How we handle
your data.

1. Who we are

Tribes is a neighborhood exchange app operated by One Tribe Holding Company, a Delaware corporation doing business as Tribes, based in Houston, Texas (“Tribes,” “we,” “us”). Your trust means a great deal to us, and we want you to know exactly how we care for your information. We are the controller of your personal data. This Privacy Policy explains what we collect when you use our mobile apps, our website, and related services (together, the “Service”), why we collect it, who we share it with, and the rights you have. It is part of our Terms of Service.

2. Information we collect

Information you give us

• Account information: email address, phone number (optional), date of birth (used to confirm you are at least 18), and a hashed password. We never store your password in plain text.
• Profile information: display name, profile photo, and bio.
• Location: the ZIP code you give us, used for local matching. We do not collect GPS or precise device location.
• Listings: titles, descriptions, photos, categories, and whether each listing is something you’re Offering or Seeking.
• Messages: in app chat between you and matched members. We may review messages when investigating a report or a safety issue.
• My Tribe: the My Tribes you create or join, your role, and invitations, removals, and bans.
• Waitlist: if your area is not open yet, your ZIP code and waitlist status.
• Trade activity: matches, accepted and declined offers, completed trades, and the ratings you give and receive. We calculate a trust score from this activity.
• Identity verification (optional): see section 6.
• Support and feedback: anything you send us when you contact support.

Information collected automatically

• Device and app data: device type, operating system, app version, a push notification token, crash logs, and diagnostic data (through Firebase Crashlytics).
• Advertising identifiers: if your device settings allow it, your device’s advertising identifier, used to show and measure ads.
• Website analytics: our website (not the app) uses Google Analytics to count visits and understand which pages are useful.

Information from others

• Sign in providers: if you sign in with Google or Apple, they send us your email address and, where you allow it, your name. We do not receive your password.
• App stores: where Apple or Google provide it, the age category of your app store account. We use it only to enforce our 18 or older rule and to comply with the law, and we delete it once the check is done.
• Verification results: if you choose to verify your identity, Didit sends us the result described in section 6.

Sensitive data

Texas law treats some data as “sensitive data.” We process sensitive data only with your consent. The only sensitive data we ask for is the biometric processing done during optional identity verification (section 6). You may also choose to include sensitive details in a listing, for example a need related to health. Please share only what you are comfortable with other members seeing. We do not process data from anyone we know is under 18.

3. How we use your information

We use the information above to:

• Run our matching engine so you can find trades with neighbors nearby.
• Send you push notifications and emails about matches, messages, and important account activity, and, if you give us your phone number, texts about your account. We send marketing texts only if you separately agree.
• Confirm you are 18 or older, and manage the waitlist.
• Verify your identity and show a badge, if you choose to.
• Calculate trust scores, moderate content, prevent fraud and abuse, and enforce our Terms.
• Provide customer support.
• Improve the product through crash reports, support requests, and research.
• Show advertising, including ads tailored to your interests, and measure how ads perform, unless you opt out.
• Create aggregated or deidentified data, as described in section 5.
• Comply with legal obligations.

We use automated tools, including artificial intelligence, for matching, listing drafts, and trust scores. We do not use automated processing to make decisions that produce legal or similarly significant effects about you.

4. How we share information

We share personal data only as described below.

With other Tribes members

Other members can see your public profile, your listings, the My Tribes you belong to where visible to them, messages you send them, and ratings you give. Your email address, phone number, date of birth, legal name, and address are never shown to other members.

With our affiliates

We may share information with our affiliates, meaning companies that control, are controlled by, or are under common control with Tribes. They may use it only in ways this Privacy Policy allows.

With our service providers (processors)

We use a small number of vendors to run the Service. They process your data only on our instructions and under contract:

• Supabase: database and authentication (United States).
• Google Firebase: push notifications and crash reporting (United States).
• OpenAI: when you create a listing from a photo, the photo and your text are sent to OpenAI to draft the listing and to power matching. OpenAI processes this data only to provide these services to us.
• Didit Identity Spain, S.L.: optional identity verification (document check, selfie match, and liveness), in the European Union. See section 6.
• Resend: account emails such as password resets (United States).
• GoHighLevel: newsletters and announcements you can unsubscribe from (United States).
• Vercel: website and API hosting (United States).
• SoTech: app development, maintenance, and technical support, which may involve access to data stored in our systems (United States).
• Google Analytics: website analytics (United States).

Advertising

We may share personal data with advertisers and advertising partners, and use it for targeted advertising and to measure how ads perform. This may include identifiers (such as your device’s advertising identifier), your ZIP code, and information about your listings and activity on Tribes. Under Texas law and some other state laws, this may count as selling personal data. You can opt out at any time, as described in section 7. We do not share sensitive data, such as biometric data or health related details, for advertising without your consent. We may also share aggregated or deidentified data with advertisers, as described in section 5.

For legal reasons or to protect the community

We may disclose information if we reasonably believe it is necessary to comply with a law, court order, or valid government request; to enforce our Terms; to prevent fraud, abuse, or imminent harm; or in connection with a merger, acquisition, or sale of assets (if that happens, your information will remain subject to this Privacy Policy unless you are told otherwise).

With your consent

We’ll share information in other ways if you ask us to.

5. Aggregated and deidentified data

We may combine information from many members into aggregated or deidentified data that does not identify any person, for example counts of what members are Offering and Seeking by ZIP code. This can include categories of needs that may relate to health or household hardship, but only in aggregate. We may share or sell this data to partners such as advertisers, local businesses, nonprofits, and researchers.

For this data, we commit to:

• Take reasonable measures so it cannot be linked to you.
• Keep and use it only in deidentified form and not try to reidentify it.
• Require every recipient, by contract, not to reidentify it.
• Not release figures for groups so small that a person could be identified.

Data handled this way is not personal data under Texas law.

6. Identity verification and biometric data

Verification is optional unless we tell you that a specific feature requires it. Here is how it works, and how we meet Texas law on biometric identifiers (Texas Business and Commerce Code section 503.001).

• What happens: you scan a government photo ID and take a selfie inside the app. The images go directly to our provider, Didit, which checks that the document is genuine and that your face matches it. This match uses a record of your face geometry, which is a biometric identifier.
• Your consent: we explain this and ask for your consent on the verification screen before anything is captured. If you don’t consent, nothing is captured.
• What Tribes keeps: Tribes never receives or stores your ID images, your selfie, your face geometry, or your document number. We keep only the result (verified, declined, or pending), the date, the legal name printed on the ID, and, if you choose to use it for distance matching, the address printed on the ID. These are never shown to other members.
• No sale: we do not sell, lease, or disclose biometric identifiers. Didit uses them only to perform the verification for us, unless the law requires otherwise.
• Destruction schedule: Didit deletes your ID images, selfie, and any biometric data within 30 days after the verification decision. In every case they are destroyed no later than one year after the purpose for collecting them ends, as Texas law requires.
• Withdrawing consent: you can ask us to remove your verification at any time by emailing info@trytribes.com. We will delete the result, name, and address we hold, and your badge will be removed.
• Security: we and Didit protect this data with at least the same care we use for our most confidential data.

We may not offer verification in states whose biometric laws we do not yet support.

7. Your privacy rights

We give every member these rights, wherever you live. They include the rights Texas residents have under the Texas Data Privacy and Security Act. You have the right to:

• Confirm whether we process your personal data and access it.
• Correct inaccurate personal data.
• Delete your personal data.
• Get a copy of your data in a portable format.
• Opt out of the sale of your personal data, targeted advertising, and profiling that produces legal or similarly significant effects.
• Withdraw your consent to the processing of sensitive data.

We will not discriminate against you for using any of these rights.

How to make a request

You can make a request in two ways:

• In the app: Me, then Settings, to view, edit, or export your data, or to delete your account.
• By email: info@trytribes.com, with the subject “Privacy request.”

We will respond within 45 days. If we need more time, we may extend this once by another 45 days and will tell you why. Requests are free up to twice in any 12 months. To protect your data, we may ask you to verify your identity first. You may use an authorized agent to make a request for you.

To opt out of the sale of your personal data and targeted advertising, email info@trytribes.com with the subject “Opt out.” We also honor the Global Privacy Control signal from a supported browser on our website as a request to opt out.

Appeals

If we decline your request, you can appeal by replying to our decision email with the word “Appeal.” We will respond in writing within 60 days and explain our decision. If we deny your appeal, you can contact the Texas Attorney General at www.texasattorneygeneral.gov to submit a complaint.

California

If the California Consumer Privacy Act applies to us, California residents also have the rights it provides, including the right to know, correct, and delete, and to limit the use of sensitive personal information. We collect the categories listed in section 2: identifiers, customer records, commercial information, internet activity, ZIP level geolocation, and inferences (trust score). We may sell or share personal information, as those terms are defined in that law, with advertising partners. California residents can opt out in the ways described above.

European Economic Area and United Kingdom

The Service is offered to people in the United States. If you access it from outside the US, you have the rights your local law gives you, including access, rectification, erasure, restriction, portability, and the right to object. Contact us to use them.

8. Account deletion

You can delete your Tribes account from inside the app at any time. Your account is closed and removed from the app right away: your profile is anonymized, your listings are removed, your sign in methods are revoked, and your verification record is deleted. We keep a limited copy of account data in secure backups and safety records for up to 90 days for fraud prevention, legal compliance, and safety investigations, and then permanently delete it. Messages you sent to other members are anonymized in their history. See trytribes.com/delete-account.

9. Data retention

We keep personal information only as long as we need it:

• Account and profile: while your account is active, and up to 90 days after deletion.
• Listings and messages: while your account is active, and up to 90 days after deletion.
• Trade history and ratings: kept only in aggregated or deidentified form after deletion, to protect other members’ reputations.
• Identity verification: the result, date, legal name, and any address are kept while your account is active and deleted with it or when you withdraw consent. Your ID images and selfie are held only by Didit, for up to 30 days after a decision.
• App store age category: deleted once the age check is done.
• Support emails: up to two years.
• Moderation reports and records needed for legal claims: as long as needed for safety or legal reasons, deidentified where possible.
• Legal and tax records: as required by law.

10. Data security

We use reasonable administrative, technical, and physical safeguards, including encryption, to protect your information. No system is perfectly secure, but we take protecting your information seriously.

If a data breach affects your sensitive personal information, we will notify you as Texas law requires, no later than 60 days after we determine the breach occurred, and we will notify the Texas Attorney General when the law requires it.

11. Minors

Tribes is only for adults. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18. If we learn that someone under 18 has an account, we will close it and delete their data, except anything we need to keep for safety or legal reasons. If you believe a minor is using Tribes, email info@trytribes.com.

12. International data transfers

Tribes is operated from the United States, and your information is stored and processed here. Some of our service providers, including our identity verification provider, may process information outside the United States. When they do, we require them by contract to protect it in line with this Privacy Policy.

13. Cookies on our website

Our website uses a small number of essential first party cookies needed to run the site, and Google Analytics 4 to understand how visitors use it. Google Analytics sets first party cookies and processes a truncated IP address, the pages you view, and basic device and referral information. We use this only in aggregate. You can opt out by disabling cookies in your browser, by installing the Google Analytics Opt out Browser Add on, or through a Global Privacy Control signal. We may also use advertising cookies and similar technologies to show and measure ads. You can opt out as described in section 7. The mobile app does not use web cookies.

14. Changes to this policy

We’ll update this page when our practices change. If a change is material, we’ll notify you by email and inside the app at least 10 days before it takes effect. If a change means we will process your data in a new way that needs your consent, we will ask first. The “Last updated” date at the top always shows the current version.

15. Contact

We are always happy to help. For questions, requests, or concerns about this policy, email info@trytribes.com or write to One Tribe Holding Company, 16192 Coastal Highway, Lewes, Delaware 19958.

One Tribe Holding Company, doing business as Tribes · 16192 Coastal Highway, Lewes, Delaware 19958, United States