Privacy Policy

1. Who we are

Catch of a Lifetime® ("we," "us," "our") is an activity-first social platform for outdoor enthusiasts. This Privacy Policy explains how we collect, use, and protect your personal information when you use our website (catchofalifetime.com) or application (demo.catchofalifetime.com).

2. Information we collect

Account information: When you register, we collect your name, email address, and password (stored as a secure hash — we never store your plain-text password).

Profile information: You may optionally provide your username, bio, city/state, interests, MBTI type, and a profile photo. This information is visible to other members according to your privacy settings.

Activity data: We record your in-app activity including check-ins, Ember Points earned, streak data, Tribe memberships, Event RSVPs, and match history. This data powers personalization and the gamification layer.

Photos and media: Photos you upload are stored securely in object storage (MinIO / S3-compatible) and associated with your profile.

Location data: If you enable location features (Adventure Map, Events), we use approximate location to show nearby content. We do not continuously track or store precise location history.

Communications: Messages you send to other users through Campfires or Direct Messages are stored to deliver the service. We do not read private messages except when required to investigate reported violations.

Device and usage data: We may collect browser type, IP address, referring URLs, and pages visited to improve the platform and diagnose issues.

3. How we use your information

• To operate and deliver the platform (tribes, campfires, sparks, events, gamification)
• To recommend connections, tribes, and events based on shared interests and activity
• To send transactional emails (account verification, match notifications, event reminders)
• To process payments and manage subscriptions (via Stripe — see Section 5)
• To improve the platform through anonymized analytics and aggregated usage data
• To enforce our Terms of Service and investigate reported violations

4. Information sharing

We do not sell your personal information. We do not share your data with third-party advertisers. We share data only in these limited circumstances:

• Other users: Your public profile information (name, photo, interests, location city) is visible to other members in accordance with your privacy settings.
• Service providers: We share data with infrastructure providers who help operate the platform (cloud hosting, object storage, email delivery). These providers act under data processing agreements and may not use your data for their own purposes.
• Stripe: When you subscribe to a paid plan, payment processing is handled by Stripe. We share only the information necessary to complete the transaction. Stripe's privacy policy governs their handling of payment data.
• Legal requirements: We may disclose information if required by law or to protect the rights, safety, or property of users or the public.

5. Payments

Paid subscriptions are processed through Stripe. We never store your full card number or CVV. All payment data is handled directly by Stripe on their secure infrastructure. We retain billing records (amount, plan, dates) for accounting purposes.

6. Data retention

We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal or accounting obligations. Messages you sent to other users may remain visible to those recipients.

7. Your rights

• Access: You may request a copy of the personal data we hold about you.
• Correction: You may update your profile information at any time in Settings.
• Deletion: You may delete your account from Settings → Account → Delete Account. This removes your profile and personal data as described above.
• Portability: You may request an export of your data in a machine-readable format.
• Opt-out: You may opt out of non-transactional emails at any time via the unsubscribe link in those emails.

To exercise any of these rights, email privacy@catchofalifetime.com.

8. Security

We use industry-standard security practices: HTTPS for all traffic, bcrypt password hashing, JWT tokens with expiration, and access controls limiting which services can reach which data. No system is perfectly secure; we will notify you promptly if a breach affects your personal data.

9. Children

Catch of a Lifetime is intended for users 18 and older. We do not knowingly collect personal information from minors. If you believe a minor has created an account, please contact us at privacy@catchofalifetime.com and we will promptly remove the account.

10. Beta service notice

The platform is currently in private beta. Features, data practices, and this Privacy Policy may evolve as we develop the service. We will notify registered users of material changes by email before they take effect.

11. Cookies

We use a single session cookie to keep you logged in. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. We do not use Google Analytics or similar surveillance-advertising tools.

12. Contact

For privacy-related questions, requests, or concerns, contact us at privacy@catchofalifetime.com. We respond within 5 business days.