Privacy Policy

Effective Date: March 1, 2025  |  Version 2.0

The Ark of Dreams ("we," "our," or "us") is operated by WUV World, Inc. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our platform at wuv.world and all associated subdomains, mobile apps, and services (collectively, the "Platform").

By using the Platform, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our services.

1. Information We Collect

We collect several types of information to operate and improve the Platform:

a) Information You Provide Directly

• Account Registration: Full name, email address, phone number, date of birth, username, password (hashed), user type (Hero, Champion, Guardian, Young Dreamer)
• Profile Information: Avatar images (uploaded or AI-generated), bio, location (city, state, country), hero type, theme preference
• Dream Challenges & Content: Videos, images, scripts (I AM / I Dream / I Believe / I Challenge statements), thumbnails, captions, tags, rich text descriptions, hashtags, nomination lists
• Hero Journal Entries: Written entries, voice notes, video reels, mood selections, drawings, and reflections submitted during your 30-day journey
• Dream Guide Responses: Answers to guided questions about your purpose, values, strengths, and goals
• Community & Social Data: Posts, comments, reactions, Dream Circle memberships, community joins, petition signatures, challenge votes, mentorship connections
• Guardian & Child Account Data: Guardian full name, phone number, COPPA consent records, child nickname, age, parental control settings, guardian-managed passwords
• Payment & Financial Data: Processed via Stripe — we receive only tokenized references. We do not store raw card numbers or full bank account details.
• Identity Verification Data: Collected and processed by Stripe Identity on our behalf for wallet activation and contest eligibility (government-issued ID, selfie liveness check, date of birth). We receive only a verified summary — not raw document images.
• Payout Details: Bank account last-4 digits, routing number last-4, or debit card last-4 (tokenized via Stripe)
• School & Organization Data: School name, email domain, district affiliation, role (student, teacher, admin), uploaded verification documents
• Survey & Contest Responses
• Support & Communications: Messages you send us, feedback, or bug reports

b) Information Collected Automatically

• Device information (browser type, OS, device identifiers)
• IP address and approximate geolocation
• Pages visited, features used, session duration, click patterns
• Video view counts, share counts, donation interactions
• Push notification token (for Firebase Cloud Messaging)
• Referral tracking links and campaign parameters
• XP gain events, quest completions, achievement unlocks, daily reward claims

c) Information from Third Parties

• Auth0 / WUV SSO: When you sign in via our SSO provider, we receive your email, name, and authentication tokens
• Stripe: Payment, subscription status, payout status, and identity verification results
• Google APIs: If you use location search or school verification features, Google Places / Geocoding data may be used
• Vimeo: When you upload videos, Vimeo stores the video file and provides a CDN-backed URL; we store only the reference URL and transcription metadata
• Backblaze B2: Secondary video and media storage provider
• Firebase: Push notification delivery service
• Go High Level (GHL): CRM integration for marketing workflows; limited profile data (name, email) may be synced for campaign purposes
• Twilio: Phone number verification — your phone number is sent to Twilio to deliver a one-time verification code
• OpenAI: AI-powered features such as Dream Insights, script analysis, AI avatar generation, and transcription analysis use your content as input. We do not send personally identifiable financial data to AI providers.

2. How We Use Your Information

• Create, authenticate, and manage your account
• Operate platform features: Dream Challenges, Hero Journal, Dream Guide, Dream Circles, Communities, Champion network, Quests, Leaderboard, Achievements, Daily Rewards, Unlockable Shop, Creator Studio, Mentorship Hub, and Resources
• Process payments, subscriptions, coin purchases, and donations via Stripe
• Enable WUV Coin economy: purchasing coins, earning through donations received, converting to Keys/Doors, spending in the Unlockable Shop or Marketplace
• Facilitate wallet activation and payout requests through Stripe Identity and Stripe Transfers
• Display your Dream Channel, public profile, and leaderboard rankings to other users
• Deliver personalized content through the Dream Feed and AI-powered recommendations
• Generate AI avatars, analyze video/audio transcriptions, surface Dream Insights
• Send transactional emails (welcome, verification, donation receipts, payout status, quest completions, level-ups, contest notices) via Mailgun, SMTP, or Mailwizz
• Send push notifications via Firebase Cloud Messaging
• Deliver Victory Encouragement messages and Victory Chat interactions
• Facilitate community events, announcements, and messages
• Manage guardian oversight of Young Dreamer accounts (parental controls, approval workflows, COPPA compliance)
• Verify school domains and manage school/district dashboards
• Track referral links and reward referral participants
• Run analytics and improve platform performance
• Comply with legal obligations including tax reporting (e.g., IRS Form 1099 for payouts ≥$600/year)
• Detect and prevent fraud, abuse, and policy violations
• Respond to legal requests and enforce our Terms & Conditions

3. Children's Privacy (COPPA Compliance)

We take children's privacy seriously. The Platform includes dedicated features for Young Dreamers (users under 13).

• Children under 13 may only create accounts with verifiable parental/guardian consent
• Guardians must complete our onboarding process and consent to COPPA terms before a child account is activated
• Guardian accounts control all privacy settings, public visibility, and content approval for associated Young Dreamer profiles
• We do not knowingly collect personal information from children under 13 without guardian consent
• If we discover an account was created by a child under 13 without consent, we will immediately disable the account and delete the data
• Parents/guardians may review, update, or request deletion of their child's data by contacting us at privacy@wuv.world
• Young Dreamer journal entries, videos, and profile data are private by default (family_only privacy mode)

4. Identity Verification — Platform Engagement & Financial Privacy

We require a one-time Stripe Identity verification for all users who wish to engage with platform content (reactions, shares, votes) and for users who wish to activate their WUV Wallet for payouts. This single verification satisfies both requirements. We use Stripe Identity — an identity verification service operated by Stripe, Inc. Identity verification may be performed via our web platform or through our native mobile applications (iOS and Android), which use the Stripe Identity Native Mobile SDK.

• You will be asked to provide a government-issued photo ID (driver's license, passport, or state ID) and complete a selfie liveness check
• Why we require this: To prevent fake accounts, duplicate profiles, bot engagement, and fraudulent donation inflation — and to protect our Young Dreamer community from harmful or fake actors
• Native Mobile SDK: On iOS and Android, verification is handled via Stripe's prebuilt Identity SDK UI, which collects your ID documents, matches your photo ID with a selfie, and validates ID numbers directly within the app. This SDK is used unmodified as required by Stripe's terms of service.
• Synthetic Identity Protection: Stripe's verification system employs biometric matching and synthetic identity detection to reject verifications where selfie biometrics match a different person's PII, helping protect against identity fraud on our platform
• Stripe processes and securely stores identity documents on their servers under their own privacy policy. We do not receive or store raw copies of your ID documents
• We receive only a verified summary: your full name, date of birth, document type, and verification status
• Verification results are retained in our system for up to 1 year for compliance purposes
• All payout bank/card details are tokenized by Stripe. We store only masked references (last-4 digits)
• We may report payout information to tax authorities as required by applicable law
• See Stripe's Privacy Policy and Stripe Identity for full details

5. How We Share Your Information

We do not sell your personal information. We may share data in the following circumstances:

• With Service Providers: Stripe (payments, identity), Vimeo (video hosting), Backblaze (media storage), Firebase (push notifications), Twilio (phone verification), OpenAI (AI features), Google (maps, geocoding), Mailgun/SMTP/Mailwizz (email), Go High Level (CRM), Supabase (database infrastructure)
• With Other Users (Public Data): Your public profile, Dream Challenges, Dream Channel, leaderboard rankings, and community contributions are visible to other users based on your privacy settings
• With Guardians: Guardian accounts can view and manage their associated Young Dreamer accounts
• With School/District Admins: Aggregated participation data (no personal content) may be visible to verified school or district administrators on their dashboards
• For Legal Compliance: We may disclose information when required by law, court order, or governmental authority
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction

6. Data Retention

• Account data is retained for as long as your account is active
• Upon account deletion, personal data is removed within 30 days, except where required for legal compliance (e.g., tax records, payout history)
• Video content deleted by users is removed from our primary storage and CDN within 14 days
• Identity verification records are retained for up to 1 year per Stripe's and our compliance requirements
• Transaction and payout records are retained for 7 years for tax and legal purposes

7. Your Rights & Choices

• Access: You may request a copy of your personal data
• Correction: You may update your profile information at any time through your account settings
• Deletion: You may request deletion of your account and associated data
• Portability: You may request an export of your data in a machine-readable format
• Opt-out of Marketing: You may unsubscribe from marketing emails at any time using the unsubscribe link. Transactional emails (receipts, security alerts) cannot be opted out of while your account is active
• Push Notifications: You may disable push notifications in your device settings or in the platform's Notification Settings page
• California Residents (CCPA): You have the right to know, delete, and opt out of the sale of personal information. We do not sell personal information.
• EU/EEA Residents (GDPR): You have the right to access, rectify, restrict processing, port, and object to processing of your personal data. You may lodge a complaint with your local supervisory authority.

8. Cookies & Tracking Technologies

• We use session tokens (stored in localStorage) to maintain authentication
• We use analytics tools to understand platform usage and improve performance
• We use campaign tracking parameters (UTM, custom tracking links) to measure referral and marketing performance
• We do not use third-party advertising cookies

9. Security

• Passwords are hashed using PBKDF2 with salt — we never store plaintext passwords
• All data transmission is encrypted via HTTPS/TLS
• Financial data is managed exclusively by Stripe under PCI-DSS compliance
• We implement access controls and audit logging for administrative actions
• We periodically review and update our security practices

10. Third-Party Links

The Platform may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-platform notification. Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related questions, requests, or to exercise your rights, please contact us at:

• Email: privacy@wuv.world
• Web: wuv.world/contact
• Company: WUV World, Inc.