Privacy Policy

Genius at Large Inc.("HERO2", "we", "our", or "us") operates the HERO2 mobile application (the "App"). This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data. By using the App, you agree to the practices described here.

1. Information We Collect

Waitlist and Onboarding Information

If you join the HERO2 waitlist or complete onboarding, we may collect information such as your name, email address, phone number, username, campus or city, referral source, onboarding responses, and user profile type. We use this information to manage early access, personalize your experience, communicate with you about HERO2, and prepare your rewards and travel profile.

Account Information

When you create an account we collect your email address and, once you set it, your username. If you sign in with Google, we receive your email address and name from Google solely to create and identify your account.

Location Data

The App may collect precise GPS location data, including background location data, to detect and classify transportation trips, such as walking, cycling, public transit, and driving. HERO2 uses location data to estimate trip distance, calculate estimated CO2 savings, support rewards, prevent fraud, and award Power Tokens.

Location data is not sold or shared with advertisers. We do not share your full trip routes or precise location history with merchants or other users. You can revoke location access at any time in your device settings, though doing so may disable trip tracking and reward functionality.

Motion and Fitness Data

We use your device's motion sensors and, with your permission, Apple HealthKit data such as walking distance and running distance to improve trip classification and user-facing activity metrics. HERO2 does not write data back to HealthKit. HERO2 does not sell HealthKit data, use HealthKit data for advertising, or share HealthKit data with merchants or data brokers.

Trip and Activity Data

We store records of your detected trips, including transportation mode, distance, duration, and estimated CO2 impact. This data is used to calculate your Power Token balance, your position on the leaderboard, and your cumulative environmental impact.

Rewards Activity

We record which rewards you have saved, claimed, locked in, and redeemed. Redemption data is shared with the relevant merchant partner only to the extent needed to verify your redemption at their location.

Device, Usage, and Diagnostics Information

We may collect device, usage, and diagnostics information, including device type, operating system, app version, timezone, log data, crash reports, performance data, app interactions, feature usage, and session information. We use this information to operate the App, improve performance, fix bugs, secure the service, understand feature usage, and support analytics.

Profile, Leaderboard, and Social Information

If you use profile, cohort, leaderboard, or social features, we may collect and display information such as your username, display name, avatar or profile image, ranking, cohort, streaks, Power Token activity, and selected progress or impact metrics. HERO2 does not show your precise trip routes or full location history to other users.

2. How We Use Your Information

• To detect transportation trips and calculate your CO2 impact and Power Token balance
• To operate the rewards system and verify redemptions with merchant partners
• To display your ranking on global and local leaderboards
• To send you account-related communications (verification codes, password resets)
• To improve our trip detection algorithms and overall app performance
• To manage waitlist access, onboarding, and early access communications
• To personalize your travel profile, rewards, streaks, and leaderboard experience
• To prevent fraud, abuse, and inaccurate reward claims
• To generate aggregated or de-identified analytics for product improvement, partner reporting, and impact measurement
• To improve trip classification, emissions estimates, reward accuracy, and app reliability
• To comply with applicable law

We do not use your data for advertising, profiling, or sale to third parties.

3. Information Sharing

We share your information only in these limited circumstances:

• Merchant partners: When you redeem a reward, we share confirmation of the redemption with the merchant. We do not share your location history or account details with merchants.
• Authentication providers:We use Keycloak for authentication management. If you sign in with Google, your email is passed through Google's OAuth service.
• Infrastructure providers: We use standard cloud infrastructure (object storage, databases, queue services) to operate the App. These providers process data only on our behalf and under confidentiality obligations.
• Legal requirements: We may disclose information if required by law, court order, or to protect the rights and safety of our users or the public.

4. Merchant and Partner Reporting

Participating businesses may receive aggregated or store-level reporting, such as reward activations, reward redemptions, discount activity, time-window performance, location-level performance, Power Tokens issued, and estimated emissions avoided.

HERO2 does not share individual users' full trip routes, precise location history, or account details with merchants. If a reward is redeemed in store, the merchant may see only the information needed to process that redemption, such as the offer, reward screen, redemption code, or redemption status.

5. AI, Analytics, and Model Improvement

HERO2 may use trip, location, activity, usage, and rewards data to improve trip classification, emissions estimates, fraud prevention, reward accuracy, routing insights, and user experience. Where possible, HERO2 uses aggregated or de-identified data for analytics and model improvement.

6. Data Retention

We retain personal information for as long as reasonably necessary to provide HERO2, comply with legal obligations, resolve disputes, enforce agreements, prevent fraud, and improve the service.

Account, waitlist, and profile information may be retained while your account is active. Raw location data is retained only as long as reasonably necessary to classify trips, support rewards, prevent fraud, and maintain service integrity. Processed trip summaries, reward records, Power Token records, and redemption history may be retained while your account is active. Aggregated or de-identified analytics may be retained for product improvement, partner reporting, research, and impact measurement.

If you delete your account, we delete or de-identify your personal data within 30 days, except where we are required or permitted to retain it for legal, security, fraud-prevention, or business record purposes.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your account and associated data (available directly in the App under Profile → Delete Account)
• Withdraw consent for location or HealthKit access at any time via your device settings
• Request a copy of your data in a portable format

Depending on where you live, you may also have the right to opt out of the sale or sharing of personal information, limit certain uses of sensitive personal information, and appeal a decision regarding a privacy request, where applicable. HERO2 does not sell precise location history or HealthKit data.

To exercise any of these rights, contact us at admin@hero2.org.

8. Children's Privacy

The App is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

9. Security

We use industry-standard security measures including HTTPS for all data in transit and encrypted storage for authentication tokens on your device. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

10. Device Permissions

HERO2 may request device permissions to provide core app features:

Users can manage permissions through device settings.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date at the top of this page and, where appropriate, by in-app notification. Continued use of the App after changes take effect constitutes acceptance of the updated policy.

12. Contact

If you have questions or concerns about this Privacy Policy or our data practices, contact us at: