Privacy Policy

This Privacy Policy describes how Rory Boon, doing business as TwoTread ("we", "us", or "our"), collects, uses, and protects your personal information when you use our mobile application TwoTread (the "Services").

If you have any questions or concerns, please contact us at privacy@twotread.com.

1. What information we collect

Information you provide

When you create an account or use the app, we collect:

• Email address
• Password (stored as a secure hash, never in plain text)
• Parking spot descriptions and votes you submit
• Photos you choose to upload

Information collected automatically

• Device data: IP address, device identifiers, browser type, operating system, language preferences
• Location data: Approximate or precise location, with your permission, used to centre the map and verify spots
• Photo metadata: EXIF data from photos you upload, including any GPS coordinates embedded in the image, used to verify spot accuracy

We do not process sensitive personal information (such as racial or ethnic origin, sexual orientation, religious beliefs, or biometric data).

Children

The Services are intended for users aged 13 and older. We do not knowingly collect data from children under 13. If you are a minor (under 18 in most jurisdictions), you must have parental permission to use the Services.

2. How we use your information

We process your information to:

• Create and authenticate your account
• Allow you to submit parking spots, photos, descriptions, and votes
• Verify the accuracy of submitted parking spots using submitter location, photo EXIF data, and community voting
• Allow you to delete your account and associated data
• Respond to your support inquiries
• Send you administrative information about changes to our terms or policies
• Protect the Services from fraud, abuse, and security threats
• Comply with legal obligations

3. Legal bases for processing

Under the GDPR and UK GDPR, we rely on the following legal bases:

• Consent: When you give us permission to process your information for a specific purpose, such as accessing your location. You can withdraw consent at any time.
• Performance of a contract: To provide the Services you have signed up for.
• Legitimate interests: To verify the accuracy of submitted parking spots, prevent fake or unsafe spots, diagnose problems, and prevent fraud.
• Legal obligations: To comply with applicable laws, court orders, or regulatory requirements.
• Vital interests: To protect the safety of any person.

4. When and with whom we share information

We share your information only with the third-party service providers we need to run the Services. We have agreements in place that require them to protect your data and use it only on our behalf.

Our current service providers are:

• Supabase — cloud computing, database hosting, and user authentication (data hosted in the EU region)
• Resend — transactional email delivery (account confirmations, password resets)

We may also share information in connection with a merger, acquisition, or sale of business assets. We do not sell your personal information to third parties for advertising or marketing.

5. Social logins

If we offer the option to sign in using a third-party account (such as Apple or Google), and you choose to do so, we will receive certain profile information from that provider, typically your name, email address, and profile picture. We use this information only as described in this Privacy Policy. Please review the privacy policy of the third-party provider for information on how they handle your data.

6. International transfers

Our servers and service providers operate in Ireland, South Africa, and the United States. By using the Services, you understand that your information may be transferred to, stored, and processed in these locations.

For transfers of personal information from the European Economic Area (EEA), United Kingdom, or Switzerland to other countries, we use the European Commission's Standard Contractual Clauses to ensure adequate protection. Copies of these clauses can be provided on request.

7. How long we keep your information

We keep your personal information only for as long as you have an account with us, unless a longer retention period is required by law. When you delete your account:

• Your email, password, and votes are permanently deleted.
• Your contributor points are permanently deleted.
• Parking spots you submitted remain on the map (so the community can still benefit) but are no longer linked to you.

8. Information security

We use appropriate technical and organisational security measures to protect your data, including encrypted connections (HTTPS/TLS), hashed passwords, and access controls. However, no system can guarantee 100% security. Please use a strong, unique password and report any suspected unauthorised access to privacy@twotread.com.

9. Your privacy rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your information
• Restrict or object to certain processing
• Receive a copy of your information in a portable format
• Withdraw consent at any time

To exercise these rights, email privacy@twotread.com. You can also delete your account directly in the app at any time.

If you are in the EEA or UK and believe we are processing your data unlawfully, you have the right to complain to your local data protection authority.

10. Do-Not-Track signals

Some browsers and devices include a Do-Not-Track (DNT) feature. There is currently no industry standard for how to respond to DNT signals, so we do not currently respond to them. If a standard is adopted, we will update this policy.

11. South African rights (POPIA)

If you reside in South Africa, you have the right under the Protection of Personal Information Act (POPIA) to access or correct your personal information. To exercise these rights, contact us at privacy@twotread.com.

If you are unsatisfied with how we have handled your request, you may contact the Information Regulator:

• General enquiries: enquiries@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za

12. Updates to this notice

We may update this Privacy Policy from time to time. The updated version will show a new "Last updated" date at the top. Material changes will be communicated to you by email or in-app notification. Please review this policy periodically.

13. Contact us

If you have questions, comments, or requests regarding this Privacy Policy or your personal information, please contact us at:

privacy@twotread.com