Privacy Policy — Community Network

1. Introduction and document status

This Privacy Policy ("Policy") describes how Community Network ("Company", "we") processes personal data of users of the Community Network Platform ("Platform"). The Platform is available at www.communitynet.app. The Policy applies to all products, mobile applications, websites, APIs, notifications and other services, regardless of the entry domain. The Policy is an integral part of the Terms of Service. All limitations of liability set out in the Terms apply equally to the processing of personal data. Data Controller: Global Data Labs LLC ("Company"). Some processing may be performed by affiliates; the list and roles are disclosed in section 9. Data Protection Officer (DPO): privacy@communitynet.app / dpo@communitynet.app. EU Representative (GDPR Art. 27) and UK Representative (UK-GDPR) will be appointed upon exceeding the applicable thresholds; current details are published in the /legal/ section of the site. The Policy is intended to comply with Russian Federal Law 152-FZ (including 242-FZ localisation requirements), GDPR (EU), UK-GDPR and Data Protection Act 2018, CCPA/CPRA and other applicable US state privacy laws, sections 394-c, 394-cc and 394-ccc of the New York General Business Law where dating functionality is available, the SHIELD Act, COPPA in respect of age limits, LGPD (Brazil), PIPEDA (Canada), and FADP/nLPD (Switzerland).

2. Role distribution: controller/processor duality

Contour 1 — user's own data. For personal data that the user personally and voluntarily provides when registering and using the Platform (profile data, photos, dating and networking preferences, payment data and account content), the Company acts as an independent data controller. Contour 2 — third-party data uploaded by the user. For third-party data that the user uploads or posts on the Platform at their own initiative (photos of other individuals, contacts, lists of event invitees, descriptions of staff of a business account, biographies and images of community members), the following model applies: — the user is the primary controller of such data; — the Company acts as a processor on behalf of the user (within the meaning of Art. 28 GDPR and part 3 of article 6 of 152-FZ); — the user is solely responsible to the data subjects and regulators for having a lawful basis, obtaining consents and fulfilling information duties. Contour 3 — administrative and technical data. For technical data collected automatically (logs, security journals, session metadata, fraud protection), the Company is an independent controller on the basis of the legitimate interest of ensuring information security.

3. Categories of processed data

Registration and identification data: email, username/displayId, first and last name, and phone number if supplied. Date of birth, gender and relationship status are optional profile fields and are not required to create or use an account. Profile, preference and networking data: profile photo, biography, interests, skills, profession, occupation, city, dating and networking goals or preferences where the relevant feature is available, social-media links if voluntarily provided, contacts, community and event participation, likes, matches, invitations and connection decisions, and second-degree reach information. Feature availability and decision labels vary by client platform and region. An ordinary profile photo is an image selected by the user for display in the profile, communities and networking. Community Network does not run face detection or face recognition on profile photos and does not derive or retain facial landmarks, facial geometry, face embeddings, biometric templates or face identifiers from them. Profile photos are stored in Community Network media storage, delivered according to profile and privacy settings, and removed through profile-media deletion or the account-erasure process. Uploaded images may contain faces and may be sent to OpenAI for content-safety classification, not identification. Section 21 explains this processing, its recipients, retention and controls. Optional identity verification (KYC) data, where offered outside native iOS. If you choose to verify, Sumsub may collect images and extracted details from an identity document; a live selfie or video; facial images, facial features and a derived biometric face template used for liveness and face matching; IP address, device and technical data; and the verification result. These document images, live selfie/video and biometric templates are transmitted directly to and stored by Sumsub, not Community Network. Community Network stores the applicant identifier, review status/result, timestamps, labels, comments and the provider's review-event payload, which does not contain the document images, selfie/video or face template. Legacy manual selfie-verification submissions, if present, are separate private images held by Community Network for human review; they are not a native iOS feature and are covered by Section 21. Communication data: content of messages, voice messages, images in the messenger; message metadata; fact and duration of audio/video calls (content is not recorded); reactions, comments, community posts. Usage data: history of visits and interactions, likes, matches, invitations and connection decisions, contacts, favorites, community and event participation, and search settings. Technical and device data: IP address, browser type and version, OS, device make and model, advertising IDs (only with consent), connection data, time zone, language, cookies. Location data: approximate geolocation from IP (legitimate interest); precise geolocation (GPS/Wi-Fi) — only with your explicit consent, revocable at any time. On the Map, if you turn sharing on, we store only your latest point (it expires after 24 hours and is erased when you turn sharing off). Your own accepted check-ins and an explicit press of “My location” also create coarse ~300–600 m map-area identifiers for the always-on fog of war, without raw coordinates, times or order. The explicit action sends only that coarse identifier, not the precise device fix. This fog history persists across sessions and is erased when you delete your account. Payment data: full bank-card data is not stored by the Company; processed by licensed payment providers per PCI DSS; we store fact of transaction, amount, currency, status, transaction identifier, masked last 4 digits of the card. Psychological test data: optional results used for self-knowledge, compatibility recommendations and personalisation. They are not medical data. Social rating data: aggregated rating (0–100), tier, components (profile completeness, verification, activity, public reputation, network trust, psychological profile), result of automated assessment of public information. Third-party data uploaded by the user (Contour 2) — processed in the interests and under the responsibility of the user-controller.

4. Purposes of processing

Each purpose is supported by a lawful basis (see section 5). We do not use data for purposes incompatible with those listed below. Service provision: account creation and maintenance, authentication, dating matching where available, professional and community networking recommendations, contact management, community and event organisation, messenger, calls and posts. Personalisation: interface settings, relevant content, matching and networking recommendations, and search ranking. Communication: transactional notifications (match, connection invitation or decision, message, community or event activity), system notifications (security and changes to terms), and informational emails only with consent. Security and anti-fraud: voluntary identity verification, liveness and face matching, fraud and impersonation prevention, anti-spam, violation detection, and protection against bots and scraping. Raw identity-document and face data is never used for advertising, matching or networking recommendations, social-rating calculations or AI training. Only the verification status/result may update the verification badge and the verification component of the user's trust score. Analytics and product improvement: aggregated and anonymised usage analysis, A/B testing, technical-issue detection. Legal compliance: responding to lawful requests from authorities and meeting tax and accounting obligations. AI model training. The Company may use public content for training and fine-tuning recommendation and generative models subject to the following: — you have the unconditional right to opt out via the profile settings; — we never use: content of private messages, data of users under 18 (not allowed on the Platform at all), special categories of personal data, KYC data; — technical measures are applied to minimise reidentification risk.

5. Lawful bases for processing

For each processing purpose the applicable lawful basis is indicated under GDPR articles 6 and 9 (for EU/EEA), 152-FZ articles 6 and 10 (for Russia), and equivalent bases in other jurisdictions. Account creation and service provision: contract performance (GDPR Art. 6(1)(b) / 152-FZ Art. 6(1) p. 5). Identity verification: your explicit consent for document, facial and biometric processing (GDPR Art. 6(1)(a) and, where applicable, Art. 9(2)(a)) plus the Company's legitimate interest in preventing fraud and impersonation. Security, anti-fraud: legitimate interest (Art. 6(1)(f) / 152-FZ Art. 6(1) p. 7). Precise geolocation: consent (Art. 6(1)(a)). Psychological tests: consent. Marketing communications: consent + 152-FZ Art. 15. Analytical cookies: consent (for EU/UK). Strictly necessary cookies: contract performance. AI model training: legitimate interest with opt-out. Legal compliance: legal obligation. Withdrawal of consent. Where processing is based on consent, you may withdraw it at any time via the profile settings or by emailing privacy@communitynet.app. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal and may result in the inability to use certain Platform functions.

6. Russian Federation special requirements (152-FZ)

Data localisation. Pursuant to part 5 of article 18 of 152-FZ, the Company ensures that the recording, systematisation, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation are carried out using databases located on the territory of the Russian Federation. Roskomnadzor notification. The Company has submitted a notification of intent to process personal data to Roskomnadzor (where the applicable thresholds are met). Details are available in the public registry of operators. Cross-border transfers. Carried out in accordance with article 12 of 152-FZ and Roskomnadzor order No. 128 of 12.07.2023, exclusively to states providing adequate protection of the rights of data subjects, or with the written consent of the subject. Consent for data made available for distribution (152-FZ Art. 10.1). By placing data in public sections of the Platform, the user gives explicit consent to its distribution within the scope of the privacy settings. Breach notification. In the event of an incident falling under part 3.1 of article 21 of 152-FZ, the Company notifies Roskomnadzor within 24 hours of detection, submits a final report on the outcome of the internal investigation within 72 hours and informs affected data subjects.

7. European Economic Area special requirements (GDPR)

Rights of the data subject: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), portability (Art. 20), objection (Art. 21), withdrawal of consent (Art. 7(3)), right not to be subject to solely automated decisions with legal effect (Art. 22). Breach notification. The Company notifies the lead supervisory authority within 72 hours of detecting an incident and affected subjects without undue delay where a high risk to their rights and freedoms is likely (Art. 33, 34). International transfers. Transfers outside the EEA are based on: — Adequacy Decisions of the European Commission; — EU-U.S. Data Privacy Framework (DPF) for the US; — Standard Contractual Clauses (SCCs); — Binding Corporate Rules (BCRs) where available; — Transfer Impact Assessment (TIA) for jurisdictions without adequacy. Complaint to a supervisory authority. You have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work or place of the alleged infringement.

8. US special requirements (CCPA/CPRA, states, NY GBL)

Sale and sharing of data. The Company does not sell or share personal data within the meaning of CCPA/CPRA. Users from the US have the "Do Not Sell or Share My Personal Information" right available at any time — the link is in the footer and in the account settings. Sensitive Personal Information (SPI): precise geolocation if you enable it, optional health data imported only with explicit consent as described in Section 20, sexual orientation if you voluntarily provide it in a client where that profile field is available, optional KYC biometric data processed by Sumsub, and private-message content. We do not collect religious or philosophical beliefs, or racial or ethnic origin as profile categories. KYC biometric data is used only for identity verification and fraud prevention. State-resident rights: right to know, right to delete, right to correct, right to opt out of "sale/sharing", right to limit use of SPI, right to portability, right to non-discrimination for exercising rights. New York dating-service special requirements (NY GBL §§ 394-c, 394-cc, 394-ccc), where dating functionality is available: — the Company displays a prominent warning about the risks of meeting individuals first encountered online; — the Company notifies the user if another user with whom communication was established was subsequently banned for fraud (fraud-ban notification); — the Company does not transfer personal identifying information to third parties without the user's explicit written consent, except as required by law. SHIELD Act (New York) cybersecurity programme. The Company maintains reasonable administrative, technical and physical safeguards to protect the private information of New York residents.

9. Data sharing with third parties

The Company does not sell personal data. Data is disclosed to a limited set of recipients: Other Platform users. Within Platform functionality, your public profile is visible to other users subject to your privacy settings. Service providers (processors): — Infrastructure: DigitalOcean (hosting, Spaces), AWS (backups), Cloudflare (CDN, DDoS protection) — US/EU/Russia (segmented); — Email: SendGrid / Mailgun / Postmark — US, EU; — Push: Firebase Cloud Messaging / Apple APNs — US; — SMS: licensed SMS gateways — RU/EU/US; — KYC, where offered outside native iOS: Sumsub (Sum and Substance Ltd. and its subprocessors) — identity-document, liveness and face-match processing. Raw document and biometric face data for this flow is sent directly to Sumsub. Community Network stores verification metadata and review-event payloads, not Sumsub's document images, selfie/video or face templates. Sumsub's service privacy notice is https://sumsub.com/privacy-notice-service/; — Payments: Stripe / ЮKassa — EU/US/RU; — Analytics: internal tools + Google Analytics only with consent, with IP anonymisation, retention 14 mo; — AI models (non-training use): OpenRouter, DeepSeek, OpenAI — for AI chat features; query content is not used by providers for training. — Content safety: OpenAI — uploaded text and ordinary images, including images that may contain faces, may be sent to the moderation API to classify prohibited content. This is separate from optional AI assistance and does not perform identity matching. End-to-end encrypted Secret Chat media and live call video are not submitted to this moderation service. See Section 21 for retention and user controls. The full current list of processors is published at https://communitynet.app/processors. Event co-organisers. Upon registering for an event, the minimum necessary information is provided to the organiser to run the event. Law-enforcement and courts. Data is disclosed only on a lawful request to the extent required by law, with each instance recorded in an internal log. Successors. In the event of reorganisation / merger / sale of assets, data is transferred to the successor. Users are notified at least 30 days in advance. All service providers are contractually bound (DPA, SCCs for cross-border transfers) to a level of data protection not below that set by this Policy. This same-or-equal protection requirement also applies to every processor receiving images containing faces or biometric face data, including the applicable infrastructure, content-moderation and identity-verification providers, and covers confidentiality, purpose limitation, security, retention and deletion.

10. Data retention

Account and profile data — while the account is active. When you delete an account, it becomes unavailable immediately, direct identifiers are scrubbed, and the remaining account record is permanently deleted within 30 days. Community Network verification record — applicant identifier, review result/status and timestamps are kept while the account is active and permanently deleted within 30 days after account deletion. Raw KYC and face data at Sumsub — document images and data, live selfie/video, facial features and biometric template are retained for identity verification and fraud prevention. After an account-deletion or specific KYC-deletion request, we instruct Sumsub to delete that data; Sumsub completes deletion within 30 days unless an applicable legal obligation or documented legal hold requires a longer period. Sumsub describes its deletion process at https://sumsub.com/privacy-notice-service/. Messenger correspondence and media — while the account is active. After account deletion, messages already delivered to another user's inbox may remain only in anonymised form; other account-linked copies are removed during the 30-day deletion process. Operational backups — age out within 30 days after the primary account record is permanently deleted. Payment data — in accordance with financial and tax legislation (usually 5 years from the transaction). Security logs and authorisation journals — up to 12 months, anonymised thereafter. Anti-fraud logs — up to 36 months where necessary to detect repeated abuse, establish or defend legal claims, or comply with law. These logs do not contain Community Network copies of raw KYC images or biometric templates. Aggregated and anonymised analytics — indefinitely (does not allow identification). Data in AI training samples — upon opt-out, data is excluded from future training cycles; removal from already-trained models is technically impossible, but anonymisation of samples minimises risk.

11. Data security

The Company applies a layered set of measures: Encryption: TLS 1.2+ in transit, mandatory HSTS; AES-256 at rest (DB, Spaces, backups); keys managed via KMS with rotation; passwords — Argon2id / bcrypt with salt. Access control: MFA/2FA mandatory for all staff with production access; principle of least privilege; brute-force and replay protection; dynamic control strings on password recovery. Monitoring: continuous monitoring of suspicious activity; journalling of authorisations and administrative operations; regular security audits and penetration testing; staff training. Backup: daily encrypted snapshots; geographically distributed storage; regular recovery drills. Incident response: 24/7 on-call, escalation chain; incident response plan; regulator notifications within statutory timelines. Limits of guarantees. Despite the measures taken, no method of transmitting and storing data over the Internet is absolutely secure. The Company cannot guarantee absolute security and is not liable for incidents caused by users or third parties beyond its reasonable control.

12. User rights and how to exercise them

You have the following rights in respect of your personal data: — access: obtain a copy of the data being processed; — rectification: request the correction of inaccurate or incomplete data; — erasure: request the deletion of your data (subject to lawful grounds for retention); — restriction of processing; — portability: receive data in a structured, machine-readable format (JSON/CSV); — withdrawal of consent where processing is consent-based; — objection to processing based on legitimate interest, including profiling; — opt-out of automated decisions: request human intervention in decisions with legal effect; — complaint to a supervisory authority (Roskomnadzor, Irish DPC, UK ICO, California CPPA, or the authority in your country). How to exercise rights. Requests go to privacy@communitynet.app with identification of the requester. The Company responds within: — 10 business days — for 152-FZ requests from Russian citizens; — 1 month — for GDPR requests (extendable to 3 months on complexity); — 45 days — for CCPA/CPRA requests (extendable by 45 days); — other statutory timelines where applicable. No discrimination. The Company does not apply discriminatory measures (price increases, quality reduction, service refusal) for exercising your rights. Account deletion. Self-service deletion is available via the profile settings. After deletion, data is anonymised/destroyed per the timelines in section 10, except data the Company is required to retain by law.

13. Cookies and similar technologies

Described in detail in the Cookie Policy: https://communitynet.app/cookies. Summary: — strictly necessary cookies work without consent (authentication, CSRF protection); — functional — with your consent (language, theme); — analytical — with your consent (anonymised analytics); — advertising cookies are not used by the Company.

14. Minors

The Platform is intended exclusively for persons aged 18 and over. The Company does not knowingly collect or process personal data of persons under 18. Upon receipt of credible information about the registration of a minor, the Company immediately blocks the account, deletes all related data and notifies legal representatives and, where warranted, competent authorities. Parents and legal representatives who discover the registration of their minor child on the Platform may submit a request for immediate account deletion to privacy@communitynet.app.

15. Changes to the Policy

We may make changes to the Policy. We notify material changes at least 14 days in advance via the Platform, push notifications and email. The date of the last revision is indicated at the top of the document. An archive of previous versions is available on request to privacy@communitynet.app. For material changes (expansion of processing purposes, new recipients, changes in lawful basis) you will be required to re-accept the updated Policy via the consent modal. Refusal to accept results in the inability to use the affected features or the entire Platform.

16. Contact information

Data Protection Officer (DPO): privacy@communitynet.app / dpo@communitynet.app EU Representative: to be appointed upon exceeding thresholds — www.communitynet.app/legal/eu-representative UK Representative: to be appointed upon exceeding thresholds Company: Global Data Labs LLC Platform: www.communitynet.app Supervisory authorities: — Russian Federation: Roskomnadzor, rkn.gov.ru — Ireland (EU lead supervisory authority): Data Protection Commission, dataprotection.ie — United Kingdom: Information Commissioner's Office, ico.org.uk — California: California Privacy Protection Agency, cppa.ca.gov

17. SMS communications and phone numbers

We use SMS for a single transactional purpose: confirming that a phone number you provide actually belongs to you. A one-time 6-digit code is sent to the number only after you explicitly enter it in the app and tap "Send code". Phone numbers are not collected from any third-party source. What we store: the phone number (encrypted at rest), the date you verified it, and a hashed history of recent OTP attempts (to throttle abuse). Numbers are deleted within 30 days after you delete your account. Frequency. At most 3 SMS per recipient per day (one initial code plus up to two re-sends). We do not send marketing or promotional SMS — only verification. Delivery partner. SMS are transmitted via SignalWire (signalwire.com), our toll-free messaging provider. They process the message in transit only and do not retain or use the contents for any other purpose. They are bound by a data-processing addendum. Cost. Standard message and data rates may apply from your mobile carrier — we never charge you directly for an SMS. Opt-out. Reply STOP to any message to immediately remove your number from our messaging list. Reply HELP or contact hello@communitynet.app for assistance. Opting out does not delete your account, but you will no longer be able to place outbound landline calls until you re-verify a phone number. Carriers (T-Mobile, Verizon, AT&T, international carriers) are not liable for delayed or undelivered messages.

18. Native iOS contacts and external AI data sharing

Address-book upload in the native iOS app. Merely opening a contacts screen does not read or upload the address book. Before iOS displays its Contacts permission prompt, Community Network identifies the data, server destination and purpose and requires a separate affirmative consent. If accepted, contact names and phone numbers are uploaded to Community Network servers only to identify existing members and show invitation options. Sync Contacts stores the synchronized list with the account; each later sync replaces it, and the list is deleted through the account-erasure process within 30 days. Invite Friends performs one-time matching and does not save a synchronized contact list. Declining consent or revoking Contacts access prevents future uploads. Native iOS face data. Identity verification and KYC face-data processing are not available in the native iOS app. It does not collect, transmit or store identity documents for verification, liveness video, facial geometry, face templates or biometric identifiers, and does not implement its own Face ID sign-in. Apple may use device biometrics to authorise Sign in with Apple; Community Network receives the authorisation credential, not biometric face data. Ordinary photos and user-enabled video can contain faces; they are processed as described in Section 21, not as a biometric identity system. Optional AI-assistance features in the native iOS app. Before an optional external-AI assistance request, the app identifies the data and recipients and requires a separate affirmative consent. Depending on the feature and question, data may include the user's prompt and recent AI conversation; relevant profile fields; contacts and connections; community memberships; recent call and chat-partner metadata; events; check-ins; posts; and public profile data of suggested people. Private-message content and Secret Chat content are not included in this AI-assistance context. Content-safety moderation of ordinary uploads is a separate processing purpose described in Section 21. Recipients and purpose. Community Network sends the disclosed context to OpenRouter, which routes it to the selected model provider, currently DeepSeek. The data is used only to produce the requested Copilot answer, matching analysis, Radar result, conversation starter or business-marketing assistance. Requests use OpenRouter's zero-data-retention mode and deny provider data collection. OpenRouter and downstream providers are contractually required to provide protection at least equal to this Policy and are instructed not to store the content or use it for model training. Consent and retention. AI-assistance consent is versioned and recorded by the native iOS app. It can be withdrawn at any time in Privacy Settings; withdrawal immediately blocks new optional AI-assistance requests, but does not disable content-safety moderation of later ordinary uploads. Community Network may retain AI conversations in the user's account until the user deletes the conversation or account. Account deletion removes account-linked copies within 30 days.

19. Friend location sharing

Opt-in and collection. Friend location sharing is off by default. It starts only after you enable the single switch in Privacy & data and grant the device permission. While you are signed in, Community Network receives location updates only when the app is in the foreground; it does not request background or "always" access. We store only the latest device fix and use it solely to provide this feature. Audience and disclosure. When sharing is enabled, every accepted, unblocked friend may see the same server-generated approximate area (an 800 m radius, described in the app as approximately 1 km). You cannot select individual friends, increase precision or pause sharing for only part of your audience. Non-friends and blocked accounts receive no location. Friends never receive the precise device fix stored by Community Network. Retention and control. Each new fix replaces the previous one. The latest fix expires after 24 hours and is deleted immediately when you turn sharing off; location history is not kept. This contract requires a new, separate location consent, so consent recorded for an earlier version is not carried forward. Map fog is revealed by your own accepted check-ins and when you explicitly press “My location” on the Map. That action sends and stores only one coarse z16 area identifier, never the precise fix or a timestamp. Friend-sharing updates alone do not reveal fog.

20. Optional health data

Opt-in and scope. Access to Apple Health (iOS) or Health Connect (Android) is off by default. It starts only after you choose categories, accept the versioned disclosure, and approve the platform permission. We request read access only; Community Network does not write health records or run health synchronization in the background. Data and source. Depending on your selection and what the device makes available, we may import steps and other activity or workouts, sleep, vital signs, body measurements, nutrition and hydration, reproductive data, and clinical or medical records such as conditions, medications, lab results, procedures, encounters and immunizations. We process only the categories you select. Recent sync windows are limited by category; imported records can include historical data. Apple Health and Health Connect remain the source of the records. Purpose and visibility. We use imported data only for your private health history and private step circles. It is never published in your profile and never used for advertising, matching, recommendations, Social Rating, eligibility, or automated decisions. We do not sell it or share it with advertisers, other users, or data brokers. Health features do not provide medical advice. Storage and legal basis. Selected records are uploaded to CNET servers, linked to your account, protected with TLS in transit, and encrypted at rest; step counts are also stored numerically to calculate private step-circle results. Processing of this special-category data is based on your explicit consent (GDPR Art. 6(1)(a) and 9(2)(a), Russian Federal Law 152-FZ Art. 10, and equivalent law). Sync occurs only while you actively use or start the feature. We retain imported health data while the integration is connected and your account is active. Control, deletion and export. You may disconnect at any time. Disconnecting permanently deletes the provider's imported samples and the related consent/integration record from CNET servers. On Android it also revokes this app's Health Connect permissions. Apple does not allow apps to revoke HealthKit permission programmatically; you can revoke it in iOS Settings or Health. Source records stay in Apple Health or Health Connect. Account deletion removes account-linked copies within 30 days. Your data export includes readable imported samples and consent metadata, but never provider tokens, encryption keys, or ciphertext. Withdrawing consent does not affect processing already lawfully performed.

21. Face data, photographs and video

Scope and collection. Photographs and videos you choose to upload or transmit can contain your face or another person's face. A profile photograph is required for a CLIENT account; other media is submitted when you use the relevant upload, camera or call control. We use ordinary images for the profile, post, check-in, story or message you request, and for content-safety moderation. A face visible in an image is not a biometric template. No native iOS biometric collection. Native iOS has no identity-verification, liveness, face-recognition or app-provided Face ID sign-in feature. Apple may use device biometrics to authorise Sign in with Apple; Community Network receives the authorisation credential, never Face ID sensor images or Apple's biometric templates. We do not derive facial landmarks, geometry, embeddings, faceprints or biometric identifiers from ordinary media. There is therefore no Community Network Face ID or native biometric dataset to retain, share or delete. Recipients and purposes. Ordinary uploaded media is processed by Community Network and its hosting, object-storage and delivery providers, including DigitalOcean and Cloudflare, and shown to the audience of the feature you choose. Images submitted to profile, post, check-in and ordinary chat upload paths may also be transmitted to OpenAI's moderation API for prohibited-content classification. This produces safety categories and scores, not identification, face matching or an assessment of a person's character. It is separate from optional AI-chat consent; turning off optional AI assistance does not turn off upload moderation. End-to-end encrypted Secret Chat images remain encrypted for the service and are not sent for server-side image moderation. Live video. Camera video is transmitted to the participants in your call, directly or through the connection relay. Community Network does not record live calls or extract biometric face data from them. Turning the camera off or leaving the call stops your video transmission. This differs from a video you deliberately upload as saved content. Storage and retention. Uploaded originals and server-generated resized copies are stored for the content's lifetime, until its deletion or the account-erasure process. A story's 24-hour display window is not a promise that its underlying check-in media has already been erased. Deleting a profile image removes its stored original and generated resized copies. Account deletion makes the account unavailable immediately; the remaining account-linked media is removed during the deletion process within 30 days. Operational backups age out within 30 days after primary erasure. We cannot erase copies another person has independently downloaded or recorded. Moderation retention. Community Network does not create a separate image archive for moderation; it may retain the resulting safety categories and decisions under the security and anti-abuse periods in Section 10. OpenAI documents the /v1/moderations endpoint as not using submitted data for model training and as having no ordinary abuse-monitoring or application-state retention. Applicable legal requirements remain binding. Provider details: https://developers.openai.com/api/docs/guides/your-data. This statement is specific to moderation, not a claim that every AI service has zero retention. Verification outside native iOS. Where optional Sumsub verification is offered, document images, selfie or liveness video and biometric face templates go directly to Sumsub for identity verification and fraud prevention, as described in Sections 3, 9 and 10. Community Network receives review-event metadata, not those biometric materials. Legacy manual selfie-verification images, if present, are stored privately by Community Network for authorised human review, not automatic face recognition; they remain until a deletion request or account erasure. Neither verification flow is available in native iOS. Deletion and withdrawal. Remove a profile image in Profile → Photos, delete the original post or check-in where applicable, or use Profile → Privacy → Delete account. You may request deletion of face-containing media, legacy verification images or Sumsub verification data, or withdraw verification consent, by emailing privacy@communitynet.app. We handle provider-held verification deletion through the privacy-request procedure described in Sections 10 and 12, including any legally required retention. Revoking camera or photo-library permission in device settings prevents future use of that permission but does not erase already uploaded media; uninstalling the app is also not a deletion request. Equal protection. Every third-party processor to which we disclose face-containing images or biometric face data is required to provide the same or equal protection as this Policy, including the stated purpose, security, retention and deletion limits. We do not sell biometric face data or use it for advertising, people recommendations or model training.

22. Check-ins at places and historical image contributions

Check-ins at places. On the Map you can check in at a landmark or a lost place. When you tap "Check in here", the app asks your device for its location once and sends the coordinates and their reported accuracy to our server with that request. The server uses them only to verify that you are within the place's check-in radius and that the location fix is precise enough, and then discards them: coordinates and accuracy are not stored, not logged and not shown to anyone. We store the place (its catalogue identifier), the time of the check-in, the optional photo and message you add, and the audience you choose. A successful check-in also updates your Map Passport counters and reveals the coarse map area around the place itself, not around your position. Who sees a check-in. You always see your own check-ins. With the default audience "Friends", your accepted friends see your name, profile photo, the time and the optional photo and message in the place card; with "Only me" nobody else sees it. Blocked accounts never see it, in either direction. Other members may see only an aggregate number of distinct visitors of a place, shown when at least five people have checked in there, without names. Photos attached to check-ins pass the same content-safety moderation as other uploads (Section 21) and are stored as re-encoded images without camera metadata. Deleting check-ins. You can delete any of your check-ins in the place card; its photo is deleted with it. Account deletion removes all your check-ins and their photos as described in Section 10. Legal basis: performance of the contract for the feature you request (GDPR Art. 6(1)(b), 152-FZ Art. 6(1)(5)). The one-time location check happens only after your explicit tap and with your device location permission, which you may refuse. Historical image contributions. You may submit an old photograph, engraving, painting, map or plan, postcard or document showing a place. We process the image and the information you provide — type, year or period, caption, creator, institution, source link, the rights basis you declare, the chosen license, whether you want to be credited by name, and your rights confirmation — together with your account identifier and the submission time. The image is re-encoded, its embedded metadata (including EXIF and location data) is removed, and it is kept in private storage until it is reviewed. It is sent to OpenAI's moderation API for content-safety classification as described in Section 21 and is then reviewed by a Community Network moderator, who sees the image, the information above and your account details. Publication. If approved, the image and its information are published in the place's evidence gallery and are visible to all users and visitors of the Platform, under the license you selected (or the original license of third-party material), with the creator and source you stated. Your display name is shown only if you opted in to be credited; otherwise the item is labelled as added by a member. If rejected, the image is deleted. You receive an in-app notification about the decision. Removal. You may ask us to remove a published contribution at any time by writing to privacy@communitynet.app; rights holders may write to dmca@communitynet.app. Account deletion removes your pending and published contributions within the period stated in Section 10. Removal from the Platform cannot recall copies that others have lawfully made under an open license you granted. Legal basis: performance of the contract (publication at your request) and our legitimate interest in keeping the Platform lawful and safe (moderation).