Privacy Policy
Last updated 17 September 2026
Three Lines Studio Ltd ("we", "us", "our") operates REX. This policy explains what we collect, why, who processes it, and the choices and rights you have. We are the data controller for the personal data described here.
1. Information we collect
- Account and profile: email address, username, name, profile photo, and anything else you add. If you use Sign in with Apple, the name and email address Apple shares with us (which may be a private relay address).
- What you post: recommendations, ratings, notes, photos, trips, lists, blasts, comments, likes, and your friend connections.
- Places you recommend: addresses and map coordinates, so they can be shown on the map.
- Your device's location: only if you allow it, and only while you're using the App, to centre the map on where you are. Apple turns the coordinates into an area name for the map's header. It isn't saved to your account, isn't shared with friends, and REX never tracks your location in the background. The App works without it.
- Your contacts: only if you choose "Find friends from your contacts". REX reads the email addresses in your contacts on your phone and scrambles each one (a SHA-256 hash) before anything leaves the device. Those scrambled values are compared with REX accounts to show which of your contacts are here, then discarded. We don't store your contacts, names or phone numbers.
- Imports: text you paste for import, and photos of recipes you choose to import (see section 4).
- Device and technical data: push notification token if you turn notifications on, device type and operating system, IP address, and basic logs needed to run and secure the service.
- Safety data: reports you make or that are made about your content, and who you have blocked.
- Records of consent: which version of these documents you agreed to, and when.
- Support: what you send us when you contact us or send feedback.
2. Why we use it, and our lawful basis
- Creating and running your account, showing your content to the friends you choose — to perform our contract with you.
- Using your location, your contacts, and sending push notifications — consent, which you give through the iOS permission prompts and can withdraw at any time in iOS Settings or in the App.
- Keeping REX safe: moderating reported content, preventing fraud and abuse, enforcing our Terms — our legitimate interest in a safe service, and our legal obligations.
- Understanding overall usage so we can improve the App — our legitimate interest in developing the service.
- Responding to your questions, complaints and data requests — our legal obligations and legitimate interests.
We don't sell your personal data, we don't use it for advertising, and we don't make decisions about you by automated means alone.
3. Who processes your data
We share data only with providers who process it on our instructions, under contract:
- Supabase — database, file storage and authentication.
- Google (Maps, Places) — maps, place and address lookup.
- Apple — Sign in with Apple, push notification delivery, and turning coordinates into an area name.
- Anthropic — reading documents and recipe photos you choose to import (section 4).
- TMDB, Open Library and Google Books — descriptions and ratings for films, TV and books shown on item pages. These are lookups of the title, not of you.
We may also disclose data where the law requires it, or to protect the rights and safety of our users.
Other people see what you post: your friends see your Rex, profile and activity. Some things are public by design — a shared trip or collection link opens for anyone who has the link, and content you post to a public collection is visible to anyone on REX.
4. Importing documents and recipe photos
When you use "Import from doc" or import a recipe from a photo, the text or image is sent to Anthropic's Claude to pick out the recommendations or read the recipe. REX doesn't store the photo — it isn't added to your account — and only the text you then choose to post is saved. Anthropic processes it under its commercial terms, doesn't use it to train its models, and deletes it after a limited retention period. If you'd rather not, type the details in yourself instead.
5. Anonymous posts
Marking a post anonymous hides your name and photo from other users in the App's normal display. It doesn't anonymise the underlying record: REX keeps the link between you and the post, and can be required to disclose it. Don't rely on it to post anything you wouldn't want linked to you.
6. Keeping and deleting your data
We keep your information while your account is active.
When you delete your account (Profile → Settings → Your data & privacy), your profile, recommendations, trips, lists, collections, comments, likes, photos, friend connections and notification settings are deleted immediately. Copies may remain in our providers' routine backups for a short period until those are overwritten, and we may keep a minimal record of reports and safety actions where we need to for legal reasons.
7. International transfers
Our providers may process data outside the UK and European Economic Area. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses.
8. Your rights
Under UK and EU data protection law you can: access a copy of your data; correct it; delete it; export it in a portable format; restrict or object to processing; and withdraw consent at any time.
Two of these you can exercise yourself, immediately: Profile → Settings → Your data & privacy → Download my data, or Delete my account. For anything else, email [email protected].
9. Complaints
If you're unhappy with how we handle your data, email [email protected] and we'll acknowledge it and investigate. If you're still unsatisfied you can complain to the Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
10. Children
REX is not for under-16s. We don't knowingly collect data from them. If we learn we have, we'll delete it.
11. Security
We protect your information with access controls on our database, encrypted connections, and rules that limit what each account can read. No system is completely secure, and we can't guarantee absolute security.
12. Changes
We may update this policy. When we make a material change we'll ask you to review and agree to the new version in the App, and we keep a record of when you did.
13. Contact
Three Lines Studio Ltd
Registered address: [TO CONFIRM — Kathryn to add the registered company address]