Privacy Policy

Introduction

ARt_ifact ("we," "our," or "us") is operated by Enigmatic Solutions LLC. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the ARt_ifact mobile application (the "App"). Please read this policy carefully. By using the App, you agree to the collection and use of information in accordance with this policy.

Information We Collect

Information You Provide

• Account Information: When you create an account using Sign in with Apple, Google Sign-In, or email, we collect your name, email address, and profile information you choose to provide (display name, username, bio).
• User-Generated Content: Photos, videos, audio recordings, text, 3D models, and other content you create and place in AR scenes.
• Social Interactions: Comments, likes, follows, friend connections, and reports you make within the App.
• Communications: Messages you send to us for support at david.m@invisiblereality.org.

Information Collected Automatically

• Location Data: With your permission, we collect precise location data to anchor AR content to real-world locations and help you discover nearby content. We do not track your movements when the App is not actively in use for AR features.
• Device Information: Device model, operating system version, and unique device identifiers for app functionality.
• Usage Analytics: We use PostHog for in-app product analytics to understand how features are used and improve the App. This data is not shared with advertisers or used for cross-app tracking.
• Camera and Sensor Data: ARKit processes camera and motion sensor data entirely on-device. Raw camera feeds are never transmitted to our servers.

Information We Do NOT Collect

• We do not use the Identifier for Advertisers (IDFA)
• We do not engage in cross-app or cross-site tracking
• We do not sell your personal information to third parties
• We do not collect data from anyone under 18 — ARt_ifact is an adults-only service

How We Use Your Information

• To provide and maintain AR content placement and discovery features
• To enable social features (following, sharing, commenting)
• To moderate content and enforce our Community Guidelines
• To improve and optimize the App experience
• To send notifications you have opted into (new content, social activity)
• To respond to support requests

Data Storage and Security

Your data is stored using Apple's CloudKit infrastructure, which provides:

• Encryption at rest and in transit for all data
• Private database: Personal content is stored in your private iCloud container, accessible only to you
• Public database: Content you choose to share publicly is stored in a shared database
• On-device processing: ARKit spatial data and camera feeds are processed entirely on your device

Data Sharing

We do not sell your personal data. We may share information in these limited circumstances:

• With other users: Content you share publicly or with specific friends is visible to those users
• Service providers: PostHog (analytics), Firebase (authentication), Apple CloudKit (data storage) — these providers process data on our behalf under strict agreements
• Legal requirements: When required by law, legal process, or to protect rights and safety

Your Rights and Choices

• Access and Export: You can export all your data through the App's Settings > Data Export feature
• Deletion: You can delete your account and all associated data through Settings > Delete Account. This removes data from both private and public CloudKit databases
• Permissions: You can revoke camera, location, microphone, and photo library permissions at any time through iOS Settings
• Notifications: You can manage notification preferences in the App's settings
• Blocking and Muting: You can block or mute other users to control your experience

Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, provides you with the following rights regarding your personal information.

Categories of personal information we collect

• Identifiers: name, email address, username, account and device identifiers.
• Customer records: profile information you provide.
• Internet or network activity: in-app product analytics about feature usage.
• Geolocation data: precise location, only with your permission.
• Audio, visual and similar information: photos, videos, audio, and 3D content you create.
• User-generated content and social interactions: comments, likes, follows, reports.

We collect this information for the business and commercial purposes described in "How We Use Your Information."

We do not sell or share your personal information

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CPRA. We do not use or disclose sensitive personal information for purposes that would require us to offer a "Limit the Use of My Sensitive Personal Information" option.

Your rights

• Right to know / access the categories and specific pieces of personal information we have collected about you.
• Right to delete the personal information we have collected from you.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information (not applicable, as we do not sell or share).
• Right to non-discrimination for exercising your rights.

To exercise these rights, contact us at david.m@invisiblereality.org. We will verify your request using the email associated with your account. You may use an authorized agent to submit a request on your behalf with proof of authorization. You can also access and delete your data directly in the App via Settings > Data Export and Settings > Delete Account.

"Shine the Light" (California Civil Code §1798.83): We do not disclose personal information to third parties for their own direct marketing purposes.

UK and European Users (UK GDPR / EU GDPR)

If you are located in the United Kingdom or the European Economic Area, the UK GDPR and EU GDPR apply to our processing of your personal data. The data controller is Enigmatic Solutions LLC, contactable at david.m@invisiblereality.org.

Legal bases for processing

• Performance of a contract: creating and operating your account, delivering AR placement, discovery, and social features.
• Consent: precise location, camera, microphone, photo library access, and optional notifications. You may withdraw consent at any time.
• Legitimate interests: product analytics to improve and secure the App, content moderation, and preventing abuse — balanced against your rights.
• Legal obligation: responding to lawful requests and meeting compliance duties.

Your rights

You have the rights to access, rectification, erasure, restriction of processing, data portability, and to object to processing. Where processing is based on consent, you may withdraw it without affecting prior lawful processing. We do not carry out solely automated decision-making that produces legal or similarly significant effects about you.

International transfers

Your data may be processed in the United States by our service providers (Apple CloudKit, Google/Firebase, PostHog). Where data is transferred outside the UK/EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum and the EU Standard Contractual Clauses, or an applicable adequacy decision.

Data retention

We retain personal data for as long as your account is active or as needed to provide the service. When you delete your account, associated data is removed from our private and public CloudKit databases. Some records may be retained where required by law or to resolve disputes.

Right to complain

You have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ICO), ico.org.uk. In the EEA you may contact your local data protection authority.

Age Requirement (18+)

ARt_ifact is an adults-only service intended solely for users who are at least 18 years of age. Because the App includes location-based discovery of nearby people, public sharing tied to physical places, and user-generated content, it is not directed to and may not be used by minors. The App includes a date-of-birth age-verification step during onboarding, and access is blocked for anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy in the App and updating the "Effective Date" above. Your continued use of the App after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

Email: david.m@invisiblereality.org

Developer: Enigmatic Solutions LLC