Privacy Policy

1. Introduction

Welcome to TownTap! This Privacy Policy explains how Town Tap LLC ("TownTap," "we," "us," or "our") collects, uses, discloses, and protects your personal information when you use our mobile application and related services (collectively, the "Service").

By using TownTap, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use our Service.

2. Information We Collect

We collect several types of information to provide and improve our Service.

2.1 Information You Provide Directly

Account Information

• Email address (required for account creation)
• Name (optional, but required for personalized features)
• Profile photo (optional)
• Date of birth (for age verification)
• Phone number (optional, for notifications)

User-Generated Content

• Restaurant reviews and ratings
• Photos of food and dining experiences
• Comments and responses
• Profile preferences (cuisine types, dietary restrictions)

Payment Information

• Note: We do not store credit card numbers or banking information
• Payment processing is handled by third-party providers (Stripe, Apple Pay, Google Pay)
• We receive transaction confirmations and subscription status

2.2 Information Collected Automatically

Location Data

• Precise location (GPS coordinates) when you check in at restaurants
• Approximate location (city/region) for showing nearby restaurants
• Location services can be disabled, but some features will be limited

Device Information

• Device type and model (iPhone 15, Samsung Galaxy S24, etc.)
• Operating system and version (iOS 18, Android 14, etc.)
• Unique device identifiers (IDFA, Advertising ID)
• IP address
• Browser type and version (for web access)

Usage Data

• Features you use and pages you view
• Time spent on different sections of the app
• Search queries and filters
• Restaurants viewed and visited
• Points earned and redeemed
• App crashes and errors (for debugging)

2.3 Information from Third Parties

• Social Media: If you sign in with Apple, Google, or Facebook, we receive basic profile information
• Business Partners: Restaurants may provide transaction data for points calculation
• Analytics Providers: We use Firebase Analytics and Google Analytics for app performance

3. How We Use Your Information

We use your information for the following purposes:

3.1 Core Service Delivery

• ✅ Create and manage your account
• ✅ Process check-ins and award points
• ✅ Show nearby restaurants based on your location
• ✅ Enable restaurant reviews and social features
• ✅ Process payments and manage subscriptions
• ✅ Send transactional emails (account confirmation, password resets)

3.2 Personalization & Recommendations

• 🎯 Recommend restaurants based on your preferences and history
• 🎯 Suggest menu items you might like
• 🎯 Show relevant offers and promotions
• 🎯 Customize your app experience

3.3 Analytics & Improvement

• 📊 Analyze app usage to improve features
• 📊 Monitor performance and fix bugs
• 📊 Conduct A/B testing for new features
• 📊 Understand user engagement and retention

3.4 Communication

• 📧 Send promotional emails (with your consent)
• 📧 Notify you of new offers from restaurants you follow
• 📧 Send important service updates
• 📧 Respond to your inquiries and support requests

3.5 Legal & Safety

• ⚖️ Prevent fraud and abuse
• ⚖️ Enforce our Terms of Service
• ⚖️ Comply with legal obligations
• ⚖️ Protect user safety and rights

4. Data Sharing with Businesses

This is the most important section of our Privacy Policy. Please read carefully.

4.1 What Data IS Shared (Anonymized)

We share the following data WITH BUSINESSES, but WITHOUT your personal identity:

4.2 What Data is NEVER Shared

The following information is ALWAYS protected unless you explicitly opt-in:

4.3 Optional Identity Sharing (Earn Rewards!)

You can choose to share your identity with specific businesses to receive:

• 🎁 Personalized service - Staff can greet you by name
• 🎁 Exclusive offers - Targeted promotions via email
• 🎁 Birthday rewards - Special treats on your birthday
• 🎁 Bonus points - 200 points for name, 200 for email (400 total!)

4.4 How Businesses Access Data

• 📊 Businesses with paid subscriptions can view aggregated analytics
• 📊 Each business can only see data from their own customers
• 📊 Cross-business data sharing is strictly prohibited
• 📊 Raw data is never downloadable - only through secure dashboards

5. Your Privacy Rights

You have full control over your data. Here are your rights:

5.1 Access & Portability

• View Your Data: See all data we have about you in Settings → Privacy → My Data
• Download Your Data: Export all your data in JSON format (machine-readable)
• Transfer Your Data: Move your data to another service (data portability)

5.2 Correction & Deletion

• Update Information: Edit your profile, preferences, and settings anytime
• Delete Your Account: Request permanent deletion in Settings → Privacy → Delete Account
• Deletion Timeline: Account deleted within 30 days (some data retained for legal compliance)

5.3 Consent & Control

• Opt-Out of Analytics: Turn off "Anonymous Analytics" in Settings → Privacy
• Opt-Out of Marketing: Unsubscribe from promotional emails via email links or app settings
• Disable Location: Turn off location services (some features will be limited)
• Revoke Permissions: Withdraw consent for camera, contacts, notifications in device settings

5.4 Specific Regional Rights

🇪🇺 GDPR Rights (European Union)

• Right to access your personal data
• Right to rectification (correction)
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making

🇺🇸 CCPA Rights (California Residents)

• Right to know what personal information is collected
• Right to know if personal information is sold or shared
• Right to opt-out of the sale of personal information
• Right to deletion
• Right to non-discrimination for exercising CCPA rights

🇨🇦 PIPEDA Rights (Canada)

• Right to access personal information
• Right to challenge accuracy
• Right to withdraw consent

6. Data Protection & Security

We take data security seriously and implement industry-standard measures to protect your information.

6.1 Technical Security Measures

• 🔐 Encryption in Transit: All data encrypted with TLS 1.3 (HTTPS)
• 🔐 Encryption at Rest: All databases encrypted using AES-256
• 🔐 Secure Cloud Infrastructure: Hosted on Google Cloud Platform / Firebase with enterprise security
• 🔐 Password Security: Passwords hashed with bcrypt (industry standard)
• 🔐 Access Controls: Role-based access control (RBAC) for internal staff
• 🔐 Regular Security Audits: Quarterly penetration testing and vulnerability scans

6.2 Organizational Measures

• 👥 Limited Staff Access: Only authorized personnel can access user data
• 👥 Confidentiality Agreements: All employees sign NDAs
• 👥 Security Training: Regular security awareness training for staff
• 👥 Incident Response Plan: Procedures for data breach notification

6.3 Data Retention

6.4 Data Breach Notification

In the unlikely event of a data breach, we will:

• 📧 Notify affected users within 72 hours (GDPR requirement)
• 📧 Notify relevant authorities as required by law
• 📧 Provide details on what data was affected
• 📧 Offer guidance on protective measures you can take

7. Third-Party Services

We use trusted third-party services to deliver our Service. These partners have access to limited data as necessary to perform their functions.

7.1 Service Providers

7.2 Advertising & Analytics

We do NOT currently use third-party advertising networks. If this changes in the future, we will update this policy and notify you.

7.3 Social Media Integration

If you connect your social media accounts:

• We receive basic profile information (name, email, profile picture)
• You can disconnect social accounts at any time
• Social media platforms have their own privacy policies

8. Children's Privacy

TownTap is NOT intended for children under 13 years of age. We comply with the Children's Online Privacy Protection Act (COPPA).

• 🚫 We do not knowingly collect personal information from children under 13
• 🚫 If we discover we have collected data from a child under 13, we will delete it immediately
• 🚫 Parents can contact us at privacy@towntap.com if they believe their child's data was collected
• ✅ Age verification is required during account creation

9. International Users

TownTap is operated in the United States. If you are accessing our Service from outside the United States, please be aware that your information may be transferred to, stored in, and processed in the United States.

9.1 Data Transfers

• 🌍 EU/EEA Users: Data transfers comply with GDPR using Standard Contractual Clauses (SCCs)
• 🌍 UK Users: Data transfers comply with UK GDPR and UK Addendum to SCCs
• 🌍 Swiss Users: Data transfers comply with Swiss Federal Data Protection Act (FADP)
• 🌍 All Users: We use cloud providers with global data center networks for optimal performance

9.2 Your Data Protection Rights

Regardless of your location, you have the rights outlined in Section 5 of this Privacy Policy.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.

How We Notify You of Changes

• 📧 Material Changes: We will email you at least 30 days before changes take effect
• 📱 In-App Notification: A banner will appear when you open the app
• 📅 Update Date: The "Last Updated" date at the top will be changed
• 🔢 Version Number: The version number will increment

Your Acceptance

Continued use of TownTap after changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with changes, you may delete your account.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data:

Data Protection Officer (DPO)

For EU/EEA users, our Data Protection Officer can be reached at:
Email: dpo@towntap.com

Supervisory Authority

EU/EEA users have the right to lodge a complaint with their local data protection authority. A list of EU data protection authorities can be found here.