Last updated: November 8, 2026 Version: 1.0
Rats ("Rats," "we," "us") is a skatepark stampbook and social app for skateboarders. This policy describes exactly what the app collects, why, where it goes, and how you control it. It is written to match what the code actually does.
Rats is a free app. It has no ads, no advertising SDKs, and no third-party analytics or tracking SDKs. We do not sell your data.
Rats is operated by Rats App LLC, a New York limited liability company ("Rats," "we," "us"), which is the data controller. Our infrastructure provider (Supabase) is a data processor acting on our instructions. You can reach us at ratsappcontact@gmail.com or by mail at Rats App LLC, 686 Walworth Penfield Rd, Unit #169, Macedon, NY 14502.
Account information — email address and username.
Your email is used only for authentication (sign-in, email confirmation,
password reset). It is stored by our authentication provider (Supabase Auth)
and is never shown to other users. Your username and (optional) display name,
bio, and profile photo are shown to other signed-in users.
Stored in: auth.users (email), public.profiles (username, display name,
bio, avatar URL).
Location — precise device GPS, used at the moment of an action. Rats uses your device's location to: - verify you are physically at a skatepark before you can "stamp" it (a ~150–200 meter geofence check). Posting a clip to a park does not use your location: you can only post a clip to a park you have already stamped, and the app does not read photo/video location metadata when you post; - check your location once when you make a World post (a clip not tagged to a park), to see whether any skatepark is within 50 miles; - count a park visit toward "Local" status (you become a Local after 10 separate visits, each at least 18 hours apart) — checked only while the app is open in the foreground; - detect the park you are at so you can join its battle queue, and confirm both players are at the park when a battle starts; - show nearby parks on the map and, with your permission, center the map on you.
We do not store your coordinates. The one exception is a park pin you choose to place with “Use my current location” when submitting a park (see Park submissions below). Each location check happens on our server at the moment of the action — for example, "is this point within 200 meters of the park?" — and the coordinate is discarded as soon as it has been checked. What we keep is only the result: that you stamped or visited a particular park, and when. For battles, we keep which park you were at and when (never a coordinate) for about 10 minutes, so a battle can confirm both players are at the park. We do not run any continuous or background location tracking. Coordinates are also sent to Google (see §4) to render maps. When you submit a new park, the address text you type (not your location) is sent to OpenCage to look up its map position.
Photos and videos you choose to upload. Skate clips (video), profile
pictures, and optional bug-report screenshots. The
app only ever accesses the single file you actively pick; it does not scan or
upload your library in the background. Before upload, we re-encode images to
strip embedded metadata, including any GPS coordinates in the photo's EXIF.
Stored in: Supabase Storage buckets (posts, avatars,
bug-screenshots). Profile photos are public. Clips are stored privately and
shown through short-lived links only to people allowed to see the post.
Bug-report screenshots are private to you and our admins. See §8 for how we handle location metadata in videos.
Park submissions. When you submit a new skatepark, we store its name, address, indoor/outdoor setting, map position, and your account as the submitter. If you tap “Use my current location,” your device’s current position becomes the park’s map position and is kept as part of the park listing, and your phone’s built-in address lookup (Apple on iPhone, Google on Android) receives that position to fill in the address. You also take a verification photo through the app. That photo is used only by our admins to confirm the park is real and correctly placed: it is stored privately, never shown to other users, and permanently deleted once the submission is approved or rejected, or if you delete your account first. Once a park is approved, its details are visible to signed-in users and your username is shown on the park page as its “Founding Rat.” If you delete your account, a pending submission is withdrawn, and an approved park stays listed, credited to an anonymized placeholder instead of you.
Invite codes. Every account has an invite code. If you sign up with someone's code, we record that they invited you, and later whether you've stamped your first park, so we can count their invites. We may use those counts in the future, for example to thank people who invite others. The person who invited you sees only how many people joined with their code, not who. We don't use this for advertising and we don't share it. If either account is deleted, the record is deleted with it.
Content you create. Captions, comments, your bio, stamps, follows, blocks, mutes, battle records, and crowns. These power the social features and are shown to other signed-in users according to your settings.
Push notification token. If you enable notifications, we store a device
push token so we can send banners for likes, comments, follows, mentions, and
battle/park events. Turning any notification type off in Edit Profile stops
the underlying notification from being generated at all — not just hidden.
Stored in: push_tokens (readable only by you).
Bug reports. If you submit one, we store your description, your device OS and version, and any screenshot you attach.
Technical/server logs. Like any hosted service, our provider (Supabase) and Google process your IP address and basic request metadata to deliver the service and for security. We do not use this for advertising or profiling.
We deliberately do not collect: phone number, contacts, precise background location, advertising identifiers, or behavioral analytics. The date of birth you enter at sign-up is checked on your device only and is not sent to or stored by Rats (see §7).
Cookies and on-device storage. The Rats app does not use cookies, and it contains no analytics, advertising, or tracking technology. The app stores a small amount of information on your phone so that it works and remembers your choices: your login session (encrypted, with its key kept in your phone's secure keystore — iOS Keychain / Android Keystore), your clip sound on/off setting, which intro, safety, and celebration screens you have already seen, and the list of accounts you have hidden from your feed on that device. This information stays on your phone and is not used to track you. Signing out removes the login session; deleting the app removes the rest. (An iPhone may keep the session's encryption key in its Keychain after the app is deleted — on its own it is useless, because the encrypted session it unlocks is deleted with the app.) Our policy web pages (including this one) set no cookies and run no scripts. They are hosted by GitHub Pages, which — like any web host — receives your IP address and basic request details when you load a page, and handles them under GitHub's own privacy statement.
Only to operate the app's features: verifying park visits, showing your content to the people you have chosen to share it with, sending notifications you opted into, ranking Locals/Rat Kings, and reviewing reported content for safety. We do not use your data for advertising and do not sell it.
Copyright claims and legal requirements. If someone sends us a copyright notice about content you posted, we may give you a copy of it (including the sender's contact details) so you can respond. If you send us a DMCA counter-notice, the law requires us to send a copy of it — including your name, address, telephone number, and email address — to the person who filed the original notice. See our DMCA Copyright Policy. We may also disclose information where we are legally required to, including reporting apparent child sexual abuse material, and the account that posted it, to the National Center for Missing & Exploited Children (NCMEC), as US law requires.
Apart from the providers above and these legal cases, we do not share your data with any other third party, and none of these are permitted to use it for their own purposes beyond providing their service.
Business transfers. Rats was originally built and run by its founder personally and is now operated by Rats App LLC; information collected before that change is held by Rats App LLC under this policy. If Rats App LLC is involved in a merger, acquisition, or sale of all or part of its assets, your information may be transferred as part of that transaction, and we will notify you before it becomes subject to a different privacy policy.
In the app you can: edit or delete your bio, avatar, posts, and comments; choose who can comment on your posts; make your battle log private; block or mute other users; and turn off any notification type.
Account and data deletion. Edit Profile → Delete my account (confirmed with your password) immediately: deletes your posts, comments, likes, follows, blocks, mutes, stamps, visit history, push tokens, and uploaded files; anonymizes your profile to a non-identifying placeholder so other players' battle history stays intact; and disables your login so it can never be used again. This cannot be undone.
Depending on where you live, you may have rights to access, correct, delete, or export your data, or to object to processing. You can exercise most of these in-app; for anything else, contact us (§9).
Content is retained until you delete it or delete your account. On account deletion, personal data is removed or anonymized as described in §5. Server security logs are retained by our provider for a limited period per their policy.
Some records are kept after the content or account they relate to is deleted, because we need them to enforce our rules, meet legal obligations (such as our repeat-infringer policy), and respond to claims: moderation records (what was removed or restricted, when, and why), reports other people made about your content or account (including a snapshot of the reported caption, comment, or profile text), copyright notices and counter-notices we receive, records of which policy versions you accepted and when, and — if an account is banned — a one-way, salted hash of its email address, used only to flag a new sign-up with the same email. Content reported as sexual content involving a minor is hidden right away and preserved, even if it or its account is deleted, for 90 days while we review it, or for 1 year if we report it to NCMEC, as US law requires. It is then deleted.
Rats is for adults aged 18 and older. We do not knowingly collect personal
information from anyone under 18. Sign-up asks for your date of birth. That
date is checked on your device and is not transmitted to or stored by
Rats; we record only a timestamp (profiles.age_verified_at) showing that the
check was passed — only someone 18 or older can pass it. An account cannot be
created if the check fails, and our servers independently refuse sign-ups not
marked 18+. If, despite these checks, we learn that we have collected personal information
from someone under 18 (for example, through a report or a moderator's review), we
will delete that account and its personal information promptly and ban it from
Rats. To enforce the ban we keep only a record of the moderation action and a
one-way, salted hash of the account's email address (see §6), used solely to flag
a new sign-up with the same email. If you believe someone under 18 is using Rats,
report their profile in the app or email ratsappcontact@gmail.com. See the Terms of Service for the eligibility requirement.
Access to your data is enforced at the database with row-level security and column-level permissions: precise location is never returned to other users, only you and admins can see privileged data, and administrative actions are authorized on the server and logged. Media buckets restrict which file types can be uploaded. Passwords are handled entirely by our authentication provider; we never see them. On your phone, your login session is stored encrypted, with its key kept in the device's secure keystore (iOS Keychain / Android Keystore).
Metadata: photos and videos have their embedded metadata — including any camera-recorded location — removed on your device before upload (videos since October 24, 2026; clips posted before then were cleaned the same day).
No method of storage or transmission is 100% secure.
Questions, privacy requests, or account deletion help: email ratsappcontact@gmail.com, or write to Rats App LLC, 686 Walworth Penfield Rd, Unit #169, Macedon, NY 14502.
We may update this policy as the app changes. Material changes will be signaled in-app. The "Last updated" date above always reflects the current version.