Privacy Policy

This Privacy Policy explains how Urban Craft Department ("we", "us", "our"), the company behind OatIsGoat (the "Service", including app.oatisgoat.co and the oatisgoat.co shop), collects, uses, stores and protects personal data of users ("you").

1. Who we are

Urban Craft Department is the data controller for information collected through the OatIsGoat app and shop. Contact us at privacy@oatisgoat.co for any privacy-related request.

2. What data we collect

• Account data: name, email address, hashed password, referral code, avatar/bio if provided.
• Security data: login timestamps, IP address, failed login attempts, device/session tokens — used to protect your account (lockouts, fraud prevention).
• Challenge & community content: photos/text you submit as challenge proof, posts, comments, votes.
• Points & rewards data: points balance, points history, redeemed rewards, coupon codes issued to you.
• Order data: order information synced from the OatIsGoat WooCommerce shop when linked to your account (for impact tracking and rewards), handled per WooCommerce's own processing and our payment processor's terms.
• Technical data: browser type, device information, cookies/local storage used to keep you logged in.

3. How we use your data

• To create and secure your account (including captcha and login-lockout protections).
• To operate the 30-day starter program, weekly challenges, points and rewards system.
• To moderate community content and enforce our Terms of Service.
• To send transactional emails (welcome, password reset, challenge approvals, reward notifications) and, where you have not opted out, occasional community updates.
• To calculate and display aggregate community impact statistics.
• To prevent fraud, abuse, and to comply with legal obligations.

4. Legal basis

We process your data based on: performance of a contract (running your account and rewards), legitimate interest (security, fraud prevention, service improvement), and consent (optional marketing emails, where applicable).

5. Sharing your data

We do not sell your personal data. We share limited data with service providers strictly to operate the Service, including: our transactional email provider (Brevo), our hosting provider, and our shop platform (WooCommerce) and its payment processor(s) for order and coupon processing. These providers are only permitted to use your data to provide services to us.

6. Data retention

We retain account data for as long as your account is active. If you delete your account, we remove or anonymize personal data within a reasonable period, except where we must retain records for legal, tax, or fraud-prevention purposes.

7. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (via your Account page or by contacting us).
• Request deletion of your account and associated personal data.
• Export your data in a portable format.
• Object to or restrict certain processing, and withdraw consent for marketing.

To exercise any of these rights, email privacy@oatisgoat.co. We will respond within one month as required by applicable data protection law (e.g. GDPR).

8. Security

We use industry-standard measures to protect your account, including password hashing, rate-limited login attempts, temporary account lockouts after repeated failed logins, CAPTCHA verification, and encrypted token-based authentication. No system is 100% secure; report any concern to security@oatisgoat.co.

9. Cookies & local storage

The app uses browser local storage to keep you signed in (an authentication token) and essential cookies required for the shop checkout to function. We do not use third-party advertising trackers.

10. Children

The Service is not directed at children under 16. We do not knowingly collect data from children under 16.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced on this page with an updated "Last updated" date.

12. Contact

Urban Craft Department · privacy@oatisgoat.co · see also our Company information and Terms of Service.