Global Privacy Policy
LAYX is engineered from the ground up on a radical privacy-by-design architecture. We do not ask for your legal name, email address, phone number, contacts list, or real-time location. Sensitive gear details are encrypted on your physical device before upload. This policy sets out our global privacy standards and your legal rights worldwide.
1. Who We Are & Data Controller
LAYX is developed and operated by Three Guys s.r.o., a corporation incorporated under the laws of the Slovak Republic, European Union (the “Data Controller” under the EU/UK GDPR and applicable global data protection laws).
- Registered Address: Three Guys s.r.o., Slovak Republic, European Union
- Dedicated Privacy & Legal Contact: privacy@layx.app
- Data Protection Officer / Representative: Reachable directly at privacy@layx.app
2. Architectural Foundations: Zero-Knowledge & Sovereign Identity
Traditional applications collect your personal identity to sell ads, build behavioral dossiers, or monetize social graphs. LAYX fundamentally rejects this paradigm through four mathematical guarantees:
- Non-Custodial 12-Word Seed Phrase: Your account is generated client-side on your phone from a 12-word cryptographic seed phrase. We never receive, store, or transmit your recovery words. Your phone derives separate keys for authentication, AES-256 vault encryption, and end-to-end messaging. If you lose your recovery phrase, no one—including LAYX—can restore your account or decrypt your private vault.
- Device-Side Sealed Vault (AES-256-GCM): Serial numbers, purchase invoices, acquisition prices, and private notes are encrypted directly on your smartphone using your private device key before any byte reaches our network. Our servers hold only unreadable ciphertext.
- Client-Side Photo & Metadata Sanitization: Before any image leaves your device, the LAYX native engine recompresses and strips all EXIF metadata, IPTC headers, camera serial identifiers, and GPS location coordinates.
- 24-Hour Ephemeral E2EE Messaging: Direct inquiries regarding tagged items are end-to-end encrypted (E2EE) and programmatically wiped from our databases after 24 hours.
3. Complete Data Inventory & Retention Schedule
We collect and process only the minimal technical and user-provided information strictly necessary to operate the application.
| Category & Data Elements | Specific Purpose | Legal Basis (GDPR / Global) | Retention Period |
|---|---|---|---|
| Pseudonymous Callsign & Bio (e.g. @GRAINLINE, optional short text) |
Public identification within the community; displaying your public drops. | Contractual necessity (Art. 6(1)(b) GDPR) | Retained until you delete your account or change it. |
| Cryptographic Keys & Technical ID (Random UUID, hashed token, public E2EE key) |
Cryptographic authentication, session management, and routing encrypted pings. | Contractual necessity (Art. 6(1)(b) GDPR) | Retained until account deletion. Private keys never leave your device. |
| Public Vault Items (Make, model, category, specs, photos) |
Displaying your gear catalog and allowing item tags in your Daily Drops. | Contractual necessity / User consent | Retained until item or account deletion. |
| Sealed Vault Data & Receipt Blobs (Serial numbers, purchase price, notes, and AES-256-GCM encrypted receipt photos) |
Secure private storage for insurance/records. Receipt photos are byte-level encrypted before upload and stored in a private bucket. Ciphertext only. Zero-knowledge to LAYX. | Contractual necessity (Art. 6(1)(b) GDPR) | Stored as encrypted blobs until item or account deletion. Purged immediately upon account deletion. |
| Daily Drops (Sanitized photo, caption, tagged items, timestamp) |
Publishing your morning carry to the chronological feed and carry history calendar. | Contractual necessity / User consent | Retained until you delete the drop or delete your account. |
| Item Inquiries (Messages) (End-to-end encrypted message payloads) |
Facilitating 1:1 private communication regarding specific gear. | Contractual necessity (Art. 6(1)(b) GDPR) | Hard deleted automatically after 24 hours. |
| Community Interactions (Nods, bookmarks, blocklist, safety reports) |
Social appreciation, personal bookmarks, content moderation, and user safety. | Contractual necessity / Legitimate interest | Retained until account deletion. |
| Device Tokens & Attestation (Push token, Apple App Attest / Play Integrity ID) |
Delivering morning Drop & Callout alerts; preventing bot abuse and fraudulent registration. | Legitimate interest (Art. 6(1)(f) GDPR) / Security | Retained until sign-out, device removal, or account deletion. |
| Database Backups & PITR (Point-in-time recovery automated snapshots) |
Disaster recovery and system resilience. Encrypted at rest using AES-256. | Legitimate interest (Art. 6(1)(f) GDPR) / Security | Retained for a rolling maximum of 7 days, then automatically purged on backup rotation. |
| Website Waitlist Email (Collected exclusively on landing page) |
Sending your closed beta (TestFlight / Google Play) invitation link. | Consent (Art. 6(1)(a) GDPR) | Permanently purged 7 days after your invite is dispatched. Never linked to your in-app account. |
| Server Access Logs & IP (Transient network connection logs) |
Defending against DDoS attacks, brute force attempts, and server errors. | Legitimate interest (Art. 6(1)(f) GDPR) / Security | Retained for a rolling maximum of 7 days, then permanently destroyed. |
4. What We Never Do (Global Negative Pledge)
- No Commercial Data Sales or Brokering: We have never sold, rented, leased, or monetized personal information, and we never will.
- No Behavioral Tracking & Cross-Context Ads: We do not track you across third-party websites or services, nor do we partner with ad networks or data brokers.
- No Address Book or Contact Harvesting: LAYX never requests permission to read or upload your contacts. Peer connections occur strictly via manual Callsign or offline QR code.
- No Geolocation Tracking: We never record, log, or track your physical GPS coordinates.
- No Marketplace Transactions: We do not process credit cards or financial transactions. LAYX is not an e-commerce platform.
5. International Data Transfers & EU Data Residency Roadmap
Our primary database and encrypted cloud storage infrastructure are currently operated via Supabase running on Amazon Web Services (AWS) in the United States (Region: us-east-1) during our initial Genesis beta.
For cross-border data transfers originating from the European Economic Area (EEA), United Kingdom, or Switzerland:
- Transfers strictly comply with Chapter V of the GDPR, relying upon the Standard Contractual Clauses (SCCs) approved by the European Commission (Implementing Decision (EU) 2021/914) and the UK International Data Transfer Addendum.
- Our core hosting sub-processors participate in and maintain active certifications under the EU–U.S. Data Privacy Framework (DPF), the UK Extension to the EU–U.S. DPF, and the Swiss–U.S. DPF.
- Cryptographic Safeguard: All sensitive vault records, personal invoices, and messages are client-side encrypted before transit. Because the encryption keys reside strictly on your device and are never transmitted to our servers, neither LAYX, nor AWS, nor foreign law enforcement can decrypt or inspect your confidential records.
- EU-Central-1 Migration Roadmap: To achieve absolute data sovereignty for our European user base, Three Guys s.r.o. has established an infrastructure roadmap to migrate all primary production databases and storage buckets directly to Supabase's European Region (
eu-central-1, Frankfurt, Germany). This migration is scheduled upon reaching 1,000 active users or general European commercial launch.
6. United States Privacy Rights (California CCPA/CPRA, Virginia, Colorado, Connecticut, Utah, Texas, etc.)
Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and comprehensive privacy statutes in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states, residents have specific statutory rights regarding their personal information.
- Categories of Personal Information Collected: Identifiers (pseudonymous callsign, random UUID, IP address), Internet activity (app interactions, push tokens), User-generated photos (stripped of metadata), and Commercial inventory records (public gear descriptions; private purchase data stored strictly in encrypted ciphertext).
- NO Sale or Sharing of Personal Information: We do not “sell” your personal information, nor do we “share” your personal information for cross-context behavioral advertising (as defined under California Civil Code § 1798.140).
- Sensitive Personal Information: We do not collect or process Sensitive Personal Information to infer consumer characteristics or for purposes outside those authorized by law.
- Right to Know & Access: You have the right to request disclosure of the specific pieces and categories of personal information we have collected about you over the preceding 12 months.
- Right to Delete: You have the right to request deletion of your personal information, executable instantly via Profile → Delete Account.
- Right to Correct: You have the right to rectify inaccurate personal information directly within the application.
- Non-Discrimination: We will never deny services, charge different prices, or provide a lower quality of service because you exercised any of your privacy rights.
- California “Shine the Light” (Cal. Civ. Code § 1798.83): We do not disclose personal information to third parties for their direct marketing purposes.
- Do Not Track & Global Privacy Control (GPC): We do not track users over time across third-party websites, and we recognize and honor browser-based GPC signals where applicable.
7. European Union & United Kingdom Rights (GDPR / UK GDPR)
If you are an individual located in the European Union, European Economic Area, or United Kingdom, you have comprehensive rights under Articles 15–22 of Regulation (EU) 2016/679 (GDPR) and the UK Data Protection Act 2018:
- Right of Access (Art. 15): Request confirmation and an export of your processed personal data.
- Right to Rectification (Art. 16): Correct inaccurate or incomplete data in your profile or vault.
- Right to Erasure / Right to be Forgotten (Art. 17): Delete all personal data via in-app deletion or by emailing privacy@layx.app.
- Right to Restriction of Processing (Art. 18): Restrict the processing of your data in specific statutory cases.
- Right to Data Portability (Art. 20): Receive your public gear data in a structured, machine-readable format.
- Right to Object (Art. 21): Object to data processing based on legitimate interests.
- Right to Lodge a Complaint: You have the right to file a complaint with our lead supervisory authority, the Úrad na ochranu osobných údajov Slovenskej republiky (Hraničná 12, 820 07 Bratislava 27, Slovak Republic; dataprotection.gov.sk), or with your local national data protection authority in your country of residence (e.g. the UK Information Commissioner's Office - ICO, CNIL, BfDI, Garante, AEPD, NAIH).
8. Canada (PIPEDA & Quebec Law 25)
For Canadian residents, our practices comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial legislation in Quebec, Alberta, and British Columbia. We collect personal information solely on the basis of meaningful consent and contractual necessity, maintain industry-standard security safeguards, and respect your rights to access and challenge compliance through privacy@layx.app or the Office of the Privacy Commissioner of Canada (OPC).
9. Australia (Privacy Act 1988 & APPs)
For Australian users, we adhere to the 13 Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth). We do not collect sensitive health or biometric information, we implement cryptographic safeguards for overseas disclosures, and you may lodge inquiries or complaints directly with us or the Office of the Australian Information Commissioner (OAIC).
10. Switzerland (revFADP)
Swiss users enjoy rights equivalent to the revised Federal Act on Data Protection (revFADP), with recourse to the Federal Data Protection and Information Commissioner (FDPIC).
11. In-App Account & Complete Data Deletion (Apple Guideline 5.1.1(v) & Google Play)
In compliance with Apple App Store Review Guideline 5.1.1(v) and Google Play Developer Policies:
- You can permanently delete your account and all associated data at any time directly inside the native app via Profile → Delete account (at the bottom of the Profile tab), or follow the step-by-step guide at /delete-account/.
- Upon confirmation, our systems execute an irreversible cryptographic cascade: your public drops, public vault listings, device tokens, and public keys are permanently expunged from the database and cache. Ciphertext vault blobs are destroyed.
- Because your seed phrase was held solely on your device, deleting the app and account leaves zero recoverable trace on our servers.
12. Safety, Abuse Reporting & Human Moderation
To protect the community while maintaining E2EE integrity:
- If a user reports an objectionable message or abusive profile, the reporting client temporarily decrypts the relevant message thread and transmits that specific excerpt to our human moderation queue.
- Our safety team reviews all reports within 24 hours. Accounts found violating community terms are banned, and abusive content is purged.
- You may block any user immediately with a single tap, which completely hides all their drops, comments, and interactions from your view.
13. Children’s Privacy (Strict 18+ Rule)
LAYX is strictly intended for individuals who are at least 18 years of age (or the legal age of majority in their jurisdiction). We do not knowingly solicit, collect, or process information from children under 13 (complying with the US COPPA), minors under 16 (complying with GDPR and CCPA), or underage individuals under the UK Age Appropriate Design Code. If we discover that an account belongs to a minor, we will immediately terminate the account and purge all associated data.
14. Changes to This Policy
If we make material changes to this Privacy Policy, we will notify you through an in-app notice and update the “Effective Date” at the top of this document. Continued use of LAYX following the effective date of an updated policy constitutes acceptance of the changes.
15. Contact & Data Protection Requests
For all privacy inquiries, data subject access requests, or regulatory communications:
Email: privacy@layx.app
Entity: Three Guys s.r.o. (Attn: Legal & Privacy Team)
Jurisdiction: Slovak Republic, European Union