Privacy Policy

1. Who we are and how to contact us

agn ("agn", "we", "us", or "our") is a daily social video app. Each day you receive a fresh personal timeline of short video clips (your own and a friend's), a timeline for your city, and timelines for live events, all set to one shared daily song.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have over it.

• Service operator (legal entity): [TO CONFIRM legal entity name]
• Contact email for privacy questions: [TO CONFIRM contact email]
• Postal address (if required in your jurisdiction): [TO CONFIRM postal address]
• Data controller for GDPR purposes: [TO CONFIRM legal entity name]
• App: agn, bundle identifier com.mathiasadam.agn.app, version 1.0
• Website: https://agn.madgraphism.com

If you have any questions about this policy or about your data, contact us at [TO CONFIRM contact email].

2. What data we collect and why

We only collect data we need to operate agn. The table below mirrors the data practices declared in our App Store privacy label. All of the data below is linked to your identity, and none of it is used to track you across other companies' apps or websites.

We do not knowingly collect any data we have not described here. We do not collect payment information in version 1.0.

3. How we use your data

We use the data described above to:

• create, operate, and secure your agn account;
• build your daily personal timeline, your city timeline, and live event timelines;
• play the single shared daily song over clips;
• show your clips to the people described in Section 5 (friends, city, events);
• suggest friends to you and help friends find you (see Section 4);
• send notifications you have allowed (for example the daily song drop, friend requests, new clips, reactions, and reminders);
• maintain safety, including handling reports and blocks (see Section 9);
• diagnose problems and improve reliability, where diagnostics are collected (see the conditional row in Section 2);
• comply with legal obligations.

We rely on the following legal bases under the GDPR where it applies: performance of our contract with you (operating the app you signed up for), your consent (for example device permissions such as camera, microphone, contacts, location, and push notifications, which you can grant or deny in iOS settings), and our legitimate interests (keeping the service safe and functional). [TO CONFIRM] the exact legal-basis mapping with counsel for your jurisdiction.

4. How contact matching works (SHA256 hashing)

Finding friends is privacy-first. If you choose to enable contact matching:

• Phone numbers from your address book are converted into SHA256 hashes on your device before anything leaves it.
• We never receive, store, or are able to read the raw phone numbers from your contacts. Only the resulting 64-character hexadecimal hashes are sent.
• Your own phone number, if associated with your account, is likewise stored only as a SHA256 hash (phoneHash).
• We compare hashes to hashes to find mutual matches and suggest friends. The hashed values are stored under your account (syncedContacts) and in a lookup table (reverse_contacts) used only for friend discovery.
• We do not sell this data and do not use it for advertising.

You can decline the contacts permission, and you can change it at any time in your device settings. Contact matching simply will not run without it.

5. How your data is shared with other users

agn is a social app, so some of your content is shown to other people by design:

• Clips you post can appear in your friends' personal timelines, in your city timeline (visible to other people in your city), and in live event timelines (visible to others in that event).
• Your profile (username, display name, profile photo, bio) is visible to people who can see your account, and your reactions are visible on the clips you react to.
• Blocked users are removed from your graph and hidden from your search and recommendations.

Consider any clip you post to a city or live event timeline to be visible to people beyond your immediate friends. Do not film or upload anything you are not comfortable sharing in that context.

6. Third parties and processors

We use a small number of service providers ("processors") to run agn. They process data on our behalf under their own terms and security commitments.

• Apple. Sign in with Apple provides your account identifier and, if you allow it, your name and your real or Apple private relay email address. The app also loads short Apple Music previews to play the shared daily song. Your use of Apple services is also governed by Apple's privacy policy.
• Google / Firebase. We use Firebase (a Google service) for authentication, database (Firestore), file storage (Storage), serverless functions (Cloud Functions), and push messaging (Firebase Cloud Messaging). Firebase processes account data, your clips and thumbnails, hashed contacts, clip place names, and your push token to provide these features.
• Diagnostics provider (conditional). [TO CONFIRM] If a crash or performance SDK is linked, that provider (for example Firebase Crashlytics or Performance Monitoring) processes crash and performance data.

We do not sell your personal data, and we do not share it with third parties for their own advertising or cross-app tracking. The app does not include a third-party advertising or attribution SDK.

7. Data retention

We keep your personal data for as long as your account is active and as needed to provide agn. Specific retention details:

• Account data and content are retained while your account exists.
• When you delete your account (see Section 8), we delete or de-identify your personal data, subject to limited copies we may need to retain for legal, security, or backup reasons for a limited period.
• Hashed contact data is retained only for as long as needed for friend discovery.

[TO CONFIRM] the exact retention periods (for example backup retention windows and any legally required retention) with counsel.

8. Your rights and choices

Depending on where you live, you may have some or all of the following rights: access to your data, correction, deletion, restriction of or objection to certain processing, and data portability (GDPR), and the right to know, delete, correct, and opt out of "sale" or "sharing" of personal information (CCPA / CPRA). We do not sell or share personal information as those terms are defined under CCPA / CPRA.

You can exercise core rights directly in the app:

• Delete your account and data. Go to Settings and choose Delete Account. This removes your account and associated personal data as described in Section 7.
• Control permissions. Camera, microphone, contacts, location, photos, and push notifications can each be granted or revoked in your device settings.
• Block and report. You can block users and report content from within the app (see Section 9).

To make any other request, or to ask a question about your data, contact us at [TO CONFIRM contact email]. We will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your local data protection authority. If you are in the EU or UK and we are required to designate a representative, our representative is [TO CONFIRM EU/UK representative, if applicable].

9. User content and safety

agn relies on user-generated content, and we take safety seriously:

• You can report a clip you find objectionable. Reported clips are flagged and hidden, and we review reports.
• You can block other users. Blocked users are removed from your graph and hidden from search and recommendations.
• We reserve the right to remove content and remove or suspend accounts that violate our terms (see the End User License Agreement).

For more on prohibited content and enforcement, see our EULA at [TO CONFIRM EULA URL].

10. Children

agn is rated 17+ and is not directed to children. We do not knowingly collect personal data from children under the age required by law in your region (for example under 13 in the United States, or the applicable age of digital consent under the GDPR). If you believe a child has provided us personal data, contact us at [TO CONFIRM contact email] and we will take appropriate steps to delete it.

11. Security

We use industry-standard measures to protect your data, including encryption in transit (HTTPS / TLS) between the app and our backend, access controls on our backend through our service providers, and server-side rules that restrict who can read and write data. Contact phone numbers are hashed on-device and never stored in readable form (see Section 4). No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

12. International data transfers

We and our processors (notably Apple and Google / Firebase) may store and process your data in countries other than the one where you live, including the United States. Where required, we rely on appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses. [TO CONFIRM] the specific transfer mechanisms and processing locations with counsel.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top and, where appropriate, notify you in the app or by other means. Your continued use of agn after an update means you accept the revised policy.

14. Contact

Questions, requests, or complaints about this policy or your data can be sent to:

• [TO CONFIRM legal entity name]
• Email: [TO CONFIRM contact email]
• Address: [TO CONFIRM postal address]

This policy is governed by the laws of [TO CONFIRM governing jurisdiction].