Privacy Policy

1. Introduction

Throne Room LLC ("Company," "we," "us," or "our"), a limited liability company organized under the laws of the State of Idaho with its principal place of business in Twin Falls, Idaho, operates Throne Room at throneroom.app and through the Throne Room mobile applications for iOS and Android (together, the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

This policy describes our data practices. Where the law requires your consent for a specific processing activity — such as personalized advertising in the European Economic Area, the United Kingdom, and Switzerland — we ask for that consent separately and you may decline or withdraw it at any time. If you do not agree with the practices described here, please discontinue use of the Service.

2. Information We Collect

Information You Provide:

• Account information: email address, display name, password (hashed)
• Review content: text, star ratings, tags, and photographs
• Business owner verification: phone number (for SMS verification only)
• Communications: reports, support requests

Information Collected Automatically:

• Device information: browser type, operating system, device model, device identifiers
• Advertising identifiers (mobile apps only): the Apple Advertising Identifier ("IDFA") on iOS and the Google Advertising ID ("AAID") on Android. These are resettable identifiers assigned by your device's operating system. On iOS, we access the IDFA only if you grant permission through Apple's App Tracking Transparency prompt. On Android, you can reset or delete your Advertising ID in your device settings at any time.
• Usage data: pages visited, features used, timestamps, and interactions with advertisements (such as whether an ad was displayed or clicked)
• IP address and approximate location, derived from your IP address
• Precise location, only when you grant location permission, used to find restrooms near you
• Cookies and similar tracking technologies (see our Cookie Policy)
• A functional cookie recording whether you are using a web browser or one of our mobile apps, so we can serve the correct experience

Information from Third Parties:

• Google Places API: business names, addresses, phone numbers, photos
• OAuth providers (Google, Apple): email address and display name when you choose social sign-in

3. How We Use Your Information

• To provide, maintain, and improve the Service
• To display your reviews, ratings, and photos to other users
• To verify business ownership via SMS
• To moderate uploaded photographs for prohibited content
• To detect and prevent fraud, abuse, and Terms violations
• To communicate with you about your account and Service updates
• To process subscription payments and manage subscription entitlements
• To display advertising in our mobile apps to users who are not Premium subscribers. This includes serving advertisements, measuring their performance, limiting how often you see the same advertisement, and detecting invalid or fraudulent ad activity.
• To display personalized advertising, where you have consented or where permitted by applicable law. Personalized advertising uses information about your device and activity to select advertisements likely to be relevant to you. Where you decline, we serve non-personalized advertising instead, which is based on contextual signals such as your approximate location and the content you are viewing rather than your past activity.
• To comply with legal obligations

We do not use your review content, photographs, or account information to target advertising.

4. Service Providers and Partners

4.1 Service Providers (Processors)

These providers process personal information on our behalf and under our instructions:

• Supabase (Supabase Inc.): Database hosting, authentication, and file storage. Data is stored in Supabase-managed PostgreSQL databases with row-level security (RLS) policies enforced. Data may be processed in the United States. Supabase Privacy Policy
• Cloudflare (Cloudflare, Inc.): DNS, CDN, DDoS protection, and web analytics. Cloudflare processes IP addresses and request metadata to deliver and secure the Service. Cloudflare Privacy Policy
• Vercel (Vercel Inc.): Application hosting and deployment. Vercel Privacy Policy
• Twilio (Twilio Inc.): SMS and voice delivery for business owner verification. Phone numbers are transmitted to Twilio solely for sending verification codes. Twilio Privacy Policy
• Stripe (Stripe, Inc.): Payment processing for subscriptions purchased on the web. Stripe collects and processes your payment details directly; we do not store full payment card numbers. Stripe Privacy Policy
• Google (Alphabet Inc.) — Places API: business names, addresses, and photos used to populate business listings. Google Privacy Policy
• Google (Alphabet Inc.) — Cloud Vision API: automated moderation of uploaded photographs to detect prohibited content. Images are transmitted to Google for analysis and are not used by Google to train its models. Google Privacy Policy
• Google (Alphabet Inc.) — OAuth: authentication when you choose to sign in with Google. We receive your email address and display name. Google Privacy Policy
• Apple (Apple Inc.): Sign in with Apple authentication, and processing of in-app subscription purchases made on iOS. Apple Privacy Policy
• ipapi (Kloudend, Inc.): IP-based approximate location lookup, used to center the map near you when precise location is unavailable. Your IP address is transmitted to ipapi for this purpose. ipapi Privacy Policy

4.2 Advertising Partner

• Google AdMob (Alphabet Inc.): Serves advertisements inside our iOS and Android apps. AdMob collects and processes your advertising identifier, IP address, approximate location, device information, and information about your interactions with advertisements in order to select, deliver, and measure advertisements and to detect fraudulent activity. Depending on your consent choices and applicable law, Google may act as an independent controller of this information rather than solely as our processor. Learn more about how Google uses information from apps that use its services and Google's advertising practices.

Advertising is not served to Premium subscribers, and is not served on the throneroom.app website.

5. Data Sharing & Disclosure

Your reviews, ratings, display name, and photos are publicly visible to all Service users.

We do not sell your personal information for money. However, when we serve personalized advertising in our mobile apps, we share advertising identifiers and related device and usage information with Google for cross-context behavioral advertising. Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, and under comparable laws in other U.S. states, this activity may be considered "sharing" — and, under the broad definitions used by some state laws, may be considered a "sale" — even though we receive no money in exchange for your personal information. You can opt out at any time; see Section 8.

We may also disclose personal information:

• To our service providers listed above, solely to operate the Service
• To comply with applicable law, regulation, legal process, or governmental request
• To enforce our Terms of Service and protect our rights
• In connection with a merger, acquisition, or sale of assets (with prior notice)

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Account deletion takes effect immediately, not within 30 days.

Deleted immediately upon account deletion:

• Your login and email address
• Your display name and profile
• Uploaded photos, including the underlying image files
• Comments, bookmarks, and XP history
• Business verification documents
• Moderation logs, and records of your consent to our Terms and cookie preferences

Any business ownership claims associated with your account are also released.

Retained: Your reviews remain published but are permanently detached from your account and displayed as "Deleted User." They can no longer be linked back to you.

Advertising consent choices: Your advertising consent preferences are stored locally on your device by Google's User Messaging Platform, not in our database. Deleting your account does not erase them. To clear them, use the in-app "Privacy and cookie settings" option to change your choices, or uninstall the app.

Billing: Active Stripe subscriptions are cancelled and the associated Stripe customer record is deleted. Subscriptions purchased through Apple must be cancelled by you in your App Store account settings — we are unable to cancel an Apple subscription on your behalf. Payment and tax records are retained where required by law.

Because our database is backed up on a rolling schedule, residual copies of deleted data may persist in encrypted backups for a short period before being overwritten. We may retain anonymized or aggregated data for analytics purposes, and certain data may be retained longer where required by law.

7. Your Rights Under GDPR (EEA/UK/Switzerland Residents)

If you reside in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate personal data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restriction: Request that we restrict processing of your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
• Right to Lodge a Complaint: Complain to your local supervisory authority

Our legal bases for processing personal data are:

• Contract performance: providing the Service, managing your account and subscription
• Legitimate interests: security, fraud prevention, content moderation, and Service improvement
• Consent: cookies, marketing communications, and the storage of and access to information on your device for advertising purposes, including personalized advertising and advertising measurement
• Legal obligations: tax, accounting, and lawful requests

Advertising consent. When you first open our mobile app from a location in the EEA, UK, or Switzerland, we present a consent form powered by Google's User Messaging Platform. You may consent to personalized advertising, decline, or manage individual purposes. Declining does not restrict your access to the Service — you will see non-personalized advertising instead. You can change your choice at any time through "Privacy and cookie settings" in the app.

To exercise your rights, contact us at privacy@throneroom.app. We will respond within 30 days.

8. Your U.S. State Privacy Rights

Residents of California and of other U.S. states with comprehensive privacy laws may have the following rights:

• Right to Know / Access: Request disclosure of what personal information we collect, use, disclose, sell, or share
• Right to Delete: Request deletion of personal information we have collected
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt Out of Sale or Sharing: Opt out of the sale or sharing of your personal information for cross-context behavioral advertising, including targeted advertising
• Right to Non-Discrimination: We will not discriminate against you for exercising these rights

How to opt out of the sale or sharing of your personal information. In the Throne Room mobile apps, open "Privacy and cookie settings" and select the option to opt out. This is available at any time and does not require an account. Opting out means you will see non-personalized advertising rather than personalized advertising; the number of advertisements does not change. You may also reset or delete your advertising identifier through your device's operating system settings, or subscribe to Premium to remove advertising entirely.

No advertising is served on the throneroom.app website, and we do not sell or share personal information collected through the website.

Categories of personal information collected in the past 12 months: identifiers (email address, display name, IP address, advertising identifiers); commercial information (subscription and transaction records); internet or other electronic network activity information (usage data, device information, advertising interactions); geolocation data (approximate location, and precise location where you have granted permission); and user-generated content (reviews, photographs).

Categories shared for cross-context behavioral advertising: identifiers (advertising identifiers, IP address), internet or other electronic network activity information, and approximate geolocation data. These are shared with Google as described in Section 4.2.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

To submit a verifiable consumer request, email privacy@throneroom.app. You may designate an authorized agent to make a request on your behalf; we may require verification of the agent's authority.

9. Children's Privacy

The Service is not directed at children under 13 years of age, and we do not knowingly collect personal information from children under 13. Our app store listings carry an age rating of 13+. Advertising served in our apps is limited to content rated suitable for teen and older audiences, and we block advertising in sensitive categories.

We do not designate our Service or our ad requests as directed to children. If we discover that a child under 13 has provided us personal information, we will delete it promptly and disable the account. If you believe a child under 13 has provided us personal information, please contact us immediately at privacy@throneroom.app.

10. Security

We implement industry-standard security measures to protect your data, including: HTTPS/TLS encryption for all connections, bcrypt password hashing, row-level security (RLS) policies in our database, encrypted file storage, and regular security reviews. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. International Data Transfers

Your information may be transferred to and processed in the United States, where our servers and service providers are located. If you are accessing the Service from outside the United States, your data will be transferred to the U.S. We rely on Standard Contractual Clauses and other lawful transfer mechanisms where required. Our advertising partner, Google, maintains its own transfer mechanisms for data it processes in connection with advertising.

12. Changes to This Policy

We may update this Privacy Policy periodically. When we do, we will post the revised policy on this page and update the "Last updated" date at the top. Where a change materially affects how we handle your personal information, we will also notify you by email or in-app notice, and we will provide advance notice before the change takes effect where applicable law requires it. We encourage you to review this page from time to time. Your continued use of the Service after a revised policy takes effect indicates that you are aware of the changes; it does not substitute for any consent we are separately required to obtain.

13. Contact Information

Throne Room LLC
Twin Falls, Idaho
Email: privacy@throneroom.app

For GDPR inquiries, our Data Protection Contact can be reached at the email above.