Privacy Policy

1. Personal data we collect

• Account and identity data: email address, authentication identifiers, role, display name, handle, profile image, biography, school, specialty, Company affiliation, and account status.
• Age and legal records: whether you selected the 13–17 or 18-or-older age band; guardian-permission or purchase-authorisation attestations where relevant; the legal documents and versions presented; acceptance or acknowledgement time; app version; locale; and signup or purchase source. We do not request an identity document or exact date of birth for the ordinary age-band control.
• Profile and marketplace content: Designer Requests, Supplier Posts, categories, keywords, budgets or price indications, availability, locations, images, videos, comments, likes, follows, saved items, responses, and sharing activity.
• Communications: one-to-one messages, attachments, conversation participants, read status, customer-support messages, reports, and moderation information.
• Enterprise data: Company profile, website, roles, permissions, Team Members, invitations, invitation email addresses, Private Networks, private content, private messages, and audit events.
• Location data: city, country, selected market location, and—when you grant permission—precise device location, coordinates, accuracy, and timestamps while the app is in use. Connect does not request background location permission.
• Location-integrity and safety data: derived country or city, hashed IP-related signals, VPN or proxy indicators, movement checks, risk indicators, bans, reports, and enforcement records.
• Technical and usage data: device/platform information, app and page events, content views, search or query length, feature use, referral URL, browser, approximate geolocation, diagnostics, and security logs.
• Notification data: push token, device identifier where available, platform, notification preferences, and delivery status.
• Subscription data: plan, product and entitlement identifiers, store, renewal and expiry status, transaction-event identifiers, and reconciliation records. Apple processes payment-card and App Store billing details; Connect does not receive your full card details.
• Waitlist and contact data: email address, submission source, consent/request context, correspondence, and unsubscribe or deletion requests.

2. How we collect data

We collect data directly from you, from your device and use of the Service, from Companies that invite or administer you, from other users who interact with or report content, and from service providers such as Apple, RevenueCat, Supabase, Vercel, Resend, and notification infrastructure. We may derive limited safety, market, and usage information from these inputs.

3. Why we process data and our lawful bases

• Contract: to create and secure accounts; provide profiles, discovery, content, messaging, Enterprise access, subscriptions, support, and account deletion; and enforce the Terms.
• Consent: to send waitlist or launch updates, access precise location, photos, camera, and notifications where device or marketing law requires consent. You may withdraw consent, although some features may then be unavailable.
• Legal acceptance and age eligibility: to document the Terms or EULA agreement, Privacy Policy acknowledgement, age-band selection, and any guardian-related attestation needed to provide the Service or demonstrate compliance. These records are not used for advertising.
• Legitimate interests: to operate and improve Connect; understand aggregated use; prevent fraud, abuse, duplicate accounts, and security incidents; moderate content; defend legal claims; and communicate essential service information, balanced against your rights.
• Legal obligation: to comply with accounting, consumer, privacy, law-enforcement, sanctions, and other binding requirements.
• Vital interests or public task: only in exceptional circumstances where processing is necessary to protect a person or respond lawfully to a competent authority.

4. Public, Company, and Private data

Public profile and content fields are visible to the audiences described in the Service and may be associated with your individual or Company identity. Company Owners and authorised Admins may manage Company data, Team Members, roles, permissions, and Company-owned content.

Private Network data is made available only to eligible participants according to the access controls in the Service. Other participants can still copy or disclose what they are authorised to see, so do not treat the platform as a substitute for a confidentiality agreement. We do not use private content to create public content.

5. Service providers and recipients

• Supabase provides authentication, database, storage, realtime, and backend infrastructure.
• RevenueCat receives subscription and entitlement identifiers to administer in-app subscription status; Apple processes App Store purchases, cancellations, and refunds.
• Vercel hosts and delivers the website and provides privacy-focused web analytics. Vercel Analytics records page/event information, filtered query parameters, referrer, approximate location, device, browser, and operating-system information. Its visitor hash is discarded after 24 hours and analytics events are not tied to an individual or IP address in the analytics view.
• Resend processes waitlist email addresses and related delivery or audience records.
• Apple Push Notification Service and Expo notification infrastructure may process push tokens and delivery data when notifications are enabled.
• Squarespace is used for domain registration or DNS administration. The Connect website itself is served through Vercel.
• Professional advisers, insurers, auditors, and competent public authorities may receive limited data where reasonably necessary and lawful.
• A successor may receive data as part of a merger, financing, reorganisation, or sale, subject to appropriate confidentiality and legal safeguards.

6. International transfers

Some providers or their subprocessors may process data outside Norway or the EEA, including in the United States. Where required, we rely on an adequacy decision, the EU Standard Contractual Clauses, a provider data-processing agreement, or another lawful transfer mechanism, together with appropriate supplementary safeguards. You may contact us for information about applicable safeguards.

7. Retention

• Account and profile data is generally retained while your account is active and for the limited period needed to close the account, resolve disputes, enforce agreements, and comply with law.
• When you use in-app self-service deletion, your profile and public Posts or Requests are hidden immediately and permanent deletion processing is scheduled for after a 10-day period. The backend preserves limited anonymised records where necessary for message integrity, audit, security, legal claims, or obligations.
• Waitlist data is kept until you unsubscribe, ask us to delete it, the launch-update purpose ends, or it is no longer reasonably needed. We review inactive waitlist records and aim to remove them within 24 months of the last meaningful interaction unless law requires longer retention.
• Legal-acceptance, age-band, guardian-attestation, moderation, and deletion-completion records may be retained after account closure for the applicable limitation period or for as long as reasonably necessary to demonstrate compliance, protect a minor, resolve a complaint, or establish, exercise, or defend legal claims. These records are access-restricted and minimised.
• Subscription, accounting, fraud, moderation, and audit records may be kept for the period required by law or reasonably needed to establish, exercise, or defend legal claims.
• Backups and provider logs may retain residual copies for a limited technical cycle. They are not restored for ordinary use after a valid deletion has been completed.

8. Your privacy rights

Subject to applicable conditions and exceptions, you may request access, correction, deletion, restriction, data portability, or objection to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. You may also object to direct marketing at any time.

Send a request to connect@bybluejones.com. We may need to verify your identity and authority. We normally respond within one month, subject to lawful extensions. You may complain to Datatilsynet, the Norwegian Data Protection Authority, or the authority in the EEA country where you live or work.

9. Required and optional information

Email, authentication data, a role, and core profile information are required to create and operate an account. Specific content, Company, location, media, notification, or subscription information is optional unless you choose the related feature. If you do not provide required data, we may be unable to create an account or provide that feature.

10. Location choices

You control device location permission through iOS. Connect requests location only while the app is in use and uses it for market context, discovery scopes, content location, and integrity or abuse-prevention checks. You can deny or later revoke permission, but location-dependent discovery or publishing may be limited. Do not publish a precise location you do not want other authorised users to see.

11. Analytics and automated checks

We use aggregated website analytics and product events to understand performance, use, and feature reliability. We do not use third-party advertising trackers and do not sell personal data.

Connect may use automated rules to identify suspicious location activity, enforce allowances, rank or filter content, and support safety review. These checks do not make solely automated decisions that produce legal or similarly significant effects. If an automated check restricts a feature and you believe it is wrong, contact us for review.

12. Security

We use access controls, row-level database policies, authentication, encrypted transport, provider security measures, limited administrator access, logging, and separation between public and private data. No online service is completely secure. Protect your credentials and tell us promptly about suspected unauthorised access or disclosure.

13. Users aged 13–17

Connect is available from age 13. We use an age-band selection—13–17 or 18 or older—rather than asking for an exact date of birth or identity document. For users aged 13–17, we process data to provide the requested marketplace, creative, safety, and communication functions and apply the protections described in these policies. Where we rely on consent and applicable law requires guardian consent, we will obtain it or will not carry out that processing.

Minor users must not publish an exact home address, private school timetable, identity document, financial details, intimate material, or other information that creates an avoidable safety risk. Parents or guardians may contact us to raise a safety concern, question a paid plan, or request appropriate action. We may need proportionate information to verify the relationship and protect the account holder's privacy.

Connect does not permit accounts for children under 13. If we reasonably believe an account holder is under 13, we may restrict the account while we investigate and delete or otherwise handle the account and data as required by law. Contact us if you believe a child under 13 is using Connect.

14. Changes to this Policy

We may update this Policy to reflect product, provider, or legal changes. We will update the date and give additional notice where required. Material new consent-based uses will not be applied without the consent required by law.

15. Contact

NGO BY BLUE JONES, a Norwegian sole proprietorship trading as By Blue Jones (organisation number 937 472 048), Norway. Privacy and legal enquiries: connect@bybluejones.com. Include enough information for us to identify the relevant account or waitlist entry, but do not email passwords or unnecessary sensitive information.