Privacy Policy

Effective Date: June 11, 2026

Floating Point Applications ("Company", "we", "our", or "us"), a business organized under the laws of the Commonwealth of Pennsylvania, is committed to protecting your privacy and safeguarding your personal information. This Privacy Policy explains how we collect, use, store, disclose, and protect your information when you use our mobile applications, including Fold, Stashly, and Device Finder, and any future applications we may release (collectively, the "Apps"), as well as our website located at floatingpointapps.com (the "Site").

Please read this Privacy Policy carefully. By downloading, installing, accessing, or using any of our Apps or visiting our Site, you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy should be read in conjunction with our Terms of Service.

1. Information We Collect

We categorize the information associated with our Apps into two types: information stored locally on your device (which we never access) and information we may collect (with your consent). The table below provides a detailed breakdown:

1.1 Information Stored Locally (Not Collected by Us)

The vast majority of data generated through our Apps is stored exclusively on your device using local database architecture. This data is never transmitted to our servers, and we have no ability to access, view, or retrieve it. This includes:

• Fold: Bet logs, odds entries, bankroll history, and all tracking data you enter.
• Stashly: Fabric details, pattern records, notion inventory, images, tags, and all catalog information.
• Device Finder: Bluetooth device scan results, signal strength measurements, and proximity data. This data exists only in active memory during use and is not persisted to disk.

1.2 Information We May Collect (With Your Consent)

With your explicit, opt-in consent, we may collect the following limited, anonymized information:

• Crash Reports: If you opt in, we may collect anonymous crash data including stack traces, device model, operating system version, and app version. This data does not contain any personally identifiable information (PII) and is used solely to diagnose and fix technical issues.
• Anonymous Usage Analytics: We may collect aggregated, non-identifiable usage data (such as which features are most used, session duration, and screen navigation patterns) to improve our Apps. This data cannot be used to identify you personally.

1.3 Information We Do NOT Collect

For clarity, we want to explicitly state what we do not collect:

• Names, email addresses, phone numbers, or physical addresses
• Financial information, payment card details, or banking information
• Precise or approximate geolocation data (Location data used by Device Finder remains on your device)
• Contacts, call logs, SMS messages, or calendar data
• Photos, videos, or audio recordings
• Advertising IDs or cross-app tracking identifiers
• Health, fitness, biometric, or genetic data
• Browsing history or search history
• Device identifiers for the purpose of tracking or profiling

2. Device Permissions

Certain Apps require specific device permissions to function. We follow the principle of just-in-time permissions — we only request access when a feature requires it, not at app startup. Below is a complete list of permissions our Apps may request:

You may revoke any permission at any time through your device's system settings. Revoking a permission may limit the functionality of the associated feature but will not affect other features of the App.

3. How We Use Your Information

Any information we collect (limited to anonymous crash reports and usage analytics, as described in Section 1.2) is used exclusively for the following purposes:

• App Improvement: To identify and fix bugs, crashes, and performance issues.
• Feature Development: To understand which features are most valuable to users and prioritize future development.
• Compatibility: To ensure our Apps function correctly across different device models and operating system versions.
• Security: To detect and address potential security vulnerabilities.

We do not use any information for:

• Advertising, ad targeting, or ad personalization
• User profiling or behavioral tracking
• Selling, renting, or trading to third parties
• Marketing communications (we do not send emails, push notifications, or SMS for marketing)

4. How We Share Your Information

We do not sell, rent, trade, or otherwise share your personal information with third parties for their own commercial purposes.

We may share limited, anonymized information only in the following circumstances:

• Service Providers: We may use third-party crash reporting and analytics services (such as Firebase Crashlytics or similar tools) to process anonymous crash reports and usage data on our behalf. These providers are contractually obligated to process data only as directed by us and are bound by data protection obligations.
• Legal Requirements: We may disclose information if required to do so by law, court order, subpoena, or other legal process, or if we believe in good faith that such disclosure is necessary to: (a) comply with applicable law; (b) protect and defend our rights or property; (c) prevent fraud or illegal activity; or (d) protect the safety of our users or the public.
• Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, any information we hold may be transferred as part of that transaction. We will notify you via a prominent notice on our Site or within the Apps of any change in ownership or use of your information.

5. Data Security

We take the security of your information seriously and implement industry-standard measures to protect it:

• Local-First Architecture: By storing your data on your device rather than on remote servers, we significantly reduce the attack surface for data breaches. Your data is only as vulnerable as your physical device.
• Encryption in Transit: Any data transmitted from our Apps (such as anonymous crash reports) is encrypted using Transport Layer Security (TLS 1.2 or higher) protocols.
• Secure Development Practices: We follow secure coding practices, including code obfuscation, dependency management, and regular security reviews.
• Minimal Data Collection: Our primary security measure is data minimization — we collect as little data as technically possible.
• Third-Party SDK Auditing: We regularly review and audit any third-party SDKs integrated into our Apps to ensure they comply with our privacy and security standards.

While we strive to protect your information, no method of electronic storage or transmission over the internet is 100% secure. We cannot guarantee absolute security, but we are committed to implementing and maintaining reasonable safeguards appropriate to the sensitivity of the information involved.

6. Data Retention

• Locally Stored Data: Data stored on your device persists until you delete it manually, clear the App's data through your device settings, or uninstall the App. We have no control over the retention or deletion of locally stored data.
• Anonymous Crash Reports: Crash report data is retained by our third-party service providers for a maximum of twenty-four (24) months, after which it is automatically purged.
• Anonymous Usage Analytics: Aggregated analytics data is retained for a maximum of twenty-four (24) months, after which it is automatically purged or permanently de-identified.

We do not retain any personally identifiable information on our servers, as we do not collect any.

7. Data Deletion

Because our Apps use a local-first architecture, you maintain direct, complete control over your data at all times. You may delete your data using any of the following methods:

• In-App: Use any available data management or deletion features within the App (e.g., deleting individual entries or clearing all data).
• Device Settings: Navigate to your device's Settings > Apps > [App Name] > Storage > Clear Data to remove all App data.
• Uninstallation: Uninstalling the App from your device will permanently remove all locally stored data associated with that App.

If you believe any of your data has been transmitted to us (for example, through crash reports) and you wish to request its deletion, please contact us at support@floatingpointapps.com. We will process all verifiable deletion requests within forty-five (45) days of receipt, consistent with applicable law. We will confirm completion of the deletion in writing.

8. Children's Privacy

Floating Point Applications is committed to protecting the privacy of children. Our Apps are not directed at children under the age of thirteen (13), and we do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA).

If we become aware that we have inadvertently collected personal information from a child under 13, we will take immediate steps to delete such information from our systems. If you are a parent or guardian and believe that your child has provided personal information to us, please contact us immediately at support@floatingpointapps.com, and we will promptly investigate and take appropriate action.

9. Third-Party Services & SDKs

Our Apps may integrate with or link to third-party services. The following is a disclosure of the categories of third-party services we may use:

We do not integrate any of the following:

• Advertising SDKs or ad networks
• Social media tracking SDKs
• Data broker or data monetization services
• Cross-app tracking or fingerprinting tools

Each third-party service provider operates under its own privacy policy. We encourage you to review the privacy policies of any third-party services, including Google's Privacy Policy if we use Firebase services. We are not responsible for the privacy practices of third-party service providers.

10. On-Device Artificial Intelligence

Certain Apps incorporate artificial intelligence ("AI") and machine learning ("ML") features powered by on-device models. This section explains how AI is used in our Apps and how it relates to your privacy.

10.1 AI Features by App

10.2 How On-Device AI Works

Our Apps use Google Gemma 4 E2B, an on-device large language model optimized for mobile devices. The AI model:

• Runs locally: All AI inference and processing occurs on your device's processor. No internet connection is required for AI features to function.
• Processes data in real-time: The AI reads your locally stored data only when you actively use AI features. It does not continuously monitor or process your data in the background.
• Has tool-calling capabilities: The AI assistant can read from and write to your local app database (such as logging bets in Fold or toggling the Bluetooth scanner in Device Finder) based on your conversational instructions. All such actions occur exclusively on your device.
• Does not learn from your data: The on-device model does not train, fine-tune, or update itself based on your personal data. The model is static; new model versions are obtained only when you choose to download them or through app updates.

10.3 User Consent and Control

AI features in our Apps are entirely opt-in. You must:

• Actively download the AI model within the App;
• Open the AI assistant interface; and
• Accept the in-app AI disclaimer before any AI processing begins.

If you choose not to use AI features, no AI processing occurs, and the core functionality of each App remains fully available without AI. You may remove the AI model at any time by clearing the App's data or uninstalling the App.

10.4 AI Model Storage

The AI model files are downloaded directly to your device from a trusted public model repository (currently Hugging Face) only when you choose to enable AI features. The download is a one-way transfer: the model file is fetched to your device, and no personal data, identifiers, or usage information is sent in return. These model files:

• Are stored locally on your device;
• Do not contain any personal or user-specific data;
• Are replaced only when you choose to download a newer model or through app updates;
• Are permanently removed when you clear the App's data or uninstall the App.

10.5 What the AI Does NOT Do

For clarity, our on-device AI does not:

• Transmit your prompts, queries, or conversations to any external server;
• Send your betting data, bankroll information, or Bluetooth scan results to the cloud;
• Share any data with Google, third-party AI providers, or any other entity;
• Collect, store, or process biometric data;
• Profile users or create behavioral models;
• Make automated decisions that produce legal or similarly significant effects;
• Operate in the background when you are not actively using the AI assistant.

11. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information under applicable data protection laws. Because our Apps collect minimal to no personal information, many of these rights are inherently satisfied by our local-first architecture. However, we respect and uphold the following rights:

11.1 Rights Under the California Consumer Privacy Act (CCPA/CPRA)

If you are a California resident, you have the right to:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you. As stated in this policy, we do not collect personal information from our Apps.
• Right to Delete: Request deletion of personal information we have collected. See Section 7 for deletion instructions.
• Right to Opt-Out: Opt out of the "sale" or "sharing" of your personal information. We do not sell or share your personal information.
• Right to Non-Discrimination: You will not be discriminated against for exercising any of your CCPA rights.
• Right to Correct: Request correction of inaccurate personal information. Since data is stored locally, you can correct it directly within the App.

To exercise any of these rights, contact us at support@floatingpointapps.com. We will respond to verifiable consumer requests within forty-five (45) days.

11.2 Rights Under the General Data Protection Regulation (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the GDPR:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of incomplete or inaccurate data.
• Right to Erasure ("Right to Be Forgotten"): Request deletion of your personal data under certain circumstances.
• Right to Restrict Processing: Request that we limit how we use your data.
• Right to Data Portability: Request a machine-readable copy of your data.
• Right to Object: Object to our processing of your data for certain purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time.

Legal Basis for Processing: Where we process any personal data (limited to anonymous crash reports and analytics collected with your explicit consent), our legal basis is your consent (Article 6(1)(a) of the GDPR). You may withdraw your consent at any time by adjusting your App settings or contacting us.

To exercise your GDPR rights, contact us at support@floatingpointapps.com. We will respond within thirty (30) days. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.

11.3 Rights Under Other U.S. State Privacy Laws

If you are a resident of a state with comprehensive privacy legislation (including but not limited to Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or other states that have enacted consumer privacy laws), you may have similar rights to access, correct, delete, and opt out of the processing of your personal information. We commit to honoring all such rights consistent with applicable law. Please contact us at support@floatingpointapps.com to exercise your rights.

12. Do Not Track Signals

Some web browsers transmit "Do Not Track" (DNT) signals. Because there is no universally accepted standard for how to respond to DNT signals, our Site does not currently respond to DNT browser signals. However, because we do not engage in cross-site tracking or behavioral advertising, our practices are already aligned with the intent of DNT signals.

13. International Data Transfers

Floating Point Applications is based in the Commonwealth of Pennsylvania, United States. If you are accessing our Apps or Site from outside the United States, please be aware that any limited, anonymized data we collect (with your consent) may be transferred to and processed in the United States, where data protection laws may differ from those in your country of residence.

By using our Apps, you consent to the transfer of your anonymized information to the United States and the processing of that information as described in this Privacy Policy. We take steps to ensure that any such transfers comply with applicable data protection laws and that your information remains protected to the standards described in this policy.

14. Advertising & Tracking

Our Apps do not contain advertisements. We do not use advertising SDKs, ad networks, or any form of ad-supported monetization. We do not collect or share data with third parties for advertising purposes. We do not engage in:

• Interest-based or behavioral advertising
• Retargeting or remarketing
• Cross-app or cross-site tracking
• Collection of advertising identifiers (GAID/IDFA)

15. Data Breach Notification

In the unlikely event of a data breach affecting any personal information we hold, we will:

• Notify affected users within seventy-two (72) hours of becoming aware of the breach, consistent with GDPR requirements and Pennsylvania's Breach of Personal Information Notification Act (BIPNA);
• Notify the Pennsylvania Attorney General as required by law;
• Provide a description of the breach, the types of information potentially affected, and the steps we are taking to address and mitigate the breach;
• Provide recommendations for actions you can take to protect yourself.

Given our local-first architecture and minimal data collection, the risk of a breach affecting personal information is significantly reduced compared to cloud-dependent applications.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Effective Date" at the top of this page;
• Post a prominent notice on our Site;
• Where possible, provide an in-app notification informing you of the changes.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of the Apps or Site following the posting of changes constitutes your acceptance of such changes. If you do not agree with the updated Privacy Policy, you should discontinue use of the Apps.

17. Google Play Data Safety Compliance

In accordance with Google Play's Data Safety requirements, the following summarizes our data practices for the Google Play Store Data Safety form:

• Data Collection: Our Apps may collect anonymous crash diagnostics and app performance data (with user consent). No personal or sensitive user data is collected.
• Data Sharing: We do not share user data with third parties except for anonymous crash reporting as described in this policy.
• Data Encryption: All data transmitted from the Apps is encrypted in transit.