GrapeVine Social Privacy Policy

Effective Date: December 3rd, 2024

Last Updated: September 6th, 2026

Welcome to GrapeVine Social! We are committed to protecting your privacy. This Privacy Policy outlines how we collect, use, and safeguard your information when you use our mobile application ("App"). By accessing or using the App, you agree to the terms of this Privacy Policy.

1. Information We Collect

We collect the following information:

• Account Information: Your email address is collected when you create an account. If you sign in with Apple or Google, we receive the email address (and, if you allow it, the name) that the provider shares with us.
• Profile Information: The display name, profile photo, bio, and links you choose to add to your profile.
• Content: The Posts and Comments you write and any photos or videos you attach to them.
• Last Location: We store your last known location to enhance your experience within the App.
• Post and Comment Locations: Whenever you create a Post or Comment, we save the current location associated with that content. You control how precisely that location is shown to other users (country only, city, or neighborhood) through your privacy settings in the App.
• Subscription Information: If you purchase a subscription through the App Store, we receive and store the purchase and transaction identifiers Apple provides so we can confirm and renew your subscription. We never see your payment card details.
• Human Verification Metadata: When you complete our human-verification flow we generate a GrapeVine Social managed verification wallet and store the hashes, proofs, and signatures needed to attest to your verification status. This metadata never includes your posts, comments, or personal wallet addresses. On iOS, we also obtain a device token from Apple's DeviceCheck service so that a single device cannot be used to verify multiple accounts.
• Connected Platform Information: If you choose to connect an account on another platform for cross-posting (see Section 6), we store the information needed to post on your behalf: your username and profile identifier on that platform, and the access credentials the platform issues to us.
• Technical Information: Standard technical data, such as your IP address and device type, is processed when your device communicates with our servers. We use it to keep the service secure, for example to limit abusive request rates.

2. How We Use Your Information

We use the collected information to:

• Provide and Improve Services: Enhance the functionality and user experience of the App.
• Personalize Content: Tailor content and features based on your location data.
• Moderate Content: Every Post, Comment, photo, and video is checked automatically for safety and appropriateness before it is shown to other users, and for profile photos before they are displayed. See Section 7 for the services involved.
• Communicate with You: Send important updates, notifications, or respond to your inquiries.
• Issue Verifiable Credentials: Publish anonymized verification hashes to the Base blockchain and make them available to partners so they can confirm that GrapeVine Social issued your human-verification credential.
• Share and Cross-Post at Your Direction: Create public Share Pages and publish your content to other platforms only when you, or another user acting within the limits you set, ask us to. See Sections 5 and 6.

3. Data Storage and Security

• Data Storage: All collected information is stored securely on our servers, which are located in the United States. Verification hashes and proofs may also be written to Base (an L2 built on Ethereum) so that third parties can independently confirm your verification status, and badges you earn may be recorded on the Base and Polygon blockchains. Information written to a public blockchain cannot be altered or removed.
• Data Retention: We retain your information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law.

4. Data Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to outside parties except in the following circumstances:

• Legal Requirements: We may disclose your information if required to do so by law or in response to valid requests by public authorities.
• Protecting Rights: To protect our rights, property, or safety, or that of our users or others.
• Verification Transparency: When you share your verification link, the recipient can view the GrapeVine Social managed verification wallet and proof bundle we generated for you. Partners that rely on GrapeVine Social public verification endpoint or smart contract receive only the cryptographic data needed to confirm your credential.
• Content You or Other Users Share: Posts and Comments can be shared outside the App as public web pages, as described in Section 5. You control whether other users may share your content.
• Content You Cross-Post: When you choose to cross-post, we send that content to the platform you selected, as described in Section 6.
• Service Providers: We use the third-party services listed in Section 7 to run the App. They process information only to provide their service to us.

5. Sharing Content Outside the App

The App lets users share Posts and Comments outside the App by creating a public web page ("Share Page") with a link that can be sent to anyone. Please read this section carefully, because a Share Page is public.

• What a Share Page contains: The text of the Post or Comment, any photo or video attached to it, the display name and avatar of the person who wrote it, the name of the grapevine it was posted in, and the country associated with the content. A Share Page never shows a street, city, or exact location, and never shows your email address. When a Comment is shared, the Share Page may also show the Post it replies to and earlier Comments in the same thread, for context.
• Who can see a Share Page: Anyone who has the link, whether or not they have a GrapeVine Social account. The link may be posted on other websites, social networks, or messaging apps, where a preview of the page may be displayed. Once a link has been sent to someone, we cannot control who they pass it on to.
• You decide whether other users may share your content: The App includes a setting, Allow Sharing My Content (under Settings › Knobs & Levers), which is turned on by default. While it is on, other users may create Share Pages of your Posts and Comments. If you turn it off, no other user can create a Share Page of any Post or Comment you have written, and your Comments are left out of Share Pages of conversations you took part in. This setting applies to your content in public grapevines and in private grapevines alike.
• Sharing your own content: The setting above controls what other users may do. You may always create a Share Page of your own Posts and Comments, regardless of how the setting is configured. Creating a Share Page of your own content is your decision to make it public.
• Private grapevines: The owner of a private grapevine decides whether content posted in it may be shared at all. If the owner has sharing turned off for that grapevine, no Post or Comment in it can be turned into a Share Page by anyone, including the author. If the owner allows sharing, your Allow Sharing My Content setting still applies to your own content.
• Share Pages cannot be recalled, only expired: Once a Share Page has been created, we do not remove it early. Turning Allow Sharing My Content off stops new Share Pages of your content from being created, but does not remove existing ones; deleting the Post or Comment, or deleting your account, does not remove them either. Every Share Page is automatically deleted no later than 90 days after it is created, after which its link no longer shows the content. Expiration is the only removal mechanism available.
• Your profile: Your public profile, meaning your display name, avatar, bio, and any badges you have earned, can also be shared as a public page. Profile pages are not affected by the Allow Sharing My Content setting and expire in the same way.

6. Cross-Posting to Other Platforms

Subscribers can publish their own Posts to accounts they hold on other platforms. This feature is entirely opt-in: nothing is ever sent to another platform unless you connect an account there and then choose to cross-post a specific Post.

• Supported platforms: Bluesky, Mastodon, LinkedIn, Tumblr, Reddit, Threads, Instagram, Facebook, Pinterest, TikTok, Telegram, Discord, and Nostr.
• Connecting an account: To connect most platforms you sign in to that platform and authorize GrapeVine Social to post on your behalf. The platform then issues us access credentials, which we store together with your username and profile identifier on that platform. For Telegram and Discord you provide us a bot token or webhook URL that you create yourself, and we store it. For Nostr, we generate and store a signing key for you; Nostr is a public, decentralized protocol, and anything published to it is public and cannot be recalled by us.
• Cross-posting is chosen per Post: When you create a Post, you select which of your connected platforms, if any, it should be published to. A Post with no platforms selected is never cross-posted. Comments are never cross-posted.
• What is sent: The text of the Post, any attached photo or video, a short attribution line (for example "via GrapeVine Social", and "Verified Human" if you have completed human verification), and a link to a Share Page of the Post (see Section 5). Cross-posting is performed by our servers after the Post has passed content moderation.
• Once published, the other platform's rules apply: Content published to another platform is subject to that platform's own terms and privacy policy, which we do not control.
• Deleting a cross-posted Post: When you delete a Post that was cross-posted, we ask each platform to remove the corresponding publication. We make every reasonable effort to do so, but removal on the other platform depends on that platform accepting the request, and we cannot guarantee it. The Share Page linked from the cross-post remains until it expires, as described in Section 5.
• Disconnecting: You can disconnect a platform at any time in the App. Disconnecting deletes the stored credentials for that platform from our servers. It does not delete content already published there; you can remove that content on the platform itself.

7. Third-Party Services and Processors

We rely on the following third-party services to operate the App. They receive only the information needed to perform their function.

• Hosting and automated moderation: Our servers, databases, and stored media run on a cloud hosting provider located in the United States. The same provider's services are used to check the text of Posts and Comments and to check photos and videos, as part of content moderation.
• Google Perspective API: The text of Posts and Comments is also sent to Google's Perspective API, which returns scores indicating whether the text is likely to be toxic or harmful. This is used only for content moderation.
• Apple and Google sign-in: If you use Sign in with Apple or Sign in with Google, those providers authenticate you and share your email address (and, if you allow it, your name) with us.
• Apple App Store: Handles subscription purchases and sends us purchase confirmations and renewal notifications.
• Apple DeviceCheck: Used during human verification, as described in Section 1.
• Blockchain networks: Verification hashes and badges are written to Base and Polygon, as described in Section 3.
• Error monitoring: We use Sentry to receive reports of errors on our servers. A report may include technical details of the request that failed.
• Link previews: When a Post contains a link, the App or our servers may retrieve a preview (title, description, image) from that website. The website may see that the request came from GrapeVine Social or from your device.
• Platforms you connect for cross-posting: As described in Section 6.

Apart from the services above, the App does not include third-party advertising, analytics, or tracking software. Partners that consume our verification status do so through GrapeVine Social operated APIs or smart contracts; they do not gain access to your posts, comments, or account data.

8. Your Rights and Choices

• Sharing Controls: You can turn Allow Sharing My Content on or off at any time under Settings › Knobs & Levers. See Section 5 for what the setting does and does not cover.
• Location Precision: You can choose how precisely your location is shown on your Posts and Comments under Settings › Knobs & Levers.
• Cross-Posting Controls: You choose which platforms to connect, which Posts to cross-post, and you can disconnect any platform at any time. See Section 6.
• Account Deletion: When you delete your account, all your content and data are permanently removed from our servers and cannot be recovered. We also invalidate your verification credential so it can no longer be used, and delete any stored credentials for connected platforms. Three things are outside our reach and are not removed by deleting your account: information already written to a public blockchain, content already published on other platforms, and existing Share Pages, which expire on their own within 90 days as described in Section 5.
• Content Deletion: When you delete specific content (such as Posts or Comments), it is permanently removed from our servers and cannot be recovered. Existing Share Pages of that content are not removed early; they expire within 90 days of their creation (Section 5). Cross-posts are handled as described in Section 6.

9. Children’s Privacy

Our App is not intended for use by children under the age of 17. We do not knowingly collect personal information from children. If we become aware that we have inadvertently received personal information from a child, we will delete such information promptly.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted within the App, and the revised policy will be effective immediately upon posting. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

11. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at: