Privacy Policy

Effective Date: February 9, 2026

Sparrowstep LLC ("Sparrowstep," "we," "us," or "our") operates the Vivi mobile application and the website at letsvivi.com (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using Vivi, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

Information You Provide

• Account information: When you sign up, we collect your phone number or email address for authentication purposes.
• Profile information: You may optionally provide your first name, last name, city, state, zip code, a short bio, and a profile photo.
• Gathering information: When you create a gathering (event), you provide details such as the title, description, venue name, address, date, and time.
• Social connections: Friend requests, friend lists, and subcrew (friend group) memberships you create or join.
• Comments: Any comments you post on gatherings.

Information Collected Automatically

• Activity logs: We log certain actions within the app (such as creating a gathering, sending a friend request, or RSVPing) to maintain the Service and improve your experience. These logs are stored on our servers and are not shared with third parties.
• Device information: We store your theme preference (light or dark mode) and onboarding status locally on your device using standard mobile storage.

Information We Do NOT Collect

• We do not track your device location. Gathering venues are entered manually by hosts, not obtained from your GPS.
• We do not use third-party analytics or advertising services (no Google Analytics, no ad trackers, no pixels).
• We do not sell or share your personal information with data brokers or advertisers.

Contacts (Optional)

If you grant permission, Vivi can access your phone contacts to help you find friends who already use Vivi and to invite others. Contact data is used solely for this purpose and is not stored on our servers or shared with third parties.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Authenticate your identity via one-time passcode (OTP) sent by SMS or email
• Display your profile to other users
• Show you gatherings relevant to your social connections
• Enable social features (friend requests, RSVPs, comments, co-hosting)
• Send you transactional messages (e.g., authentication codes)
• Maintain, improve, and secure the Service

3. How We Share Your Information

We do not sell your personal information. We share information only in the following limited circumstances:

Service Provider	Purpose	Data Shared
Supabase	Database, authentication, and file storage	Account data, profile data, gathering data, uploaded photos
Twilio	SMS delivery for phone authentication	Phone number (for OTP delivery only)
Google Places API	Venue address autocomplete	Search queries (no personal data)

These providers process data on our behalf and are contractually bound to use it only for the purposes we specify.

We may also disclose your information if required by law, legal process, or government request, or to protect the rights, safety, or property of Sparrowstep, our users, or the public.

4. What Other Users Can See

• Visible to other users: Your first name, last name, city, state, bio, and profile photo.
• Always private: Your email address, phone number, and zip code are never displayed to other users.
• You control your friend list visibility: You can choose who sees your friend list — no one, only your friends, friends of friends, or everyone. The default is "friends only."
• Gathering visibility: When you create a gathering, you choose who can see it — your friends, friends of friends, or a specific subcrew.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you deactivate your account, your profile is hidden from other users but your data is retained in a deactivated state. You may request permanent deletion of your data by contacting us (see Section 10).

6. Data Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS), row-level security on our database, and secure authentication via one-time passcodes. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Children's Privacy

Vivi is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will promptly delete it.

8. Your Rights Under California Law (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to know: You can request what personal information we have collected, the sources, the purposes, and with whom it has been shared.
• Right to delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to opt out of sale: We do not sell your personal information, so there is nothing to opt out of.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at privacy@letsvivi.com. We will respond within 45 days as required by law.

9. SMS/Text Messaging

When you choose to sign in with your phone number, we send a one-time verification code via SMS. Message and data rates may apply. You will receive one SMS per sign-in attempt. We do not send marketing messages via SMS. You can opt out of phone-based authentication at any time by switching to email-based sign-in.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by other means. Your continued use of Vivi after changes are posted constitutes your acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

Sparrowstep LLC
Email: privacy@letsvivi.com