Last Updated: March 8, 2026
Karass ("we," "our," or "us") operates the Karass mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.
By using the App, you agree to the collection and use of information in accordance with this policy.
Information You Provide Directly
Information Collected Through Third-Party Authentication
If you choose to sign in using Apple, Twitter/X, or GitHub, we receive your public profile display name, provider-specific user ID, and email address (if available from the provider). Apple may provide a private relay email address. We do not receive or store your passwords from these third-party services.
Information Collected Automatically
Information We Do NOT Collect
Scanning: The App scans for nearby Karass beacon signals using a unique service UUID. It does not scan for or interact with any non-Karass Bluetooth devices.
Broadcasting: When a designated "Beacon" user activates broadcasting, the App advertises a BLE signal containing only a truncated, irreversible cryptographic hash derived from the user's username. No personally identifiable information is transmitted over Bluetooth.
No location tracking: Bluetooth is used solely for proximity detection between devices. We do not derive, infer, store, or transmit any location data from Bluetooth interactions.
Data retention: Detected beacon identifiers are stored only in device memory during an active scan session and are cleared when scanning stops. They are not transmitted to our servers.
Account data is stored in Google Cloud Firestore, hosted in the United States. Authentication is managed by Firebase Authentication using industry-standard encryption. All communication between the App and our servers occurs over HTTPS/TLS encrypted connections.
We do not sell, rent, or trade your personal information to third parties.
We may share your information only with service providers (Google Firebase for infrastructure), when required by law, or to protect safety. Your username is visible to other authenticated members. Your email, Twitter handle, and GitHub handle are not shared with other users.
Data Export: You can request a copy of all your data at any time through the App menu ("Request My Data"). This generates a JSON file you can save or share.
Account Deletion: You can permanently delete your account and all associated data at any time through the App menu ("Delete Account"). This deletes your user profile, announcements, beacon records, rate limit records, and Firebase Authentication account. Deletion is irreversible.
Push Notifications: Disable at any time through your device's Settings.
Bluetooth: Disable at any time through your device's Settings.
Active accounts: data retained while the account is active. Deleted accounts: all data permanently deleted immediately. Rate limit records: old timestamps pruned automatically. Announcements: expire based on administrator-set dates.
The App is not intended for children under 13. We do not knowingly collect personal information from children under 13. Contact us at hq@karass.xyz if you believe a child has provided us with personal information.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy within the App. Continued use constitutes acceptance.
Email: hq@karass.xyz