This Privacy Policy explains how Royal Notes LLC, a Wyoming limited liability company ("Royal Notes," "we," "us" or "our"), collects, uses, discloses and protects information about you when you use the Royal Notes mobile application (the "App"), our website at royalnotes.io (the "Site"), and related services (together, the "Platform"). Capitalized terms not defined here have the meanings given in our Terms of Service.
This policy does not cover third-party services that we link to or that you use alongside the Platform, such as Apple, our payment processor or social networks. Their own privacy policies apply to them.
01The short version
- What we collect: your Apple sign-in details, a verified phone number, your username, your shipping addresses, your transactions in the App (purchases of Credit, Box opens, Sell-Backs and shipments), and device and usage data.
- What we do not collect: Social Security numbers, government ID images, selfies or other biometrics, precise GPS location, or your contacts. Our payment processor handles your full card number, not us.
- Who we share it with: the service providers that run the Platform; the Retailers and carriers that deliver the Items you ship; and, for advertising measurement, our measurement partner and the ad networks it reports to (currently Meta and TikTok).
- We do not sell your personal information for money. Our advertising measurement may count as "sharing" or "targeted advertising" under some state laws. You can opt out (Section 6).
- Your choices: you can control App tracking through Apple's App Tracking Transparency prompt, opt out of ad sharing, delete your Account in the App, and make privacy requests to [email protected].
02Who can use the Platform
The Platform is for adults 18 and older in the United States. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it and close the Account. If you believe a minor is using the Platform, contact [email protected].
03Information we collect
3.1 Information you give us
| Category | Examples |
|---|---|
| Sign-in details | When you sign in with Apple: your Apple user identifier, plus your name and email address if you choose to share them. If you choose Hide My Email, we receive an Apple private relay address instead of your real email |
| Phone number | The U.S. mobile number you verify, and when you verified it |
| Profile | Your username (generated for you and editable) |
| Consent records | Your confirmation that you are 18 or older, the version of the Terms you accepted, and the time and IP address when you accepted |
| Shipping addresses | The name, street address, city, state, ZIP code and phone number you save for delivery |
| Communications | Messages you send to support, and your survey responses or feedback |
3.2 Information created when you use the Platform
| Category | Examples |
|---|---|
| Credit purchases | Amount, method type (card or Apple Pay), status, our payment processor's reference, and refund or chargeback status. If the processor provides them, we may also receive limited card details such as the card brand and last four digits |
| Box opens | The Box, price paid, Odds Version, the random values drawn, and the tier and Item you won |
| Collection and Sell-Backs | Items you hold, Item Values, Sell-Back and Auto-Sell amounts, and timestamps |
| Shipments | A copy of the delivery address, Shipping Charges, status, Retailer order reference, carrier and tracking number |
| Balance records | Each addition to and deduction from your Balance |
| Account status | Blocks, restrictions, and the reasons for them |
3.3 Information collected automatically
| Category | Examples |
|---|---|
| Device information | Device model, operating system, App version, and Apple's identifier for vendors (IDFV) |
| Advertising identifiers | Apple's Identifier for Advertisers (IDFA), only if you allow tracking through Apple's App Tracking Transparency (ATT) prompt, and your ATT status |
| Network and session data | IP address, user agent, and session start and last-seen times |
| Approximate location | City, region or state worked out from your IP address. We do not collect precise GPS location |
| Attribution data | Which ad, campaign or link led to your install or sign-up, provided by our measurement partner, plus its device identifier |
| Diagnostics | Crash reports, error logs and performance data |
| Site cookies | See Section 7 |
3.4 Information from third parties
- Apple: sign-in details, and sign-in revocation notices.
- Twilio: whether your phone number was verified, and phone line details (such as mobile or internet-based, and carrier). We use these to prevent duplicate and fraudulent accounts.
- Our payment processor: payment status, refunds, chargebacks and fraud-risk signals.
- Our measurement partner and ad networks: attribution data about the ads you saw or tapped.
- Retailers and carriers: order, shipping and delivery status.
3.5 Device permissions
The App asks for permission before using the following:
- Tracking (ATT): lets us and our measurement partner use your IDFA. You can change this at any time in iOS Settings, under Privacy & Security, then Tracking.
- Photos (add only): lets you save an image of an Item you won to your photo library when you choose to. We do not read your photo library.
The App does not request access to your location, contacts, camera or microphone.
04How we use information
We use information to:
- Provide the Platform: create and run your Account, process purchases of Credit, run Box draws, keep your Collection and Balance, process Sell-Backs and Auto-Sells, and fulfill shipments.
- Keep draws auditable: store the record of each open so that results can be checked against the published Odds.
- Verify and protect: verify your phone number, enforce one Account per person, and detect and prevent fraud, chargebacks, abuse and security incidents. Some of these checks are automated. For example, an Account is blocked automatically when a chargeback makes its Balance negative. If you think an automated decision is wrong, contact [email protected] and a person will review it.
- Communicate with you: send transaction, shipping, security and support messages, and, if allowed, news and offers, which you can opt out of.
- Measure and improve advertising: find out which ads lead to installs, sign-ups and purchases, and report those results to ad networks so that they can optimize our campaigns (Section 6).
- Improve the Platform: debug, analyze usage and develop features.
- Meet legal obligations: comply with law, tax and accounting requirements, sanctions rules and legal process; enforce our Terms; and protect the rights, safety and property of our users, Royal Notes and others.
- Do anything else you ask or agree to.
We may also create aggregated or de-identified information that cannot reasonably identify you, and use it for any purpose. We will not try to re-identify it.
05How we disclose information
| Recipient | What and why |
|---|---|
| Service providers that work for us under contract: cloud hosting, database and file storage, website hosting and delivery, payment processing (Coinflow), phone verification (Twilio), email and workspace tools, crash reporting, and advertising measurement (our mobile measurement partner) | Only what each provider needs to perform its service for us |
| Retailers and carriers | When you ship an Item, we give the Retailer your name, delivery address and phone number so that it can ship to you directly, and carriers receive them to deliver. Retailers may also handle that information under their own privacy policies |
| Ad networks, through our measurement partner (currently Meta and TikTok) | Device identifiers (IDFA if allowed, and the IDFV), IP address, hashed (scrambled) email address and phone number, and events such as sign-up and purchase amount. We use this to measure and optimize our ads. See Section 6 |
| Apple | As needed for Sign in with Apple, Apple Pay and the App Store |
| Professional advisors | Lawyers, accountants and auditors, under confidentiality obligations |
| Legal and safety | When we believe disclosure is needed to comply with law, legal process or government requests; to enforce our Terms; or to protect anyone's rights, safety or property, including to prevent fraud and handle chargebacks with our processor and card networks |
| Corporate transactions | To a buyer, successor or financing party in a merger, acquisition, financing, reorganization, bankruptcy or sale of assets. Where required, we will notify you if your information becomes subject to a different privacy policy |
| With your consent or at your direction | For example, when you share an image of an Item you won to another app |
We do not sell personal information for money. Some state laws define "sale," "sharing" or "targeted advertising" broadly. Under those definitions, the advertising disclosures above may count, and Section 6 explains how to opt out.
06Advertising and measurement
We advertise Royal Notes on platforms such as Meta (Facebook and Instagram) and TikTok. To find out which ads work, and to help those platforms show our ads to people likely to be interested, we use a mobile measurement partner. Its software in the App, and our servers, send it events such as installs, sign-ups and purchases of Credit, together with device identifiers. It then reports those events to the ad networks. We hash your email address and phone number before sending them for ad matching.
Your choices:
- App Tracking Transparency: if you choose "Ask App Not to Track," we and our partner will not access your IDFA. You can change this at any time in iOS Settings, under Privacy & Security, then Tracking.
- Opt out of sharing and targeted advertising: email [email protected] from the email address on your Account with the subject "Do Not Sell or Share." We will stop sending your hashed identifiers and your events to ad networks for advertising, except where we need to for limited purposes the law allows, such as fraud prevention or aggregate measurement.
- Global Privacy Control: on the Site, we treat a Global Privacy Control signal from your browser as an opt-out request for that browser.
- Ad network settings: you can also manage ad preferences directly with Meta and TikTok, and with industry tools such as the Network Advertising Initiative's opt-out page (optout.networkadvertising.org) and the Digital Advertising Alliance's opt-out page (optout.aboutads.info).
07Cookies on the Site
The Site uses a small number of cookies and similar technologies:
- Essential: needed for the Site to work and stay secure.
- Functional: remember your preferences.
- Analytics: help us understand Site traffic and fix errors.
If we add advertising cookies or pixels to the Site, we will update this section and honor opt-outs as described in Section 6. You can block or delete cookies in your browser settings. Some Site features may not work if you do. Third-party content on the Site may set its own cookies, which are governed by those third parties' policies.
08Your privacy rights
Depending on where you live, you may have the right to:
- Know and access the personal information we have about you and how we use and disclose it, and get a copy in a portable format;
- Correct inaccurate personal information;
- Delete personal information, subject to exceptions;
- Opt out of the "sale" or "sharing" of personal information, and of targeted advertising (Section 6);
- Limit the use of sensitive personal information. We use sensitive personal information only for purposes the law allows without offering this right, such as account security and fraud prevention;
- Appeal our decision on your request; and
- Not be discriminated against for exercising these rights.
How to make a request: email [email protected] from the email address on your Account, or contact us through the App's support screen. We will verify your request by matching it to your Account. For example, we may ask you to confirm a code sent to your verified phone number. You can also delete your Account directly in the App (Section 10).
Authorized agents: an agent may make a request for you with your signed permission. We may still ask you to verify your identity directly.
Timing: we will respond within 45 days, and may extend that by another 45 days where the law allows, if we tell you. You may make access and portability requests free of charge at least twice in any 12-month period.
Appeals: if we decline your request, you may appeal by replying to our decision with the subject "Privacy Appeal." We will respond within the time the law requires. If you are not satisfied, you may contact your state attorney general.
Exceptions: we may keep or decline to delete information that we need to complete transactions, meet legal, tax and accounting obligations, keep auditable draw records, prevent fraud and chargebacks, secure the Platform, or establish or defend legal claims.
09Notice at collection for California residents
In the past 12 months we have collected the following categories of personal information, as the California Consumer Privacy Act defines them. Sources, purposes and recipients are described in Sections 3 to 5.
| Category | Examples | Disclosed for business purposes to | Sold or shared for cross-context advertising? | Retention |
|---|---|---|---|---|
| Identifiers | Name, email, phone number, Apple user identifier, IDFV, IDFA, IP address, Account ID | Service providers, Retailers and carriers (name and phone), advisors | Shared: hashed email and phone, device IDs and IP, with ad networks through our measurement partner | Section 10 |
| Customer records (Cal. Civ. Code § 1798.80) | Name, address, phone number, limited payment card details | Service providers, Retailers and carriers | No | Section 10 |
| Commercial information | Purchases of Credit, Box opens, Items won, Sell-Backs, shipments | Service providers, advisors | Shared: sign-up and purchase events, with ad networks through our measurement partner | Section 10 |
| Internet and network activity | App interactions, session data, crash logs, attribution data | Service providers | Shared: App events and attribution data, with our measurement partner | Section 10 |
| Approximate geolocation | State or city worked out from your IP address | Service providers | No | Section 10 |
| Sensitive personal information | Account sign-in credentials (Apple sign-in token) | Service providers (Apple) | No | Life of Account |
| Inferences | None | Not applicable | Not applicable | Not applicable |
We do not knowingly sell or share the personal information of consumers under 16.
10How long we keep information
| Information | How long we keep it |
|---|---|
| Account profile, phone number, addresses | While your Account is open. After deletion, we remove or de-identify it within 90 days, except as listed below |
| Records of purchases of Credit, Box opens, Balance changes, Sell-Backs and shipments | 7 years after the transaction, for tax, accounting, chargeback and audit purposes, and to keep draw results auditable |
| Consent records (age confirmation, Terms version, time, IP address) | While your Account is open, plus 7 years |
| Phone-verification and fraud-prevention records, including the phone numbers of closed or banned Accounts | Up to 5 years, to prevent repeat fraud and duplicate Accounts |
| Device and attribution data | 24 months after collection |
| Support communications | 3 years |
| Crash and diagnostic logs | 90 days |
When you delete your Account in the App, we revoke your sessions, unlink your Apple sign-in, and mark the Account deleted. After that, we keep only the records listed above, for the periods shown, and then delete or de-identify them.
11Security
We use reasonable administrative, technical and physical safeguards to protect your information. These include encryption in transit (TLS), encryption at rest through our hosting providers, access controls, hashed session tokens, strong password hashing and logging of every staff action in our admin tools, and a payment processor certified under the payment card industry's security standard (PCI DSS) to handle card data. No system is completely secure, and we cannot guarantee the security of information sent over the internet. You can help by keeping your Apple ID, phone and device secure. If a breach affects your personal information, we will notify you as the law requires.
12Where we process information
We are based in the United States, and we and our service providers process information in the United States. The Platform is not intended for use outside the United States.
13Third-party links and features
The Platform may link to or include third-party sites, software and services, such as Retailer pages, carrier tracking pages and social sharing. We are not responsible for their privacy practices. Information you give them is governed by their policies.
14Changes to this policy
We may update this Privacy Policy. We will post the new version with a new "Last updated" date. If a change is material, we will notify you in the App or by email before it takes effect.
15Contact us
Royal Notes LLC 30 N Gould St Ste R Sheridan, WY 82801
Email: [email protected] (privacy requests, questions and general support)