Privacy Policy for Own Place

Русский: /ru/ownplace/privacy · Español: /es/ownplace/privacy

Effective Date: September 7, 2026. Effective on the first public release of the App.

Data controller and service provider: OWN PLACE LLC, 7707 NE 141st St, Kirkland, WA 98034-5321, USA. Email: contact@ownplace.net. Telephone: +1 (213) 524-8012. App: Own Place (published on the App Store as “OwnPlace”), iOS bundle identifier com.mycompany.ownplace, Android package com.ownplace.app. [PENDING: подтвердить у владельца — расхождение идентификаторов: android/app/build.gradle и AndroidManifest.xml содержат applicationId com.mycompany.ownplace, а в Google Play приложение зарегистрировано как com.ownplace.app (это подтверждено в SESSION_2026-05-25). Нужно решить, какой идентификатор указывать в документах, и привести код в соответствие до сборки релиза.]

OWN PLACE LLC (“we,” “us,” or “our”) is a limited liability company organized under the laws of the State of Washington, USA, and is the developer of the App.

Own Place is a marketplace for local services. A service professional (in the App, a “specialist” or “master”) creates a profile, lists services with prices and durations, sets working locations and a schedule, and receives bookings. A client finds a professional, books an available time slot, messages the professional inside the App, and may leave a review afterwards.

We are not a party to the service agreement between a professional and a client. We operate the platform. This Policy describes the data the platform handles.

This Privacy Policy is available in English, Russian, and Spanish (see the language links at the top of this page). Each language version contains the same disclosures and rights. Mandatory rights under applicable law are not limited by differences between translations. In case of doubt about interpretation, the English text is the reference version.

1. Scope and Territory

The App is distributed in the United States only (Apple App Store: United States storefront; Google Play: United States). We do not offer the App in the European Economic Area, the United Kingdom, or Switzerland, and this Policy is written for United States law. If you use the App from outside the United States, you do so on your own initiative.

The App’s interface is available in English and Russian. This Policy is also published in Spanish for convenience.

2. Plain-Language Summary

• You need an account. The sign-in screen offers Sign in with Apple and Sign in with Google. An email-and-password path also exists in the App’s authentication layer.
• What the platform stores about you: your name and profile photo, the email address your sign-in provider gives us, and — if you are a professional — your bio, services, prices, working addresses, schedule, and the languages you speak.
• The App does not read your device’s GPS position. There is no location permission in the App. Addresses are typed in and looked up through Google Places address search.
• Bookings, chat messages, and reviews are stored on our servers so that both sides of a booking can see them.
• We never see your card number. Card payments are handled entirely by Stripe. Professionals are paid out through Stripe Connect.
• The professional subscription is billed by Apple or Google, not by us, and is managed through RevenueCat. We receive subscription status, not payment details.
• We do not use advertising, we do not sell personal information, and this release contains no analytics or crash-reporting SDK (see Section 9).
• You can delete your account from inside the App. Section 11 explains exactly what is deleted and what is not.
• This is not a health service. See Section 13.

3. Information We Collect

3.1 Account information

Created when you first sign in.

The sign-in screen offers Sign in with Apple and Sign in with Google. The App’s authentication layer also supports email and password. [PENDING: подтвердить у владельца — какие способы входа открыты в первом релизе: только Apple и Google (как на экране входа), или ещё вход по e-mail и паролю (метод реализован в supabase_auth_manager.dart)? Экран входа по телефону/SMS лежит в lib/second_release/ и к текущему входу не подключён — вход по SMS в первом релизе НЕ работает.]

3.2 Professional (specialist) profile

If you switch your account to a professional account, the platform additionally stores: a free-text bio; the services you offer (name, description, photo, price range, duration range, and the category the service belongs to); your working locations (street address, city, state, ZIP code, country, latitude and longitude, time zone, and whether you travel to the client); your schedule (working days and time slots); private notes you write on your own calendar; and the languages you speak.

Service categories and professions are not fixed in the App’s code: they are rows in our database, managed by us, and shown to you as a list. The App’s own in-product description refers to “beauty, wellness, and related services,” and the categories built so far are in the hair, barbering, and beauty area. [PENDING: подтвердить у владельца — открытый перечень профессий и категорий (таблицы professions/categories администрируются нами, seed-данных в коде нет). Нужен список категорий, открытых на дату релиза, чтобы документы и возрастной рейтинг соответствовали факту.]

3.3 Booking information

For each booking: who the client is, which professional and which services, which location, start and end time, price or price range, duration, travel time, break time, a free-text note, and the booking status (booked by client, booked by professional, confirmed, completed, cancelled). Completed and cancelled bookings are moved to an archive table and kept there.

3.4 Communications and reviews

• Chat messages between a client and a professional: the message text, sender, thread, whether an attachment is present, whether the message has been read, and the time. Attachments you send are stored in our file storage.
• Reviews: a rating, the review text, who wrote it, and about which professional. Reviews are visible to other users of the App.
• In-app notifications, including complaint notifications (Section 3.6).

Anything you type into a chat message, a review, a booking note, or a profile is stored on our servers and is visible to the other side of the conversation (and, for reviews and profiles, to other users). Do not put information there that you do not want the other person to have.

3.5 Contacts created by professionals

A professional can create a manual contact for a client who is not an App user, entering that person’s name, phone number, and a note. If you are a professional and you do this, you are responsible for having the right to enter that person’s information, and you must not enter more than you need to run the booking.

3.6 Complaints about a booking

Either side of a completed booking can file a complaint about that booking. The complaint opens a dispute on the payment and notifies the other side. If the dispute is not answered within 4 hours, it is resolved automatically: a complaint opened by the client releases the hold (no charge); a complaint opened by the professional captures the hold (the professional is paid).

3.7 Payments

We do not receive, see, or store card numbers, CVV codes, or bank account numbers. Card data goes directly to Stripe. What our database stores is: a Stripe customer identifier for clients, a Stripe Connect account identifier and payout percentage for professionals, and payment status and Stripe PaymentIntent identifiers for bookings.

3.8 Subscription

The professional subscription is purchased through the App Store (iOS) or Google Play (Android) and administered through RevenueCat. We and RevenueCat receive subscription status and store-provided purchase identifiers. We do not receive your Apple Account or Google Account credentials or your payment method.

3.9 Device and technical information

• Push notification tokens (the token, the platform, and the account it belongs to), so that we can send you booking and message notifications through Firebase Cloud Messaging.
• Server-side technical records. Our backend providers (Firebase/Google and Supabase) keep operational logs that include IP addresses and request metadata, as any hosted service does. These are used to run and secure the service.
• Local settings stored on your own device (interface language, session state). These stay on your device.

3.10 What we do not collect

• No precise or background location. The App does not request a location permission on iOS or Android and does not read your device’s GPS position. Addresses are typed by hand and completed using Google Places address search.
• No contacts, microphone, calendar, or health permissions.
• No advertising identifiers, no cross-app tracking, no App Tracking Transparency prompt, no cookies for advertising.
• No analytics or crash-reporting SDK is present in this release. See Section 9.

4. Device Permissions

You can refuse or withdraw any of these in your device settings. Refusing the camera or photo permission only means you cannot upload a photo.

5. How We Use Information

We use the information above only to:

1. create and operate your account and, if applicable, your professional profile;
2. show professionals, services, and availability to clients, and show bookings to both sides;
3. run bookings: reserve a slot, place and capture or release a payment hold, pay out professionals, archive completed bookings;
4. deliver messages, reviews, and notifications;
5. handle complaints and disputes about a booking;
6. provide support when you write to us;
7. keep the service secure, prevent fraud and abuse, and enforce our Terms of Use;
8. comply with law and respond to lawful requests.

We do not use your information to build advertising profiles, and we do not use the content of your chats for any purpose other than delivering and storing them and responding to a complaint or a lawful request.

6. Who Receives Information

6.1 Other users

• A professional you book sees your name, profile photo, the booking details, your note, and your messages.
• A client who views your professional profile sees your name, photo, bio, services, prices, working locations, schedule, languages, and your reviews and rating.
• Reviews are public inside the App, together with the reviewer’s name and photo.

6.2 Service providers that process data for us

Each of these acts under its own privacy policy and under our agreements with them. We are transitioning our backend from Firebase to Supabase; during that transition both may be in use. [PENDING: подтвердить у владельца — на дату публичного релиза миграция Firebase → Supabase завершена (тогда Firebase остаётся только для FCM) или обе платформы работают параллельно? Формулировку в разделе 6.2 надо привести в соответствие с фактом на дату релиза.]

6.3 Legal and business

We may disclose information when required by law, subpoena, court order, or a lawful government request, or where necessary to protect our rights, the safety of users, or the integrity of the service. If OWN PLACE LLC is involved in a merger, acquisition, or sale of assets, user information may be transferred as part of that transaction; the receiving entity remains bound by this Policy until it gives you notice of any change.

6.4 What we do not do

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined in California and other US state privacy laws. We have not done so in the preceding twelve months (the App has not been publicly released).

7. Legal Bases and Your Choices

We process personal information because it is necessary to provide the service you asked for, to comply with law, and for our legitimate interest in operating and securing the platform. Where a state law requires your consent for a particular processing (for example, consent to receive SMS messages, if we ever send any), we ask for it separately and you can withdraw it.

[PENDING: подтвердить у владельца — планируется ли отправка SMS-уведомлений (TCPA-согласие)? В текущем коде SMS-уведомлений нет; во встроенном в приложение тексте политики раздел про SMS/TCPA есть. Если SMS не будет — удалить упоминание из встроенного текста; если будет — описать здесь и добавить экран согласия.]

8. Retention

[PENDING: подтвердить у владельца — конкретные сроки хранения архивных записей (old_appointments) и логов; в коде сроков нет, нужны числа, иначе таблица останется без сроков.]

9. No Analytics, No Advertising, No Tracking

This release of the App does not contain an analytics SDK, a crash-reporting SDK, an advertising SDK, or any cross-app tracking. We verified this against the App’s dependency list: there is no Google Analytics for Firebase, no Crashlytics, no Sentry, no advertising library, and no App Tracking Transparency request. Firebase is present only for authentication, file storage, and push notifications.

If we later add analytics or crash reporting, we will update this Policy and the App’s App Store and Google Play privacy labels before turning it on.

Note on the in-app text. An older Privacy Policy text embedded in the App mentions “Google Analytics for Firebase,” crash data, and an App Tracking Transparency prompt. That text is out of date and does not match the shipped code. This page is the authoritative version. [PENDING: реализовать — заменить встроенный в приложение текст политики (lib/flutter_flow/internationalization.dart) ссылкой на эту страницу или актуальным текстом; сейчас приложение обещает аналитику и ATT, которых в сборке нет.]

10. Security

Data is stored with our backend providers using their standard encryption in transit and at rest. Database access is restricted by row-level security policies so that a user reads and writes their own records and the records of bookings they are part of. Server-side operations that need elevated rights (payments, account deletion, push delivery) run in server functions, not in the App. Payment credentials never reach our systems: the App contains no payment SDK at all, and every Stripe operation runs in a server function.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the applicable authorities as required by Washington law (RCW 19.255) and the other state laws that apply to you.

11. Deleting Your Account and Your Data

You can delete your account from inside the App: Profile settings → Delete Account.

When you delete your account, the App:

• deletes your user record and, if you are a professional, your professional profile, together with the profile data attached to it;
• releases the time slots of your upcoming bookings and archives those bookings;
• detaches, but does not erase, your chat messages and reviews. They are reassigned to an anonymous “deleted user” placeholder so that the other party’s conversation history and the review history of a professional remain readable. Your name and photo are no longer shown with them;
• deletes your authentication record on our side.

[PENDING: реализовать — на сегодня кнопка «Delete Account» (lib/my_profile_setting/my_logout_delete_user/my_delete_panel/) вызывает СТАРОЕ, firestore-based удаление (delete_account.dart). Supabase-версия (delete_account_supa.dart) не вызывается ни из одного экрана, а SupabaseAuthManager.deleteUser() бросает UnimplementedError. Поскольку живой бэкенд — Supabase, удаление аккаунта на нём фактически не работает. Apple требует рабочее удаление аккаунта (Guideline 5.1.1(v)); без него приложение отклонят, а этот раздел политики будет обещать то, чего нет.]

Some information necessarily survives account deletion: records held by Stripe, Apple, Google, and RevenueCat under their own retention obligations; archived booking and payment records we must keep for tax, accounting, dispute, and fraud-prevention purposes; and server logs.

We cannot restore a deleted account.

To ask for anything the in-app deletion does not cover — a copy of your data, correction of a record, or deletion of a specific message or review — write to contact@ownplace.net from the email address on your account, or call +1 (213) 524-8012. We will respond within 45 days and may extend once by another 45 days where the law allows, telling you why. We may need to verify your identity before acting; verification uses only information you already have with us.

12. Your Rights Under US State Laws

The App is distributed only in the United States. Depending on where you live, you may have some or all of the following rights: to know what personal information we hold and how we use it; to access and receive a copy of it; to correct it; to delete it; to opt out of sale, targeted advertising, or profiling with legal effects; and to not be discriminated against for exercising a right.

We do not sell personal information, do not share it for targeted advertising, and do not carry out profiling that produces legal or similarly significant effects. There is therefore nothing to opt out of, but you may still exercise the access, correction, and deletion rights above.

• California (CCPA/CPRA). You have the rights listed above, and the right to limit the use of sensitive personal information — we do not collect sensitive personal information as that term is defined, other than as described in Section 13. You may use an authorized agent; we will ask for proof of authorization. To appeal a decision, reply to our response.
• Washington. Our company is organized in Washington. See Section 13 for the My Health My Data Act.
• Connecticut, Nevada, and other states with consumer privacy statutes. You have the access, correction, deletion, portability, and opt-out rights those statutes give you, and the right to appeal a refusal by replying to our response; if an appeal is denied you may contact your state attorney general.
• Nevada (NRS 603A). We do not sell covered information and will honor a request not to sell it.

Send every request to contact@ownplace.net.

13. Health Data, and What This App Is Not

Own Place is a booking and payment platform for services. It is not a medical, diagnostic, therapeutic, or health service, and we do not present it as one.

The App does not ask you for health information. It has no health questionnaire, no symptom field, no medical-record field, and no connection to Apple Health, Google Fit, or any health data source.

We are aware that a marketplace of local services can include categories such as beauty and wellness, and that information about a booking could, depending on the category, allow an inference about a person’s health. Under the Washington My Health My Data Act (RCW 19.373), the Nevada consumer health data law (SB 370), and the Connecticut Data Privacy Act, that kind of inference can be treated as consumer health data.

Accordingly:

• Do not enter health information — diagnoses, symptoms, medications, treatments, pregnancy status, or anything similar — into a profile, service description, booking note, chat message, or review. Those fields are not designed for it.
• We do not use booking or category information to infer anything about your health, we do not sell it, and we do not share it for advertising.
• If you nevertheless send us information that qualifies as consumer health data, you may ask us to delete it at contact@ownplace.net, and we will delete it from our active systems and instruct our processors to do the same, to the extent it is not part of a record we must keep.

[PENDING: подтвердить у владельца — нужен ли отдельный документ Consumer Health Data Privacy Policy (как у Talefall) для категорий бьюти/wellness, или достаточно этого раздела? Это зависит от того, какие категории услуг будут реально открыты в первом релизе.]

14. Children

The App is not intended for children under 13, and we do not knowingly collect personal information from a child under 13. If we learn that we have, we will delete it.

The App’s in-product Terms text sets the minimum age at 13, and provides that users aged 13 to 17 may use the App only with the involvement and consent of a parent or legal guardian, who accepts the Terms on the minor’s behalf.

[PENDING: подтвердить у владельца — маркетплейс с приёмом платежей и договором об оказании услуг: оставить порог 13+ (как во встроенном тексте) или поднять до 18+ (для профессионалов — точно 18+, поскольку Stripe Connect требует совершеннолетия)? Возрастной рейтинг в App Store Connect должен совпадать с выбранным порогом; сейчас это единственное место, где документы и код расходятся с обычной практикой маркетплейсов.]

[PENDING: подтвердить у владельца — есть ли в коде фактическая проверка возраста? Поля даты рождения и возрастного гейта в lib/ не найдено, то есть порог заявлен, но не проверяется. Нужно решить: добавить проверку или описать как декларативную (заявление пользователя).]

15. Content Reporting and Safety

Chat messages, reviews, profiles, and service descriptions are content created by users. The App currently provides a complaint about a booking, which opens a dispute and notifies the other side (Section 3.6).

[PENDING: реализовать — в коде не найдено ни жалобы на пользователя или на конкретное сообщение/отзыв, ни блокировки пользователя, ни автоматического фильтра недопустимого контента. Apple App Review Guideline 1.2 требует для приложений с пользовательским контентом: фильтр недопустимого контента, механизм жалобы, блокировку обидчика и опубликованный контакт. До реализации приложение будет отклонено. Владельцу нужно подтвердить объём работ.]

Until that is in place, report anything abusive to contact@ownplace.net. We review reports and may suspend or terminate an account under our Terms of Use.

16. App Store and Google Play Privacy Labels

Our store privacy labels must match this Policy. On the basis of the code as built, the App collects: contact information (name, email, and — where collected — phone number), user content (photos, messages, reviews, notes), identifiers (account identifier, push token, purchase identifier), purchase history (subscription status), and coarse address information typed by the user. It does not collect precise location, browsing history, advertising data, health or fitness data, or contacts, and it does not use data for tracking.

[PENDING: подтвердить у владельца — метки конфиденциальности в App Store Connect и в Google Play Data Safety должны быть выставлены по этому разделу до отправки на ревью; PrivacyInfo.xcprivacy в проекте сейчас пустой (<dict/>) и не декларирует ни одного типа данных и ни одного required-reason API — Apple это отклоняет.]

17. Changes to This Policy

We may update this Policy. When we make a material change, we will update the effective date at the top and publish the new version at this address before the change takes effect in the App. Continued use of the App after a change takes effect means you accept the updated Policy.

Website forms

Our website, ownplace.net, has two forms: a waitlist form (email address and interface language) and a support form (name, email address, product, and message). Submissions are stored in a Cloudflare D1 database located in the United States. Support messages are also delivered to contact@ownplace.net through Resend, our email delivery provider. To prevent spam, the forms use Cloudflare Turnstile, which may process your IP address and browser signals. We use this data only to reply to you or to notify you about the launch. We keep waitlist entries until the launch notification plus 12 months, and support messages for 24 months. You can request deletion at any time by emailing contact@ownplace.net.

18. Contact

OWN PLACE LLC 7707 NE 141st St, Kirkland, WA 98034-5321, State of Washington, USA Email: contact@ownplace.net Telephone: +1 (213) 524-8012 Website: https://ownplace.net

For privacy requests, write to contact@ownplace.net with “Privacy request” in the subject line.