Privacy policy
Effective
Stucky is operated by SOSA PROJECTS, LLC ("Stucky", "we", "us"). This policy covers the Stucky app, the brand dashboard and this website. If you have a question about it, email [email protected].
What we collect from students
- Account. Your school email address, first and last name, campus and a referral handle. When you request a sign-in code we store the email address, a hashed copy of the code and the IP address of the request.
- Profile. An optional profile photo, your major and class year, your laptop model or lid measurements, the places on campus you use your laptop, and optional Instagram and LinkedIn handles and a short pitch.
- Applications. A photo of your laptop lid and the campaigns you apply to.
- Shipping address. The name and address a sticker is mailed to, with the map coordinates of that address. Address search in the app uses Apple Maps.
- Check-ins. Each photo you take of your lid, when you took it, and your device's precise location and its accuracy at the moment you submit it. The app reads your location only when you submit a check-in photo, never in the background.
- Earnings and payouts. Your earnings, payout history, your Stripe account ID, and the name, type and last four digits of the bank account or debit card you connect. Identity, tax and full bank details are entered with Stripe directly and are held by Stripe, not by us.
- Support and bug reports. Messages you send us, and for bug reports the app version, operating system version and device model.
- Notifications. If you allow notifications, a push token and an installation ID for your device, plus your notification settings.
- App usage. Events about how the app is used, such as starting an application or opening a screen, sent to our analytics provider.
Face ID is handled by iOS. We never receive your face data or fingerprint.
What we collect from brands and visitors
Brand dashboard users give us their name, work email address and organization. Brand billing details are entered with Stripe. When you use a form on this website we store what you enter, such as your name, email address, school, social handle or brand, and the time you sent it.
How we use it
- To sign you in and keep your account secure.
- To show you campaigns at your campus and let brands review your applications.
- To print and mail stickers.
- To verify check-ins. We check the location and time automatically, then a person on our team reviews the photo.
- To calculate earnings and send payouts.
- To send sign-in codes, account emails and the push notifications you have turned on.
- To answer support requests and fix bugs.
- To prevent fraud and abuse, including rate limits by IP address.
- To understand how the app is used and improve it.
We do not sell personal information, and we do not use it for advertising or to track you across other companies' apps and websites.
What brands see
When you apply to a brand's campaign, that brand sees your name and photo, major and class year, laptop model, the places on campus you use your laptop, your lid photo, your pitch, and your Instagram and LinkedIn handles if you added them. If the brand approves you, it also gets your shipping address so it can post the sticker. A brand may see a check-in photo of its own sticker when a check-in is disputed.
Brands never see your email address, your bank details or the coordinates of your check-ins.
Service providers
These companies process data for us, only to run Stucky:
- Google Firebase, for sign-in sessions.
- Stripe, for student payouts through Stripe Connect and for brand billing. Data you give Stripe directly is covered by Stripe's own privacy policy.
- Cloudflare, for network delivery and for storing photos.
- Amazon Web Services, for sending email.
- PostHog, for app usage analytics.
- Expo, for delivering push notifications through Apple.
- Hetzner, for server and database hosting.
- Telegram, to notify our team when someone sends a form on this website.
We may also disclose information when the law requires it, or to a buyer or successor if Stucky's business is sold or reorganized.
How long we keep it
- Account and profile data, for as long as your account is open.
- In-app activity items, for 90 days. Push tokens from a device we have not seen in 90 days are deleted.
- A waitlist signup for a school we cannot serve is erased 90 days after that decision.
- Earnings and payout records, for seven years after the payout, because tax and accounting law requires it.
Deleting your account
Delete your account in the app under Account, then Profile, then Delete account, or email [email protected] from the school email address you sign in with. Some things have to finish first, and the app lists them: a sticker still on your lid or on its way to you, a payout still on its way, money still under review, or a balance with no bank connected to send it to. Once nothing is left, your available balance is paid out to your bank, pending applications are withdrawn and you are signed out. After 30 days we erase your profile, photos, check-ins, addresses and other personal data, except the earnings and payout records described above. Signing back in before then keeps your account. You can also ask us for a copy of your data at the same address.
Your choices
- You can edit your profile, address and notification settings in the app.
- Camera, photo library, location and notification access are each asked for separately and can be turned off in iOS Settings. Location is needed only to submit a check-in.
- Depending on where you live, you may have the right to access, correct or delete your data or to object to how we use it. Email us and we will respond.
Who Stucky is for
Stucky is for students enrolled at participating US colleges and universities, and for the brands that work with them. It is not directed at children under 13, and we do not knowingly collect their data.
Security and location of data
Data is sent over encrypted connections. Photos are stored privately and shown only through short-lived links. Stucky operates in the United States, and some providers above may process data in other countries, including the European Union.
Changes
If we change this policy we will update this page and its effective date. If a change is significant, we will tell you in the app or by email before it applies.
Contact
SOSA PROJECTS, LLC
[email protected]