Privacy Policy — US: Our Journey

This Privacy Policy explains how Zafiro Labs SAS ("Zafiro Labs", "we", "us" or "our") handles personal information in connection with the mobile application US: Our Journey (the "App") and any related services (collectively, the "Service"). Zafiro Labs is a company incorporated under the laws of the Oriental Republic of Uruguay.

We've written this policy to be as clear as we can. If anything is unclear, write to us at support@usworld.app.

1. Who We Are

The data controller responsible for your personal information is Zafiro Labs SAS, a company incorporated and registered in the Oriental Republic of Uruguay. We are the entity that decides how and why your personal information is processed in connection with the Service.

If you have any questions about this policy or how we handle your data, you can reach our privacy team at support@usworld.app.

2. Where This Privacy Policy Applies

This Privacy Policy applies to your use of the Service worldwide, except in jurisdictions where the Service is not made available (currently China and Russia). Where local laws grant you additional rights — for example, the European Union, the United Kingdom, Switzerland, California, Uruguay or other Latin American countries — those rights are reflected in Section 13 (Regional Privacy Disclosures).

3. Data We Collect

3.1 Data you give us

Account information. Your name, email address, password (which we store hashed and salted), date of birth, profile photo, language and time-zone preferences.
Relationship and partner information. The identifier or invitation code used to pair you with your partner, the date you paired, and (optionally) relationship milestones you choose to record.
Shared content. Messages, notes, lists, journal entries, photos, calendar events, milestones and any other content you create or upload within the App, either privately or together with your partner.
Communications with us. Messages and information you provide when you contact our support team, respond to a survey or submit feedback.
Purchase information. Subscriptions and in-app purchases are processed by Apple App Store and Google Play. We receive purchase receipts and entitlement information but do not see or store your payment card details.

3.2 Data generated or automatically collected

Device and technical data. Device model, operating system and version, unique device identifiers (e.g., IDFV on iOS, Android ID), language, time zone, mobile carrier, app version, IP address.
Usage data. Screens viewed, features used, taps and other in-app interactions, session duration, referrers, performance metrics and crash diagnostics.
Location data. We derive an approximate location from your IP address. Precise (GPS-level) location is only collected if you grant the corresponding permission and use a feature that requires it.
Advertising identifiers. We do not access the iOS Advertising Identifier (IDFA). On Android, the Google Mobile Ads SDK accesses the Android advertising ID, which is used solely for non-personalized purposes — frequency capping, aggregated ad reporting and fraud prevention — and never for interest-based ad targeting or cross-app profiling. See Section 12 (Advertising).

3.3 Data we receive from other sources

Third-party sign-in. If you sign up using Apple ID or Google, we receive your email address and a basic profile (such as your name) from that provider, with your authorization.
Your partner. When your partner accepts a pairing invitation, certain information they provide (such as their display name) becomes visible to you within the Service. We never reveal one partner's private notes or unshared content to the other.

4. Why and How We Use Your Data

We use your personal information to:

Provide the Service. Create and manage your account, pair you with your partner, store and sync your shared content across devices, deliver push notifications you have opted into, process subscriptions through the Apple App Store and Google Play.
Improve and develop the Service. Understand which features are used, identify and fix bugs and crashes, measure performance, prototype new features.
Keep the Service safe. Detect, prevent and respond to fraud, abuse, security incidents and violations of our Terms & Conditions; verify that requests come from genuine devices and instances of the App.
Communicate with you. Respond to your support requests, send transactional messages (e.g., password resets, receipts) and, where you have opted in, occasional product updates.
Show advertising in the free tier of the Service, where applicable. Subscribing to a paid plan removes advertising from the experiences in which it appears.
Comply with legal obligations and enforce our rights, including responding to lawful requests from public authorities.

Where required by law (for example, in the European Economic Area), the legal bases on which we rely are described in Section 13.

We share personal information only as described in this Policy, and only with the following categories of recipients:

Cloud infrastructure and backend providers that host our database, run our server-side logic, store your uploaded files, deliver push notifications, and protect the Service against abuse.
Analytics and crash-reporting providers that help us understand how the App is used and diagnose problems.
Authentication providers that handle sign-in flows (e.g., Sign in with Apple, Sign in with Google).
Subscription and in-app purchase providers that process payments and manage entitlements through Apple App Store and Google Play.
Advertising networks that serve ads in the free tier of the App. We do not provide them with your email, name or content of your conversations.
Map and location-service providers that render maps and resolve places when you use location features.
AI and content-generation providers that power optional AI features, if and when you choose to use them. We only engage AI providers under terms that prohibit them from using your content to train their models.
App-build and distribution providers that help us release and update the App.
Professional advisers (lawyers, accountants, auditors) under duties of confidentiality.
Public authorities when required by law, valid legal process or to protect rights, property, or safety.
An acquirer, in the event that Zafiro Labs is involved in a merger, acquisition, financing, reorganization or sale of assets, subject to this Policy.

For a current list of the specific third-party processors we engage, see our Sub-Processors page. We update that page whenever we add or change a provider.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act.

6. Sharing Between Paired Partners

US: Our Journey is, by design, an app for two. Content you place in shared spaces of the App — including messages, shared lists, journal entries you mark as shared, joint milestones, calendar events and photos — is visible to your paired partner. You are responsible for what you choose to share.

If you unpair, you lose access to the couple's shared space; the shared content remains available to your partner until they delete it or delete their own account. Private notes and entries you marked as private are never shared and remain accessible only to you.

Because your shared space belongs to both of you, a data export requested by either partner includes the shared content of the couple — notes, tasks, shopping lists and travel entries — regardless of which of you created each item. This mirrors how messaging apps export a conversation. Content that is private to one partner is never included in the other partner's export.

7. Cross-Border Data Transfers

Zafiro Labs operates from Uruguay. Our service providers are primarily located in the United States, the European Union and other regions. Whenever your personal data is transferred across borders, we rely on appropriate legal safeguards:

Adequacy decisions. Uruguay has been recognized by the European Commission as providing an adequate level of data protection (Commission Implementing Decision 2012/484/EU), so transfers between the EEA and Uruguay do not require additional safeguards.
Standard Contractual Clauses. Where transfers occur to jurisdictions without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses or equivalent contractual safeguards approved under applicable law.
Supplementary measures. Where appropriate, we implement additional technical and organizational measures (such as encryption in transit and at rest) to protect transferred data.

8. Your Rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you.
Correct inaccurate or incomplete information.
Delete your personal information ("right to be forgotten").
Object to or restrict certain processing.
Port your data — receive it in a structured, machine-readable format.
Withdraw consent at any time, where processing is based on your consent. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Lodge a complaint with your local data protection authority. In Uruguay, the competent authority is the Personal Data Regulatory and Control Unit (URCDP).

You can exercise most of these rights directly in the App: go to Settings → Privacy to download all your data as a JSON file, or to Settings → Delete account to schedule deletion. Account deletion has a 30-day grace period during which you can sign back in to cancel; see Section 9 for details. You can also write to support@usworld.app at any time and we will respond within 30 days (extendable by an additional 60 days where permitted by law for complex requests).

9. How Long We Keep Your Data

We keep your personal information only as long as we need it for the purposes set out in this Policy. Specific retention windows include:

Account and shared content are kept while your account is active.
Account deletion — 30-day grace period. When you request account deletion in the App, we immediately sign you out from all devices and schedule your account for permanent deletion 30 days later. During those 30 days you can sign back in to cancel the deletion. After the 30 days elapse, a server-side job permanently erases your account, your personal subcollections, and your associated files. Shared couple data is preserved for your partner while their account remains active, and is permanently erased when the last member of the couple deletes their account. The grace period exists so accidental deletions can be reversed.
Data exports — 7 days. The JSON file produced when you download your data is stored temporarily and deleted automatically 7 days after it is generated. The download link itself expires after one hour. You can also remove generated exports at any time from Settings → Privacy, and they are erased when you delete your account.
Safety and abuse data. If we suspend or ban an account for violating our Terms, we may retain related information for up to one year to protect the Service and other users.
Inactive accounts. If you do not access the App for two years, we may close your account and delete the associated content, after giving you reasonable notice.
Transactional and financial records are kept for up to five years after the transaction, to comply with Uruguayan accounting and tax obligations.
Diagnostic and aggregate analytics may be retained in anonymized form for longer, as they no longer identify you.
Legal holds. Where we are required to retain data to comply with a legal obligation or in connection with a legal claim, we retain it for as long as that requirement persists.

10. Security

We use a combination of technical and organizational measures to protect your data, including TLS encryption in transit, encryption at rest on our cloud infrastructure, role-based access controls for our team, hashed and salted passwords, and abuse-prevention checks on requests to our backend. No system is perfectly secure; we cannot guarantee absolute security. If a personal-data breach affects you, we will notify you and the competent authorities as required by applicable law.

11. Children's Privacy

The Service is intended for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Advertising

The free tier of the App shows ads served by Google AdMob. Ads are served on a non-personalized basis: they are based on general context rather than on your interests or your past behaviour, and we do not track you across apps or websites owned by other companies. On iOS we never access the Advertising Identifier (IDFA), which is why the App does not present Apple's App Tracking Transparency prompt. On Android, the Google Mobile Ads SDK accesses the Android advertising ID, which — because ads are configured as non-personalized — is used only for frequency capping, aggregated ad reporting and fraud prevention. In the European Economic Area and other regions where consent is required, ads are only shown after you respond to the consent form presented in the App, and you can revisit your choice at any time from the App's settings. Subscribing to a paid plan removes ads entirely.

13. Regional Privacy Disclosures

13.1 European Economic Area, United Kingdom and Switzerland

If you are in the EEA, the UK or Switzerland, the General Data Protection Regulation (GDPR) and the UK GDPR apply to our processing of your personal data. The legal bases on which we rely under Article 6 of the GDPR are:

Performance of a contract — to provide the Service you signed up for.
Our legitimate interests — to secure, debug, analyze and improve the Service, prevent fraud, and protect our rights, balanced against your privacy interests.
Your consent — for optional features such as location and marketing communications. You can withdraw consent at any time.
Compliance with a legal obligation — when we are required by law to retain or disclose information.

You may also lodge a complaint with your local supervisory authority.

13.2 California, United States

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), gives you the right to:

Know what categories of personal information we collect, use and disclose.
Request deletion of your personal information.
Correct inaccurate personal information.
Opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as defined under the CPRA.
Limit the use of sensitive personal information.
Be free from retaliation for exercising your rights.

To exercise these rights, contact support@usworld.app. We may verify your identity before responding.

13.3 Uruguay and Latin America

If you are in Uruguay, our processing is governed by Law No. 18.331 on Personal Data Protection (LPDP) and its regulations. You may exercise your rights of access, rectification, update, inclusion and erasure by contacting support@usworld.app. The competent supervisory authority is the URCDP. Similar rights are recognized in other Latin American jurisdictions under their respective data-protection laws (e.g., LGPD in Brazil, Ley 25.326 in Argentina), and we will give effect to such rights where applicable.

14. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will notify you within the App and update the "Last updated" date at the top of this page. Continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.

15. How to Contact Us

Zafiro Labs SAS
Montevideo, Uruguay
Privacy inquiries: support@usworld.app
Postal address available upon request.