1. Introduction

Josh Walton (“I”, “me”, or “my”) operates joshmon27.com and associated web applications, iOS applications, and Android applications (collectively, the “Services”). This Privacy Policy explains how I collect, use, disclose, and safeguard your information when you use my Services.

I am a software developer based in Lompoc, California, building custom web applications (Laravel/PHP, Vue, WordPress), iOS apps (Swift/Objective‑C), and Android apps (Kotlin/Java) for clients and personal projects including VineCrawl.com, the Bunkie chatbot review system, and client work for organizations like Sleep in Heavenly Peace.

2. Information I Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Information from Third Parties

3. How I Use Your Information

I do not sell your personal information (as defined by CCPA/CPRA). I do not share data for cross‑context behavioral advertising.

4. Data Sharing & Disclosure

5. Data Retention

You may request deletion at any time — see Section 8.

6. Your Rights & Choices (CCPA/CPRA & General)

Cookie / Analytics Opt‑Out

• Plausible: No cookies; respects Do Not Track.
• GA4: Use Google Analytics Opt‑out Browser Add‑on or disable analytics cookies via the consent banner.
• Mobile: iOS → Settings → Privacy → Tracking (disable “Allow Apps to Request to Track”); Android → Settings → Google → Ads → “Delete Advertising ID” or “Opt out of Ads Personalization.”

Email Unsubscribe

Every marketing email includes a one‑click unsubscribe link. Transactional emails (receipts, security alerts) cannot be unsubscribed.

7. Children’s Privacy

The Services are not directed to children under 13 (or 16 in the EU/UK). I do not knowingly collect personal information from children. If you believe a child has provided data, contact privacy@joshmon27.com for immediate deletion.

8. Security Measures

No system is 100% secure. I encourage responsible disclosure via security@joshmon27.com.

9. Platform‑Specific Disclosures

9.1 iOS App(s) (App Store)

• App Tracking Transparency (ATT): Requested only if/when IDFA is used for attribution. Current apps: no IDFA usage — ATT prompt not shown.
• App Privacy Label (App Store Connect): Declared data types — Contact Info, Identifiers, Usage Data, Diagnostics — linked to this policy.
• Sign in with Apple: Supported where third‑party login offered; hides email via private relay.
• Permissions Requested: Camera / Photo Library / Notifications — only when feature used, with Info.plist usage descriptions.
• Account Deletion: In‑app “Delete Account” flow (Settings → Account → Delete) per App Store Guideline 5.1.1(v).

9.2 Android App(s) (Google Play)

• Data Safety Section (Play Console): Declared — Personal info (name, email), App activity, Device IDs, Crash logs, Performance.
• Permissions: Requested at runtime (CAMERA, READ_MEDIA_IMAGES, POST_NOTIFICATIONS, ACCESS_FINE_LOCATION only if feature enabled). Revocable in system settings.
• Play Billing: Used for subscriptions/IAP; Google processes payments — I receive only purchase tokens.
• Advertising ID: Used by Firebase Analytics for attribution; user can reset/opt‑out in Settings → Google → Ads.
• Account Deletion: In‑app flow + web fallback URL provided in Play Console.

9.3 Web Applications (joshmon27.com, VineCrawl.com, client sites)

• Cookies: Only essential (session, CSRF) + optional analytics (Plausible — cookieless; GA4 with consent mode v2).
• Consent Banner: Shown to CA/EU/UK visitors (geolocation via Cloudflare cf-ipcountry header). Preference stored in localStorage + cookie.
• Third‑Party Embeds: YouTube (no‑cookie domain), GitHub Gists, Stripe.js — governed by their policies.
• Security Headers: Content‑Security‑Policy, Permissions‑Policy, Cross‑Origin‑Opener‑Policy, Strict‑Transport‑Security.

10. California Privacy Rights (CCPA/CPRA Summary)

Designated Request Address: privacy@joshmon27.com
Verification: Email + one additional factor (e.g., last 4 of card on file, recent login IP, or signed declaration).

11. International Data Transfers

I am based in California, USA. Your data is processed on servers in San Francisco (DigitalOcean SFO3) and Cloudflare’s global network. If you are in the EU/UK:

• I rely on Standard Contractual Clauses (2021/914) with subprocessors.
• No adequacy decision for the U.S. post‑Schrems II; you may withdraw consent for analytics/optional processing at any time.
• I do not maintain an EU establishment; if Art. 27 GDPR applies to you, contact me to designate a representative.

12. Changes to This Policy

Material changes will be announced via:

• Banner on joshmon27.com for 30 days
• Email to registered users (if transactional/contact email on file)
• In‑app notification (mobile apps)
• Updated “Last Updated” date above

Continued use after the effective date constitutes acceptance.

13. Contact Information

Appendix A: Cookie & Storage Inventory (Web)

No advertising cookies. No third‑party tracking pixels (Facebook, TikTok, etc.).

Appendix B: Mobile Permissions Actually Requested

No background location, microphone, contacts, SMS, or call logs.

Appendix C: Subprocessor DPA Links

Appendix D: Deployment Notes (for you)

• Policy URL: https://joshmon27.com/privacy (also linked in footer, app settings, App Store / Play Console)
• Last Updated: 2026-08-07 — update this date + header on every change
• Cookie Consent: Implemented via lightweight vanilla JS (/js/consent.js) reading/writing cookie_consent cookie + localStorage.consent; respects navigator.doNotTrack and Global Privacy Control header
• DSAR Endpoint: POST /api/privacy/request → logs to privacy_requests table, emails you, auto‑replies with ticket ID
• Account Deletion: DELETE /api/user/account (requires password re‑auth + TOTP if enabled) → queues job: anonymize PII, revoke tokens, cancel Stripe subscription, delete Sentry user data, send confirmation email
• Annual Review: Calendar reminder every August 7 — review subprocessors, cookie inventory, permission list, retention schedule