Privacy Policy

1. Information We Collect

We collect information in three ways: directly from you, automatically when you use the Services, and from third-party sources.

1.1 Information You Provide

Account Information. When you create an account, we collect your name, username, email address, date of birth, gender, age, password, and profile photo. Some of these fields are required; others are optional. You may provide information of your choosing for optional fields.

Authentication Data. If you sign in via Apple or Google OAuth, we use these services solely for authentication purposes. We do not store OAuth tokens or pull additional profile data from these providers beyond what is needed to verify your identity.

Activity Preferences (Mood Data). When you use Dromo, you select activity preferences from categories such as fun, thrill, creative, chill, sports, fitness, history, nature, and nightlife. These selections are stored to personalize your experience.

Reviews and Trip Notes. You may submit reviews and trip notes about venues and experiences. Reviews are published anonymously. Trip notes are stored within your account.

Saved Content. We store your bookmarks, saved places, lists, and other content you choose to save within the Services.

Group Content. If you participate in groups, we collect the content you post, including comments and shared lists.

Communications. If you contact us for support or feedback, we collect the content of those communications.

1.2 Information We Collect Automatically

Device Information. We collect information about the device you use to access the Services, including operating system, device model, language settings, screen size, and browser type.

Location Information. With your permission, we collect your precise location (GPS coordinates) when the app is open and in use. Location data is used to provide location-relevant recommendations. You can disable location sharing at any time through your device settings. If you decline location access, the Services will still function but with reduced personalization.

Usage Data. We log your interactions with the Services, including places viewed, searches performed, features used, activity preferences selected, session times, and navigation patterns.

Search History. We store your search queries to improve recommendations and your experience.

Log Data. We collect IP addresses, access times, and error logs for security and diagnostic purposes.

1.3 Information from Third Parties

We do not currently collect personal information about you from third-party sources. If this changes, we will update this Policy.

2. How We Use Your Information

We use the information we collect for the following purposes:

Provide and Operate the Services. To deliver mood-based and location-based recommendations, display search results, and enable core app functionality.

Personalization. To build and maintain your user profile, including your persistent activity preferences and session-specific mood selections, and to tailor recommendations accordingly. We use both your overall preference profile and your in-session mood selection to generate relevant suggestions.

Machine Learning and AI. To train and improve our recommendation algorithms and automated venue categorization models using aggregated and individual usage data. This processing occurs server-side.

Analytics. To understand how users interact with the Services, identify trends, and improve features. We use PostHog and may use Mixpanel for analytics.

Communications. To send you transactional messages (account confirmations, security alerts, service updates) and, with your consent, promotional messages (feature announcements, recommendations) via email and push notifications. You can opt out of promotional communications at any time.

Safety and Security. To detect and prevent fraud, abuse, and unauthorized access, and to enforce our Terms of Service.

Legal Compliance. To comply with applicable laws, regulations, legal processes, and governmental requests.

3. How We Share Your Information

We do not sell your personal information. We share information in the following circumstances:

3.1 Venue and Business Partners

We provide venue and business partners with aggregated, non-individually-identifiable insights about how users interact with their listings. This may include the number of page views, the general geographic area of visitors, and gender distribution of visitors. We do not share individual user identities or individual visit data with venue partners.

3.2 Service Providers

We share information with third-party service providers that process data on our behalf. These include:

• Infrastructure: DigitalOcean (hosting and data storage)
• Analytics: PostHog, and potentially Mixpanel
• Push Notifications: Firebase Cloud Messaging (Google)
• Error Monitoring: We may use Sentry or similar services for crash reporting

Each service provider is contractually bound to process your data only as necessary to perform their services for us and in compliance with applicable data protection laws.

3.3 Advertising Partners

We display advertisements within the Services. Initially, we use Google Ads. Over time, we may serve contextual advertisements based on the type of trip you are planning or the venue you are viewing, similar to how product recommendations work in e-commerce. We may share limited data with advertising partners, including device identifiers and usage signals, to serve and measure the performance of advertisements. We will update this section as our advertising model evolves.

In the future, we may collect and use advertising identifiers (such as IDFA or GAID). When we do, we will request your consent where required by applicable law (including through iOS App Tracking Transparency prompts).

3.4 Other Users

Depending on your privacy settings, other users may be able to view your profile, saved places, trip notes, and group activity. Reviews are published anonymously. You can set your profile to private at any time in your account settings.

3.5 Legal and Safety Disclosures

We may disclose your information if required by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect the rights, property, or safety of Dromo, our users, or others.

3.6 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

4. International Data Transfers

Dromo LLC is a United States company. Our Services are available globally, and we store and process data in the European Union, the United States, and Australia via DigitalOcean data centers.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, your personal data may be transferred to countries outside the EEA that may not provide the same level of data protection. When such transfers occur, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs), to ensure your data is protected in accordance with applicable law.

By using the Services, you acknowledge that your data may be processed in jurisdictions outside your country of residence.

5. Data Retention

We retain your information as follows:

• Account Data: Retained for as long as your account is active. Upon account deletion, we delete your account data within 30 days, except as required by law or as needed for legitimate business purposes (such as resolving disputes or enforcing our terms).
• Activity Preferences and Mood Data: Retained for as long as your account is active. Mood session data that is no longer needed for personalization is anonymized or deleted within 90 days.
• Location Data: Session-level precise location data is retained for up to 90 days for recommendation purposes and then anonymized or deleted.
• Usage and Log Data: Retained for up to 90 days for analytics, security, and diagnostic purposes, then anonymized or deleted.
• Reviews and Trip Notes: Reviews remain published anonymously even after account deletion. Trip notes are deleted when you delete your account.
• Communications: Support communications are retained for as long as necessary to resolve your inquiry and for quality assurance purposes.

When data is no longer needed for the purposes described above, we either delete it or anonymize it so that it can no longer be associated with you.

6. Your Rights and Choices

6.1 All Users

• Account Deletion. You may delete your account at any time through the app settings. Upon deletion, we will remove your personal data within 30 days, subject to the exceptions described in Section 5.
• Location Opt-Out. You may disable location sharing through your device settings at any time. The Services will continue to function with reduced personalization.
• Profile Visibility. You may set your profile to private or public.
• Push Notifications. You may disable push notifications through your device settings.
• Marketing Emails. You may opt out of promotional emails by using the unsubscribe link in any such email.

6.2 European Economic Area, UK, and Swiss Residents

If you are located in the EEA, the UK, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and equivalent local laws:

• Right of Access. You may request a copy of the personal data we hold about you.
• Right to Rectification. You may request correction of inaccurate or incomplete data.
• Right to Erasure. You may request deletion of your personal data, subject to applicable legal obligations.
• Right to Data Portability. You may request your data in a structured, commonly used, machine-readable format.
• Right to Restrict Processing. You may request that we limit how we process your data in certain circumstances.
• Right to Object. You may object to our processing of your data where we rely on legitimate interests as a legal basis.
• Right to Withdraw Consent. Where we rely on consent to process your data, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@dromo.so. We will respond within 30 days (or within the period required by applicable law). We may need to verify your identity before processing your request.

6.3 Legal Bases for Processing (EEA/UK/Switzerland)

We process your personal data on the following legal bases:

• Contract: Processing necessary to provide you the Services you have signed up for (account management, recommendations, core functionality).
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving the Services, analytics, fraud prevention, and serving contextual advertisements, where those interests are not overridden by your data protection rights.
• Consent: Processing based on your explicit consent, such as location data collection, promotional communications, and (where applicable) advertising identifiers.
• Legal Obligation: Processing necessary to comply with applicable laws and regulations.

6.4 California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we collect and how we use it, the right to delete your personal information, and the right to opt out of the sale or sharing of your personal information. We do not sell your personal information. To exercise your rights, contact us at privacy@dromo.so.

7. Children's Privacy

Dromo is not directed to children. We require all users to provide their date of birth at registration. The minimum age to use Dromo is:

• 16 years in Germany and other EU/EEA member states where the minimum age of digital consent is 16
• 13 years in the United States and other jurisdictions where the minimum age is 13

If we become aware that we have collected personal information from a user below the applicable minimum age, we will promptly delete the account and associated data. If you believe a child has created an account on Dromo, please contact us at privacy@dromo.so.

8. Cookies and Tracking Technologies

Our mobile application does not currently use cookies. We may use cookies and similar technologies on any web-based surfaces we operate in the future. When we do, we will update this Policy and, where required, obtain your consent.

Within the app, we use Firebase and PostHog SDKs, which may collect device identifiers, usage data, and diagnostic information. See Section 3.2 for details on these providers.

9. Third-Party Links and Services

The Services may contain links to third-party websites, applications, or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you access through Dromo.

10. Data Security

We implement technical and organizational measures to protect your personal data, including encryption of data in transit and at rest. While we take reasonable steps to safeguard your information, no system is completely secure, and we cannot guarantee the absolute security of your data.

You are responsible for maintaining the security of your account credentials. If you believe your account has been compromised, contact us immediately at privacy@dromo.so.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated Policy within the app and, where appropriate, via email or push notification. The "Effective Date" at the top of this Policy indicates when the latest version took effect.

Your continued use of the Services after any changes constitutes your acceptance of the updated Policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

Dromo LLC
123 Main St, Anytown, USA
Email: privacy@dromo.so

For privacy-related inquiries from EEA, UK, or Swiss residents, you may also contact us at the address above. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.