Last updated 3 October 2026
Down4 is operated by SchemaVita LLC (“we”, “us”). This policy explains what the app collects, why, and what control you have over it. It describes what the app actually does today.
When you create an account. Your email address and password. If you set up Face ID or Touch ID sign-in, we store a passkey credential — a public key, never your fingerprint or face.
Your profile. Display name, profile photo if you add one, and your availability status (free, maybe, busy) when you set one.
What you do in the app. The crews you belong to, any nickname you use in a crew, and when you joined. Vibes you post: the activity, an optional place you type in, the time, and who said they were coming. Game results: who won, who lost, any photo you attach and any caption. Messages you send in a vibe chat, replies you post on a result, and emoji reactions. Photos you upload.
For notifications. If you turn on push notifications, a device push token and the browser or device description your browser reports.
Your device’s location. When a vibe has a place attached, that is text somebody typed, not GPS. We don’t access your contacts, calendar, microphone, or your camera roll beyond photos you choose to upload, and we don’t use advertising identifiers.
We don’t track your behaviour. There is no analytics SDK, no ad network and no third-party tracker in this app.
Only to run the app: keeping you signed in, showing your crews their feed and leaderboard, delivering notifications you asked for, and keeping season records.
We do not sell your data. We do not share it with advertisers. We do not show ads.
Your activity is visible to members of the crews you belong to. Someone outside your crew cannot see your vibes, results, messages or status, and your email address is never shown to other users.
We don’t read your messages. We can technically reach what is stored, because we run the servers, but we only do so when required — to act on a report someone has filed, or where the law obliges us. Not out of curiosity, and not to build a picture of you.
Photos you upload are stored in a public storage bucket, which means someone holding the exact file link could open it. Links are long and random and aren’t listed anywhere, but don’t treat an uploaded photo as secret.
Supabase — database, sign-in and file storage. Your account and app data live here. Cloudflare — hosts and serves the app. Apple, Google and Mozilla push services — when we send a notification, your device’s push token and the message pass through the push service your browser uses. That only happens if you turn notifications on. hCaptcha — the “are you human” check on sign-up, sign-in and password reset. It sees your IP address and some details about your browser, which is how it tells a person from a script. It runs on those three screens and nowhere else. Resend — sends the emails the app has to send you, such as confirming your address or resetting your password.
We keep your data for as long as your account exists. A crew that every member has left is deleted thirty days later, along with its vibes, chat, results and photos — rejoining with the invite code inside those thirty days brings it all back. You can delete your account at any time in the app, under Profile → Account → Delete account. It is immediate and permanent. When you do:
We keep a minimal record that a deletion happened, containing no personal data.
Down4 is for people aged 13 and over. We ask for your date of birth when you sign up, use it once to check, and don’t keep it — it is never sent to our servers or stored anywhere. We don’t knowingly collect data from anyone under 13. If you believe a child under 13 has an account, contact us and we’ll remove it.
You can view and edit your profile in the app, and delete everything as described above. For any other request about your data, contact us.
We may update this policy. The date at the top shows when it last changed, and we’ll note material changes in the app.