Privacy Policy

Last updated: 2026-05-28

This Privacy Policy explains what data Thoosie collects, why we collect it, who can see it, and how you can control it. It applies to the Thoosie iPhone app, the Thoosie Apple Watch app, the Thoosie WidgetKit extensions, and all services hosted at thoosie.app.

If you don't read another section of this document, read this one:

TL;DR. We collect the minimum amount of data needed to make the features you choose to use work. We do not sell your data. We do not use third-party advertising trackers. You control who can see your location through a tier-based sharing model. You can delete your account at any time and we will erase your personal data within 30 days, except where retention is required by law.

1. Who we are

Thoosie is operated by Ben Brooks (sole proprietor) doing business as Thoosie. You can reach us at privacy@thoosie.app or via the in-app "Contact Support" link.

2. Data we collect

2.1 Account data

Apple Sign-In identifier (sub) — your stable identifier with Thoosie; never leaves our servers
Display name — what you set during onboarding; visible to other users
Email address — only if you choose to share it via Apple Sign-In; used only for account recovery and support
Date of birth (year of birth at minimum) — required to enforce age-appropriate feature gating (see §6, Minor Protection)

2.2 Location data

We use precise location ONLY when you actively use a feature that needs it. We never collect location in the background outside of an active Park Day session.

Park presence — coarse geofence check to confirm you're at a participating theme park
Ride detection GPS stamp — single point at the moment a ride is detected, used to confirm the ride attribution
Tier-based location sharing — see §4 for who sees what
Ad-hoc location share — when you tap "Send my location to Sarah for 1 hour," we share your live location with that specific person for that duration only
Find Riders Nearby — when the Find Riders page is open AND you're inside a park geofence, your location is briefly visible to other users who ALSO have the page open in the same park. Closing the page removes you from the discoverable pool within 60 seconds.

2.3 Motion sensor data

Accelerometer and gyroscope traces from your iPhone or Apple Watch are collected during a ride to detect which coaster you rode. This is NOT HealthKit data — we never read your heart rate, steps, or workouts. Motion samples are deleted after the ride is identified and stored as a row in your ride history.

2.4 User-generated content

Ride reviews, club posts, daily-challenge submissions
Photos and videos you upload to your profile, club, or recap
Pin locations you drop on the in-park map

You retain ownership of everything you post. We display it to the audience you choose at post time.

2.5 Audio data — Push-to-Talk

When you use Push-to-Talk (PTT) with a Family or Close Friend channel, your voice is streamed live through our audio relay (LiveKit, self- hosted on our infrastructure) to the listeners on that channel.

Audio is NOT stored. We do not write PTT audio to disk. Once the audio packets reach the listeners, they are discarded. We retain only ephemeral channel metadata (who joined when) and that metadata is deleted within 24 hours.

PTT is only available to Family members and Close Friends — never to regular Friends or strangers.

2.6 Creator account links (optional)

If you choose to become a Verified Creator (so you can receive tips), you can link a YouTube, TikTok, or Instagram account via OAuth. We store only the linked account's platform-specific ID (e.g. creator_youtube_id). We do NOT store:

Your videos, posts, or content from those platforms
Your follower count or follower lists
Your messages or comments
Your platform login credentials

You can unlink any platform at any time from Settings → Creator Verification. Unlinking immediately removes your Verified Creator status if no other platform remains linked.

2.7 Purchase data

StoreKit-reported purchase receipts for in-app purchases (THOOSIE credit packs, optional subscriptions)
THOOSIE credit balance + transaction history

2.8 Diagnostic data

If SENTRY_DSN is configured, we collect crash reports and performance traces tagged with an opaque user identifier (not your name or email). Used solely to find and fix bugs.

3. Data we do NOT collect

We do not use the iOS Advertising Identifier (IDFA)
We do not call ATTrackingManager or any tracking SDK
We do not share data with third-party advertising networks
We do not read your iOS contacts, photos library (beyond what you explicitly pick), HealthKit, or messages
We do not collect background location outside of an active Park Day
We do not store PTT audio
We do not see content from your linked creator platforms

Each person you follow on Thoosie belongs to exactly ONE tier:

Tier	What that person sees of you
Family	Your precise location while in a park, family-safety alerts (separation, wristband), your achievements in their newsfeed, all features
Close Friends	Your precise location while in a park, the pins you drop, your at-park status
Friends	An "at the park" badge only — no precise location
No follow	Public profile only (display name, optional bio, public posts)

Tier is set when you accept a follow request and is changeable at any time from the friend's profile via the … menu. A person is never in two tiers at the same time. Demoting (e.g. from Close Friends to Friends) revokes location visibility immediately.

Ad-hoc location share is a separate mechanism: you can grant any specific friend access to your precise location for 15 minutes, 1 hour, 4 hours, or until end-of-day, regardless of their tier. You can revoke the share early from the friend's profile.

5. Find Riders Nearby

The Find Riders Nearby feature is a mutual-opt-in proximity finder that works as follows:

Open the page → you become discoverable to other users with the page also open who are within ~100 meters and in the same park
Close the page → within 60 seconds, you drop out of the discoverable pool
Tapping a discovered rider sends them a follow request; they choose whether to accept and at which tier

You are never discoverable when you do not have this page open. You are never discoverable outside of a park geofence. Heartbeat data expires every 60 seconds.

6. Minor protection

We do not knowingly collect personal information from children under 13 without verifiable parental consent.

COPPA-compliant features (under 13)

If your date of birth indicates you are under 13:

Push-to-Talk: Limited to the Family channel only. Per-friend ad-hoc PTT is disabled. The Family channel is enrolled by a parent through the family-setup flow on the parent's verified-age Thoosie account, which constitutes verifiable parental consent for the child's audio communication under COPPA's parental consent framework (16 CFR §312.5). The parent can revoke access at any time by removing the child from the family group.
Voice messages, location sharing with non-family, Creator Verification, Tipping: All disabled.
Find Riders Nearby: Disabled.

Ages 13–17

Older minors have the same access as adults, except that Creator Verification and Tipping require account age ≥ 7 days plus a parental acknowledgment screen.

Ages 18+

Full access.

7. Creator Tipping

If you have linked at least one creator platform (YouTube, TikTok, or Instagram), you become eligible to receive THOOSIE tips from other users on content you author. Senders are limited to 5 tips/day, 1–50 THOOSIE per tip, and must have an account at least 7 days old.

Receivers have a daily inbound cap. Transactions above a trusted- creator threshold may be reviewed for anti-money-laundering compliance related to the THOOSIE-to-XRPL conversion path. If you choose to convert THOOSIE to XRP through the Claim feature, you may be subject to additional identity verification per applicable financial regulations.

You can turn off tipping for your content at any time from Settings.

8. Data retention

Account data: retained until you delete your account
Ride history: retained as long as your account exists; you can delete individual rides
PTT audio: never stored
PTT channel metadata: deleted within 24 hours
Location samples: retained only for the active session; trip history shows park visits not raw points
Discovery (Find Riders) heartbeats: expire every 60 seconds
Diagnostic data: retained 90 days

We share data ONLY with:

Apple (for Sign-In, push notifications, StoreKit, App Privacy reporting) — strictly necessary for app function
Cloudflare (CDN + DDoS protection for our API) — Cloudflare does not see decrypted body content for authenticated requests
Sentry (crash reporting) — opaque user ID only, if configured
OAuth platforms (YouTube/TikTok/Instagram) — only your OAuth identifier, only when YOU choose to link an account
LiveKit (audio relay, self-hosted on our VPS) — ephemeral audio streams only, not stored

We do NOT share data with advertising networks, data brokers, or any third party for marketing or profiling purposes.

10. Your rights and choices

10.1 Access and portability

You can request a copy of all data we hold about you by emailing privacy@thoosie.app. We will respond within 30 days.

10.2 Deletion

You can delete your account at any time from Settings → Account → Delete Account. All personal data will be erased within 30 days except where retention is required by law (e.g. financial transaction records under AML rules).

10.3 Correction

You can edit your profile data directly in the app at any time.

You can disable location sharing globally from Settings → Privacy → Location Sharing. You can also revoke any specific friend's tier access by demoting them via the … menu on their profile.

10.5 Push-to-Talk

You can leave the Family channel at any time. You can decline incoming PTT invitations.

10.6 Creator verification

You can unlink any platform from Settings → Creator Verification. Unlinking takes effect immediately.

10.7 Children's data (under 13)

If you are a parent and believe your child has provided personal information to Thoosie without your consent, please contact privacy@thoosie.app and we will delete that data within 7 days.

We are based in the United States. If you access Thoosie from outside the US, you consent to the transfer of your data to the US for processing.

If you are an EU resident, you have additional rights under the GDPR including the right to object to processing, the right to data portability, and the right to lodge a complaint with your national data protection authority. Contact privacy@thoosie.app to exercise any of these rights.

California residents

California residents have rights under the CCPA including the right to know what personal information we collect, the right to delete, and the right not to be discriminated against for exercising these rights. We do not sell personal information.

12. Security

We use TLS 1.3 in transit and AES-256-GCM at rest for sensitive fields. Authentication tokens are short-lived (24 hours by default). Payment data is handled exclusively by Apple's StoreKit — we never see card numbers.

We are a small operation and cannot guarantee perfect security; if you discover a vulnerability, please report it to security@thoosie.app.

13. Changes to this policy

We will update this policy when we add new features or change how we handle data. The "Last Updated" date at the top will reflect the most recent change. Material changes (new data categories, new sharing) will be announced via in-app banner at least 7 days before they take effect.

14. Contact

Topic	Address
General privacy questions	`privacy@thoosie.app`
Security disclosures	`security@thoosie.app`
Account deletion / data access	`privacy@thoosie.app`
In-app	Settings → About → Contact Support