Privacy Policy

// WHAT WE COLLECT

At threedeep, we respect your privacy. When you use threedeep to order drinks, we collect the information necessary to process your order and operate the service. Depending on how you use threedeep, this includes:

Account & orders. Your name, email address, password (stored as a salted hash), order history, Bar TAB Credit balance and transactions, and the name you enter at checkout.

Payments. Payment details are processed by our PCI-compliant payment processor (Stripe); threedeep never stores full card numbers. We retain transaction identifiers and a card fingerprint (a non-reversible identifier Stripe derives from the card) used for fraud prevention and order attribution.

Location. If you grant location permission, we collect your device's precise location while you use the app and store your last known location to show nearby bars and, if you opt in, to send nearby-bar notifications. We do not track your location in the background.

Notifications. If you enable push notifications, we store your device push tokens and subscription endpoints, your notification preferences, and any bars you watchlist.

Sign-in security. If you enable biometric sign-in, we store a WebAuthn public-key credential identifier and signature counter. We never receive your fingerprint or face data — only a cryptographic confirmation that your device authenticated you.

Sessions & analytics. Session records include IP address and browser user agent. Our own analytics record page paths, referrers, timestamps, and a persistent random visitor identifier — we do not use third-party advertising trackers.

Live Action specials. If you participate, we collect the videos and images you submit, frames extracted from those videos, and associated gameplay and review information ("Live Action data"). This may include a view of the game area and people appearing in the recording. The Live Action restrictions below apply to this data.

// HOW WE USE IT

We use this information solely to facilitate transactions, provide customer support, prevent fraud, help venues and bartenders fulfill orders efficiently, and operate and improve Live Action as described below. We do not sell, rent, or trade your personal information to third parties. Your data is used exclusively to operate and improve the threedeep platform and to support the venue where you are placing your order.

// LIVE ACTION — TRAINING & PRIVACY

Limited training purpose. Live Action data may be used to judge gameplay, verify promotional outcomes, prevent cheating, and train, test, and improve the computer-vision systems used for Live Action. Authorized reviewers and contracted service providers, including Roboflow where used, may process this data on our behalf only for these purposes. It is not used for unrelated general-purpose AI training.

Never sold. Live Action data is never sold, rented, or traded. Participation does not authorize public posting or advertising use of your recordings.

No facial recognition. No facial recognition is used to process Live Action data. We do not use it for automated identification of people, face matching, or the creation of facial biometric templates.

Deleted after training. If Live Action data is used for training, we delete the source recordings, extracted images, and associated identifiable training records and dataset copies when that training is complete, or when the training run is abandoned or cancelled. We require our service providers to delete their copies on the same basis. Training data is not retained for indefinite future training. This deletion covers the training data, not the trained model itself or separate account, payment, and order records.

Restrictions apply before training. Training is permitted only where we and our service providers can meet these no-sale, no-facial-recognition, and deletion requirements. We provide notice of training use and obtain any consent required by applicable law before using recordings for training. This update does not retroactively authorize training on recordings collected without the required notice or permission.

// PAYMENT SECURITY

Payment information is handled by secure, PCI-compliant payment processors, and threedeep does not store full credit card numbers. We may share limited information with service providers only as necessary to deliver the service (such as payment processing or messaging providers), and only under strict confidentiality obligations.

// DATA PROTECTION

We implement reasonable administrative, technical, and physical safeguards to protect your information, consistent with the New York SHIELD Act. Access to personal data is restricted to server-side systems using credentialed service roles.

// RETENTION & DELETION

We keep account, order, and transaction records for as long as your account exists and as required for tax, accounting, and dispute-handling obligations. Push tokens are deleted when the device unsubscribes or the token is reported dead. Location is limited to the most recent known position and is overwritten as it updates. You may request access to, correction of, or deletion of your personal data by emailing hello@threedeep.io; we will delete data not subject to a legal retention requirement within 30 days.

The specific post-training deletion requirement in Live Action — Training & Privacy applies to Live Action data used for training. Our retention of separate account, payment, and order records does not extend retention of those training recordings or dataset copies.

// SERVICE PROVIDERS

We share limited information with service providers only as necessary to deliver the service — payment processing (Stripe), email delivery (Resend), push-notification delivery (Apple Push Notification service and web-push providers), our database/hosting infrastructure (Supabase, Vercel), and Live Action analysis and computer-vision providers (including Anthropic and Roboflow where used) — each under confidentiality obligations. Live Action providers are subject to the purpose limitations and restrictions above, including deletion of training copies after training. We do not sell, rent, or trade your personal information.

// YOUR CONSENT

By using threedeep, you consent to the collection and use of information as described in this policy, which may be updated periodically to reflect improvements in our services or changes in legal requirements.