Privacy Policy (v0.3)

1. Our commitment

LENS-AI (Social Intelligence) (“LENS,” “we,” “us”) reads the social scenes you choose to scan and helps you know what to say. Here is our commitment, in plain words:

• We never sell your data.
• We never use your scans to target ads.
• We never identify people from their faces or voices.
• We never keep your photos, video, or audio.
• We never lie to you about any of this.

If we ever change these rules, we'll tell you first. And we won't apply the change to data we already have without your permission.

One honest footnote: Google, whose Gemini AI reads your scan, keeps a safety log for up to 55 days to catch abuse. Google doesn't use your scans to improve its products. Section 5 explains.

This commitment is the same for everyone, whether you're one person using the app on a Friday night or a business that partners with us.

Power facts

• Phone permissions: internet, camera, and microphone. Location is optional, approximate only, asked only if you tap “Find venues near me,” used on your phone, and never in the background. No contacts, no gallery access.
• No LENS account, no password. Your profile never leaves your phone.
• The mic is on only while you're recording.
• Photos are read in memory and never written to our server's disk. Videos are deleted from Google's AI storage right after analysis.
• Google doesn't use your scans to improve its AI products. We use Gemini's paid tier with training turned off.
• Sharing to the scene is off unless you turn it on. A venue shows only after 5+ people share, and sensitive places are never shown.
• Same Sponsored spots for everyone in your city. Never targeted at you personally.
• Privacy requests answered within 45 days, on the Colorado Privacy Act's timeline.

Our benchmarks: this policy is written to meet Google Play's User Data policy, to follow the Colorado Privacy Act's consumer rights and data-minimization principles, and to apply GDPR-style data minimization: we collect the least we need and keep it no longer than we need it. These are standards we hold ourselves to, not certifications.

2. Who we are

LENS is run by Lens-AI-Social Intelligence LLC, a Colorado limited liability company. We decide how the information in this policy is used (in legal terms, we're the “controller”).

Email: privacy@lens-ai-socialintelligence.com
Mail: Lens-AI-Social Intelligence LLC, 1500 N Grant St, Suite 4437, Denver, CO 80203
Web: www.lens-ai-socialintelligence.com

3. What this policy covers

This policy covers the LENS Android app, our server, and our website, www.lens-ai-socialintelligence.com. It applies the same way to individual users and to business partners. It doesn't cover other sites we link to, like a partner's ticket page. Those have their own policies.

4. What we collect, and what we don't

• What you choose to scan. A photo you take or pick, or a video or audio clip you record. Every scan is your choice. Section 5 explains what happens to it.
• Audio scans and voices. Audio clips (up to 15 seconds, and the sound in videos) can pick up nearby voices. LENS uses them to read the room, including the general topics of conversation around you. It never quotes anyone, says who said what, or identifies anyone by their voice, and we don't keep the clip or any transcript. Only record where you're openly present, and never record private conversations.
• What you type in chat. If you ask follow-up questions about a scan, your messages (with the scan result, tone, and mode) are sent to our server and to Google's Gemini to write a reply.
• Your profile. The name and short bio you add stay only on your phone. They are never sent to us or anyone else.
• Your results. The read (the analysis of your scan) and your chats stay on your phone, under your control (testers: see Beta testers).
• Your history (Nodes). Nodes keeps your past reads on your phone so you can look back at places and vibes. It saves the read (the vibe, the vibe group, the type of scene LENS detected, the energy level (Low, Medium, or High), the summary, the mode, and the What to say suggestions, including which one you used), the date and time, and a place name only if you type one. It never stores photos, video, or audio. If you place a read on the map, that pin is saved only on your phone. LENS never uses your phone's location to place pins. Your history is never sent to us or included in phone backups, except reads you choose to share to the scene (section 4b). You can delete a read, a place, or everything, or turn saving off in Profile. Deleting the app deletes it too.
• Technical logs. Our server keeps basic logs to run and protect the service, such as the time, the type of request, and whether it worked. We don't log users' IP addresses. Our host, Google Cloud, has to see your IP address to deliver each request, but we've turned off its request logs. To stop abuse, our server holds IP addresses in its working memory to limit how many requests one connection can send. They're never written to disk or to logs, and they're wiped whenever the server restarts. See section 11.
• Usage stats. Anonymous, combined counts. See section 7.
• Partners and people who contact us. The name, email, business details, and message you send by email or our contact form. For partners, Order Form details (business name, contact, package, payment status). When partner payments start, Stripe will handle them; we don't see or store full card numbers.

On our website. Our site uses only the cookies it needs to work. The contact form uses Google reCAPTCHA to block spam, which is subject to Google's Privacy Policy and Terms of Service. Our email list is opt-in: the box is unchecked unless you check it, and every email has an unsubscribe link.

What we don't collect. No GPS, no precise location except a venue you choose to share (section 4b), no background location, no contacts, no texts, no access to your photo gallery, no faceprints or voiceprints. Approximate location is used only on your phone and is never sent to us (section 4b). LENS itself doesn't create or collect a device or install ID; the only exception is the random ID Google's map software uses (see section 9). If you turn on sharing, your phone also makes a random code that changes every week; it isn't tied to your phone, your account, or you (section 4b). We never give partners a guest list.

4b. Location and sharing to the scene (optional)

Everything in this section is optional and off by default. Saying no costs nothing: every other part of LENS works the same.

Your location choices (the Map tab → Sharing):

• Off (default). LENS never asks for location. You can still place pins yourself and search for venues by name. Nothing from Nodes is shared.
• Private on phone. If you allow approximate location, your phone uses it only to sort nearby venues when you tap “Find venues near me.” It's used on your phone, while the app is open, and then thrown away. It's never sent to us, never saved, and never added to your history. Nothing from Nodes is shared.
• Share to the scene. Everything in Private on phone, plus you can choose reads to add to anonymous venue pictures. Sharing sends the venue only; your phone's location is never sent. A shared venue shows where you were, so we treat it as precise location data. See “Sharing to the scene” below.

Before Android asks. LENS shows its own screen first that says what location is used for, that it stays on your phone, and that you can say no. You choose “Allow approximate location” or “Not now.” Saying no changes nothing else. You can turn location off anytime in the Map tab → Sharing or in Android settings.

How location works. Android asks for approximate location only, and only when you tap “Find venues near me.” It's used while the app is open, never in the background. Your phone matches it to nearby venues, then throws the coordinates away. They're never sent to us or saved. LENS never asks for precise (GPS-level) location. You can always search for a venue by name instead.

Searching for venues. When you search by name, the text you type and the city you picked go to our server once to find matching venues. We don't log or store your search. Venue names and places come from the Overture Maps directory. We don't use your IP address to guess your city.

Sharing to the scene. During the test, sharing is open only in Colorado, for venues in cities we've launched. You choose each read you share. For each shared read, our server receives only:

• the venue's ID (from the Overture Maps venue directory);
• the vibe group, the type of scene, and the energy level (Low, Medium, or High);
• the hour it happened, rounded to the hour;
• a random code your phone makes that changes every week. Our server turns it into a separate code for each venue and each day, then throws the original away; your phone never sends those codes itself.

To make sure shared reads can't be edited or faked, the scan result includes a signed, one-time receipt (vibe fields and hour only). We don't keep it at scan time, so a scan can't be linked to a share. Google Play Integrity checks that the share comes from the real LENS app; we use only its pass/fail answer and don't store it.

It never receives your photos, audio, video, words, names, faces, your phone's exact location, or account details. Because a venue and a time can show where you were, we treat a shared read as sensitive location data under Colorado law, and we ask before you share.

Your phone's weekly code is used only to count each person once and block spam. We can't link it to you, your phone, or your other reads, and we destroy the key that would let anyone match it within 16 days (one week of use, plus one more week so you can still delete last week's shares).

What others see.

• A venue's combined picture (like the vibe mix and “usually Fri nights”) shows only once at least 5 people have shared there, at least an hour later, and only for venues that also passed in 2 of the last 4 weeks. A vibe group shows only with at least 3 people. Counts are shown as ranges (like “5–9”), never ranked as “most popular.”
• Everyone in a city gets the same map. We don't learn which venues you look at.
• Sensitive places are never shown. Venues in these categories can't be shared: health and recovery; places of worship; LGBTQ+ venues; adult and sex-related venues; cannabis dispensaries; shelters and social services; government, courts, police, immigration, and military sites; schools and childcare; union halls, political offices, and protest sites; cultural groups serving one racial or ethnic group; homes, hotels, and workplaces; funeral homes and cemeteries. If we can't tell what kind of place a venue is, it can't be shared.
• Read cards (individual anonymous cards others can see, and the blocking that comes with them): Not in this version; we'll update this policy before adding them.

Venue vibes describe places and groups, not individuals. We don't use shared reads to describe, rate, or profile any person.

Deleting your shares. Your phone keeps what it needs to find your recent shares: this week's and last week's random codes, the venues you shared, and any delete keys. Our server never stores the codes your phone holds, and stores a delete key only as a scrambled version (a hash). You can delete your shares anytime in the Map tab → Sharing; they're removed within 24 hours. Turning sharing off stops new shares right away. Shares older than 7 days have already been blended into anonymous totals and can't be traced back to you, so they can't be pulled out. After a deletion, your phone makes a new code. Want everything gone? Clear all Nodes, or email us.

Consent. Sharing is sensitive location data under Colorado law, so we ask for your clear, separate “yes” first, on a screen that isn't pre-checked and has an equal “Not now.” We keep a record of your choice (date and version) on your phone, not on our server. Sharing starts only with reads made after you say yes; nothing already saved is shared. During the test, sharing is open only to adults in Colorado.

Our promise about combined totals. Scene totals we share are de-identified. We commit to keep them that way, never try to re-identify anyone, and require every partner to promise the same in writing.

5. How your scans are handled

1. You choose. LENS sees only the photo or clip you take, or the one photo you pick. Android's Photo Picker hands us just that photo, never your gallery. The mic is on only while you record.

2. We analyze. Your scan goes to our server and on to Google's Gemini, which reads it and sends back a result.

• Photos are analyzed in memory and never written to our server's disk.
• Temporary files on our server are deleted after each request, even when something goes wrong.
• Video is uploaded to Google's Gemini file storage for analysis and deleted right after. If that deletion ever fails, Google deletes it automatically within 48 hours.

3. We discard. The app keeps only your results (the read and your chats) on your phone. It never keeps the photo, video, or audio itself, and media is left out of phone backups. A photo you picked from your own gallery stays in your gallery. That copy is yours.

Google's role. Gemini runs on Google's paid API tier with training turned off. Under Google's terms, Google doesn't use your scans or chats to improve its products. Google keeps prompts and responses for up to 55 days only to detect abuse and meet legal duties, and authorized Google staff may review items its safety systems flag. Read Google's Gemini API terms.

No identification. We don't create faceprints or voiceprints, and we don't match identities. Our instructions tell the AI never to identify or name real people. Reads about other people are guesses, not facts, and any read can be wrong. Don't use a read to make decisions about a real person.

Demo build. In the LENS demo, scans aren't sent anywhere. Results are samples.

6. How we use information

• To give you the scan results and chat replies you ask for.
• To run, fix, and protect LENS, including stopping abuse.
• To answer you about support, testing, or partnerships.
• To show combined venue pictures from reads people choose to share (section 4b).
• To deliver partner packages: Sponsored spots, shoutouts, links, and combined totals.
• To send our email list, only if you opted in.
• To follow the law.

We don't use your scans, chats, or profile for advertising, and we don't build a profile of you.

7. Usage stats

We collect anonymous, combined usage statistics, for example how many scans happen in each city, which modes get used, and how many taps Sponsored spots get. We use them to improve LENS and to give partners totals.

• We never build a profile of an individual.
• We never tie these stats to a person's scans, chats, or profile.
• Partners only ever get combined totals, never anything about one person. We don't report totals so small they could point to one person.
• Combined totals are de-identified, and we never try to re-identify anyone (section 4b).

8. Sponsored placements

LENS is free for users. You never pay through LENS. Local businesses (“partners”) pay us to appear in the app and on our website.

• Clearly labeled. Every paid spot says “Sponsored.”
• Same for everyone in your city. Sponsored spots are chosen by city only, based on the city you pick. Never based on precise GPS, your location permission, or anything you share to the scene.
• Never personal. Never targeted using your scans, profile, chats, or behavior.
• Sponsored venues. Venue listings may later include clearly labeled “Sponsored” spots. They're the same for everyone in a city, never based on your reads, scans, shares, or location, and paying never changes the regular, unpaid results or the vibe totals.
• Your click, their site. Tapping a Sponsored spot opens the partner's own site, where their privacy policy applies.
• No promises we can't keep. We don't promise partners ticket sales, and we never give them your identity.

9. Who helps us run LENS

These companies handle data for us, only to provide their service:

• Google (Gemini API): analyzes scans and writes chat replies (terms).
• Google Play: delivers the app and tester invites, under Google's own privacy policy.
• Google Cloud (Cloud Run and Firestore): hosts our server and stores shared scene data. Request logging is turned off, so users' IP addresses aren't kept in our logs.
• Google Play Integrity: checks that a share comes from the real LENS app. We keep only the pass or fail result, briefly, and never store it with your share.
• Stripe: When partner payments start, Stripe will handle them.
• GoDaddy: hosts our website and its contact form.
• Proton: runs our email, including the privacy inbox.
• Google reCAPTCHA: blocks spam on our contact form.
• Google Maps (Google LLC): shows the Nodes map. When the map loads, Google's map software receives your IP address, the map area you view and how you move the map, basic device and crash information, and a random ID that Google's map software creates, and uses them under the Google Privacy Policy. Google doesn't receive your reads, pins, or account details from LENS.

Venue information comes from the Overture Maps Foundation's open directory. Venue data © Overture Maps Foundation contributors, including Meta, Microsoft and Foursquare, under CDLA-Permissive-2.0 and Apache-2.0. We don't send Overture anything about you.

10. Sharing

We never sell personal information or share it for targeted ads. We share it only:

• with the service providers above, so LENS can run;
• with partners, as de-identified combined totals only (at least 10 people per total), never your identity, scans, chats, or shared reads;
• when the law requires it, or to protect someone's safety or rights;
• if LENS is merged or sold. This policy's commitments go with the data, and we'll tell you first.

11. How long we keep things

• Photos, video, audio: not kept by LENS. Server temp files are deleted after each request. Video in Google's storage is deleted right after analysis, with a 48-hour automatic backstop.
• Google's abuse-monitoring logs: up to 55 days, under Google's terms.
• Results, chats, and history (Nodes): on your phone until you delete them or delete the app.
• Profile: on your phone only.
• Shared reads (raw records): deleted automatically after 35 days (usually within a day after that). Before that, they're combined into totals that keep no codes.
• Combined venue totals (no codes, de-identified): up to 13 months.
• Spam-check records: one-time receipt checks, up to 4 hours; once-per-venue-per-night and daily-limit checks, 48 hours.
• Venue searches: not kept.
• Weekly code keys: destroyed within 16 days (one week of use, plus one week so you can still delete last week's shares).
• Read cards: Not in this version; we'll update this policy before adding them.
• Approximate location: never kept. Coordinates are thrown away on your phone.
• Server logs (no users' IP addresses): up to 30 days, then deleted. We don't store your IP address in logs or databases; our server uses it briefly in memory to prevent abuse.
• Partner and contact records: while the relationship is active, then only as long as tax and accounting rules require.
• Email list: until you unsubscribe.
• Beta testers: see Beta testers.

Beta testers

If you join a LENS test through Google Play, this section applies to you too.

• What you sign up with. Your name, your Google account email, and a box confirming you're 18 or older. If you get a Room chatter code, you also give your Colorado city and ZIP code (no street address or ID) and check a box confirming you're in Colorado and will use the audio features only there. We record the date and time you agreed and which version of the Tester Terms you agreed to.
• What we use it for. Only to run the test and to send you one “Founding tester” email at the end. If you reply yes, we list your first name on our website, and you can ask us to remove it anytime. We delete tester emails once the test and that follow-up are finished. We keep a small sign-up record (your name, email, city and ZIP if given, your checkbox answers, and the date and Terms version) for 3 years after the test ends, so we can show what each tester agreed to, then delete it.
• Updates. A separate “Send me LENS-AI updates” box is unchecked unless you check it. It's the only way onto any update list.
• Help improve LENS. This arrives in a test update, not the first test build. When it does, it's on by default for testers, and you can turn it off with one tap in Profile. It sends your read results only, never photos, video, audio, or location. They go only to the LENS team to fix problems and are never shown to other users. We keep the structured results (like vibe, scene type, and energy level) for 12 months. We keep the read's text for 90 days, after automatically removing names; if that removal fails, we don't keep the text. We never keep free text from audio reads.
• Your feedback. Feedback you send may be used to improve LENS.
• Leaving. You can leave the test anytime, and ask us to delete your tester data at privacy@lens-ai-socialintelligence.com.

12. Security

The best protection is not having the data in the first place. Beyond that:

• The app connects to our server over HTTPS only.
• We collect the least data we need and don't store what we don't need.
• API keys stay on our server and out of logs, and we rotate secrets.
• Only people who need access get it.

No system is perfectly secure, and we won't pretend otherwise. If a breach affects your personal information, we'll notify you as Colorado law requires.

13. Your rights

You can ask us to:

• Access: tell you what we hold about you and give you a copy.
• Delete: deleting the app or clearing your results removes what's on your phone. Delete your shares anytime in the Map tab → Sharing (removed within 24 hours). For anything else we hold, like emails or partner records, email us.
• Correct: fix anything that's wrong.
• Opt out: leave the email list (every email has an unsubscribe link), and say no to any sale, targeted advertising, or profiling. We don't do those things, but you can still tell us no.
• Withdraw consent: turn sharing or location off anytime. It's as easy as turning it on.

Sensitive data. Under the Colorado Privacy Act, we ask before using sensitive data, and a shared read counts as sensitive location data. We don't infer sensitive data about people, such as health, religion, sex life or orientation, race or ethnicity, or citizenship. Venue vibes describe places and groups, not individuals.

Because we can't link shared reads to you, we may not be able to find them from an access request. Use the Map tab → Sharing to delete them instead.

Email privacy@lens-ai-socialintelligence.com. We may ask you to confirm the email address you used with us. We'll answer within 45 days, following the Colorado Privacy Act's timeline. If a request is complex and we need up to 45 more days, we'll tell you why within the first 45.

If we say no, we'll explain why and how to appeal. To appeal, email us with “Appeal” in the subject. We'll answer within 45 days. If you still disagree, you can contact the Colorado Attorney General. We'll never treat you differently for using your rights.

14. Age

LENS is for adults 18 and older. It isn't made for children, and we don't knowingly collect data from anyone under 18. Location and scene sharing are for adults only; if we learn a user is under 18, we block sharing and delete what we can find. If you think a child has given us data, email us and we'll delete it.

15. International users and EU partners

We're based in Colorado, United States, and LENS runs in the U.S. Google may process data in other countries where it operates. Partners in the EU get a separate data processing agreement before any personal data is shared.

16. Changes

We'll announce material changes in the app and on this site before they take effect. A change to our commitment won't apply to data we already have without your permission. The date at the top shows the current version.

17. Contact

Lens-AI-Social Intelligence LLC, 1500 N Grant St, Suite 4437, Denver, CO 80203
Privacy: privacy@lens-ai-socialintelligence.com
Web: www.lens-ai-socialintelligence.com