Privacy policy

Who’s Late? is operated by Stellar Corporate LLC (“we,” “us,” or “our”). This policy covers the mobile app and this website. Contact us at troy@stellarcorporate.com about privacy or your information.

• Account and profile: account identifiers, email address, sign-in provider information, username, display name, and photos you provide. Apple or Google may supply profile information when you choose their sign-in options.
• Crew and challenge activity: memberships, invitations, meeting places and coordinates, arrival promises, check-in times, standings, agreed consequences, and content you submit, including photos or voice recordings where those features are used.
• Location: precise location, accuracy, and a timestamp are processed to verify check-ins. Check-in is manual; the app does not collect location in the background or automatically check you in. Nearby place searches may send your location to Google Maps/Places. We store meeting-point coordinates and arrival outcomes; the check-in service does not store your precise check-in coordinates in crew records or publish a live location trail to members.
• Device and service information: push notification tokens, app and device information used for app verification, operational logs, IP addresses processed by service providers, image-generation jobs, usage limits, and generation cost records.
• Support: information you include in support, deletion, safety, or privacy requests.

We use this information to provide accounts, private crews, invitations, plans, verified arrivals, results, notifications, image generation and saved artwork; to secure the service, prevent misuse, enforce limits, troubleshoot failures, measure operating costs, and respond to your requests. Where applicable law requires a legal basis, we rely on providing the service you request, consent for optional features, legitimate interests in security and service operation, and compliance with legal obligations.

What we collect and why. You may select or take a photo containing your face to create an AI-generated 3D avatar. The photo and resulting avatar contain recognizable facial appearance. We do not extract or store face geometry, biometric templates or face embeddings, perform facial recognition, identify people from a face database, or use a face to authenticate you. Image generation interprets the appearance in the image to create artwork; it is not identity verification.

Your permission and recipients. Before uploading or processing content, the app asks for your permission to send content to OpenAI. Selected photos, including visible faces, and generated avatars are sent to OpenAI for image generation and safety screening. Image instructions and the plan’s agreed refreshment or activity may also be sent to generate a result illustration. With that permission, generated avatars can be reused for shared crew artwork when membership changes and for automatic challenge results. We require each depicted member’s recorded consent before generating shared artwork. Original uploaded face photos are not used as shared crew profile images; those use generated avatars.

Other content screened by AI. OpenAI receives profile names, crew names, plan text, messages, uploaded images and generated artwork for automated safety screening. Email addresses, passwords, payment details and precise check-in coordinates are not included in these image-generation or moderation requests. AI processing can be declined; account and deletion settings remain available, while posting and generation requiring this processing are unavailable.

Storage and retention. Original uploaded photos and generated avatars are stored privately in Google Cloud Storage for the life of the account unless removed earlier by our cleanup process. Generated crew and result artwork is stored in Google Cloud Storage and its references and job records in Firebase Firestore, until removed using the applicable Photo Booth controls or account deletion. There is no separate facial-recognition database. The app may cache downloaded generated images on the device for faster display. Original photos do not automatically expire after generation. Account deletion queues removal of original photos, generated avatars and identifiable shared artwork; account cleanup is scheduled every five minutes and can take longer if a service error requires a retry. Copies independently exported by other people are outside our control.

Provider safeguards. Google Firebase/Google Cloud stores and processes this information to provide the service, and OpenAI processes the specific requests described above. We require service-provider protection through the applicable data-processing terms, confidentiality obligations and security measures, including encryption in transit and access controls. OpenAI API content is not used to train its models by default. OpenAI may retain API input and output in abuse-monitoring logs for up to 30 days, with longer retention when required for safety or legal obligations; image safety review can have additional retention exceptions. See OpenAI’s Data Processing Addendum, OpenAI API data controls, and Google Cloud’s Data Processing Addendum. Providers may process data in the United States and other countries.

Deletion and questions. Request removal through Profile → Settings → Delete account or our web deletion route. For access, withdrawal of consent or removal questions, contact troy@stellarcorporate.com. Only submit a photo you have permission to use.

• Crew members can see information needed for your shared experience, including profiles, crew artwork, meeting details, promises, arrivals and results. A member can choose to share a result outside the app. Copies shared by others are outside our direct control.
• Service providers include Google Firebase/Google Cloud for authentication, storage, database, functions, hosting, device verification and notifications; Google Maps/Places for place search; OpenAI for image generation; and Apple/Google for platform sign-in and notification delivery. See Google’s privacy policy and Apple’s privacy policy.
• We may disclose information when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or support a business transfer with appropriate protections.

We do not sell personal information or share it for cross-context behavioral advertising. This website does not include advertising trackers or third-party analytics scripts.

We retain account, crew, challenge and saved-artwork information while needed to provide the service and for the purposes described here. Retention depends on the record and its purpose; we do not promise one fixed retention period for every category. Abandoned uploads are eligible for cleanup after 24 hours. Account deletion is processed through a background cleanup job that removes the account and associated profile/media records and removes or anonymizes participation records. Some shared artwork, copies others have exported, backups, security records, or records needed for legal obligations may remain for their respective purposes. Contact us if shared generated artwork still identifies you and you want it reviewed for removal. See how to request account and data deletion.

You can edit your profile, manage crews and artwork, disable notifications, revoke photo/camera/microphone permissions, and revoke location permission in device settings. Revoking a permission affects features that require it and does not automatically delete previously submitted information. Delete your account in the app through Profile → Settings → Delete account, or contact us through the web deletion route. Depending on your location, you may have rights to access, correct, delete, obtain a copy of, restrict or object to processing of your information, or withdraw consent. We may need to verify your identity. You may also contact your local privacy regulator. We do not discriminate against you for exercising applicable rights.

We use access controls and service-provider security measures to protect information, but no service is completely secure. Providers may process information in the United States and other countries; applicable safeguards depend on the provider and law. Who’s Late? is intended for adults 18 and older. We do not knowingly invite children to create accounts. Contact us if you believe a child has provided information so we can investigate and take appropriate action.

The website serves static pages, fonts and images. Your browser may cache them, and our hosting provider processes technical request information to deliver and secure the site. Email links open your email application; we receive only what you choose to send. We may update this policy as features or practices change. We will change the effective date and provide additional notice when required.

Messages are stored to provide your crew conversation and are available to active crew members. Messages are encrypted in transit; they are not end-to-end encrypted. We send text and images to OpenAI for automated safety screening before publication. Reports may preserve the reported message and account identifiers for review by authorized staff. Automated screening can make mistakes; contact support to ask for review.

Blocking hides that sender’s messages in your conversation and suppresses message notifications between the two accounts. It does not remove either member from shared crews. Message notification previews do not include the message text. You may delete your own messages; crew owners and authorized moderators can remove messages. Deleting your account removes authored crew messages and related stored profile content. Shared artwork containing you is removed during cleanup where identified; older group artwork may be removed conservatively. Copies other people have exported are outside our control. Limited safety, transaction, and legal records may be retained for the purposes described above.