to access or use our Service after those revisions become effective, you agree to be bound by the revised terms.