Invitation privacy

Invitations are optional. Ordinary task features remain available without an account. This notice applies only when you choose to use invitations, separately from the ordinary task features described in the main Privacy Policy.

Data: a hash of Apple’s app-specific identifier, authentication and revocation tokens, account and consent timestamps, invitation code and relationship, campaign participation, qualification status and time, invitation counts, and awarded cosmetic IDs. We do not request your name or email, or send task titles, notes, individual task IDs, photos, location, or contacts.

Purpose: account authentication, preventing self-invites and duplicate rewards, awarding both participants, restoring rewards, and revoking Apple sign-in when you delete your account. We do not access contacts or send invitations automatically. You choose where and with whom to share.

Processing: the API and database use Amazon Web Services in Seoul, South Korea (ap-northeast-2). Connections use HTTPS/TLS and authentication tokens are encrypted at rest. Authentication tokens are sent to Apple for verification and revocation; Apple’s Privacy Policy governs Apple’s services.

Retention: reward recovery records remain while your invitation account exists. Delete invitation account in the With friends screen to revoke Apple access and remove your account, code and reward recovery records from the active database. Failed deletion attempts are retried and are not shown as successful before completion. Database backups expire within 7 days. Operational error logs without personal identifiers are retained for 14 days.

Uninstalling or signing out does not delete the server account. Tasks and cosmetics already on your device remain after account deletion; device data can be removed separately in app settings.

Invitations are offered to people aged 16 or older with optional consent. Declining prevents invitations and server reward recovery, but leaves ordinary task features and existing cosmetics available. We do not collect your date of birth.

Access, correction, deletion or consent withdrawal: Xeta, Seongju Park, dev@xeta.im. This notice is presented separately when you first use invitations. Notice version: referrals-2026-10-26.