Privacy Policy

Naroon is a product of LucidCo Inc. This document applies to the Naroon service operated under the LucidCo Inc. brand.

This Privacy Policy explains how LucidCo Inc. ("we," "us") collects, uses, and shares information in connection with Naroon (https://naroon.ca) and its mobile applications (together, the "Service"). It does not apply to third-party websites or services linked from the Service, which have their own privacy practices.

We collect information you choose to give us, including:

• Account information — name, email address, phone number, and profile details
• Content you post — business listings, reviews, event details, posts, photos, and messages
• Business information — for accounts that manage a business profile: business details, menus, offers, and dashboard activity
• Payment-related information — where the Service supports payments (for example, event ticket purchases), our payment processor collects the payment details needed to complete the transaction; we do not store your full card number
• Communications — messages you send us, for example at support@naroon.ca

When you use the Service, we and our service providers automatically collect:

• Device and browser information (device type, operating system, browser type)
• IP address and approximate location derived from it
• Usage data (pages and features viewed, actions taken, referring/exit pages, timestamps)
• Cookies and similar technologies, including a first-party session identifier used to keep you signed in and to support basic, privacy-preserving analytics
• Diagnostic and error data, used to keep the Service reliable and secure

We use the information we collect to:

• Provide, operate, and maintain the Service, including your account, listings, reviews, events, loyalty points, and games
• Verify your phone number or email address and secure your account
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Send transactional messages (such as verification codes and account notifications) and, where you have opted in, newsletter or campaign email
• Respond to support requests sent to us
• Understand aggregate usage of the Service and improve it
• Comply with legal obligations and enforce our Terms of Service

We use your phone number and/or email address to send one-time verification codes and to confirm you control the contact method associated with your account. We also use verification signals (such as which phone numbers and email addresses have been used, and basic request metadata) to detect and prevent fraudulent account creation, account takeover, and abuse of the verification system, including automated or excessive verification requests.

We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes.

This section describes our specific practices for the SMS messaging program: the information we collect for it and how we use it.

What we collect for SMS verification:

• Your phone number, when you submit it to request a one-time verification code
• A consent record for that request — a timestamp, which flow you requested it from (for example sign-in, account phone number change, or business claim/unclaim), the exact version of the consent disclosure you saw, your IP address, your device/browser user agent, and whether the code was sent
• A short-lived send-attempt record used only to enforce rate limits — this record never stores your phone number or IP address in plaintext, only one-way salted cryptographic hashes of them, and only for as long as needed to apply the limit (a few days)

How we use it for the messaging program:

• To send the one-time verification code you requested, through our SMS delivery provider (see "Service providers and subprocessors" below)
• To enforce per-number and per-IP sending limits that prevent abuse of phone verification, such as automated or excessive code requests, and to support the security of your account
• To keep proof that you consented to receive the message, for as long as needed to demonstrate compliance with messaging regulations (see "Data retention" below)
• To honor a STOP or HELP reply

Message frequency varies based on your account activity (for example, how often you sign in or request a new code) — these messages are transactional and user-initiated, never a recurring or scheduled marketing series.

We do not sell your phone number or your SMS consent records.

We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes. The only sharing we do is with the messaging providers and mobile carriers necessary to deliver, secure, and support the SMS service itself (see "Service providers and subprocessors" below) — never with anyone else, and never for marketing.

We use third-party service providers to operate the Service. They process information on our behalf and are contractually restricted from using it for their own purposes:

• Supabase — database, authentication, and file storage
• Postmark — transactional and (where you opt in) newsletter/campaign email delivery
• Twilio — SMS delivery for phone verification
• Stripe — payment processing for ticketed events and other paid features
• Vercel — application hosting
• Cloudflare — content delivery, network security, and Turnstile bot protection on sign-in and other code-request forms. Turnstile checks whether a visitor is a human without tracking them across sites; Cloudflare describes what it processes in its Turnstile Privacy Addendum at https://www.cloudflare.com/turnstile-privacy-policy/
• Google Maps — maps and location display on business listings
• Apple, Google, and Microsoft — optional social sign-in, if you choose to use it

Where we introduce a new subprocessor that materially changes how your data is handled, we will update this policy.

Payments made through the Service (for example, event ticket purchases) are processed by Stripe. Stripe collects and processes your payment details directly under its own privacy policy; we receive confirmation of payment and the transaction details needed to fulfill your purchase, not your full card number.

We use a first-party, httpOnly session cookie to recognize repeat visits and support basic product analytics. This cookie does not carry directly identifying information and is not used for cross-site tracking or third-party advertising. We also use cookies to remember your language and theme preference and to keep you signed in.

You can control cookies through your browser settings; blocking some cookies may affect features such as staying signed in or remembering your preferences.

Reviews, business listings, event details, posts, and certain profile information (such as your display name) are visible to other users of the Service, and business listings, events, and reviews are generally intended to be publicly discoverable, including via search engines. Do not include information in this content that you do not want to be public.

We may access, preserve, or disclose information if we believe in good faith that doing so is required by law, regulation, or legal process, or is necessary to protect the rights, property, or safety of our users, the public, or LucidCo Inc.

If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy or a successor policy that applies to it.

We retain information for as long as your account is active and as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. SMS consent and verification records are retained for as long as needed to demonstrate compliance with messaging regulations, even after an account is closed. When information is no longer needed, we take reasonable steps to delete or de-identify it.

We use administrative, technical, and physical safeguards designed to protect information against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure, and we cannot guarantee absolute security of your information.

• You can review and update your account and profile information at any time while signed in
• You can opt out of newsletter or campaign email using the unsubscribe link in those emails, or through your notification preferences
• You can reply STOP to an SMS message at any time to opt out of SMS, or HELP for assistance
• You can request deletion of your account by contacting support@naroon.ca, subject to information we are required to retain by law

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us at support@naroon.ca so we can investigate and, if appropriate, delete the information.

LucidCo Inc. is based in Canada, and information we collect may be processed and stored in Canada or other countries where our service providers operate, which may have data protection laws different from those of your own jurisdiction.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide additional notice where required by law.

Questions about this Privacy Policy? Contact us at support@naroon.ca.

LucidCo Inc. — 6D–7398 Yonge St., Suite 1053, Vaughan, ON L4J 8J2, Canada

Naroon is a product of LucidCo Inc. This document applies to the Naroon service operated under the LucidCo Inc. brand.