7exo
Sign inGet the app

7exo Privacy Policy

Effective date: August 14, 2026

This Privacy Policy explains what information 7exo collects, how it is used, who can see it, and the choices you have. It covers the 7exo iOS app — including exoVerse (social), exoPulse (places and communities), exoHealth (health dashboard), the exoID Apple Wallet pass and check-in features, and exoCircle nearby pairing — as well as the 7exo website at www.7exo.com (together, the "Services").

We have tried to write this policy in plain language and to describe what the app actually does — not what a generic template says. Two principles guide everything below:

  • We do not sell your personal information, and we do not show ads. There are no advertising networks, data brokers, analytics companies, or tracking SDKs anywhere in 7exo.
  • The most sensitive data stays on your device. Your Apple Health data and your device's location are processed on your iPhone and are never transmitted to our servers.

1. Who we are

The Services are operated by 7exo ("7exo," "we," "us"). For any privacy question or request, contact us at support@7exo.com.

2. Information you provide to us

Account information. When you create a 7exo account (your "exoID"), we collect:

  • First and last name
  • Username (your @handle)
  • Email address
  • Phone number
  • Profile photo
  • Password

Your password is handled by Google Cloud Identity Platform, the sign-in service we use. It is transmitted securely to Google for authentication and is never stored on 7exo's servers or on your device. We store the other account fields listed above, along with a unique account identifier (your user ID) and the date your account was created.

Your phone number and email address are used for account identity and support. They are not shown on your public profile and are not searchable by other users.

Content you create. Posts and stories (text and photos), comments, and reactions in exoVerse. Photos you upload are re-encoded before upload, which removes hidden photo metadata such as the GPS location embedded by your camera — the location where a photo was taken is not uploaded with it.

Community memberships (exoPulse). You can join venue communities — for example a residence, workplace, campus, gym, park, institution, or dealership. We store the venue name and type for each community you join. Because a residence membership can reveal where you live, a dedicated Residence Visibility setting controls who can see it: everyone, friends, fellow residents, or no one.

Venue suggestions. If you request that a venue be added to exoPulse, we store the city, venue name, and the venue's map coordinates (taken from the map listing you selected — not from your device's location), linked to your account so you can withdraw the request.

Reports and blocks. If you report content or a user, we store your report and its reason. If you block someone, we store that block to enforce it.

Settings. Your app preferences (appearance, launch tab, notification toggles, visibility settings, and similar) are synced to your account so they follow you across devices.

3. Information created as you use the Services

Social activity. We record likes, follows, comments, and views — including which account viewed a given post, story, or profile — to power view counts, viewer lists, and your activity feed. See Section 6 for who can see this.

Check-ins (exoID Wallet pass). Your exoID pass contains your name, username, profile photo, and a QR code identifying your account. When a host scans your pass (or checks you in manually), we record a check-in: your account, the host's account, and the check-in and check-out times. This creates an attendance record for that event or venue. No GPS location is recorded with a check-in.

Push notification tokens. If you enable notifications, we store the Apple push token for your device so we can deliver them. If you add your exoID pass to Apple Wallet, Apple provides us a device registration and pass-update token so the pass can refresh; these are technical identifiers, not your name or contact details.

Technical logs. Like virtually all cloud-hosted services, our infrastructure (Google Cloud) automatically records standard request logs, which include IP addresses, for security, debugging, and reliability. We do not use these logs to build profiles of users, and we run no analytics on them.

4. Information processed only on your device

The following never leaves your iPhone and is never sent to 7exo's servers:

Apple Health data (exoHealth). With your permission, the app reads data such as weight, body composition, exercise minutes, workouts, steps, active energy, resting heart rate, and sleep from Apple Health to display your dashboard. This data is read-only, displayed on device, and cached only in the app's local storage on your iPhone. It is never uploaded, never shared, and never used for advertising or any other purpose. If you unlink Apple Health, the local cache is deleted. You can revoke access at any time in iOS Settings → Health.

Location (exoPulse). With your permission, the app uses your approximate location (reduced accuracy, roughly 100 meters) while you are using the exoPulse map, solely to show where you are on the map and rank nearby venues above distant ones. Your coordinates are never transmitted to our servers, and the app never accesses location in the background.

Camera and photos. The camera is used to take photos for posts, stories, and your profile picture, and to scan exoID QR codes at check-in. Camera frames are processed on device; only the photos you choose to post are uploaded.

Nearby pairing (exoCircle). When you actively use nearby friend pairing, your device briefly broadcasts your username, display name, and user ID over Bluetooth and local Wi-Fi so another nearby 7exo user can find and add you. This happens only while the pairing feature is open, and no location data is involved. Nearby discovery can be disabled in settings.

5. Information we do NOT collect

To be explicit, 7exo does not:

  • Sell, rent, or trade personal information — to anyone, ever
  • Show advertising or work with ad networks
  • Use third-party analytics, tracking, or crash-reporting SDKs
  • Track you across other companies' apps or websites (the app declares "no tracking" in its Apple privacy manifest)
  • Access the advertising identifier (IDFA) or fingerprint your device
  • Upload your Apple Health data
  • Upload your device's location
  • Record audio or access your microphone
  • Read your contacts, calendar, or messages

6. Who can see your information within the app

7exo is a social product, so some information is visible to other users by design:

  • Profile: Your username, display name, profile photo, and first name are visible to other signed-in users. Your Name Privacy setting controls whether others see your full name or first name only. Your email and phone number are never shown.
  • Content: Posts and stories are visible according to their visibility setting (public posts appear in the shared feed; stories expire automatically after 77 hours).
  • Engagement: Lists of who liked or viewed a post, story, or profile are visible to signed-in users, and profile view counts are public. Profile-view notifications are deliberately anonymous ("Someone viewed your profile"), but viewer lists show who.
  • Communities: Members of a venue community can see the other members. Your residence community is additionally protected by your Residence Visibility setting.
  • Check-ins: When your exoID pass is scanned, the scanning host sees your first and last name, username, and your check-in/check-out times, and you appear on that host's attendee list with an occupancy count while you're checked in. Hosts also see aggregate statistics about their own events (attendance curves, arrival times, and similar).
  • Nearby pairing: As described in Section 4, nearby 7exo users can see your username and display name while you are actively pairing.
  • Search: Other users can find your account by searching your name or username.

You can block any user, which prevents interaction between your accounts, and you can report users or content to us.

7. How we use information

We use the information described above only to:

  1. Provide the Services — accounts, feeds, stories, communities, passes, check-ins, and notifications
  2. Maintain safety — enforcing blocks, reviewing reports, and preventing abuse
  3. Secure and operate our infrastructure — authentication, debugging, and reliability
  4. Comply with legal obligations

We do not use your information for advertising, profiling, or automated decision-making that produces legal or similarly significant effects.

8. Service providers and disclosures

We use exactly two infrastructure providers, and we share personal information with no one else in the ordinary course of operating the Services:

  • Google Cloud Platform hosts the Services: sign-in (Google Cloud Identity Platform), our application servers (Cloud Run), our database (Cloud SQL), and photo storage (Cloud Storage). Google processes this data on our behalf as a service provider and does not use it for its own purposes.
  • Apple provides push notifications (your notification and Wallet pass tokens pass through Apple's push service), Apple Wallet, and Apple Maps. When you search for venues or addresses in exoPulse, your search text is sent to Apple Maps to return results, under Apple's privacy terms. Apple Health data, as noted, stays on your device.

We may disclose information if required by law, legal process, or to protect the rights, safety, or property of 7exo, our users, or the public — and if 7exo is ever involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to this policy.

9. Where your data is stored

Our servers and database are located in Google Cloud's us-central1 region (Iowa, United States). If you use the Services from outside the United States, your information is transferred to and processed in the United States, where privacy laws may differ from those in your country. We protect it as described in this policy regardless of where you are.

10. How long we keep information

  • Account data and content: kept until you delete the content or your account.
  • Stories: automatically deleted 77 hours after posting.
  • Deleted posts: held in your Recently Deleted bin for about 24 hours (during which you can restore them), then permanently removed. You can also delete a post permanently and immediately.
  • Push tokens: removed when you sign out, and pruned automatically when Apple reports a device is no longer registered.
  • Backups: our database is backed up automatically; deleted records can persist in encrypted backups and recovery logs for approximately 7 days before rolling off.
  • Photos: stored until deleted; copies may persist in our storage systems and encrypted backups for a period after deletion and are not accessible through the Services.
  • Wallet technical records: limited technical records needed for Apple Wallet pass management (device registrations and pass-update state) may persist after account deletion; they contain device and pass identifiers, not your name or contact details.

11. Deleting your data and your privacy rights

Account deletion is built into the app: Settings → Legal & Safety → Data Rights & Deletion → Delete Account. You will confirm with your password. Deletion removes, immediately and permanently:

  • Your exoID profile (name, email, phone, photo reference, settings)
  • Your posts, stories, comments, likes, and views
  • Your follows and followers, blocks, and reports
  • Your community memberships and venue requests
  • Your check-in history — both check-ins of you and, if you hosted events, your attendee records
  • Your push notification registrations
  • Your sign-in account at our authentication provider
  • All 7exo data stored locally on your device

Residual copies may persist briefly in encrypted backups as described in Section 10.

Your rights. Depending on where you live (for example under the GDPR in Europe or the CCPA/CPRA in California), you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to non-discrimination for exercising those rights. Most of these you can exercise directly in the app: your profile and settings are editable in place, and deletion is self-service as described above. For anything else — including data export requests or questions — email support@7exo.com and we will respond within the timeframe required by applicable law. We do not "sell" or "share" personal information as those terms are defined in the CCPA/CPRA, and we honor deletion rights without requiring you to contact us.

If you are in the EEA or UK and believe we have not resolved your concern, you may lodge a complaint with your local data protection authority.

12. Security

  • All traffic between the app and our servers uses HTTPS/TLS encryption.
  • Sign-in uses short-lived, cryptographically signed tokens; your session credentials are stored in the iOS Keychain, Apple's encrypted credential store.
  • Photos are stored in a private storage bucket that cannot be accessed publicly; the app retrieves them through short-lived signed links that expire within an hour.
  • Passwords are handled and hashed by Google Cloud Identity Platform; 7exo never stores them.
  • Database credentials and signing secrets are kept in a managed secret store, not in code.
  • The app renders through a screen-capture protection layer, so screenshots and screen recordings of 7exo content come out blank on device.

No system is perfectly secure, but we design for least exposure: no third-party code in the app, no analytics pipelines, and no copies of sensitive data we don't need.

13. Push notifications

Notifications are optional and controlled both by iOS permissions and by per-type toggles in 7exo's settings (follows, post likes, story likes, profile views). Notification content is minimal — for example, a first name and the action ("liked your post"); profile-view notifications never identify the viewer. Apple Wallet pass updates use silent, content-free pushes.

14. Children

The Services are not directed to children under 13, and you must be at least 13 years old (or older where your country's law sets a higher minimum for consenting to data processing, such as 16 in parts of the EEA) to create an account. We do not knowingly collect personal information from children under these ages; if we learn that we have, we will delete it. Content that sexualizes or endangers minors is prohibited without exception, is removed immediately, and is reported to authorities where the law requires.

15. The 7exo website

Browsing www.7exo.com does not require an account, and the website does not use advertising or cross-site tracking. Standard technical logs (such as IP address and browser type) may be recorded by our hosting infrastructure for security and reliability.

16. Changes to this policy

We may update this policy as the Services evolve — for example, when new 7exo products launch. If we make material changes, we will update the effective date above and notify you through the app or the website before the changes take effect. Continued use of the Services after changes take effect means the updated policy applies.

17. Contact

Questions, requests, or concerns about privacy at 7exo:

support@7exo.com