This page is the California Consumer Privacy Act notice for Goodbye App Corporation. It says, in the Act's own categories, what we collect, why, from where and with whom it is shared, and how a California resident can exercise the rights the Act gives them. The full account of how we handle information is our Privacy Policy, and where this page is shorter than that one, the Privacy Policy governs.
Personal Information Collected:
In the past 12 months we have collected these categories of personal information:
Identifiers: your email address, your username, a name if you add one to your profile, and the account identifier we assign. At sign-up we also keep a hashed form of your network address and a description of your browser or app, inside the record of your agreement to our policies; the same hashed form is the key that holds the daily limit on forms anyone can submit without an account. If you turn notifications on in your browser, we keep the token that browser gives us so a notice can reach it. The iOS app holds no such token, because it sends no push notifications.
Personal information you choose to write down: everything you put in a letter, a post, a comment or your profile. The letter has places for your address, your date of birth, your parents' names, your contacts' names and telephone numbers, passwords to your devices and accounts, what you owe, and your wishes for the end of your life, and you can write anything else you want anywhere in it. No field asks about your health, and much of what people write here is about it anyway: a diagnosis, a treatment and what it is doing to you belong in the writing itself, as do your religious or political views and anything else you choose to set down. Some of that is sensitive personal information under the Act. We collect it because you wrote it, we store it as written, and we use it for nothing but holding it and delivering it as you asked.
Commercial Information: none. There is nothing to buy on the service and no payment is taken. The donate page on the website hands you to PayPal, and no payment detail passes through us.
Internet Activity: what you do on our own site and app: the posts you like and comment on, whom you follow and block, and a daily count of those actions that enforces our limits. Reading is not part of it: opening a post, scrolling past it and sitting with it are recorded nowhere. Playing a post's video or audio is recorded. If you play a post's video for thirty seconds or halfway through it, whichever comes first, or let a post's audio play to the end, one line is written under that post holding your account id and the time. A second attempt is refused, so it counts people rather than plays, and it is what produces the play count shown under the post. The audio in a letter is never counted. A search you run is answered and not kept. We do not collect your browsing or search history from anywhere else, and we do not track you across other sites or apps.
Geolocation Data: none. The only location we hold is a town or an address you type into your profile or a letter. We do not take your device location.
Audio and Visual Information: the profile picture, photos, videos and voice recordings you choose to upload.
Inferences: none. Nothing here profiles you, ranks you, scores you or predicts anything about you, and nothing you are shown is chosen for you. The one exception is a note reconstructed for accounts made before we started keeping consent records, which infers from your sign-in providers which signup screen you would have seen. It is described in full in our Privacy Policy.
Purposes for Collecting Personal Information:
We collect personal information for the following purposes:
To run the service: to sign you in, to hold what you write until the date you set, and to deliver it to the people you addressed it to.
To communicate with you about your account, and to reply when you write to us.
To keep the service working and safe: to enforce daily limits, to tell automated submissions from people, to find and fix faults, and to act on reports.
On the website only, to measure whether advertising we bought elsewhere brought people here.
To comply with legal obligations.
Sources of Personal Information:
We collect personal information from:
You, directly: what you type, choose, upload and do on the service, and what you send us through the forms.
Google and Apple, when you choose to sign in with one of those accounts, which send us the fields named in our Privacy Policy.
Google reCAPTCHA, which returns a verdict on whether a form submission looked automated.
Our own servers, which write error logs. We buy nothing from data brokers and receive nothing about you from any other company.
Sharing Personal Information:
We disclose personal information to the following categories of third parties, for the business purposes named:
Measurement: A Google Ads tag and Google Tag Manager, from Google, LLC, on our own pages. They measure whether advertising we bought elsewhere brought someone here. Nothing you write on Goodbye App is sent to them, with one exception: the event that records that an account was created carries the username you chose. Neither tag is in the iOS app.
Service Providers: Google LLC, whose Firebase and Google Cloud hold and run everything: the database, the file storage, sign-in, push notifications, the servers and their logs, in the United States. Everything you write here is stored there. Mailgun, which delivers every email we send and so sees the address and the email, including a letter being delivered. Google Maps Platform, which receives what you type into the three location fields in order to suggest places. Google reCAPTCHA Enterprise, on the forms. Apple, for Sign in with Apple in the iOS app.
Companies whose content sits on one of our pages: opening a page that carries their content sends them your network address and a description of your browser, and nothing else of yours. YouTube and noembed.com, on the home page, which is where the previews of our videos come from. PayPal, on the donate page, which is a PayPal form. images.dmca.com, for the badge on the copyright page. unpkg.com, if your browser needs converter code to record a voice message, though the recording itself is converted on your own device and never sent there. Each of them is named, with its own policy, on our Cookie Use page.
Advertising Partners: none. No advertising network runs on the site or in the app, and nothing you write here is used to target advertising at you anywhere. We buy advertising from Google, LLC to reach people who may need this service, and the measurement tag named above is the whole of that arrangement.
The people you address: a letter or a post goes to the recipients you chose, together with your username, your name and your picture.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. Because of that there is no "Do Not Sell or Share My Personal Information" link to offer: there is nothing it would turn off. We have no actual knowledge that we sell or share the personal information of anyone under 16, and we do not knowingly hold an account for anyone under 18.
Consumer Rights under CCPA:
California residents have the following rights:
Right to Know: You have the right to request information about our collection and use of your personal information over the past 12 months.
Right to Delete: You have the right to request the deletion of your personal information, subject to certain exceptions. Closing your account deletes it: the account itself, your posts, and any letter or post still waiting to go all go with it, together with the files attached to them. A letter that has already been delivered stays with the person who received it, because it belongs to them now.
Right to Correct: You have the right to ask that inaccurate personal information be corrected.
Right to Opt-Out: You have the right to opt-out of the sale or sharing of your personal information ("Do Not Sell or Share My Personal Information"). We do neither, so there is nothing to opt out of.
Right to Non-Discrimination: You will not be discriminated against for exercising your CCPA rights.
How to Exercise CCPA Rights:
Most of these rights you can exercise yourself, without writing to us: Settings lets you download a copy of your data and correct your profile and your settings, and it is where you start closing the account, which finishes in one pass on the page it sends you to. To make a request by other means, use our contact form or email ccpa@goodbyeapp.com. To protect your privacy and security, we will verify that a request comes from the holder of the account before acting on it, and an authorized agent acting for you must show that you gave them permission to.
Under the California Consumer Privacy Act (CCPA), you have certain rights regarding your personal information. We collect, use, and share personal information as described in this policy. We also publish a Data Processing Addendum (DPA), written for an organisation that would have us process personal data on its behalf; no organisation uses the service that way today. To ask about the DPA, contact us at legal@goodbyeapp.com.