⚠️ DRAFT — pending legal review. This document is a draft prepared for internal and external legal review. It is not yet a final, legally binding policy. Do not rely on, distribute, or publish this version as the definitive privacy policy for the Treat Map app until it has been reviewed and approved by counsel. Note for counsel: Treat Map is an all-ages, family-facing app used in Sweden, the United States, and across Europe; §8 (Children's Privacy) and §2A (Marketing Communications) require particular attention (COPPA / GDPR-K / age of digital consent, which varies by EU member state).
Last Updated: July 12, 2026 Effective Date: July 12, 2026
Introduction
This Privacy Policy explains how Innovaiden Inc. ("Innovaiden," "we," "us," or "our") collects, uses, shares, and protects personal information when you use the Treat Map application and its companion website (together, the "App"). Treat Map helps neighborhoods run trick-or-treat events: organizers create a neighborhood, hosts register their house on a map, and trick-or-treaters browse the map, see participating houses and door codes, and leave short reactions and reviews.
Innovaiden is the data controller for the personal information processed through the App.
Please read this Privacy Policy carefully. By downloading, installing, or using the App, you agree to the practices described here. If you do not agree, please do not use the App.
This policy applies specifically to the Treat Map app. Our general website and platform privacy practices are described in our main Privacy Policy.
1. Personal Information We Collect
We collect only the information needed to operate the App and provide its features.
1.1 Account Information
Email address and password. When you create an account or sign in, we collect your email address (and a securely hashed password, if you use email sign-in). We use AWS Simple Email Service (SES) to send a verification code to confirm your address. Your email links your account so you can sign in across devices and so we can secure and support your account.
If you use Sign in with Apple, Apple may provide a private relay email address rather than your real email. We treat the relay address the same way we treat any account email.
Display name (optional) and year of birth. We ask your year of birth to determine whether you are under the age of digital consent in your country, which governs the parental-consent and marketing rules in §2A and §8. We store the year only — not your full date of birth.
Legal basis (GDPR): Performance of a contract — Article 6(1)(b). We need your email to create and operate the account you have requested. Year of birth is processed to comply with our legal obligations regarding minors — Article 6(1)(c).
1.2 Location Information
Coarse and precise location. With your permission, the App uses your device location to center the trick-or-treat map on your neighborhood and, when you tap "find me," to show where you are on the map. If you create a neighborhood, the coordinate you set becomes the event's map center.
Your live location is used on your device and sent to our backend only transiently when a feature needs it. We do not build a location history and we do not use your location for tracking or advertising. A neighborhood's map center that an organizer deliberately sets is stored as part of that event.
Legal basis (GDPR): Consent — Article 6(1)(a), captured through the iOS location permission prompt; and our legitimate interest in providing the map features you request — Article 6(1)(f). You can withdraw consent at any time in the iOS Settings app.
1.3 Content You Create
To provide the service, we store content you create in the App, linked to your account:
- Neighborhoods you create (name, area, map center, event date, visibility, join code, and any sponsor names you add).
- Host listings you register: the name on your door, street address, floor, door code, availability times, and notes. A door code and address are sensitive — see §1.4.
- Attendee membership in the neighborhoods you join.
- Reactions and reviews you post about a host (a thumbs-up, an "out of treats" report, or a short review).
Legal basis (GDPR): Performance of a contract — Article 6(1)(b).
1.4 Sensitive Host Details (Addresses and Door Codes)
If you register as a host, you provide your street address and, if applicable, a building door/entry code so trick-or-treaters can reach you. We treat these carefully:
- A host listing appears on the public map only after the neighborhood's organizer approves it.
- A host's door code is shown only to trick-or-treaters who have created an account, verified their email, and joined that neighborhood — never to anonymous browsers — unless the organizer has explicitly chosen to show door codes to everyone for that event.
- You can edit or delete your host listing at any time, and deleting your account removes it.
Legal basis (GDPR): Performance of a contract — Article 6(1)(b); you provide this information specifically to participate as a host.
1.5 No Tracking
Treat Map does not track you. Specifically, the App:
- Does not use the Advertising Identifier (IDFA);
- Does not present an App Tracking Transparency (ATT) prompt, because we do not track;
- Does not include third-party advertising or third-party analytics SDKs;
- Does not sell or share your personal information for advertising.
Neighborhood sponsors are shown as names/logos within the app; sponsors do not receive your personal information unless you separately opt in to sponsor communications (see §2A), and even then we send those messages ourselves — we do not hand your contact details to sponsors.
2. How We Use Personal Information
We use the information described above only to:
- Create, secure, and manage your account, and verify your email address;
- Provide the App's features: neighborhood discovery, creating and joining neighborhoods, the trick-or-treat map, host registration and approval, door-code access for verified attendees, and reactions and reviews;
- Enforce age-appropriate rules and obtain parental consent where required (§8);
- Maintain the safety and integrity of the App, moderate content, and prevent abuse;
- Send you the account and event messages you have asked for, and — only with your consent — the marketing messages described in §2A;
- Comply with our legal obligations.
We do not use your information for advertising or for cross-app or cross-site tracking.
2A. Marketing Communications (Opt-In)
When you sign up, you may separately opt in to receive:
- updates about this event;
- updates about other Treat Map events; and
- messages from event sponsors (sent by us on their behalf — we do not give sponsors your contact details).
These opt-ins are off by default, are independent of each other, and are not required to use the App. You can turn any of them on or off at any time in the app's settings, and every marketing email includes an unsubscribe link.
Minors: if you are under the age of digital consent in your country, these marketing opt-ins remain disabled until a parent or guardian provides verifiable consent (see §8). We do not send marketing messages to a minor without that consent.
Legal basis (GDPR): Consent — Article 6(1)(a). Withdrawing consent does not affect messages already sent.
3. How We Share Personal Information
We do not sell, rent, or lease your personal information. We share information only with the processors needed to run the App, and only as necessary to provide the service:
3.1 Service Providers (Processors)
- Amazon Web Services (AWS) — cloud hosting and infrastructure that runs the App's backend (United States region).
- AWS Simple Email Service (SES) — sending account verification, password reset, parental-consent, event, and (where you opted in) marketing email.
- Apple — when you use Sign in with Apple, Apple processes your sign-in per Apple's own privacy policy.
These providers are contractually bound to protect your information and to process it only on our instructions.
3.2 Information Visible to Other Users
By design, some of the content you create is visible to other participants in a neighborhood: your host listing (name on door, address, availability, and — to verified members — door code) is shown to that neighborhood's trick-or-treaters, and your reviews/reactions are shown with the display name you choose. Do not put information in these fields that you are not comfortable sharing with the neighborhood.
3.3 Legal Requirements
We may disclose personal information where required by law, such as in response to valid legal process, to comply with regulatory requirements, or to protect the rights, property, or safety of Innovaiden, our users, or the public.
4. Data Retention
- Account and content data (email, year of birth, neighborhoods, host listings, memberships, reviews) is retained until you delete it or delete your account.
- Consent records (including marketing opt-ins and parental consent) are retained as long as needed to evidence the consent and to comply with our legal obligations.
- Live location is transient and is not retained against your account (a neighborhood's deliberately-set map center is retained as event data).
When you delete your account, the associated account data is permanently deleted as described in Section 7.
5. International Data Transfers
Innovaiden is based in the United States, and the App's backend is hosted on AWS infrastructure in the United States. Treat Map is used in Sweden, elsewhere in the European Economic Area (EEA), the United Kingdom, and the United States. If you are located in the EEA, the UK, or Switzerland, your personal information will be transferred to and processed in the United States.
We rely on the following safeguards for these transfers:
- EU Standard Contractual Clauses (SCCs), as incorporated into the AWS GDPR Data Processing Addendum.
- AWS's certification under the EU-U.S. Data Privacy Framework (and the UK and Swiss extensions, where applicable).
These measures are intended to provide an adequate level of protection for your personal information when it is transferred outside the EEA, the United Kingdom, or Switzerland.
6. Security
We implement technical and organizational measures to protect your personal information, including:
- Encryption in transit using TLS for all communication between the App and our backend;
- Encryption at rest for stored data, using AWS Key Management Service (KMS);
- Hashed passwords (bcrypt) and short-lived, signed session tokens (JWT);
- Access controls, moderation, and monitoring to limit and detect unauthorized access and abuse.
No system is completely secure, but we take reasonable measures to protect your information. Please keep your account credentials confidential and contact us if you suspect unauthorized access.
7. Your Privacy Rights (GDPR)
If you are located in the EEA, the United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) and UK GDPR (Articles 15–22):
- Right of access (Art. 15) — confirm whether we process your personal data and receive a copy.
- Right to rectification (Art. 16) — correct inaccurate or incomplete data.
- Right to erasure (Art. 17) — request deletion of your data. The App includes an in-app Delete Account function that permanently deletes your account, including your host listing, memberships, and reviews.
- Right to restriction (Art. 18) — limit how we process your data in certain situations.
- Right to data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format.
- Right to object (Art. 21) — object to processing based on legitimate interests.
- Right to withdraw consent — where processing is based on consent (such as location or marketing), withdraw it at any time without affecting prior processing.
Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority. In Sweden, this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, "IMY") — https://www.imy.se. You may also contact the supervisory authority in your country of residence.
To exercise any of these rights, contact us at privacy@innovaiden.com. We may request information to verify your identity before acting on a request, and we will respond within the timeframe required by applicable law.
8. Children's Privacy, Age, and Parental Consent
Treat Map is a family-facing app that people of many ages use to take part in a neighborhood event. We take extra care with the personal information of minors.
- Age signal. At sign-up we collect your year of birth to determine whether you are under the age of digital consent in your country. This age is 16 in many EU countries but varies by member state (for example, it is 13 in Sweden), and is 13 under the United States' COPPA.
- Under the age of consent. If you are under the applicable age, you may still create an account and take part in a neighborhood, but:
- all marketing opt-ins are disabled and no marketing message is sent, and
- we require verifiable parental/guardian consent before enabling any optional processing that requires consent. We obtain this through a parental-consent email: the minor provides a parent/guardian email address, and the parent/guardian confirms via a secure, tokenized link.
- Data minimization for minors. We collect only what is needed for a minor to participate, and we do not knowingly use a minor's data for marketing or profiling.
- If we learn that we have collected personal information from a child without required parental consent, we will delete it promptly.
If you are a parent or guardian and believe your child has provided personal information without your consent, or you want to review or delete it, contact us at privacy@innovaiden.com.
9. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the App, or legal requirements. When we make material changes, we will update the "Last Updated" and "Effective Date" above and, where appropriate, provide notice within the App. Your continued use of the App after changes become effective constitutes acceptance of the updated Privacy Policy.
10. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices for the Treat Map app, please contact us:
Innovaiden Inc. Privacy Officer
Email: privacy@innovaiden.com
For data subject rights requests, please use the email address above and provide sufficient detail to verify your identity and process your request.
This Privacy Policy is effective as of July 12, 2026.