Privacy Policy

1Who we are and who this covers

This policy applies when you download or use the The Deaf Socials mobile app, create or use an account, tap I’m going on an event, create or edit an event, visit our legal pages or the password-reset page, or otherwise use the Service.

The Service helps the Deaf community discover and share local events on a map and list. It is operated by Zbroz Technology Solutions, LLC.

Questions, requests, or complaints: privacy@thedeafsocials.com. Use the email on your account when you write to us so we can find you.

2Information you give us

You give us information when you create an account, sign in, reset or change a password, create or edit an event, or delete your account.

• Account. Email address (stored in lowercase and trimmed), username, and a password. We store only a one-way hash of the password (Argon2id). We never store or log your password in readable form. New public accounts are created as ordinary users. You cannot choose a staff role.
• Locked identity. In the app, email and username are locked. Treat them as permanent. Do not use an email or username you are not willing to keep.
• Events you create or edit. Title, description, start time, end time, street address line 1, optional apartment/suite line, city, state or province, postal code, country, map pin (latitude and longitude), a place label we compose from the address, and at most one optional Facebook, Instagram, or Eventbrite page link. We store who created the event. If an event is rejected, we may store the reason. If you edit a published event, we may store a proposed update separately until it is approved or declined.
• Going. If you tap I’m going, we store that your account is going to that event. If you tap Not going, we remove that record.
• Password reset and change. The email you use to request a reset. The new password is hashed like any other password. We do not keep the reset link in a form you can read after it is used.
• Account deletion. Your current password, which we check and do not store in readable form, to confirm it is you.

3Information we collect automatically

When you use the Service, we collect technical and security information needed to run it.

• Installation ID. A random ID stored in your device’s secure storage. We send it with API calls (as a header and, when a JSON body is sent, in that body). We use it to recognize the same install for security. We do not clear it when you log out. It stays until the app is removed or the secure storage is cleared.
• Sign-in tokens. A short-lived access token and a longer refresh token stored only in your device’s secure storage (not in ordinary app settings). On our servers we store only a hash of the refresh token, when it expires, whether it was revoked, and the installation ID when known. The access token includes your account id and role so the app can call the Service. Role is checked again from our database for protected actions.
• Your phone’s location. If you allow when-in-use location, the app uses it on the device to center the map and to sort the list by distance. We do not upload your live GPS to search for events. Discovery downloads published events; your phone does the distance math. If you deny location, the map can still open on a wide United States view. We ask only for when-in-use location. We do not ask for always-on or background location.
• Event place pins. When you publish or save an event, the latitude and longitude you confirm are stored and shown on the map after approval. That is the event’s place, not a live track of your phone.
• Internet address and request id. Our servers may see your IP address to apply rate limits and to record security events. Each request can carry a request id so we can match a problem without storing the full request body.
• Activity times. We may store when you last signed in, signed out, requested a password reset, completed a reset, changed your password, and when the account was created or last updated. Token refresh does not change those activity times.
• Map tiles. When the map is shown, your device loads map images from OpenStreetMap. That company may see your IP address. See Cookies & similar technologies.

We do not collect a profile picture, your contacts, camera or microphone access, calendar, advertising ID, or tracking used for ads. We do not use analytics, crash, or advertising software in the app today.

4Security records

We keep a limited security trail so we can investigate abuse, protect accounts, and meet our own safety needs. These records are not your public profile. They may include the time, a type of event, your account id when known, email when known, IP address, request id, installation ID, and a small set of extra notes (such as which route was hit). We never put passwords, password hashes, or tokens in this trail.

Types of security records include:

• Sign-in succeeded or failed.
• Too many requests (rate limit).
• Refresh token succeeded or failed.
• Password reset requested or completed.
• Password changed.
• Signed out everywhere.
• Account deleted.

If you delete your account, these records may remain, with the account link cleared, so we can still investigate abuse. The delete record may still include the email used at the time of deletion.

5How we use information

We use the information above to:

• Create and run your account, sign you in, refresh your session, and sign you out.
• Show published events on the map and list, including how many people are going.
• Let you create events (which start as pending), edit them, unpublish them, and see your own event history.
• Let our operators review pending creates and published updates before they appear on the map.
• Show usernames of people going when someone opens a published event.
• Send a password-reset email when you ask and we have email sending configured.
• Protect the Service: rate limits, hashed tokens, security records, and blocking disabled accounts.
• Compose a place name from the address parts you enter so the map and list can show a clear label.
• Keep an activity history for events you own (created, updated, unpublished, approved, rejected, and update review actions).
• Comply with law, enforce our Terms of Use, and protect Zbroz Technology Solutions, LLC, the Service, and other people.

We do not sell your personal information. We do not share it with advertising networks. We do not use it to build a marketing profile. We do not send it to third-party AI companies to train their models. See AI & Data.

6How we share information

We share information only as needed to run the Service, as you choose to make public, or as the law requires.

• Other users. Published events show title, description, times, place, map pin, going count, and optional social link. Opening an event can show usernames of people going — not emails. Pending, rejected, cancelled, and past-ended published events stay off the public map and list. Your proposed edits to a live event stay off the map until approved.
• Hosting and database. We use cloud hosting and a PostgreSQL database (currently including Heroku and Heroku Postgres) to store and serve the Service. Those providers process data on our instructions.
• Email. When configured, we use Resend to send password-reset email. The message includes a reset link. We do not put your password in email.
• Maps. Your device loads OpenStreetMap tiles. If you paste a Google Maps or Apple Maps share link, we may fetch that public HTTPS link (allowlisted map hosts only, capped redirects, public DNS) to read coordinates. We do not send your cookies or sign-in details with that fetch.
• Social sites. If you add a Facebook, Instagram, or Eventbrite link, that site’s own rules apply when someone opens it in their browser.
• Law and safety. We may share information if we believe in good faith it is required by law, court order, or government request, or to protect the Service, our users, or Zbroz Technology Solutions, LLC from fraud, abuse, or harm.
• Business changes. If we merge, sell, or reorganize, information may transfer to the successor as part of that transaction, still under this policy or a notice we will give.

7How long we keep it

We keep account, profile, session, and event data while your account exists and as needed to provide the Service.

• While your account is open. Account, username, hashed password, activity times, sessions, reset tokens, events you created, event history snapshots, and going records that include you.
• If you delete your account. We remove your login, profile, sessions, reset tokens, and events you created (and those events’ history and going lists). Going records on other people’s events that pointed at your account are removed with the account. Security records may remain with the account link cleared, as described above.
• Refresh sessions. Refresh tokens expire. Logout and logout-everywhere revoke them. A short-lived access token on a device may still work until it expires even after logout, which is why the app deletes it locally when you sign out.
• Password reset tokens. Single-use and time-limited. A successful reset revokes all of that account’s sessions.

8Your choices

You can:

• Change your password in Profile (this device stays signed in; other devices are signed out).
• Log out on this device.
• Delete your account in Profile by entering your current password. This cannot be undone.
• Turn off location in your device settings. The map can still open without your GPS.
• Tap Not going to remove yourself from an event’s going list (while the event is live and published).
• Unpublish your own live published event (not when it has already ended).
• Email privacy@thedeafsocials.com to ask what we have, to correct something we can correct, or to ask us to delete what the law allows us to delete. We may still keep security records as described above. We may need to verify it is you.

The app does not offer a way to change email or username. The API may allow a username change; the app does not. Treat both as locked.

9Children

The Deaf Socials is for people 13 and older. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe we have, email privacy@thedeafsocials.com. We will delete it. If you are 13–17, a parent or guardian should review this policy and the Terms of Use with you. In-person events may not be appropriate for minors. Organizers and attendees are responsible for that. See the Terms.

10Security

We use reasonable measures designed to protect information: password hashing, hashed refresh and reset tokens, secure storage on the device, HTTPS for the public API, parameterized database queries, rate limits, and limited logging that omits passwords, tokens, and request bodies. No method of transmission or storage is 100% secure. You are responsible for your password and for who can unlock your phone.

11Where information is processed

We currently host the Service in the United States. If you use the Service from another country, you understand your information is processed in the United States, which may have different privacy laws than your country.

12California and similar U.S. state rights

If you are a California resident (and where other U.S. state laws give similar rights), you may have the right to know, delete, and correct personal information, and to opt out of “sale” or “sharing” for cross-context advertising.

• We do not sell personal information, and we do not “share” it for cross-context behavioral advertising, as those words are used in California law.
• Categories we collect include identifiers (email, username, account id, installation ID), internet / device information (IP, request id), geolocation of event pins you publish (not a live GPS track), and user content (events, going status).
• We do not use or disclose sensitive personal information for purposes that California requires us to limit, beyond providing the Service.
• We do not use automated decision-making that produces legal or similarly significant effects about you without human involvement in event approval.
• To exercise rights, email privacy@thedeafsocials.com. We will not discriminate against you for asking. We may need to verify your identity. Authorized agents may contact us at the same address.

We do not respond to “Do Not Track” browser signals because the public web pages we serve do not use tracking cookies. The mobile app does not use advertising trackers.

13Cookies, AI, and the Terms

The app does not use HTTP cookies. Details on tokens, the installation ID, and map tiles are in Cookies & similar technologies. How we process information in software, that the Service does not use generative AI today, and that our team may use tools such as Cursor to write code, is in AI & Data. Use of the Service is also governed by the Terms of Use.

14Changes

We may update this page. The “Last updated” date at the top will change. If you keep using The Deaf Socials after an update, you accept the new version. We may also tell you in the app or by email when a change is important. Your continued use is acceptance even if you do not read the new version.