Sugarlist Privacy Policy

Effective Date: August 5, 2025 - Last Updated: August 9, 2026

This Privacy Policy ("Policy") describes how Sugarlist, operated by Sugarlist LLC ("Sugarlist", "we", "our", or "us"), collects, uses, and shares information when you use our website, mobile application, and related services (the "Service"). By accessing or using the Service, you consent to the practices described in this Policy.

1. Information We Collect

1.1 Information You Provide

• Account & Identity Data: email address, phone number, username or handle, display name, optional birthday, and authentication identifiers. Authentication credentials are handled through Firebase Authentication and supported identity providers.
• Profile, Wishlist & Communication Data: profile descriptions, links, profile and banner images, wishlist items, private messages, message images and GIFs, voice recordings, and reactions.
• Payout & Financial Data: payout account holder name, country and address, bank-recipient details needed for Wise payouts, balances, received purchases, gifts and tips, withdrawal amounts, fees, and payout status.
• Support & Safety Data: support requests, reports, report reasons, optional details, and the account, profile, wishlist item, conversation, or message context needed to review a report.
• Affiliate Program Data: referral codes, affiliate earnings.

1.2 Information Automatically Collected

• Device, Notification & Log Information: IP address, browser type, operating system, referring URLs, a mobile installation identifier, Expo push token, platform, app version, and notification preferences.
• Functional Interaction Data: conversation typing status, message-read state, purchase-seen state, and similar interactions needed to provide unread counts, notifications, and in-app state.
• Usage & Diagnostic Data: website pages visited, time spent, interactions, and service error logs, including analytics collected where Firebase or Google Analytics is enabled.

1.3 Payment, Purchase & Payout Data

• Payment-card details are processed by Stripe, and we do not store full card numbers.
• Stripe-connected creator payouts and related payout statements are administered through ShareTech LLC.
• When you configure a Wise payout method in the mobile app, Sugarlist collects the bank-recipient and address details required for your country and transmits them to Wise. We retain the resulting Wise recipient identifier and limited payout and address metadata, rather than your full bank credentials.
• Transaction metadata from Stripe (e.g., transaction ID, token purchase amount, chargeback status).
• Purchase and received-activity history, token balance, withdrawals, payout fees and status, and revenue-sharing records.

2. How We Use Your Information

• Create, authenticate, link, and manage your account across supported sign-in providers.
• Provide, operate, and improve the Service.
• Publish and manage profiles and wishlists and deliver messages, images, GIFs, voice recordings, and reactions to their intended recipients.
• Register devices and deliver account, message, gift, tip, and security notifications through push, email, or SMS.
• Facilitate token purchases, gifts, tips, affiliate payouts, and withdrawals.
• Create and verify payout recipients, process withdrawals, and meet fraud-prevention, tax, know-your-customer, and anti-money-laundering obligations.
• Detect, investigate, and prevent fraud and Chargebacks.
• Moderate submitted content, receive safety reports, preserve relevant context, and escalate reports to our support reviewers.
• Communicate with you about your account, support requests, and policy updates.
• Analyze usage trends to improve user experience and develop new features.

3. Legal Bases for Processing (EEA/UK Users)

• To perform our contract with you (Terms of Service).
• Based on legitimate interests (Service security, fraud prevention, analytics).
• With your consent (marketing emails, optional cookies).
• To comply with legal obligations (tax, anti-money-laundering rules).

4. How We Share Your Information

• Service Providers and Payout Administration: ShareTech LLC (administration of Stripe-connected creator payouts and payout statements), Stripe (payments and Stripe Connect payout infrastructure), Wise (bank-recipient setup and payouts), Firebase (authentication, database, and storage), Apple and Google (supported authentication), Expo and Apple Push Notification service (mobile delivery and push notifications), email and SMS delivery providers, Google Analytics where enabled, and AI moderation vendors. These providers receive the information needed to perform their services.
• GIF Search: GIF search terms are relayed to GIPHY when you use the GIF picker so GIPHY can return matching content.
• Other Users and the Public: public profile, link, photo, banner, and wishlist information is visible to other people using Sugarlist and may be visible on the public web. Private conversation content is shared with the conversation participants.
• Safety and Support Review: report details and relevant account, profile, wishlist item, conversation, or message context are shared with authorized company support reviewers and the email provider used to deliver report alerts. Submitted images or content may be sent to moderation providers for safety review.
• Affiliates: When a transaction occurs via an affiliate link, limited transaction details are shared to credit the affiliate.
• Legal & Safety: We may disclose information if required by law or to protect the rights, property, or safety of Sugarlist or others.
• Business Transfers: In merger, acquisition, or sale of assets, user information may be transferred as part of the transaction.

5. Cookies & Similar Technologies

We use cookies, local storage, and similar technologies to remember preferences, keep you logged in, and analyze usage. The mobile app also uses local storage for app state and a stable installation identifier used to manage push-notification registrations. You can disable cookies in your browser, but parts of the Service may not function properly. Sugarlist does not use mobile-app data for cross-app tracking or third-party advertising.

6. Data Retention

• We retain personal data as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.
• Profile, wishlist, message, and media content is generally retained while your account is active or until you delete the content, subject to backups, safety investigations, and legal requirements.
• Transaction and financial records are kept for at least seven (7) years or as required by tax and accounting laws.
• Full Wise bank identifiers are relayed to Wise rather than retained by Sugarlist. Sugarlist retains limited payout-profile information such as recipient and provider identifiers, country, currency, account type, recipient name, and payout address. Stripe and Wise retain information under their own privacy policies.
• Support and safety reports may be retained as needed to investigate abuse, enforce our policies, protect users, and document our response.
• Mobile push tokens and installation identifiers are retained while needed to deliver notifications and are removed or disabled when the device is unregistered, notifications are disabled, or the associated account is deleted, subject to security and legal-retention requirements.

7. Security

We implement industry-standard technical and organizational measures to protect your information. However, no Internet transmission or storage system is completely secure; we cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, or delete personal data; object to or restrict processing; data portability; and withdraw consent at any time. You can exercise these rights by contacting support@sugarlist.com. We may require identity verification. You can also initiate account deletion from Settings in the mobile app. Deletion removes or disables the public profile, but transaction, payout, fraud-prevention, safety-report, security, and other records may be retained for the periods described above when required by law or necessary to protect the Service and its users.

9. Children's Privacy

Sugarlist is not directed to children under 18, and we do not knowingly collect personal information from children. If we learn that a child under 18 has provided personal information, we will delete it.

10. International Data Transfers

Your information may be transferred to and processed in countries outside your country of residence, including the United States. We use standard contractual clauses or other approved mechanisms to protect your data where required.

11. Changes to This Policy

We may modify this Policy periodically. We will post the updated Policy and update the "Last Updated" date. Material changes will be communicated via email or in-app notice.

12. Contact Us

For questions or concerns about this Policy or our data practices, email support@sugarlist.com.