Privacy Policy

TRADETECH LLC is a Wyoming limited liability company registered to do business in Utah. We operate the GO social connection app. For privacy questions: privacy@goappofficial.us.

a. You provide directly: name, email address, date of birth (used to verify you are 18+), profile photos, bio, interests, availability, and any other information you add to your profile.

b. Generated by your activity: events joined or created, profiles viewed, swipe actions, posts, comments, messages, login history, reports submitted, and in-app interactions.

c. Identity verification data (sensitive): to confirm you are a real person aged 18 or over, our provider Didit collects an image of your government-issued ID, a live selfie, and the facial-geometry data derived from comparing the two. Didit performs the check and returns only a pass/fail decision and a session reference to GO — we never receive or store your ID image or your selfie. Didit retains that material under its own retention policy. Facial-geometry data is biometric information under laws including the Illinois Biometric Information Privacy Act, Texas CUBI, and Washington’s My Health My Data Act. We process it solely for age and identity assurance — never for advertising, profiling, or sale.

d. Audio recordings: voice notes you record in chats are stored so the recipient can play them back. They are kept in private storage and served only through short-lived signed links to participants in that conversation.

e. Device & technical data: device type, operating system, unique device identifiers, IP address, browser type, crash reports, and app performance data.

f. Precise geolocation (sensitive data): collected only with your explicit permission, used only to show you nearby people and activities. You can revoke location permission at any time in device settings. We do not sell, share, or otherwise disclose precise location data to any third party for their own purposes — including data brokers or advertisers.

We use your data to: create and maintain your account; show you nearby people and events based on your location and interests; enable messaging and connections; send service notifications you have enabled; detect fraud, enforce our Terms, and maintain platform safety; improve GO through aggregated analytics and research; and comply with legal obligations. We do not use your personal data for fully automated decision-making that produces significant legal or similarly significant effects without human review.

With other users: your profile, posts, and general location (city-level only, never precise GPS) are visible per your privacy settings.

Third-party service providers (processors): we use the following vendors who process data on our behalf under strict data protection agreements:
• Supabase — database, authentication, and file storage (US-based; Supabase DPA / Standard Contractual Clauses apply)
• Didit — identity and age verification. Receives your ID image and selfie directly from your device and returns only a pass/fail result to GO
• Cloudflare R2 — storage of photos, voice notes, and other media. Private media is served only through short-lived signed links
• Resend — verification and security emails
• EmailJS — password-reset emails
• Apple Push Notification service — delivery of push notifications to your device
• Leaflet / OpenStreetMap — map rendering (no personal data transmitted)
These vendors are prohibited from using your data for their own purposes.

Legal compliance: we may disclose data when required by law, valid court order, or to prevent imminent harm to any person. We report all CSAM to NCMEC as required by federal law.

Business transfers: if GO is acquired or merged, your data may transfer as a business asset. We will notify you at least 30 days before any such transfer takes effect.

We do NOT: sell your personal data, sell or share precise location data, share message content with advertisers or analytics providers, or use your data for targeted third-party advertising without your opt-in consent.

Precise GPS location is a sensitive data category under California (CCPA/CPRA), Virginia (CDPA), Utah (UCPA), Texas (TDPSA), and other state laws. We: (a) collect precise location only with your explicit, in-app consent shown before the first location request; (b) use it only to compute proximity matching — we do not persist precise GPS coordinates beyond the matching computation; (c) display only approximate location (city/region) to other users; (d) never sell or share precise location data with any third party. You can revoke location permission any time in Settings › Privacy or device settings. Revoking does not affect other app features except distance-based matching.

The content of your private messages is not sold, shared with advertisers, or disclosed to third parties except: (a) as required by valid law enforcement process; (b) to prevent imminent risk of serious harm; or (c) as disclosed elsewhere in this Policy. If we scan messages for prohibited content (CSAM, trafficking, spam) for safety purposes, we disclose that here and limit use to safety enforcement only. Messages are transmitted over encrypted connections (TLS/HTTPS). We comply with the Electronic Communications Privacy Act (ECPA) in handling stored communications.

Under the TAKE IT DOWN Act (federal law, effective May 19, 2025), GO maintains a process to remove non-consensual intimate imagery — including AI-generated deepfakes — within 48 hours of receiving a valid notice. To submit a removal request: use "Report Intimate Image" in Settings › Privacy, or email safety@goappofficial.us with subject "NCII Takedown Notice." Include a description or URL of the content, your relationship to it, and your contact information. We will also search for and remove duplicates. False notices may violate federal law.

We retain your data while your account is active. After account deletion: personal data is removed within 30 days; a 90-day safety retention window applies for investigating Terms violations reported before deletion; transaction records are kept 7 years for tax and legal compliance; anonymized aggregate analytics data may be retained indefinitely. To request expedited deletion, email privacy@goappofficial.us.

This section is our publicly available written policy for biometric identifiers and biometric information, published to satisfy the Illinois Biometric Information Privacy Act (740 ILCS 14/15(a)) and comparable requirements in Texas and Washington.

What we hold: GO does not collect or store biometric identifiers. Your ID image and selfie are transmitted directly from your device to our verification provider, Didit. GO receives only a pass/fail result and a session reference. We hold no facial-geometry data at any time.

What Didit holds: Didit processes the ID image, selfie, and derived facial geometry solely to complete the verification, under a data processing agreement that prohibits any other use.

Destruction schedule: biometric data is destroyed within one (1) month of your verification. We have configured this retention limit directly with Didit; it applies automatically to every verification session, existing and future. This is substantially shorter than the three-year outer limit permitted by 740 ILCS 14/15(a), because the purpose — confirming you are a real adult — is satisfied the moment verification completes. Deleting your GO account also destroys the associated verification record.

No profit: we do not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information, and we never will. We do not disclose it except as required by law or with your consent.

Consent: before any biometric collection begins, we show you a written disclosure of what is collected, by whom, for what purpose, and for how long, and we record your affirmative agreement with a timestamp. You may withdraw consent by deleting your account in Settings › Security.

Access: view your data in Profile Settings.

Correction: edit profile data in-app, or email us for other corrections. We respond within 45 days (UCPA effective July 1, 2026).

Deletion: delete your account in Settings › Security. Data removed per Section 8.

Data portability: request an export of your data at privacy@goappofficial.us.

Do Not Sell or Share: use the toggle in Settings › Privacy › Data Rights. We honor opt-outs within 15 business days.

Limit Sensitive Data: use the "Limit Sensitive Data Use" toggle in Settings › Privacy to restrict how we use your location and other sensitive data.

Opt out of marketing email: use the unsubscribe link in any marketing email we send.

If you are a Utah resident, you have rights under the Utah Consumer Privacy Act (UCPA) including: access to personal data we process about you; deletion of personal data you provided; obtaining a copy (portability); correction of inaccurate data (effective July 1, 2026 per HB 418); and opt-out of the sale of personal data and targeted advertising. Precise geolocation, along with race/ethnicity, religion, health, sexual orientation, and biometric data, is treated as sensitive data under UCPA and is subject to heightened protections. We do not sell personal data and do not process sensitive data without a valid legal basis. Submit requests to privacy@goappofficial.us. We respond within 45 days with a possible 45-day extension.

California residents have the right to: know what personal information we collect and how it is used and shared; request deletion; correct inaccuracies; opt out of the "sale" or "sharing" of personal information (we do not sell, and the "Do Not Sell or Share" toggle in Settings is available to you); limit use of sensitive personal information including precise geolocation; and not be discriminated against for exercising these rights. To submit a verifiable consumer request, email privacy@goappofficial.us or use in-app privacy controls. We respond within 45 days. We do not have actual knowledge of selling personal information of consumers under 16.

Residents of states with comprehensive privacy laws (Virginia CDPA, Texas TDPSA, Colorado CPA, Connecticut CTDPA, Oregon OCPA, Montana MCDPA, and others) have rights including: access, correction, deletion, portability, and opt-out of targeted advertising and data sales. Virginia law (effective July 1, 2026) requires opt-in consent before GO collects or processes your precise geolocation — our standalone location consent prompt satisfies this requirement. We do not sell precise geolocation data. Contact privacy@goappofficial.us to exercise your rights. We respond per applicable state timelines (generally 45 days).

Our legal bases for processing your data are: contract performance (account and matching features); legitimate interest (safety, fraud prevention, service improvement); consent (location data, optional marketing); and legal obligation. You have rights to access, rectify, erase, restrict, object to processing, and receive a portable copy of your data. To exercise rights or lodge a complaint with your local supervisory authority, contact privacy@goappofficial.us. Data transfers to the US from the EU/EEA are covered by Supabase's Standard Contractual Clauses (SCCs). In the event of a breach affecting EU residents, we notify the relevant supervisory authority within 72 hours as required by GDPR Article 33.

GO is strictly for users 18 and older. We do not knowingly collect personal information from anyone under 18. Our signup flow requires a date of birth and blocks users under 18. If we learn that a user under 18 has created an account, we immediately delete the account and all associated data. If you believe a minor is using GO, report them via the in-app "Report a User" feature or email safety@goappofficial.us immediately. We comply with COPPA and the FTC's 2026 guidance on age verification.

In the event of a data breach that creates a risk to your rights or freedoms, we will notify affected users as required by applicable law. Specific timelines we follow: California residents — within 30 days; New York residents — within 30 days; EU/EEA residents — supervisory authority notified within 72 hours, individuals notified without undue delay; all other US states — without unreasonable delay (typically within 30–60 days depending on state law). Notifications will describe: what data was exposed, what we are doing about it, and steps you can take to protect yourself.

We implement technical and organizational safeguards including: encryption in transit (TLS/HTTPS); database row-level security (Supabase RLS); access controls and least-privilege database access; server-side rate limiting; regular security reviews. No system is completely secure — you are responsible for keeping your credentials confidential. We maintain a written Incident Response Plan and will execute it in the event of a breach.

We use session storage and local storage to maintain your login session and remember preferences. We do not use third-party advertising cookies or tracking pixels. We do not share browsing or usage data with advertisers. You can clear local/session storage through your browser or device settings; this will log you out.

GO may display links to external services. This Privacy Policy does not govern third-party services. We are not responsible for third-party privacy practices. Review each third party's privacy policy before providing them with your data. Third-party processors that handle your data on our behalf are listed in Section 4.

We may update this Privacy Policy. We will notify you of material changes via in-app notification and/or email at least 14 days before changes take effect. The "Last updated" date at the top of this Policy reflects the most recent revision. Continued use after the effective date constitutes acceptance. If you do not agree, delete your account before the effective date.

Privacy requests, rights exercises, NCII notices, and legal matters:
privacy@goappofficial.us

TRADETECH LLC
Sheridan, Wyoming

We respond to all privacy requests within 45 days.