Privacy Policy

Collectivus LLC, doing business as "Collectivus" ("Collectivus," "we," "our," or "us"), is a limited liability company registered in the State of Texas, United States of America. We operate the Collectivus website, any associated applications, and all related features and services (collectively, the "Service").

Questions, requests, or concerns about this Privacy Policy can be directed to us at: [email protected]

Information you provide directly

• Name — optional, when joining the waitlist.
• Email address — required when joining the waitlist or creating an account.
• Phone number — when joining the waitlist. Used to send a single early access notification via SMS when access opens.
• Account — if you have an account on our website: your email address and when you signed in and last used the website.
• Invite code — entered when claiming early access. Not stored as personal data; verified and discarded.

Information collected automatically when you use the Service

• Usage data — which parts of the Service you visit, time spent, navigation paths, and similar interaction data.
• Loop progression data — discoveries, interactions, and session state within Loops. This data powers the persistence mechanic (the world knows what you've found).
• Device and environment information — device type, operating system, browser type and version, screen resolution, and IP address.
• Log data — server logs, error reports, and timestamps associated with your sessions.
• Website use — our website may count the pages you open and, while a Loop plays, which Loop, how much of it is on screen, whether the page is in front and the sound on, how the Loop's objects, including a sponsor's, are seen and used, and the kind of browser. This counting uses no cookie or anything else that recognises your browser later. The reports go to our own servers on Amazon Web Services, which do not keep your IP address, and are kept for 395 days.
• Codes and short links — if you scan one of our codes or open one of our short links, we may count the time, the code and the kind of browser, without your IP address, on our own servers on Amazon Web Services, for 395 days. If you then join the waitlist, the code is kept with your sign-up.

Information received from third parties

• Authentication providers — if you sign in using Apple Sign-In, we receive limited profile information (name and email) as permitted under Apple's policies. Clerk, our authentication provider, processes your credentials on our behalf.
• Analytics providers — we may receive aggregated and anonymized data about how users find and interact with the Service from analytics tools. See Section 6 (Cookies and Tracking) for current tools.

We collect information in three ways:

Directly from you — when you join the waitlist, create an account, enter an invite code, or contact us with a question or request.

Automatically — through cookies, local storage, and similar technologies when you access and use the Service. See Section 6 for details.

From third-party providers — authentication providers (Clerk), analytics tools, and other services we use to operate the Service share limited information with us as described in their respective privacy policies and in our agreements with them.

We use the information we collect for the following purposes:

• To provide and operate the Service — creating and managing your account, authenticating your identity, delivering Loop content, and maintaining your session and progression data so the world continues where you left it.
• To send waitlist and early access communications — notifying you of character drops, Loop previews, and your early access invitation via the email address and phone number you provided, where you have opted in to those communications.
• To send a single SMS invitation — when early access opens, we will send one text message to your phone number if you provided it and consented. We do not send recurring SMS marketing without separate consent.
• To improve the Service — analyzing usage patterns, diagnosing technical issues, and understanding how the Service is used in order to make it better.
• To enforce our Terms of Use — investigating potential violations and protecting the security and integrity of the Service.
• To comply with legal obligations — responding to lawful requests from government authorities, courts, or regulators.

We do not sell your personal information. We do not use your personal information for targeted advertising or cross-context behavioral advertising.

We may share aggregated, anonymized audience data (for example, demographic and usage trends that cannot identify any individual) with brand partners for sponsorship and partnership purposes.

We rely on the following third-party services to operate the Service. Each processes personal data on our behalf under agreements that restrict their use of that data. Each is subject to their own privacy policy.

• Clerk — Authentication provider. Handles account creation, magic link login, SMS one-time passwords, and Apple Sign-In. Clerk processes your email address and phone number to operate these features.
  Privacy Policy: https://clerk.com/legal/privacy
• Cloudflare — Network provider. Handles network traffic, DNS, security, performance, and reliability services. Cloudflare maintains log data about events on its network. Data may be processed by Cloudflare in the United States or Europe.
  Trust Hub: https://www.cloudflare.com/trust-hub/
• Sentry — Crash reporting for our apps for iPhone, iPad, Mac and Apple TV, provided by Functional Software, Inc. d/b/a Sentry. Receives the apps' usage events and crash reports described in "Our Apps", none of them linked to a person. Data is stored in the United States.
  Privacy Policy: https://sentry.io/privacy/
• Apple — If we invite you to test our apps through TestFlight, we give Apple your email address so it can send the invitation. From our waitlist, we invite only people who asked to hear about early access by email. Apple then shows us your TestFlight activity — installs, sessions, crashes and any feedback you send, with your device's model and settings — together with your email address and, if Apple has it, your name. Accepting a TestFlight invitation is covered by Apple's privacy policy and TestFlight's terms. Leaving our email list does not remove you from TestFlight; select the "Stop Testing" option in TestFlight to remove yourself from TestFlight as well.
  Privacy Policy: https://www.apple.com/legal/privacy/
• Amazon Web Services (AWS) — Hosts our website, stores waitlist entries, accounts, and enquiries sent through our contact forms, sends the emails we send you, delivers content to our apps, and stores the usage reports described in Section 2 and "Our Apps". Data is stored in the United States.
  Privacy Policy: https://aws.amazon.com/privacy/

No third-party service listed here is authorized to use your personal information for their own purposes beyond operating the feature for which they were engaged.

We use cookies and similar technologies to operate and improve the Service. The cookies we use fall into the following categories:

• Strictly necessary cookies — Required for the Service to function. These include session tokens and authentication state. You cannot opt out of these while using the Service; they are essential to basic functionality.
• We do not currently use advertising cookies, retargeting pixels, or third-party tracking technologies for behavioral advertising purposes.
• Your cookie controls — You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent the Service from functioning correctly.

All users

You have the following rights with respect to your personal information:

• Access — You may request a copy of the personal information we hold about you.
• Correction — You may request that we correct inaccurate or incomplete information.
• Deletion — You may request deletion of your account and associated personal information.
• Opt out of email — Leave our email list at any time with the form at https://collectivus.com/early-access#unsubscribe or the leave link in our marketing emails. Leaving deletes your waitlist entry, phone number included, from our database.
• Opt out of SMS — You may stop SMS messages at any time by replying STOP to any text message we send. You can also request removal via [email protected].

To exercise any of these rights, contact us at: [email protected]. We will respond within the timeframe required by applicable law.

California residents (CCPA / CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• The right to know what personal information we have collected about you, including the categories of information, the purposes for collection, and the third parties with whom it has been shared.
• The right to delete personal information we have collected from you, subject to certain exceptions.
• The right to correct inaccurate personal information.
• The right to opt out of the sale or sharing of personal information. We do not sell personal information and do not share it for cross-context behavioral advertising.
• The right to non-discrimination for exercising these rights.

To submit a CCPA request, contact us at [email protected]. We will verify your identity before processing requests. California residents may designate an authorized agent to make requests on their behalf.

Texas residents (TDPSA)

If you are a Texas resident, you have rights under the Texas Data Privacy and Security Act (effective July 1, 2024), including the right to confirm whether we process your personal data, access it, correct it, delete it, obtain a portable copy of it, and opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling. We do not sell personal data or process it for targeted advertising. To submit a request, contact [email protected].

Your information is stored and processed in the United States through the following services: Clerk (authentication), Amazon Web Services (database, transactional email, hosting for our apps, and usage reports), and Sentry (crash reports and usage events from our apps).

We implement reasonable technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, and loss. These include encryption in transit (TLS), access controls, and the use of reputable managed services with their own security programs.

No system can guarantee complete security. You are responsible for maintaining the security of your account and the confidentiality of your email address and phone number. If you believe your account has been compromised, contact [email protected] immediately.

Data retention — We retain personal information for as long as your account is active or as long as necessary to fulfill the purposes described in this policy. Upon account deletion, we will delete or anonymize your personal information within a reasonable period, except where retention is required by law or necessary for legitimate business purposes (such as fraud prevention or legal compliance). You may request deletion at any time by contacting [email protected].

The Service is intended for users aged 13 and older. We do not knowingly collect personal information from children under the age of 13.

If we become aware that a user under 13 has provided personal information, we will take prompt steps to delete that information from our records.

If you are a parent or guardian and believe that a child under 13 has provided personal information to Collectivus without your consent, please contact us at [email protected] and we will investigate and respond promptly.

Users between the ages of 13 and 17 should have a parent or legal guardian review these policies before using the Service.

If you are located in the European Economic Area (EEA) or the United Kingdom, the following applies in addition to the rest of this policy.

Data controller

Collectivus LLC, doing business as Collectivus, is the data controller for personal information collected through the Service. Contact: [email protected]

EU/UK representative

We have determined that we are not currently required to appoint an EU or UK representative under Article 27 GDPR and Article 27 UK GDPR, respectively. We rely on the exemption for controllers whose processing of EEA/UK personal data is occasional, does not involve large-scale processing of special categories of data, and is unlikely to result in a risk to the rights and freedoms of natural persons. We will revisit this assessment as the Service grows and will appoint a representative if required.

Lawful basis for processing

We process your personal information on the following lawful bases under Article 6 of the GDPR:

• Performance of a contract (Article 6(1)(b)) — to create and manage your account, authenticate your identity, and deliver the Service.
• Legitimate interests (Article 6(1)(f)) — to improve the Service, ensure security and integrity, diagnose technical issues, and communicate service-relevant updates. Our legitimate interests do not override your fundamental rights and freedoms.
• Consent (Article 6(1)(a)) — for marketing communications (email and SMS), for giving your email address to Apple for a TestFlight invitation, and for analytics cookies where consent is required. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Your rights under GDPR

You have the following rights, subject to applicable conditions and limitations:

• Right of access (Article 15) — to obtain a copy of your personal data and information about how it is processed.
• Right to rectification (Article 16) — to correct inaccurate or incomplete personal data.
• Right to erasure (Article 17) — to request deletion of your personal data in certain circumstances.
• Right to restriction of processing (Article 18) — to request that we limit how we process your data.
• Right to data portability (Article 20) — to receive your personal data in a structured, machine-readable format.
• Right to object (Article 21) — to object to processing based on legitimate interests, including for direct marketing.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact: [email protected]. We will respond within 30 days (one month), with the possibility of extension as permitted by law.

You also have the right to lodge a complaint with your local data protection supervisory authority. In the EU, find your authority at: https://edpb.europa.eu/about-edpb/about-edpb/members_en. In the UK, the relevant authority is the Information Commissioner's Office (ICO): https://ico.org.uk.

International data transfers

Your personal data is stored and processed in the United States. Transfers of personal data from the EEA or UK to the United States are subject to safeguards under Chapter V of the GDPR. We rely on the following mechanisms: Clerk participates in the EU–U.S. Data Privacy Framework (DPF) as certified by the U.S. Department of Commerce (verifiable at dataprivacyframework.gov). Amazon Web Services incorporates the European Commission's Standard Contractual Clauses (SCCs) into its GDPR Data Processing Addendum, which applies to customer data transferred outside the EEA. Sentry incorporates the Standard Contractual Clauses into its Data Processing Addendum. Apple relies on the Standard Contractual Clauses, as its privacy policy states. You may request a copy of applicable transfer safeguards by contacting [email protected].

This section describes what the Collectivus apps for iPhone, iPad, Mac and Apple TV ("the apps") collect.

The apps have no accounts. You do not sign in or give us your name, email address or phone number to use the apps.

What the apps send us. A short list of usage events. None contains free text or anything you type.

• The app was opened, with the kind of device (iPhone, iPad, Mac or Apple TV).
• A Loop was opened or closed, with which Loop and how long it ran.
• A download finished, with which Loop, whether it succeeded, its size and how long it took.
• The Loop Pool was loaded, with whether the app used its built-in copy, a saved copy or a new one.

We use these events to count how many devices use the apps, which Loops are opened and for how long, and whether downloads fail.

Crash reports. If an app crashes, it sends a crash report to Sentry, our crash-reporting provider. A crash report contains technical details of the crash, your device's model and settings (such as operating system version, language, region and time zone), and the app's activity just before the crash. We use crash reports to fix crashes.

Test copies of the apps. Copies we distribute for testing through Apple's TestFlight also do the following; the App Store copy does not.

• Each installation creates a random number and saves it on your device, so we can count returning devices. It is not derived from your device or anything about you, and it is not an advertising identifier. Deleting the app deletes it, and a reinstalled app creates a new one that we cannot connect to the old one.
• The app reports when each visit to a Loop starts and ends, and, while a Loop is on screen, sends a short report about every 15 seconds: whether the Loop is showing, whether its sound is on, and whether someone appears to be there. On Apple TV that means the remote was used, or the app was brought to the front, in the last 30 minutes; elsewhere it means the app is in front. The report never says which button was pressed.
• A Loop may also report how its objects, including a sponsor's, are seen and used: how long each was on screen and how much of the screen it filled, whether and how you interacted with it, how long a sponsored scene played and whether it finished, whether a sponsor's code or link was shown or opened, and whether you used the Loop's photo or share button (never the photo).
• Each report names the Loop, the kind of device, whether it is a test or App Store copy, the installation's random number, a random number for that visit, and when it was made.

These reports go to our own servers, hosted by Amazon Web Services in the United States, which processes them only on our behalf. Our servers do not keep the IP address of the device that sends them. The usage events listed above also go to Sentry; the installation's random number does not.

Who processes it. Sentry receives the usage events and crash reports on our behalf. It is the only third-party software built into the apps. Sentry is provided by Functional Software, Inc. d/b/a Sentry, under its data processing terms, and stores this data in the United States. Privacy Policy: https://sentry.io/privacy/. Amazon Web Services hosts our own servers (see Section 5).

How long we keep it. Sentry keeps usage events and crash reports for 30 days. Our servers keep the reports and usage events they receive for 395 days. Totals made from them, which contain no device's number, may be kept longer.

What is not collected.

• No name, email address, phone number or other contact details.
• No advertising identifier. Sentry creates a random identifier for each installation to count sessions that end without a crash, and test copies create the random number described above. Neither says anything about you, and deleting the app removes both.
• No location. We do not use your IP address to identify or locate you.
• No screenshots, screen recordings or performance profiling.
• The apps do not ask for access to your camera, microphone, motion, location, contacts or photos.

No tracking. The apps do not track you across other companies' apps or websites. Nothing they collect is linked to your identity, so the App Tracking Transparency prompt never appears.

Downloading Loops. The apps download content from our servers. Like any web service, our servers receive your IP address in order to deliver it. We do not keep logs of these requests.

What stays on your device. The Loops you have downloaded, a saved copy of the Loop Pool and its artwork, a few small settings that let the app pick up where you left off, and, in test copies, the random number. Deleting the app removes all of it.

Each device. The apps on iPhone, iPad, Mac and Apple TV collect the same things.

Children. The apps are rated 13+ on the App Store. They ask no one, including children, for personal information, and nothing they send is linked to a person.

Your choices and rights. Because the apps have no accounts and nothing they send is linked to you, we cannot tell which data came from your device, so we cannot look it up or delete it. We do not sell the data the apps collect or use it for targeted advertising, and we never give a sponsor or other brand partner a report about a single device; we may share totals. Deleting an app stops it sending anything. To ask about the apps' data, contact [email protected].

We may update this Privacy Policy from time to time to reflect changes in the Service, applicable law, or our data practices. When we make material changes, we will update the effective date at the top of this page. Where the change is significant — particularly where it affects how we use personal information you have already provided — we will notify you via the email address associated with your account before the change takes effect.

Minor updates that do not materially affect your rights will be effective upon posting.

Your continued use of the Service after any update constitutes your acceptance of the revised Privacy Policy. If you do not agree to a material change, you may request deletion of your account and data before the change takes effect.

For privacy-related questions, requests, or concerns — including requests to access, correct, or delete your personal information — contact us at:

Collectivus LLC d/b/a Collectivus
[email protected]

We will acknowledge your request within a reasonable period and respond within the timeframe required by applicable law.