LEGAL

PRIVACY
POLICY

Last updated: 9 July 2026

1. WHO WE ARE

Double Yellow is operated by Plucky Films Ltd ("we", "us", "our"). Our contact email is doublyellowapp@gmail.com.

We are the data controller for the personal data described in this policy. We are subject to UK GDPR and the UK Data Protection Act 2018.

2. WHAT DATA WE COLLECT

We collect only what's necessary to make the app work.

• Email address — used to create and manage your account.
• Username — a display name you choose. This is visible to other users on the leaderboard.
• Profile photo — optional. If you upload one, it is stored securely and visible within the app.
• Location data — your approximate location when you activate parking protection or submit a warden report. We do not track your location in the background when the app is closed.
• Warden report photos — optional photos you take when submitting a verified warden report.
• Push notification token — a device identifier used to send you warden alerts. This is not shared with third parties for marketing purposes.
• Usage and activity data — points earned, reports submitted, badges, and ranking data.
• App analytics — anonymous usage data such as which screens you visit and how often, used to improve the app. This data cannot be used to identify you individually.

3. HOW WE USE YOUR DATA

We use your data only to provide and improve the Double Yellow service:

• To create and authenticate your account.
• To send you real-time alerts when a warden is spotted near your parked car.
• To display warden reports on the community map.
• To calculate your points, rank, and badges.
• To display the community leaderboard (username and points only — no personal contact details are ever shown).
• To send you push notifications about nearby warden sightings.
• To improve app performance and fix bugs using anonymous analytics.

We do not sell your data. We do not use your data for advertising targeting. We do not share your data with any third party for marketing purposes.

4. LEGAL BASIS FOR PROCESSING

Under UK GDPR, we process your data under the following legal bases:

• Contract performance — processing your email, username, and activity data is necessary to provide the service you signed up for.
• Consent — we ask for your permission before accessing your location or camera. You can withdraw consent at any time in your device settings.
• Legitimate interests — we use anonymous analytics to understand how the app is used and to improve it. This does not override your rights or privacy.

5. THIRD-PARTY SERVICES

We use the following third-party services to operate Double Yellow. Each has its own privacy policy.

• Supabase (Supabase Inc, USA) — our database, authentication system, and file storage provider. Your account data, reports, and profile photo are stored on Supabase's infrastructure. Privacy Policy
• Firebase / Google (Google LLC, USA) — used for app analytics and push notification delivery on Android. Privacy Policy
• Google Maps (Google LLC, USA) — used to display maps within the app when placing a warden report pin. Privacy Policy
• Expo (Expo Inc, USA) — the platform used to build and distribute the app, and to deliver push notifications on iOS. Privacy Policy
• Resend (Resend Inc, USA) — used to send transactional emails such as password reset codes. Privacy Policy

Where data is transferred outside the UK (for example, to US-based services), this is done under appropriate safeguards including Standard Contractual Clauses.

6. DATA RETENTION

We keep your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it by law.

Warden reports are anonymised after 30 days — location data is retained to improve alert accuracy, but it is no longer linked to your account.

7. YOUR RIGHTS

Under UK GDPR, you have the following rights:

• Access — you can request a copy of the personal data we hold about you.
• Rectification — you can correct inaccurate data at any time in the app's Profile section.
• Erasure — you can request that we delete your account and all associated data.
• Restriction — you can ask us to stop processing your data in certain circumstances.
• Portability — you can request your data in a machine-readable format.
• Objection — you can object to processing based on legitimate interests.
• Withdraw consent — you can withdraw consent for location or camera access at any time in your device settings.

To exercise any of these rights, email us at doublyellowapp@gmail.com. We will respond within 30 days.

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

8. CHILDREN

Double Yellow is not intended for children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

9. SECURITY

We take reasonable technical and organisational measures to protect your data. All data is encrypted in transit using HTTPS/TLS. Access to your account data is controlled by row-level security policies — our servers can only return data belonging to the authenticated user.

No method of transmission or storage is 100% secure. If you have concerns about your account security, please contact us immediately.

10. CHANGES TO THIS POLICY

We may update this policy from time to time. If we make significant changes, we will notify you in the app. The "last updated" date at the top of this page always reflects the most recent version.

11. CONTACT

If you have any questions about this policy or how we handle your data, please contact us: