Privacy Policy

doolit — Wake up to your city.

Last Updated: September 2026

1. Introduction

Welcome to doolit ("we," "our," or "us"). We are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application ("App").

By using doolit, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our App.

2. Information We Collect

2.1 Information You Provide

Account Information: Name and email address when you create an account, and a username the App generates for you
Age Information: After you sign in, we ask for your birthday once. The check runs on your device and your birthday is never sent to us; we keep only an age-status indicator (whether the account belongs to someone under 18) and, for younger users, the month they turn 18, in the private part of your account that only you and doolit can read. We may also use an age range or age signal made available by your device where supported
Profile Information: Profile photo (a photo you choose from your photo library; we store only the cropped image you confirm), avatar color, and, for artists and partners, a bio (limited to 100 characters)
Social Links (artists and partners): Links to your social media profiles (Instagram, TikTok, YouTube, X/Twitter, Facebook, Spotify)
Payment Links (artists and partners): Links to your payment platforms (Venmo, Cash App, PayPal)
Events and Passes (artists and partners): Event titles, categories, times, locations, images, badge codes, and Passes you publish
Reports: If you report an event, the reason you choose, any details you type, your name and user ID, and the reported event and artist
Exit Feedback: If you delete your account, the reason you select and any optional comment you provide, together with your account type, Sparks balance, and total gems found, stored without your user ID

2.2 Information Collected Automatically

Location Data: Precise location, only while the App is in use, to show your position on the map, wake and collect gems, confirm visits to events and prize locations, and apply location-based fairness limits
Usage Data: Gems collected and traded, Sparks (✦) earned and spent, Wander Rank (your rank, when it was earned, and the counts behind it: places woken, days you wake a gem, artists met, and Passes used at a venue), badges, boosts owned and activated, Dream Box openings, quest and milestone progress, daily wander stamps and calendar milestones, Passes redeemed, activated, and used, prize claims, and the distance you walk each day while the App is open (calculated on your device from location updates)
Camera (artists and partners only): The camera is used to scan badge and Pass QR codes. Camera frames are processed on the device and are not stored or sent to us
Analytics Data: In-app events such as gem collections, quest completions, wander calendar days, rank changes, boost use, and feature usage, collected via Google Analytics for Firebase together with your doolit user ID and account attributes such as your rank, wander calendar days, and account type (configured without advertising identifiers)
Crash Data: Crash logs and device state at the time of a crash, collected via Firebase Crashlytics to help us fix problems
Push Token: A device token used to deliver push notifications you have opted into, such as wander reminders
Device Information: Device type, operating system, and app version, plus app-instance and installation identifiers generated by Firebase (including the iOS vendor identifier), for app functionality, analytics, and crash reporting
Social Graph: The accounts you follow, the accounts that follow you, and the artists you block
Social Activity: If social features are enabled for your account, milestone events (rank-ups, rare finds, Golden Keys, calendar milestones, badges) are recorded so they can be shown to people who follow you, subject to your settings (see Section 5.1)

2.3 Information from Third-Party Services

If you choose to sign in using third-party services, we may receive:

Google Sign-In: Name, email address
Apple Sign-In: Name, email address (you may choose to hide your email)

3. How We Use Your Information

Account authentication — Email, user ID
Profile display — Name, photo, avatar color, bio, links
Map and discovery features — Precise location
Gem collection, trades, and badges — Location, usage data
Wander Rank, calendar days, and milestones — Places woken, days you wake a gem, artists met, Passes used, Sparks earned
Boosts and Dream Box — Usage data
Event attendance and Pass verification — Location (proximity), badge and Pass code scans
Real prize claims — Location (proximity), time of claim, email address
Passes and redemptions — Sparks spent, redemption codes
Fairness and abuse prevention — Location patterns, collection timing, device information
Social features — Profile info, following lists, milestone activity, privacy settings
Push notifications — Push token, notification preferences
App improvement and stability — Analytics data, crash data
Understanding why users leave — Exit feedback

We do NOT use your data for third-party advertising, selling to data brokers, or cross-app tracking. doolit does not sell Virtual Items and has no in-app purchases.

4. Location Data

doolit uses your precise location when you use location-based features of the App: to display the map and nearby content, to decide whether you are close enough to wake a gem or confirm a visit to an event or a real prize, to connect location-based activity to the game (including Aether gems and Golden Keys), to measure the distance you walk each day, and to apply fairness and anti-abuse limits such as caps on repeated collections in one spot.

Location is collected only while the App is in use and only after you grant location permission. doolit does not request background or "always" location access and does not keep a continuous trail of your movement. You can disable location access in your device settings, but this will limit app functionality.

For fairness and abuse prevention, doolit keeps the coordinates and time of your most recent gem wakes (at most 50). Entries older than 24 hours are discarded the next time you wake a gem. This record is used only to apply game limits and prevent manipulation, is readable only by your own account, and is deleted with your account.

Separately, your normal account history keeps records of location-based actions you chose to take in the App, such as gems you woke, events you connected with, and Passes you used. Because those actions are tied to places and times, your account history can reflect the places where you used doolit. Those records are retained as described in Section 7.

Daily distance is stored as part of your private account activity and is shown only to you. Precise location is sensitive personal information under some laws, including California's; we use it only for the purposes listed in this section (see Section 12).

5. Data Sharing and Disclosure

5.1 Public and Social Information

The following information may be visible to other doolit users: your name, username, profile photo, and avatar color; your social media and payment links (artists and partners); your events, badge codes, and Passes (artists and partners); your badges and Wander Rank; and, to signed-in users, your Sparks balance, rank counts, wander calendar days, and boosts and gem inventory. Your email address and push token are never shown on your profile or in social features; doolit can see them for abuse review and safety (Section 5.4), and a real-prize claim shares your email as described in Section 5.2.

doolit may offer social features, including following, an activity feed of milestones, and a weekly leaderboard among you and the accounts you follow. Some of these features may be introduced gradually. Two settings in Settings → Privacy control them from day one: Show on Leaderboard decides whether your weekly Sparks appear in rankings, and Share Activity decides whether your milestones are shown to people who follow you. Those two settings control the leaderboard and the feed; the profile information listed above is visible regardless.

Regular user accounts are not searchable or followable by other users; only artist and partner profiles can be followed, and artists and partners are public-facing accounts whose profile information is visible to other users. Event screens may show aggregate information, such as the number of people who have connected or are on their way, without showing the identities of regular attendees through those indicators. If you follow an artist, doolit stores that relationship so the follow feature can operate. If you block an artist, doolit uses that block to keep the artist's events and profile off your map, unfollows them for you, and files a report to our moderation team; the artist is not told.

5.2 Partners

When you redeem, activate, or claim a Pass or a real prize, the partner fulfilling it may see the information needed to honor it, such as the redemption code and the time of activation. For a real prize, the claim record includes your email address and the time of your claim so that doolit or the partner can contact you to fulfill it. Partners do not receive your location history.

5.3 Third-Party Service Providers

We use the following services to operate the App. Each has its own privacy policy governing its use of information:

Firebase (Google): Authentication, database storage (Cloud Firestore), file storage, Cloud Functions, push notifications (Cloud Messaging), analytics (Google Analytics for Firebase), and crash reporting (Crashlytics)
Google Maps Platform: Map display and related map services
Apple: Sign in with Apple authentication
Google: Google Sign-In authentication

5.4 Safety and Legal Requirements

We may disclose your information if required by law or in response to valid legal requests by public authorities. We may also use and disclose information to enforce our Terms of Service, including their eligibility and safety rules, to investigate reports of harmful conduct, and to protect the safety of users, especially minors, including by cooperating with law enforcement.

6. Data Storage and Security

Your data is stored securely on Firebase (Google Cloud) servers. We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure; while we strive to protect your personal information, we cannot guarantee its absolute security. To the maximum extent permitted by law, doolit is not liable for unauthorized access, loss, or disclosure of information that results from events beyond our reasonable control, from the acts of third parties, or from your failure to keep your sign-in credentials secure. You are responsible for the security of your device and account.

6.1 Third-Party Services

The third-party services listed in Section 5.3 process information under their own privacy policies and security practices. doolit does not control those services and, to the maximum extent permitted by law, is not responsible for their acts or omissions, their availability, or the accuracy of the information they provide (including map data and device location).

6.2 Information You Make Public

Information you choose to make visible to other users (Section 5.1), including your name, photo, links, events, and Passes, can be seen, copied, or shared by those users. doolit is not responsible for how other users or partners use information you have chosen to make public. Payment links point to third-party platforms; any payment made through them is between you and the other user on that platform.

7. Data Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, subject to legal, security, fraud-prevention, dispute-resolution, and backup requirements.

While your account is active, your account information and gameplay history stay with the account. Live events are removed from the map when they end and their records are deleted within about 7 days. The record of recent gem wakes used for fairness limits keeps at most 50 entries and drops those older than 24 hours at your next wake
When you delete your account, we delete your account information and the personal information associated with it: your profile and photo, gameplay history, location-related records, follows and blocks, private account data, and the sign-in itself. We may keep limited information where reasonably necessary to complete an outstanding transaction, comply with law, protect the security and integrity of doolit, or establish or defend legal claims
Records kept without your identity: a report you submitted stays as a moderation record with your name and user ID removed; a fulfilled prize claim stays as a fulfillment record with your user ID and email removed; and your exit feedback is stored without your user ID. An unfulfilled prize claim is cancelled when you delete your account
Analytics, crash, and diagnostic information is kept according to the retention settings we maintain with the service providers listed in Section 5.3

8. Your Rights and Choices

Access: View your profile information in the App settings
Update: Edit your name, photo, avatar color, bio, and links at any time
Delete: Delete your account and associated data directly in the App (Settings → Account → Delete Account)
Location: Control location permission through your device settings
Camera: Control camera permission through your device settings (artists and partners)
Notifications: Control push notifications in the App settings or your device settings
Social: Control leaderboard and activity sharing in Settings → Privacy
Portability: Request a copy of your data

To exercise these rights, contact us using the information below.

9. Younger Users

doolit is intended for people who are at least 13 years old. Users under 13 may not create an account or use the App, and we do not knowingly collect personal information from children under 13.

We ask for your birthday once after sign-in, check it on your device, and keep only an age-status indicator and, for younger users, the month they turn 18. Your birthday itself never leaves your phone. We may also use a supported device age signal.

For users we know are between 13 and 17 years old, we limit personal-data processing to what is needed to provide and maintain the doolit features you use, protect users and the service, prevent fraud or abuse, comply with law, or other uses for which appropriate consent has been obtained where required. For those users, activity sharing starts off and can be turned on in Settings → Privacy; younger users never appear in rankings; and analytics carries no user ID or account attributes for them. Other users cannot see who is under 18. When a younger user turns 18, the age-status indicator changes and their settings stay as they left them. For every user, regular profiles are not searchable or followable, daily activity statistics are private, and event attendance indicators show aggregate counts rather than attendee identities. Artist and partner accounts are limited to people who are at least 18 years old.

An account whose birthday shows the person is under 13 is deleted right away, before it can be used; if that cannot finish at that moment (for example, offline), the account stays locked at that step until it can. A new account made afterwards in this app on the same device is refused as well. If we otherwise learn that an account belongs to a child under 13, we will disable the account and delete the personal information associated with it in accordance with applicable law. If you are a parent or guardian and believe your child has provided us with personal information, contact us using the information below.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those of your country. By using our App, you consent to the transfer of your information to these countries.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically.

12. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), gives you additional rights: the right to know what personal information we collect, use, and disclose; the right to delete personal information we collected from you; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information; the right to limit the use and disclosure of sensitive personal information; and the right to non-discrimination for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioral advertising.

Sensitive personal information. The only sensitive personal information we collect is your precise geolocation, and only while the App is in use. We use it solely to provide the features you request (showing your position on the map, waking gems, confirming visits to events and prizes, measuring the distance you walk each day, and applying fairness limits) and never to infer characteristics about you, so the right to limit does not apply to how we use it today.

How to exercise your rights. You can delete your account and correct your profile in the App (see Section 8). For any other request, email privacy@doolit.co from the email address on your account; we may ask you to confirm your identity, and you may use an authorized agent to make a request on your behalf. We will respond within the time required by law.

12.1 Notice at Collection

This section is our notice of the categories of personal information doolit collects, why we collect them, and how long we generally keep them.

Category	Examples	Main purposes	Retention
Identifiers and account information	Name, email, username, user ID, age-status indicator (and the month a younger user turns 18), account type	Create and secure your account, provide App features, apply eligibility and younger-user protections, customer support	While the account is active; deleted with your account (Section 7)
Precise location	Location used for the map, gem wakes, visits, events, and fairness controls	Provide location-based App features and prevent fraud or abuse	Live location is processed as needed for the feature; the record of recent wake coordinates keeps at most 50 entries and drops those older than 24 hours at the next wake; location-associated gameplay records remain as part of account history
Profile and user content	Profile photo, artist or partner bio, social and payment links, reports, feedback	Provide profiles and community features, respond to reports and feedback, operate artist and partner features	Deleted with your account; reports and feedback are kept without your identity (Section 7)
Activity and usage information	Sparks, rank, wander calendar days, inventory, daily distance, gems woken, events, Passes, follows, product interactions	Operate the game and account, provide progress and social features, security, analytics, and App improvement	Gameplay and account information remains with the account; analytics according to our configured analytics retention period
Device and installation identifiers	Installation identifiers, vendor or device identifiers	App operation, analytics, security, fraud prevention	According to our configured service-provider retention period
Diagnostics	Crash and diagnostic information	Maintain reliability, troubleshoot problems, improve the App	According to our configured diagnostic-service retention period
Prize claim information	Email address, claim identifier, prize information	Validate and fulfill prize claims and let the Partner contact the winner	Until fulfilled, then kept without your user ID or email; cancelled if you delete your account first
Exit feedback	Reason, comments, user ID, account type, Sparks balance, gem count	Understand why users leave and improve doolit	Stored without your user ID

doolit does not sell personal information or share it for cross-context behavioral advertising. For more about our practices and your choices, see the rest of this Privacy Policy.

13. Contact Us

Email: privacy@doolit.co · Website: www.doolit.co