Legal

Privacy Policy

Effective: May 27, 2026 · Version 1.1

1. Who We Are

Susty, Inc. (“Susty,” “we,” “us,” or “our”) operates the Susty social platform and is the data controller for personal information collected through the Services. If you have questions about this Policy or our data practices, contact us at:

2. Information We Collect

Information You Provide Directly

We collect information you provide when you create an account, use the Services, or communicate with us, including:

• Account registration: name, email address, username, and password (stored in hashed, non-recoverable form). If you register via Google or Apple, we receive your name and email from those providers rather than directly from you.
• Profile information: profile photo or avatar, optional bio, location (city or region, entered manually and separate from device GPS), sustainability interests, and any other optional details you add to your profile.
• User Content: posts, photos, images, captions, comments, reactions, challenge submissions, and direct messages you create or share on the platform.
• Communications with Susty: messages you send to our support team, survey responses, feedback submissions, and any other correspondence you initiate.

Information Collected Automatically

When you use the Services, we automatically collect:

• Device information: device type and model, operating system and version, browser type and version, and mobile device identifiers (such as IDFA on iOS or Android Advertising ID, as permitted by your device settings).
• Usage and engagement data: features accessed, content viewed and interacted with (likes, shares, comments, follows), search terms entered, challenges joined, and time spent on the platform.
• Log data: IP address, access dates and times, referring URLs, and error or crash reports.
• Cookies and similar technologies: we use cookies, web beacons, and similar tools to maintain your session, remember preferences, measure platform performance, and deliver features. See Section 4 for details and your choices.

Approximate location inferred from IP address: independent of device GPS permission, we may derive your approximate city or region from your IP address to surface relevant local content. You cannot disable this inference through the app.

Location Information (Precise GPS)

With your explicit permission, we collect precise geolocation from your mobile device. We use this to:

• Surface nearby sustainability events and eco-friendly businesses;
• Connect you with Susty users in your geographic area;
• Deliver region-specific community challenges and content.

You may grant or revoke precise location permission at any time through your device’s operating system settings. Revoking location access will disable location-based features but will not affect your ability to use core platform functionality. Susty does not share your precise location data with other users or third parties except as described in Section 5.

Information from Third-Party Login Providers

If you register or log in using Google or Apple, we receive information from those providers as permitted by your settings with them. This typically includes your name, email address, and a unique identifier from the provider. We do not receive your password. The scope of information received may vary by provider and your individual privacy settings with them. Your use of Google or Apple login is governed by those providers’ own privacy policies, which we encourage you to review.

3. How We Use Your Information

• Account creation and authentication: to create and maintain your account and verify your identity, including via Google and Apple SSO.
• Operating the platform: to display your profile and User Content to other users per your privacy settings; to facilitate community interactions (follows, likes, comments, direct messages, group challenges); and to run all core platform features.
• Personalization: to tailor your feed, explore tab, push notifications, and content recommendations based on your activity, stated interests, location, and the behavior of users with similar interests.
• Location features: to deliver local content, events, and nearby user discovery when you have granted location permission; and to surface approximate regional content using IP-based location inference.
• Communications: to send mandatory service messages (security alerts, Terms updates, account notices) and, with your opt-in, marketing communications such as newsletters, sustainability tips, and platform announcements.
• Safety and platform integrity: to detect, investigate, and prevent fraud, spam, harassment, hate speech, and other conduct violating our Terms or Community Guidelines; to authenticate users; and to protect the safety of Susty, our users, and the public.
• Analytics and improvement: to understand aggregate usage patterns, measure feature performance, and develop new features. Where possible we rely on aggregated or de-identified data for this purpose.
• Legal compliance: to comply with applicable federal and state law, respond to lawful requests from government authorities, and enforce our Terms of Service and Community Guidelines.
• Aggregate research and reporting: using de-identified data only, to understand and publish insights about collective sustainability behaviors. Individual users are never identified in published outputs.

4. Cookies and Tracking Technologies

We use the following categories of cookies and similar technologies:

• Strictly necessary: required to operate the Services (e.g., session authentication, security tokens). Cannot be disabled.
• Performance and analytics: help us understand how users navigate the platform and measure feature effectiveness. We use third-party analytics tools for this purpose.
• Functional: remember your preferences (e.g., notification settings, theme preferences) to deliver a consistent experience.

You can manage non-essential cookies through your browser settings. Disabling certain cookies may impair some platform features. Our Services do not currently change their behavior in response to “Do Not Track” browser signals.

5. How We Share Your Information

We do not sell your personal information. We share it only as follows:

• With other Susty users: your public profile, User Content, and social activity (follows, likes, public posts) are visible to other users according to your privacy settings. Some information — such as your username and profile photo — may be visible to all users whenever you participate in public communities or challenges.
• Service providers: we share information with third-party vendors that provide services on our behalf, including cloud infrastructure and hosting, analytics, push notification delivery, customer support tools, and content moderation assistance. These vendors are contractually required to process your data only as directed by us and consistent with this Policy.
• Third-party login providers: when you use Google or Apple login, limited account data is exchanged with those providers solely to facilitate authentication. Please review their privacy policies for details on how they process that data.
• Law enforcement and legal process: we may disclose your information when required by law, court order, or other valid legal process, or when we reasonably believe disclosure is necessary to protect the rights, property, or safety of Susty, our users, or the public.
• Business transfers: if Susty undergoes a merger, acquisition, asset sale, financing, or bankruptcy, your information may be transferred as part of that transaction. We will notify you via email or a prominent in-app notice before your personal information becomes subject to a materially different privacy policy.
• With your consent: we may share your information with third parties when you give us explicit consent, such as when you authorize a specific integration or participate in a co-branded feature.
• Aggregated or de-identified data: we may share data that cannot reasonably be used to identify you — for example, anonymized statistics about sustainability behaviors across the Susty community.

6. User-Generated Content and Public Information

When you post User Content to public areas of the Services — such as public community feeds, public challenges, or your public profile — that content becomes visible to all Susty users and may be indexed by third-party search engines. Even if you later delete content, it may have been copied by other users or cached by third parties for some period of time.

Direct messages sent within the Services are visible to intended recipients. Susty does not proactively read private messages but may access message content when required by law or to investigate reported violations of our Terms or Community Guidelines.

Certain User Content you have shared publicly may remain visible after account deletion if other users have interacted with it. You may request removal of specific content by contacting support@susty.app.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Services. When you delete your account, we will delete or anonymize your personal information within 90 days, except for data we are required or permitted to retain under applicable law (such as security logs, abuse records, or records required to respond to legal requests). Aggregated, de-identified data derived from your information may be retained indefinitely.

Certain User Content you have shared publicly may remain visible after account deletion if other users have interacted with it. You may request removal of specific content by contacting support@susty.app.

8. Data Security

We maintain commercially reasonable technical and organizational security measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction, including encryption of data in transit using TLS, encrypted storage of sensitive data, access controls for Susty personnel, and regular security assessments.

No security system is impenetrable. In the event of a data breach that is reasonably likely to result in significant harm, we will notify affected users and relevant authorities as required by applicable law.

9. Your Rights and Choices

Access and Correction

You may review and update most of your account information at any time in your account settings. For additional assistance accessing or correcting information we hold, contact legal@susty.app.

Deletion

You may delete your account at any time through your account settings. We will delete or anonymize your personal information within 90 days, subject to the exceptions in Section 7.

Data Portability

You may request a copy of your personal information in a structured, machine-readable format by contacting legal@susty.app. We will respond within 45 days.

Marketing Communications

Opt out of promotional emails using the “unsubscribe” link in any marketing message or via your account notification settings. You will still receive essential service and security communications.

Push Notifications

Disable push notifications at any time through your device operating system settings or the Susty app notification settings.

Location Data

Revoke precise location access at any time through your device’s app permissions (iOS: Settings → Privacy & Security → Location Services; Android: Settings → Location). IP-based approximate location inference cannot be disabled through the app.

Third-Party Login

Disconnect a linked Google or Apple account from your profile in your account settings. You must have an email/password login configured before disconnecting to avoid losing access to your account.

10. Children’s Privacy

The Services are not directed to children under 13 years of age and we do not knowingly collect personal information from anyone under 13. If we learn we have collected personal information from a child under 13, we will promptly delete it. If you believe we may have done so, please contact legal@susty.app immediately.

11. Additional Rights for California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”) grants you specific rights regarding your personal information:

• Right to know: request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties to whom it was disclosed.
• Right to delete: request deletion of personal information we have collected from you, subject to legal exceptions.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale or sharing: Susty does not sell your personal information, nor do we share it for cross-context behavioral advertising. If this ever changes, we will update this Policy and provide the required opt-out mechanism.
• Right to limit use of sensitive personal information: to the extent we process sensitive personal information (such as precise geolocation), you may direct us to use it only for purposes specified by the CCPA.
• Right to non-discrimination: we will not discriminate against you for exercising any CCPA rights.

To submit a CCPA request, contact us at legal@susty.app. We may need to verify your identity before processing your request. You may designate an authorized agent to submit requests on your behalf, provided the agent supplies written authorization signed by you. We will respond to verified requests within 45 days, with an optional 45-day extension when reasonably necessary.

Categories of Personal Information Collected (CCPA Disclosure)

In the 12 months preceding the effective date of this Policy, we have collected the following CCPA-defined categories: Identifiers (name, email, IP address, device IDs, username); Internet or network activity (usage data, interaction history within the Services); Geolocation data (precise location, with permission; approximate location from IP); Audio, electronic, visual, or similar information (photos and videos you upload); and Inferences drawn from personal information to create a profile reflecting your sustainability interests and preferences. Each category was collected for the business and operational purposes described in Section 3 of this Policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting a prominent notice within the Services or by email to the address associated with your account at least 30 days before changes take effect, except where required for legal or security reasons. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy. The current version of this Policy is always available at susty.app/privacy.

See also our Terms of Service.