Privacy Policy

1. What Hint It Is

Hint It, Inc. is a private feedback app. It lets you drop a Hint (a short message and up to five optional photos) about a nearby local business. Your Hint is private. The business cannot see your name, phone number, or any other information that identifies you.

A business can claim its listing on Hint It. Once claimed, it can read the hints associated with its location. Even then, your identity is not revealed. Hint It is not a public review platform. Hints are not published for other consumers to read. Your feedback goes only to the business you wrote about, and only after that business has claimed its listing.

When we say "Service" in this policy, we mean the Hint It mobile app, the website at www.hint.it, and all related software and features.

By using the Service, you agree to the collection, use, and disclosure of your information as described in this policy. This policy is part of the Hint It Terms of Use.

2. Information We Collect

What you provide directly

• Phone number. If you enter the monthly Giveaway, you provide your phone number. We send a one-time verification code (OTP) via Twilio Verify to confirm it. Your phone number is used only for giveaway communications. It is not shared with the business you wrote about.
• Optional: email address, name, and birthday. These are not required to drop a hint. You may provide them when entering the giveaway. We use your birthday only to confirm you are 18 or older, as required to enter. We do not store your full date of birth after verification.
• Hint text. The text of your hint is stored on our servers and associated with the business location you selected. It is anonymous to the business. The business sees what you wrote; it does not see who wrote it.
• Photos. You may attach up to five photos to a hint. Photos are stored in Microsoft Azure Blob Storage. See Section 3 for an important note about photo metadata.
• Location suggestions. If you suggest a place to be added to the Service, we collect the place details you provide (including name, address, and any other information you submit) and any photos of the place you choose to attach. Place details you submit may be displayed publicly on the associated Business Listing within the Service. Photos you submit as part of a location suggestion may also appear publicly on that Business Listing. See Section 7 for more.
• Correspondence. If you contact us by email or other means, we collect and retain the content of that message in order to respond to you.

What we collect automatically

• Persistent consumer identifier (GUID). When you first install the app, we generate a unique identifier for your device session. This GUID associates your hints with your device without requiring a named account. It is stored locally on your device and on our servers.
• Device and push notification tokens. If you allow push notifications, your device generates a token (through Google Firebase Cloud Messaging on Android, or Apple APNs on iOS). We register that token on our servers to deliver push notifications to you. You can disable push notifications at any time through your device's operating system settings.
• Location (GPS, foreground only). When you use the app to drop a hint, we access your device's GPS to identify your location. We do this only while the app is open. We do not track your location in the background. We do not store your precise GPS coordinates as a standalone data point. Your location is used to match you to a nearby business and is embedded in the associated hint record. We use tiered precision: higher accuracy briefly while the app is acquiring a fix, then balanced accuracy once a fix is established. We cache your most recent location briefly in local device storage (MMKV) to improve app performance. This cache is local only; it is not transmitted to our servers separately from a hint submission.
• Crash and diagnostic data. We use Sentry to collect crash reports and diagnostic information when the app encounters an error. Sentry receives device identifiers and stack traces. We use this data to identify and fix bugs. Sentry does not receive your hint content.
• Push delivery data. Firebase (Google) and Apple APNs receive push notification tokens and notification payloads when we send you a push notification. They do not receive your hint content.

3. Your Photos and Metadata

Photos you submit are stored exactly as your device took them. We do not strip metadata from your photos before storage.

If your phone embeds location coordinates in photos (many devices do this automatically when location services are on), that metadata travels with the photo. A business receiving your hint photo can read that embedded location data. When a business that has claimed its listing receives your hint photo, it receives the full image file as your device stored it, including any metadata.

We recommend reviewing your device's camera settings if you do not want location data embedded in your photos.

4. Website Cookies and App SDKs

Website (hint.it)

When you visit www.hint.it, we use cookies for session management. These cookies keep you logged in during your visit and help us understand how the site is being used at an aggregate level. We do not use cookies to build a behavioral advertising profile of you. We do not place third-party advertising cookies.

Mobile App

The app does not use browser cookies. The app includes two third-party software development kits (SDKs):

• Sentry: uses device identifiers to correlate crash reports across sessions. No advertising purpose.
• Firebase (Google): uses your device's push notification token to deliver notifications you have opted into. No advertising purpose.

We do not include any third-party advertising SDK in the app. We do not build a cross-app tracking profile of you.

We do not respond to Do Not Track signals in your browser. We do not participate in behavioral advertising networks.

5. How We Use Your Information

We use what we collect to run the Service, protect it, and communicate with you. Nothing more.

We use the information we collect to:

• Operate the Service. Store and deliver your hints to the business you wrote about, once that business claims its listing.
• Process giveaway entries. Verify your eligibility (18+, US resident), enter you in the monthly draw, and contact you if you win.
• Send push notifications. Deliver notifications you have opted into, including giveaway-related updates and reminders.
• Send transactional email. If you have provided your email address, we may use it for account-related communications (such as winner notifications). We do not send marketing email without your separate consent.
• Verify your phone number. We use Twilio Verify to send you a one-time passcode when you opt in to the giveaway.
• Analyze your Hints with automated systems. We process the text and photos of your Hints using automated sentiment analysis and machine-learning models to identify themes, generate aggregate and de-identified insights (including the Hindsight summaries shown to other users), and surface relevant reminders. This is core to how the Service works.
• Diagnose and fix problems. We use crash reports from Sentry to identify and fix bugs in the app.
• Prevent fraud and abuse. We use information about your account and activity to detect and prevent fraudulent giveaway entries, automated submissions, and other prohibited conduct.
• Comply with law. We may use or retain information as required to comply with applicable law or to defend our legal rights.

We do not use your information to target you with advertising.

6. Service Providers

We work with a small set of trusted providers. Each one receives only what it needs to do its job, nothing more.

• Sentry. Receives device identifiers and stack traces, for crash diagnostics and error monitoring.
• Firebase (Google). Receives push notification tokens and notification payloads, for Android push notification delivery.
• Apple APNs. Receives push notification tokens and notification payloads, for iOS push notification delivery.
• Twilio Verify. Receives your phone number, for one-time passcode delivery for giveaway opt-in.
• MailerSend / Twilio. Receives your email address (if provided), for transactional email (winner notifications, account communications).
• Microsoft Azure. Receives hint photos and backend application data, for blob storage, service bus, and container hosting.
• Stripe. Receives business subscription billing information only, for payment processing for business subscribers.

A note on Stripe: Stripe is used exclusively to process subscription payments from businesses that claim a listing on Hint It. Consumer data is not passed to Stripe. If you are a consumer using the free app, your information does not reach Stripe.

We require service providers to maintain the confidentiality of your information and to use it only for the purposes for which it is shared.

Business transfers

If Hint It, Inc. is involved in a merger, acquisition, asset sale, or similar transaction, your information may be transferred to the acquiring entity. If that happens, we will notify you before your information is transferred and becomes subject to a different privacy policy.

To protect our interests and comply with law

We may disclose your information if we believe in good faith that doing so is required by law, or is necessary to protect our rights, the rights of others, or the safety of our Service and its users.

7. Business Listings and Third-Party Marks

Businesses on Hint It are listed from two sources: (1) licensed public data sources, including Foursquare OS Places, Overture Maps, and OpenStreetMap; and (2) Location Suggestions submitted by users. A business does not need to have signed up for Hint It to have a listing.

Being listed on Hint It does not mean a business has any relationship with us.

These places are listed independently. They're not affiliated with, sponsored by, or endorsed by Hint.

Where a business has not yet claimed its listing, we may display the business's name and, where publicly available, its logo, solely to help you identify the right place. We do this under nominative fair use: we use no more than is needed to identify the business.

User-submitted location photos may appear publicly on a Business Listing. When you submit a location suggestion, the place details and photos you provide may be displayed to other users of the Service on that listing. See the "What you provide directly" section above and the Terms of Use Section 7B for the license and warranties that apply.

Our listings come from licensed public data sources (such as Foursquare, Overture Maps, or OpenStreetMap), not from the Google Places API. Some listings are seeded from user submissions rather than public data sources.

A business may request removal of its listing, or correction or removal of inaccurate user-submitted listing details or photos, by contacting us about copyright.

8. Your Communication Choices

Giveaway SMS

When you enter the monthly giveaway, you provide your phone number and consent to receive text messages from us about the giveaway. To opt out of giveaway SMS communications at any time, reply STOP to any message. Message and data rates may apply.

Your phone number is exclusively used for the giveaway. We value your privacy and ensure that it is not shared with any third parties, including the business to which you've provided feedback.

For full details on giveaway communications, see the Giveaway Rules.

Push notifications

Push notifications are optional. You can disable them at any time in your device's operating system settings.

Transactional email

If you have provided your email address, we may use it to contact you about your account, giveaway winnings, or important updates to our Service. You cannot opt out of transactional email and continue to receive those services, but you can remove your email address from your account settings at any time.

Do Not Track and behavioral advertising

We do not respond to Do Not Track signals. We do not participate in behavioral advertising networks or share your information with third parties for cross-context behavioral advertising.

9. Your Account and Hint Data

Accessing and updating your information

Your optional personal information (name, email, birthday) is yours to update at any time in your account settings.

Deleting your account

You can request deletion of your account by contacting support. We will delete your account and associated personal information within 30 days of your request.

We may retain certain information after deletion where we have a legal obligation to do so (for example, records related to giveaway winnings for tax purposes) or where we have a legitimate interest in fraud prevention.

What stays after you delete your account: Hint content you submitted may persist in de-identified form in a business's dashboard after your account is deleted. The business sees the text of the hint; after your account is deleted, no information linking that hint to you remains in our systems.

For California residents, see "Your California Privacy Rights" below for your rights under the California Consumer Privacy Act.

10. Links to Other Websites

The Service may contain links to sites we do not operate. This policy does not cover those sites. If you visit them, check their privacy policies.

11. Children

The Service is not for children under 13. We do not knowingly collect personal information from anyone under 13. If we learn we have, we will delete it promptly. If you believe a child under 13 has submitted personal information, contact support.

12. International Visitors

Our servers are located in the United States, hosted on Microsoft Azure infrastructure. If you use the Service from outside the United States, your information is transferred to and processed in the United States.

By using the Service, you consent to that transfer and processing. US privacy laws may differ from the laws in your home country.

13. Security

We use reasonable security measures to protect your information from unauthorized access, disclosure, misuse, and loss. No security measure is perfect, and we cannot guarantee the security of information you transmit to us. You transmit information at your own risk.

You are responsible for the security of your device and for activity that occurs through your account.

14. Your California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) gives you specific rights over your personal information. Here is what they are and how to use them.

Right to know. You have the right to know what personal information we collect about you, where it comes from, how we use it, and who we share it with. To make a request, submit a privacy request.

Right to access. You have the right to receive a copy of the personal information we hold about you. To make a request, submit a privacy request.

Right to delete. You have the right to request that we delete your personal information. To make a request, submit a privacy request or use the account deletion option in your app settings.

Right to correct. You have the right to request that we correct inaccurate personal information we hold about you. To make a request, submit a privacy request.

Right to opt out of sale or sharing. Based on our current service configuration, we do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising. Our service providers receive only what they need to perform their specific function. See the providers section above for details. If this changes, we will update this policy and provide you with an opt-out mechanism before any such sale or sharing begins.

Right to limit use of sensitive personal information. Under CPRA, you have the right to limit how we use certain categories of sensitive personal information. The sensitive personal information we collect is limited to: your precise geolocation (collected briefly during hint submission), your phone number (collected for giveaway opt-in), and photos you choose to submit (which may contain EXIF location data). You may submit a privacy request to limit our use of this information.

Right to non-discrimination. We will not discriminate against you for exercising any of these rights. Exercising your rights will not affect your access to the Service.

How to submit a request. Submit a privacy request. We will respond within 45 days. If we need more time (up to an additional 45 days), we will notify you of the extension and the reason for it.

15. Changes to This Policy

We may update this policy from time to time. When we do, we update the "Last Updated" date at the top of this page.

For material changes (changes that meaningfully affect how we use or share your personal information), we will notify you through an in-app notice before the change takes effect, in addition to updating this page.

Continuing to use the Service after a change takes effect means you accept the updated policy.

16. Contact Us

Questions about this policy or your personal information? Reach us here:

General questions: contact support
CCPA / privacy rights requests: submit a privacy request
Copyright and takedown requests: contact us about copyright

Mail:
Hint It, Inc.
4605 Tutu Park Mall Suite 133-106
St Thomas, VI 00802