FRAPP

Privacy Policy

Effective date: 2026-08-06. FRAPP is operated by Frapp LLC (“we”, “us”), 1231 E Mayfair Ave, Orange, CA 92867 — a campus social-events app for Chapman University students and creators.

Who this covers

Students and creators who create an account with a college email (Chapman .edu for the current campus), use the iOS app, or contact support.

Information we collect

• Account: email address, full name, password (stored hashed), role (student/creator), and a server-assigned user id.
• Profile: optional profile photo and profile text you choose to publish.
• User content: event posts, community posts, photos/videos you upload, comments, messages, stories, RSVPs / “going” lists, ratings, and reports you submit.
• Push notification token: if you allow notifications, Apple and Firebase issue a device token that we store against your account so we can deliver pushes. It identifies the device, not you. It is removed from your account when you log out, and a token registered on a device is removed from any other account that previously held it.
• Device & diagnostics: Firebase Crashlytics crash and performance diagnostics (device model, OS version, stack traces) to keep the app stable.
• Product analytics: PostHog product analytics events keyed to your server-assigned user id (for example signup, login, and feature milestones). We do not send your email address to PostHog. We do not sell personal information.
• Payments: paid event tickets are processed by Stripe; Creator tools may use Apple In-App Purchase. We receive payment status and ticket metadata — not full card numbers. For each ticket order we also store your email address, IP address and device/browser string, which we need to defend card chargebacks and to detect fraud. See Retention — these are kept with the order after account deletion.
• Campus Pulse: anonymous, venue-level crowd heat only. We do not publish an individual’s exact location to other students.

How we use information

• Provide campus discovery, events, RSVPs, messaging, and Creator tools
• Moderate public surfaces and direct messages for a harassment-free adults-and-older-teens campus community
• Authenticate sessions, prevent abuse, and secure accounts
• Deliver notifications you have opted into
• Improve reliability (Crashlytics) and product quality (PostHog)
• Respond to support requests at verification@thefrappapp.com

Sharing

We share data with processors that help us run FRAPP: Google Cloud (application hosting, EU region), MongoDB Atlas (database), Cloudinary (media), Brevo (transactional email — receives your email address and the message we send you), Stripe (tickets), Apple (In-App Purchase and push delivery), Firebase Cloud Messaging (push delivery), Firebase Crashlytics, and PostHog.

Content moderation providers. Before an image you upload is stored, it is sent to Sightengine for automated screening, which receives the image itself and returns category scores. Text you post or send may be sent to OpenAI's moderation service for the same purpose. Neither receives your name, email, or account identity — only the content being screened. Neither is permitted to use it to train models.

Map features additionally contact three third parties directly from your device: OpenStreetMap Nominatim (nominatim.openstreetmap.org) receives the venue text you type when searching for a location; CARTO (basemaps.cartocdn.com) receives your IP address and the map area being viewed in order to serve map tiles; and when you switch the campus map to satellite view, Esri (server.arcgisonline.com) receives the same in order to serve satellite imagery. None receives your account identity.

We do not sell your personal information. Content you post or RSVP to may be visible to other students on your campus according to product settings.

Message screening

Direct messages and story replies are screened before they send, by the same automated systems used on public posts: a word-list filter plus automated classifiers, which for text may include the third-party moderation provider named above. Images sent in messages are screened by the image provider named above. We do not read your messages routinely, we do not send them to advertisers, and no human reads a message unless it is reported to us. If a message is blocked, the block is recorded and — for harassment, hate, or advertising alcohol to under-21s — it counts toward the enforcement ladder described below, the same as a blocked public post.

Reports & private conversation snapshots

When you report a direct message, moderators may review a thread snapshot: up to 6 recent messages from that conversation, each truncated to 500 characters, retained with the report for safety review. The snapshot contains only messages written by you and the person you reported — in a group or crew chat, messages from other participants are not included. Neither party is notified when a snapshot is taken. Ask verification@thefrappapp.com if you need help with a report record.

Child safety

Where we become aware of apparent child sexual abuse material, we report it to the National Center for Missing & Exploited Children as required by 18 U.S.C. §2258A, and we preserve the related content and account records for the period the law requires. Content under such a preservation is exempt from the automatic deletion described under Retention, including the 24-hour story expiry, for as long as the preservation obligation lasts.

Automated decision-making (moderation ladder)

FRAPP uses an automated weighted-strike ladder on compose: harassment/hate blocks add weight; reaching a defined threshold within a 90-day window suspends write access for 7 days; passing a higher threshold (or an egregious case) bans the account. Thresholds and category weights are published in the Community Guidelines. You can contest an active suspension or ban in the app, and a human moderator reviews it. If you cannot open the app, email verification@thefrappapp.com from the address on the account and we will route it to the same human queue. App Review demo accounts are exempt from the automated ladder.

Retention

We keep account and content data while your account is active. Diagnostic and analytics data is retained under each vendor’s retention settings and our operational needs.

After you delete your account we still retain, for limited legitimate purposes named here (Cal. Civ. Code §1798.105(d) / analogous exceptions): Order and Ticket rows — including the email address, IP address and device string captured with each order — for tax, accounting and chargeback defense; and enforcement records and AuditLog entries, for ban-evasion and safety integrity. Reports you filed about other people are kept as a safety signal but your identity is removed from them; reports about your own content, and moderation appeals you filed, are deleted with the account. We also cannot delete product-analytics events that have already been sent to PostHog; those are keyed to your server-assigned user id, not your name or email, and are retained under PostHog’s retention settings. None of this is used to rebuild a social profile.

Your choices & deletion

In the app: Settings → Delete account deletes your account. The server removes your user record; posts, comments, stories, messages, friendships, crews, notifications, streaks, referral attribution, product-analytics events stored on our own servers, payout-account linkage, push notification tokens, and subscription row tied to you; associated Cloudinary assets for your posts/profile; and your id from other users’ likes, saves, ratings, guest lists, access requests, and block lists. Orders/tickets and enforcement/audit records are retained as described under Retention. Deleting your account does not cancel an Apple subscription — cancel it in Settings → your name → Subscriptions on your device or Apple will keep charging you.

Reviewing or changing your information. You can review and edit your name, username, profile photo, campus and profile text in the app under Profile → Edit Profile, and change your email or password in Settings. If you want a copy of the personal information we hold, or a correction we do not offer in the app, email verification@thefrappapp.com from the address on your account and we will respond within 45 days. This disclosure is provided under Cal. Bus. & Prof. Code §22575(b)(2)–(3).

Do Not Track (CalOPPA)

Some browsers send a Do Not Track (DNT) signal. FRAPP does not currently respond to DNT signals because there is no consistent industry standard for interpreting them. We limit analytics to the practices described above and do not sell personal information. This disclosure is provided under Cal. Bus. & Prof. Code §22575(b)(5)–(6).

Changes to this policy

When we change this policy we update the effective date at the top of this page. If a change is material we will notify you in the app or by email to the address on your account before it takes effect. We keep a record of which version of this policy your account accepted, and when. This disclosure is provided under Cal. Bus. & Prof. Code §22575(b)(4).

Applicability (CCPA / GDPR)

At current single-campus scale we likely do not meet CCPA/CPRA “business” thresholds (§1798.140(d)(1)). We nonetheless voluntarily provide the deletion and disclosure practices described above. GDPR Art. 3(2) turns on where users are located plus intentional targeting of the EU; FRAPP is a .edu-gated, English-only, USD, California-campus app and is treated as out of scope of GDPR for that reason — students traveling in the EU could change that fact pattern.

Children

FRAPP is for college students (adults and older teens). Our Terms require you to be at least 16, matching the App Store 16+ rating. It is not directed at children, and we do not knowingly collect data from anyone under 13. If you believe we have collected data from a child under 13, contact us and we will delete it.

Your rights under California law

Contact

Frapp LLC, 1231 E Mayfair Ave, Orange, CA 92867
Privacy questions: verification@thefrappapp.com. Also see Community Guidelines, Terms, and Support.

Last updated: 2026-08-06 · Operational privacy disclosure for the shipping app.