Cookies Policy

1.1 Controller; Applicability. This Cookies Policy ("Policy") is issued by Friends Technologies LLC ("FRIENDS," "we," "us," "our"), acting as controller for cookie- and SDK-related data we place or read on devices in connection with the FRIENDS mobile application(s), website(s), subdomains, embedded widgets, and related digital properties (collectively, the "Platform"). Where a third party places or reads identifiers for its own purposes, such party may act as an independent controller under its own policy.

1.2 Purpose of this Policy. This Policy explains what cookies and similar technologies we use, why we use them, how we obtain and record consent where required, and how you can control them. It also clarifies allocation of responsibility between FRIENDS and third parties and limits our liability to the fullest extent permitted by law.

1.3 Relationship to Privacy Policy & Terms. This Policy forms part of, and is incorporated by reference into, our Privacy Policy and Terms of Service. If there is a conflict, ePrivacy/PECR/GDPR-mandated rules control for device storage/access, the Privacy Policy governs personal data processing generally, and the Terms govern dispute resolution, governing law, and limitations of liability.

1.4 Global Scope; Local Overrides. This Policy applies worldwide, including the U.S., EU/EEA, UK, Brazil, Canada, Australia, New Zealand, Singapore, South Africa, and other jurisdictions. Stricter local requirements (e.g., EU/UK prior opt-in for non-essential cookies) prevail solely to the extent required by law.

1.5 Legal Bases & Consent Architecture.

• We rely on consent for non-essential cookies/SDKs (e.g., analytics, advertising) where required by law.
• We rely on legitimate interests, contractual necessity, or legal obligation for strictly necessary technologies essential to provide requested services (e.g., authentication, security, load balancing).
• We maintain consent logs (timestamp, tool version, categories, jurisdictional settings) to evidence compliance. Re-prompt intervals are configured to meet local standards and may vary by region, device, and material changes.

1.6 No Guarantee of Third-Party Compliance. We do not control and are not responsible for third-party cookies/SDKs used independently by third parties (e.g., on their domains/apps or for their own purposes). You should review those parties' policies. Our inclusion of third-party tools does not imply endorsement of their independent practices.

1.7 User Responsibilities. You are responsible for:

• managing your preferences via the consent banner and in-app settings;
• configuring browser/device controls (e.g., blocking, clearing, resetting advertising IDs); and
• ensuring you have authority to enable any integrations that process others' data (e.g., contact syncing).

1.8 Technology & Policy Changes. We may add, remove, or reclassify technologies and vendors. We will update this Policy and, where required, re-prompt for consent before materially changing non-essential categories. Continued use after effective date constitutes acceptance where consent is not legally required.

1.9 No Waiver of Rights; Reservation. We reserve all rights not expressly granted. To the maximum extent permitted by law, we disclaim liability for:

• user/device/browser settings that prevent preference storage;
• ad-blockers, ITP/ETP, or similar features that interfere with consent tools; and
• third-party acts beyond our reasonable control.

2.1 Cookie. A small text file stored on a browser or device to store/retrieve information (e.g., identifiers, preferences). Includes HTTP cookies and functionally similar storage.

2.2 First-Party Cookie. Set by FRIENDS on domains we control or by our app code/SDKs for our purposes.

2.3 Third-Party Cookie. Set by a third party (e.g., analytics, ad network) that may read/write identifiers across sites/apps.

2.4 Session Cookie. Expires upon closing the browser/app or after a short inactivity period.

2.5 Persistent Cookie. Persists beyond a session for a defined time-to-live (TTL) or until deleted.

2.6 SDK (Software Development Kit). Third-party or proprietary code embedded in our app to enable functionality (e.g., analytics, crash reporting, messaging, payments).

2.7 Tracking Pixel / Web Beacon. Code or tiny image that loads from a server to record events (e.g., opens, conversions).

2.8 Local Storage / Session Storage / IndexedDB. Browser storage mechanisms used to persist data locally on a device.

2.9 Device Fingerprinting. Collection of device/browser attributes (e.g., fonts, screen size) to derive a probabilistic identifier, used solely for security/fraud unless otherwise consented where required.

2.10 Unique Identifier. A persistent or resettable value (e.g., cookie ID, IDFA/GAID/AAID, app instance ID) used to recognize a browser/app/device.

2.11 Tag Manager / Server-Side Tagging. Systems used to deploy, sequence, and route tags/requests client- or server-side; server-side tagging does not change the need for consent where required.

2.12 Strictly Necessary Technologies. Storage/access strictly necessary to provide a service explicitly requested by the user (e.g., login session, security, load balancing, consent storage). Not subject to opt-in requirement in most jurisdictions.

2.13 Non-Essential Technologies. Storage/access used for analytics, performance, personalization, advertising, or social media that require opt-in in EU/UK and certain regions.

2.14 Profiling. Any form of automated processing of personal data evaluating personal aspects (e.g., behavior, preferences) to tailor content/ads; may require consent or provide opt-out rights by jurisdiction.

2.15 Cross-Context Behavioral Advertising / "Sharing". As defined by U.S. state law (e.g., CPRA), using data across services for targeted ads; users may have opt-out rights and GPC (Global Privacy Control) must be honored where required.

2.16 Global Privacy Control (GPC). A recognized browser/device signal indicating a user's opt-out of sale/sharing/targeted ads; honored where required.

2.17 Consent Management Platform (CMP). The tool that presents banners, captures preferences, stores logs, and signals consent status to tags/SDKs.

2.18 Controller / Processor. As defined by Applicable Law. FRIENDS typically acts as controller for our own purposes; certain vendors act as processors under contract; some third parties act as independent controllers for their purposes.

2.19 SameSite / Secure / HttpOnly. Cookie attributes to mitigate CSRF, limit transmission to HTTPS, and restrict script access. Not all attributes are applicable in app environments.

2.20 Email Tracking. Pixels or links embedded in emails to measure opens/clicks; functionality may be limited by client settings. Unsubscribing from marketing emails will cease marketing-related email tracking.

2.21 Do Not Track (DNT). A legacy browser setting. We do not respond to DNT but do honor GPC where required.

2.22 Aggregated / De-identified Data. Data that cannot reasonably be used to identify an individual, subject to safeguards against re-identification.

2.23 Jurisdictional Terms. References to GDPR, ePrivacy Directive/PECR, CPRA, LGPD, etc., include successors and implementing regulations.

3.1 Properties Covered. This Policy applies to technologies we deploy on or through:

• Mobile Applications (iOS/Android), including in-app webviews and push notification interactions;
• Websites and Subdomains operated by FRIENDS;
• Embedded Widgets/Plugins placed on partner sites where our code executes;
• Emails and In-App Messages sent by FRIENDS that contain pixels or tracked links;
• Beta/Preview Builds and experimental features accessible to testers;
• CDN-served assets where cookies or headers may be set/read as part of delivery or security.

3.2 Methods of Access. This Policy applies regardless of access method (browser, native app, tablet, mobile, IoT, smart displays) and regardless of login state (authenticated or guest).

3.3 Jurisdictional Coverage. We configure consent and category availability by region to comply with local device access rules (e.g., EU/UK prior opt-in for non-essential categories, opt-out regimes in certain U.S. states, LGPD consent for certain tracking). Where location cannot be reliably inferred (e.g., VPNs), we apply a conservative configuration at our discretion.

3.4 Scope Limitations.

• Third-Party Domains/Apps. This Policy does not govern cookies/SDKs placed on domains or in apps we do not control, even if linked from our Platform.
• Independent Controllers. Where a third party acts independently (e.g., social login provider, external ad platform), their terms/privacy policy apply.
• Partner Sites with Our Widgets. This Policy governs only technologies we deploy via our widget; the partner's own cookies/SDKs are outside our control.
• App Stores/OS Services. Distribution platforms (e.g., Apple App Store, Google Play) and OS services may perform their own tracking under their policies.

3.5 User Categories. This Policy applies to visitors, registered users, beta testers, recipients of communications, and widget interactors to the extent our technologies are active.

3.6 Consent Scope & Persistence.

• Per-Browser/Per-App. Consent is stored per browser/device/app. You must set preferences on each environment separately.
• Duration. Consent preferences persist for the configured retention period unless cleared or changed; we may re-prompt periodically or upon material changes.
• Interference. Browser features (e.g., Safari ITP, Firefox ETP), privacy extensions, or device settings may block consent storage; in such cases, we may be unable to honor or recall your preferences across sessions.

3.7 Strictly Necessary vs. Non-Essential.

• Strictly Necessary technologies are deployed without opt-in (e.g., session auth, fraud/security, load balancing, cookie-consent storage).
• Non-Essential technologies (e.g., analytics, advertising, social, personalization) are deployed only after valid consent where required. In opt-out jurisdictions, we provide mechanisms to disable targeted advertising and honor GPC signals where mandated.

3.8 Cross-Device & Cross-Platform Association. Where permitted by law and consented where required, we may associate identifiers across devices/apps/browsers to provide a cohesive experience and for fraud prevention. Users may opt out via Platform settings or applicable legal mechanisms (e.g., CPRA "Do Not Sell or Share").

3.9 International Transfers. Data derived from cookies/SDKs may be transferred internationally for hosting, analytics, security, or support, subject to safeguards (e.g., SCCs/IDTA) described in our Privacy Policy. We do not control independent controllers' cross-border transfer mechanisms.

3.10 Retention; Deletion. Storage durations for identifiers vary by category, purpose, and jurisdiction. You may delete cookies via browser settings, reset mobile advertising IDs, or change in-app preferences. Server-side logs referencing cookie IDs may be retained for security, fraud, or compliance for periods disclosed in our Privacy Policy, even after local deletion.

3.11 Liability Allocation. To the fullest extent permitted by law, FRIENDS is not liable for:

• third-party cookies/SDKs used for their own purposes;
• user/device/browser configurations that prevent preference storage or cause drift;
• ad-blockers or privacy tools that interfere with consent signaling;
• cache/CDN behaviors beyond our control; or
• partner implementations that modify or misconfigure our widgets/tags.

3.12 Contact & Redress. Questions about this Policy or our cookie practices should be directed to privacy@myfriendsapp.com. You may also exercise rights set out in our Privacy Policy (e.g., access, deletion, objection/opt-out). Complaints may be lodged with competent supervisory authorities where applicable.

4.1 Strictly Necessary Technologies. Used solely to deliver services you expressly request and to ensure security and stability. Not subject to opt-in under most regimes (EU/UK prior consent not required for "strictly necessary").

• Purposes (illustrative): Authentication/session management; load balancing/CDN routing; fraud/abuse prevention; consent storage; security headers/CSRF protection; service continuity (e.g., payment flow state).
• Examples: session IDs, auth tokens, consent state cookies, server affinity, rate-limit flags.
• Notes: May set attributes such as Secure, HttpOnly, SameSite. Disabling via browser/device settings may render the Platform unusable.

4.2 Performance & Operational Analytics. Measure uptime, latency, crashes, and core operations; typically aggregated or pseudonymized.

• Purposes: reliability monitoring, error diagnostics, device compatibility analysis, capacity planning.
• Examples: crash logs, performance timers, error counters, edge trace IDs.
• Consent: In EU/UK, opt-in may be required if not strictly necessary.

4.3 Functionality & Preference Storage. Improve usability but are not essential.

• Purposes: remember language, theme, accessibility, saved logins ("remember me"), tutorial dismissal state.
• Examples: locale, UI density, tutorial_seen, A11y preferences.
• Consent: Opt-in in EU/UK where not strictly necessary.

4.4 Product Analytics & Measurement. Analyze feature usage and cohorts to improve the Platform.

• Purposes: feature adoption, funnel progression, cohort retention, A/B test allocation, propensity modeling (non-marketing).
• Examples: app instance IDs, experiment variant IDs, event beacons.
• Consent: Opt-in in EU/UK; provide opt-out in certain U.S. states if used for targeted ads; otherwise legitimate interest balancing with safeguards.

4.5 Targeting/Advertising & Attribution. Support ad delivery/measurement and cross-context behavioral advertising where applicable.

• Purposes: frequency capping, conversion measurement, audience segmentation, attribution across channels, retargeting.
• Examples: ad click IDs, conversion pixels, third-party ad tags/SDKs.
• Consent/Opt-out:
  • EU/UK: Prior opt-in required.
  • U.S. (CPRA et al.): Provide "Do Not Sell or Share" and targeted advertising opt-outs; honor Global Privacy Control (GPC) signals.
  • Children: No behavioral ads for users we know are under the applicable digital consent age.

4.6 Social Media & Sharing. Enable social logins/shares and measure social engagement.

• Purposes: single sign-on, share buttons, embedded content.
• Examples: social platform pixels/SDKs.
• Controller Role: Often independent controllers; their policies apply.
• Consent: Opt-in in EU/UK.

4.7 Security, Fraud & Abuse Detection. Used solely to prevent account takeovers, spam, and platform abuse (including device fingerprinting for security).

• Purposes: unusual pattern detection, bot mitigation, credential stuffing defense, token binding.
• Examples: device fingerprint attributes (for security only), risk scores, fail counters.
• Consent: Generally permitted on legitimate interests or legal obligation; not used for advertising without explicit consent where required.

4.8 Email Tracking & Link Beacons. Pixels or link redirects in FRIENDS emails.

• Purposes: delivery diagnostics, open/click measurement, campaign performance.
• Opt-out: Unsubscribing from marketing emails stops marketing-related tracking; transactional email tracking may persist (deliverability/abuse prevention).

4.9 Mobile/SDK Identifiers. SDKs embedded in the app (analytics, crash reporting, messaging, payments).

• Identifiers: IDFA/GAID/AAID, app instance IDs, push tokens.
• Platform Rules: Comply with Apple ATT and platform-specific consent/opt-out settings. Users may reset advertising IDs at OS level.

4.10 Server-Side Tagging & Proxying. We may route tags server-side to reduce client load and protect data. This does not circumvent consent; non-essential tags respect CMP signals.

4.11 Experimentation & Feature Flags. Assign users to test groups for product improvement.

• Purposes: A/B tests, rollout safety, compatibility checks.
• Consent: Opt-in in EU/UK if not strictly necessary.

4.12 Proximity/Location Beacons (App). When enabled, Bluetooth/Wi-Fi/GPS signals may support proximity features and fraud prevention.

• Consent: Explicit device permission; disable via device settings (functionality may degrade).

4.13 Emerging Technologies Clause. We may pilot new privacy-preserving measurement (e.g., on-device aggregation, SKAdNetwork, Privacy Sandbox). Non-essential uses will be opt-in where required.

5.1 Lawful Basis by Category (EU/UK).

• Strictly Necessary: Contract (deliver requested service) and/or Legitimate Interests (security/availability).
• Performance/Operational Analytics: Legitimate Interests or Consent where required.
• Functionality/Preference: Consent (unless strictly necessary).
• Product Analytics/Measurement: Consent in EU/UK; possible Legitimate Interests with strong safeguards if compliant locally.
• Targeting/Advertising: Consent required.
• Social Media: Consent required.
• Security/Fraud: Legitimate Interests and/or Legal Obligation.

5.2 U.S. State Law Alignment. We provide required opt-outs for "sale"/"sharing" and targeted advertising (e.g., CPRA, CPA, VCDPA, CTDPA, TDPSA), and honor GPC signals where applicable. Cookies used only for security are not subject to these opt-outs.

5.3 Brazil (LGPD). Consent required for non-essential tracking; legitimate interest may apply for security and strictly necessary uses, with safeguards and transparency.

5.4 Children/Teens. We do not knowingly engage in cross-context behavioral advertising to users we know are under the applicable digital consent age. Parental/guardian consent is obtained where required.

5.5 Consent Mechanics. We deploy a Consent Management Platform (CMP) to present granular choices, record time-stamped logs, and propagate consent signals to tags/SDKs. We periodically re-prompt and re-collect consent upon material changes or where required by local law.

5.6 Legitimate Interests Balancing. Where relied upon, we document balancing tests, minimize data, apply pseudonymization, provide easy opt-outs, and restrict use to strictly defined purposes.

5.7 No Consent, No Non-Essentials. If consent is not granted or is withdrawn, non-essential cookies/SDKs will not load (or will be disabled) prospectively. Functionality may be degraded; FRIENDS is not liable for reduced performance resulting from your choices.

5.8 Proof & Audit. We maintain consent records (jurisdiction logic, CMP version, category selections) for legal defense and regulator audits.

6.1 Role Classification. Third parties engaged through the Platform operate as:

• Processors (service providers acting on our instructions under DPAs), or
• Independent Controllers (determine their own purposes/means; their policies apply). We are not responsible for independent controller practices.

6.2 Categories of Third Parties (Non-Exhaustive).

• Analytics/Crash: usage metrics, diagnostics (e.g., analytics SDKs).
• Advertising/Attribution: ad delivery, measurement, retargeting (e.g., ad networks, attribution SDKs).
• Payments/Fraud: PCI processors, chargeback/fraud screening.
• Maps/Location: map tiles, geocoding, routing APIs.
• Messaging/Push: email, SMS, and push notification providers.
• CDN/Security: content delivery, DDoS/WAF, bot mitigation.
• Social/SSO: social login and sharing.
• Experimentation: A/B testing, feature flags, rollout services.

6.3 Illustrative Providers. Providers may include, without limitation, analytics suites, mobile crash tools, payment processors, major ad networks, and mapping APIs. The roster changes over time; a current list of processor categories is available on request, subject to confidentiality. Naming independent controllers may be limited for contractual or security reasons.

6.4 Contractual Controls (Processors). DPAs require: processing only on our documented instructions; confidentiality; technical/organizational measures; breach notice; sub-processor controls; deletion/return of data at end of service; and no secondary use (including a ban on re-identification or sale).

6.5 Independent Controller Disclaimer. Where a third party acts independently (e.g., social login or external ad platform you interact with), their privacy policy and choices govern. FRIENDS disclaims liability for their actions/omissions outside our control.

6.6 International Transfers. Where third parties receive data internationally, we require appropriate safeguards (e.g., SCCs/UK IDTA, supplementary measures). Independent controllers are responsible for their own transfer mechanisms.

6.7 Opt-Outs & Controls.

• Use the CMP and in-app settings to disable non-essential categories.
• Exercise CPRA "Do Not Sell or Share" and targeted advertising opt-outs (we honor GPC).
• Use industry tools (e.g., DAA/NAI in U.S., Your Online Choices in EU).
• Reset or limit mobile ad IDs and review Apple ATT prompts as applicable.

6.8 Dynamic Tagging. We may use tag managers and server-side tagging. Vendor sets can change; we strive to keep CMP configurations current. We do not guarantee third-party availability or correctness and are not liable for misconfigurations beyond our reasonable control.

6.9 Prohibited Practices. We prohibit processors from re-identifying, selling, or using data beyond contracted purposes. Breaches may result in suspension or termination of the vendor relationship.

6.10 User Responsibility. Do not enable third-party integrations (e.g., contact syncing) unless you are authorized to share others' data. You are responsible for your configuration choices.

7.1 Principles. We apply data minimization and purpose limitation to set time-to-live (TTL) values. Persistent identifiers may refresh upon interaction to maintain service continuity or security. Local deletion by you does not erase server-side logs that reference cookie IDs (see Privacy Policy retention).

7.2 Category-Level TTLs (Indicative).

Disclaimer: Actual durations may differ by jurisdiction/vendor or be shortened if no longer necessary. Third-party TTLs are governed by the provider's policies.

7.3 Consent Preference Retention. We store your consent state locally (e.g., cookie/local storage) and server-side logs for evidentiary purposes. If your environment blocks storage or you clear data, we may re-prompt for consent; FRIENDS is not liable for repeat prompts caused by client-side restrictions.

7.4 Effect of Opt-Out/Withdrawal. Upon opt-out or withdrawal of consent, we will cease prospective setting/reading of non-essential technologies and will endeavor to disable or delete previously set identifiers where technically feasible. Some identifiers controlled by third parties must be cleared using their tools or your browser/OS settings.

7.5 Mobile Advertising IDs & Push Tokens. Resetting IDFA/GAID/AAID will disrupt targeted advertising. Push tokens persist until revoked at OS level or you disable notifications. These identifiers are not cookies but are treated analogously in this Policy.

7.6 Change Management. We may adjust TTLs for risk, legal, or operational reasons. Material changes to non-essential categories will trigger a CMP update and, where required, a new consent prompt.

7.7 Data Subject Requests (DSAR). When legally obligated, we will honor access/deletion/objection requests relating to data derived from cookies. Technical logs or security records may be retained as permitted by law (e.g., for fraud prevention or legal defense). We may de-link identifiers instead of full deletion where allowed.

7.8 Children's Data. We set only strictly necessary technologies for child users we know are under applicable digital consent age unless verified parental consent is obtained. Advertising identifiers are not used for behavioral ads for such users.

7.9 No Warranty on Third-Party Durations. We do not warrant or control third-party retention practices. Refer to the providers' policies for authoritative durations.

8.1 Consent Management Platform (CMP). We deploy a CMP to present a clear banner and granular controls upon first visit/use and when otherwise required. The CMP allows: Accept All, Reject All (except strictly necessary), and Customize by category/purpose and, where applicable, by vendor.

8.2 Granularity & Transparency. Non-essential categories (e.g., analytics, advertising, social) are disabled by default in jurisdictions requiring prior opt-in. The CMP identifies categories, purposes, examples of data collected, and whether third parties are involved.

8.3 Withdrawal & Changes. You may withdraw or modify consent at any time via the CMP, in-app settings, or relevant OS/browser controls. Withdrawal is prospective; it does not affect prior lawful processing. Some features may degrade or become unavailable. FRIENDS is not liable for reduced functionality resulting from your choices.

8.4 Per-Device/Per-Browser Scope. Choices are stored per app, browser, and device. You must set preferences separately on each environment and for each profile. Clearing cookies or resetting identifiers removes saved preferences and may trigger re-prompting.

8.5 Signals We Honor.

• Global Privacy Control (GPC): We honor valid GPC signals where required by law by treating them as an opt-out of "sale/share" and targeted advertising.
• Do Not Track (DNT): DNT is not standardized; we do not respond to DNT.
• Universal Opt-Out Mechanisms (UOOM): Where mandated (e.g., Colorado), we honor recognized UOOM signals for targeted advertising/sale/share opt-outs.

8.6 Platform-Specific Consent.

• iOS ATT: For activities requiring Apple's App Tracking Transparency (ATT), we present the ATT prompt and respect your selection.
• Android Advertising ID: We respect OS-level resets/limits on ad personalization.

8.7 Re-Prompting & Recordkeeping. We re-prompt when legally required (e.g., material changes in purposes/vendors, lapse of consent validity) and maintain time-stamped consent logs (e.g., categories selected, region logic, CMP version) for evidentiary/audit purposes.

8.8 Email Tracking Preferences. Marketing emails may include pixels and tracked links. You can unsubscribe from marketing at any time; transactional/service emails may continue (with minimal, deliverability-oriented tracking).

8.9 Children & Teens. We do not knowingly deploy non-essential tracking for children under the applicable digital consent age without verifiable parental consent. Behavioral advertising is disabled for such users.

8.10 Third-Party Choice Tools. Where applicable, you may also use industry tools (e.g., NAI/DAA in the U.S.; YourOnlineChoices.eu in the EU) to manage ad preferences. These tools are independent; we do not control their effectiveness.

8.11 Cookie Walls & Access. We comply with local rules regarding conditions for access. Certain features may reasonably require specific cookies; if you decline, access to those features may be limited.

8.12 User Responsibilities. You are responsible for managing preferences, keeping devices/browsers updated, and ensuring you have authority to enable integrations that may process others' data (e.g., contact syncing). We are not responsible for ad-blockers, privacy tools, or device settings that prevent storage of preferences or cause repeated prompts.

9.1 Purpose & Scope. Subject to Applicable Law and consent where required, we may associate identifiers across devices/browsers/apps to (a) maintain account continuity, (b) improve security/fraud prevention, and (c) enhance personalization and measurement.

9.2 Methods. Association may use:

• Deterministic signals (e.g., login, hashed email/phone);
• Resettable identifiers (e.g., app instance ID, advertising IDs);
• Security fingerprints used solely for abuse/fraud prevention;
• Server-side graphs linking your sessions across our properties.

9.3 Legal Basis. Contract (to provide requested features), Legitimate Interests (security and service improvement), and/or Consent (for non-essential profiling/ads in jurisdictions requiring consent).

9.4 User Controls. You may:

• Log out on devices you want to de-link;
• Reset mobile ad IDs and limit ad personalization in OS settings;
• Use the CMP to opt out of non-essential categories;
• Exercise "Do Not Sell or Share"/targeted advertising opt-outs (where applicable);
• Request account/device unlinking through support where feasible.

9.5 Children/Minors. Cross-device association for minors is limited to security and core functionality; behavioral advertising is disabled for users we know are under the applicable digital consent age.

9.6 Third-Party Graphs. Some third parties may build their own device graphs as independent controllers. Their practices are governed by their policies. We disclaim liability for independent controller actions outside our control.

9.7 Retention & De-Linking. Association keys and logs are retained only as long as necessary for the purposes described and then deleted or de-linked per our Privacy Policy. Server-side security/audit logs referencing identifiers may be retained as permitted by law.

9.8 Liability Allocation. We are not liable for (a) associations inferred by third parties beyond our control, (b) associations arising from your sharing of devices/accounts, or (c) degraded functionality resulting from your decision to opt out or reset identifiers.

10.1 EU/EEA (GDPR & ePrivacy Directive) / UK (UK GDPR & PECR).

• Prior Opt-In: Non-essential cookies/SDKs require prior consent.
• Granularity: Consent must be specific, informed, freely given, and granular by purpose/category.
• Easy Withdrawal: Must be as easy to withdraw as to give; provided via CMP/in-app.
• Proof: We maintain consent records; we may re-prompt periodically.
• Independent Authorities: National guidance (e.g., CNIL, ICO, BfDI/TTDSG) may impose local nuances; we implement reasonable configurations to reflect such guidance.
• Analytics: Certain low-impact, first-party analytics may be permitted without consent under narrow conditions in some Member States; we default to consent where uncertainty exists.

10.2 United States (Federal/State).

• CPRA (California): Provide "Do Not Sell or Share My Personal Information" and targeted advertising opt-outs; honor GPC signals; enhanced protections for minors (opt-in for users under 16).
• VCDPA/CPA/CTDPA/UCPA/TDPSA (and similar): Offer opt-outs for targeted advertising and sale; Colorado recognizes UOOM signals.
• COPPA: For children under 13, verifiable parental consent is required; behavioral ads disabled.
• Email (CAN-SPAM/CASL for Canada): Marketing emails must provide unsubscribe; tracking limited per law.
• DNT: Not honored due to lack of standardization.

10.3 Brazil (LGPD). Non-essential tracking generally requires consent; legitimate interest may apply for security and strictly necessary purposes with safeguards and transparency.

10.4 Canada (PIPEDA) & CASL. "Meaningful consent" standard for collection/use; transparency for cookies; CASL applies to commercial electronic messages and tracking in emails.

10.5 Australia (Privacy Act) & New Zealand (Privacy Act 2020). Consent expected for non-essential tracking; breach notifications in defined circumstances; local OAIC/OPC guidance applies.

10.6 Asia (Selected).

• Japan (APPI): Cross-context disclosures may require consent/opt-out; cross-border transfer notices required.
• South Korea (PIPA): Generally stricter consent requirements and security expectations.
• Singapore (PDPA): Consent required unless exception applies; breach notice for significant harm events.

10.7 Middle East & Africa (Selected).

• UAE PDPL / DIFC / ADGM: Consent-first regimes; cross-border restrictions; breach notifications.
• Saudi PDPL: Consent and localization obligations in some cases.
• South Africa (POPIA): Consent/justification required; user rights; breach notification to the Information Regulator.

10.8 Switzerland (FADP). Similar principles to GDPR; transfers require adequate safeguards.

10.9 Precedence. Where local mandatory law conflicts with this Policy, the stricter rule prevails solely to the extent required. Nothing herein expands obligations beyond Applicable Law.

11.1 Security Objectives. We implement appropriate technical and organizational measures to protect cookie/SDK data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, proportionate to risk and in line with industry practice.

11.2 Technical Controls.

• Cookie Attributes: Use Secure, HttpOnly, and SameSite (Lax/Strict) where appropriate; scope by domain/path; minimize TTLs; rotate identifiers.
• Transport/Storage: TLS 1.2+ in transit; HSTS on web properties; HMAC signing or encryption of critical tokens to detect tampering.
• Tag Governance: Allowlist vendors; sandbox third-party tags (e.g., iframes), apply CSP, SRI, Referrer-Policy, and rate-limiting; block unauthorized network calls via tag manager rules.
• Server-Side Tagging/Proxying: Where used, restrict data fields, apply pseudonymization, and enforce CMP signals server-side; do not circumvent consent requirements.
• Segregation & Access Control: Role-based access (RBAC), least privilege, audit logging for tag changes; change management for CMP configs.
• Monitoring: Centralized logs, anomaly detection for unusual tag behavior, and alerting on violations (e.g., unauthorized data egress).

11.3 Organizational Controls. Vendor risk assessments and DPAs for processors; periodic policy reviews; secure SDLC with code reviews for tag/CMP changes; staff training on privacy and tag hygiene; incident response runbooks (including cookie/SDK incident scenarios).

11.4 CMP Integrity. Store consent states securely; reconcile CMP signals with tag firing rules; detect consent-bypass attempts; re-prompt on material changes; maintain verifiable audit logs (timestamps, config versions, geo-logic).

11.5 Incident Response. In the event of a suspected or confirmed security incident involving cookie/SDK data, we will follow the breach procedures in our Privacy Policy, including containment, forensics, and notifications as required by law. Notices do not constitute an admission of fault.

11.6 User Responsibilities. You are responsible for (a) maintaining updated browsers/OS, (b) not sharing accounts/devices, (c) enabling available security features (e.g., MFA), and (d) promptly notifying us of suspected compromise. We are not liable for harms caused by malware, device compromise, or user negligence.

11.7 Limitations & Disclaimers. While we use reasonable safeguards, no system is 100% secure. To the maximum extent permitted by law, we disclaim liability for (a) sophisticated attacks, (b) third-party failures beyond our control, (c) forced disclosures to authorities under lawful process, (d) ad-blockers/privacy tools that interfere with CMP operation, and (e) caching/CDN behaviors outside our control. Any liability is also limited by the Terms of Service.

11.8 Retention & Deletion. We retain cookie/SDK identifiers only as long as necessary for the stated purposes and then delete or de-identify them in accordance with our Privacy Policy and Section 7 of this Policy. Server-side security and audit logs may persist per legal and operational requirements.

12.1 Right to Amend. We may update or amend this Policy at any time to reflect changes in law, guidance, technology, vendors, purposes, Platform functionality, or our internal governance. The Effective Date at the top indicates when the current version took effect.

12.2 Material Changes. Without limitation, the following are presumed material and may trigger user notice and/or renewed consent where required by Applicable Law:

• Addition of new non-essential categories (e.g., targeting/advertising where none existed);
• Introduction of new third-party vendors that act as independent controllers or materially change Processing purposes;
• Expansion of purposes for which data is collected/used, especially for profiling/ads;
• Material changes to retention periods, international transfers, or user choice mechanisms.

12.3 Notice; Re-Consent.

• EU/UK: Where required, we will re-prompt for consent via the CMP before enabling newly introduced non-essential technologies.
• U.S. & Other Jurisdictions: We will provide conspicuous notice within the Platform and preserve opt-out rights (e.g., CPRA "Do Not Sell or Share").
• Email Notices: We may send email/push notices for significant changes where appropriate and where we hold valid contact details.

12.4 Versioning & Archives. We maintain archived copies of prior versions for a minimum of five (5) years, or longer where required by law, together with consent logs (e.g., CMP version, selections, timestamps) to evidence compliance.

12.5 Continued Use. Except where consent is legally required, your continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

12.6 Severability of Amendments. If a specific amendment is found invalid, the remainder of the Policy (and other amendments) remain in full force and effect.

12.7 No Retroactive Reduction of Statutory Rights. We will not reduce rights granted to you under Applicable Law without completing any legally required processes (e.g., renewed consent).

12.8 Disclaimer. Notices and updates provided under this Section are for compliance and transparency and do not constitute an admission of legal obligation beyond Applicable Law or a waiver of any legal defenses.

13.1 Primary Contact (Global).

13.2 Security Reports. Report suspected vulnerabilities or incidents involving cookies/SDKs to security@myfriendsapp.com. Do not publicly disclose before we confirm and remediate.

13.3 EU/UK Representative; DPO (if appointed). Contact details for our EU/UK Article 27 representatives and/or DPO (if applicable) may be published on our website or provided upon request: dpo@myfriendsapp.com.

13.4 Supervisory Authorities. You may lodge a complaint with a competent supervisory authority; we encourage contacting us first so we can attempt to resolve concerns.

13.5 Verification & Sensitive Info. We may require identity verification before discussing cookie-related data. Do not include sensitive information in unencrypted email.

13.6 Non-Support Channel. These contacts are for privacy/security. General support: support@myfriendsapp.com or in-app help.

13.7 Notices & Delivery. We may provide notices regarding this Policy via in-app banners, CMP prompts, website postings, email, or push notifications, consistent with law and your communication preferences.

14.1 Strictly Necessary

14.2 Performance & Operational Analytics

14.3 Functionality & Preferences

14.4 Product Analytics & Measurement (Non-Ads)

14.5 Targeting/Advertising & Attribution

14.6 Social Media & SSO

14.7 Security, Fraud & Abuse Detection

14.8 Email Pixels & Link Beacons

14.9 Mobile/SDK Identifiers

14.10 Company-Protective Notes.

• Vendor rosters and data flows are dynamic; we may add/remove vendors at any time (see Section 12).
• Some vendors act as processors; others as independent controllers (their policies apply).
• We disclaim liability for independent controller practices outside our control.

15.1 Touchpoints. We collect or receive cookie/SDK data through:

• Web: Our sites/subdomains, webviews, embedded widgets, and CDN-served assets;
• Apps: Native iOS/Android apps and associated SDKs;
• Communications: Emails with pixels/tracked links; push notifications delivery/interaction;
• Partner Integrations: Widgets placed on partner sites (only our code within the widget is covered by this Policy);
• APIs/Server-Side Tagging: Server-side proxying/forwarding of tag requests to reduce client load and protect data (respecting CMP signals).

15.2 Mechanisms.

• Client-Side Storage: HTTP cookies, local/session storage, IndexedDB;
• SDKs: Embedded libraries for analytics, crash reporting, messaging, attribution, payments;
• Pixels/Beacons: 1×1 images or scripts to record events (views, conversions, opens);
• Redirects/UTM: Link redirection and UTM parameters for attribution;
• Server Logs: IPs, headers, timestamps associated with cookie IDs or app instance IDs for security/diagnostics.

15.3 Consent Gating & Firing Rules.

• Prior Consent (EU/UK): Non-essential tags/SDKs do not load until consent is captured via CMP; strictly necessary technologies may load by default.
• Propagation: CMP preferences are propagated to tag managers, SDK initializers, and server-side proxies; tags are allow-listed per category.
• Re-Prompting: We re-prompt upon material changes or when consent validity lapses.

15.4 Minimal Pre-Consent Activity. Before consent (EU/UK), we limit activities to strictly necessary operations (e.g., serving pages, storing consent state). Any pre-consent measurements adhere to local guidance and are configured conservatively.

15.5 Data Flows & International Transfers. Cookie/SDK data may be processed in data centers outside your jurisdiction (see Privacy Policy). We implement appropriate transfer mechanisms (e.g., SCCs/IDTA) and supplementary measures as needed. Independent controllers are responsible for their own mechanisms.

15.6 Pseudonymization & Minimization. Where appropriate, we use pseudonymous identifiers, minimize data fields, and apply TTL limits. Security identifiers used for fraud/abuse are segregated from marketing systems.

15.7 Interference by Client Tools. Ad-blockers, ITP/ETP, VPNs, private browsing, or restrictive device settings may block storage and/or CMP operation. This can erase preferences, hinder consent propagation, or degrade features. FRIENDS is not liable for issues caused by such tools or settings.

15.8 No Implied Consent Where Not Permitted. We do not rely on implied consent in jurisdictions requiring explicit opt-in (e.g., EU/UK), and we configure banners accordingly. Where implied consent is permitted, we still strive for clear, informed user choices.

15.9 Children & Teens. For users known to be under the applicable digital consent age, we restrict collection to strictly necessary technologies absent verifiable parental consent. Behavioral advertising is disabled.

15.10 Auditing & Evidence. We keep time-stamped logs of CMP interactions, category selections, and configuration versions to demonstrate compliance and defend against claims.

15.11 No Admission of Fault. Collection descriptions and disclosures in this Policy are for transparency and compliance only and do not constitute an admission that any specific law applies in any particular manner, nor a waiver of defenses.