Aviex Solutions LLC ("we," "us," or "our") operates the BaseRecon mobile application ("App"). This Privacy Policy explains how we collect, use, disclose, and protect information when you use BaseRecon. By using the App, you agree to the practices described in this policy.

1. Information We Collect

Information You Provide Directly

• Account registration: Name, email address, and password when creating an account.
• Military verification: We use ID.me to verify military status. We receive only a verification status (e.g., "Active Duty," "Veteran") — we do not receive, store, or have access to your government ID, DD-214, or other documents submitted to ID.me.
• Community content: Reviews, tips, photos, and discount suggestions you voluntarily submit.
• Communications: Messages you send to us via email at feedback@baserecon.app.

Information Collected Automatically

• Usage data: Screens viewed, features used, session duration, and in-app interactions (via Firebase Analytics).
• Crash reports: Error logs and crash diagnostics (via Firebase Crashlytics).
• Device information: Device type, operating system, app version, and unique device identifiers.
• Push notification token: If you enable push notifications, your Expo push token is stored on our servers.

Information We Do NOT Collect

• Background location data — we use foreground location only (see Section 5)
• Financial information, credit card numbers, or bank details
• Government ID numbers, SSNs, military ID numbers, or DD-214 documents
• Biometric data

2. How We Use Your Information

We use your information to:

• Create and manage your account
• Verify your military status to unlock verified-only features
• Display personalized content based on your duty station selection
• Send push notifications about deals and updates (only if you opt in)
• Respond to your questions, feedback, and support requests
• Analyze usage patterns to improve the App
• Detect and prevent fraud, spam, and abuse
• Comply with legal obligations

We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects.

3. Information Sharing & Disclosure

We do not sell, rent, or share your personal information with third parties for their own marketing purposes. We may share information only in the following circumstances:

• Service providers: Firebase (Google) for authentication, database, analytics, and crash reporting. These providers operate under their own privacy policies and data processing agreements.
• ID.me: Military verification is processed by ID.me under their privacy policy. We receive only a verified status flag.
• Legal requirements: We may disclose information if required by law, court order, or to protect the rights and safety of our users or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred. We will notify you before any transfer takes place.

4. Military Identity Verification (ID.me)

BaseRecon uses ID.me as our military identity verification provider. When you verify through ID.me:

• Your verification is processed entirely on ID.me's secure platform
• We receive only a verification status (e.g., Active Duty, Veteran, Military Spouse)
• We do not receive, store, or view any documents you upload to ID.me
• Your ID.me access and refresh tokens are stored locally on your device in encrypted secure storage (iOS Keychain / Android Keystore) and are never transmitted to our servers

For questions about ID.me's data practices, see id.me/privacy.

5. Location Data

BaseRecon may request access to your device location to:

• Display nearby discounts and base resources
• Show base maps in the PCSing Soon tab

Foreground only: We only access your location while the App is actively in use. We do not track your location in the background.

Not stored: Location data is used in real time and is not stored on our servers or associated with your account.

You can revoke location access at any time in your device Settings. Core App functionality is available without location access.

6. User-Generated Content & OPSEC

BaseRecon allows users to submit reviews, tips, photos, and discount suggestions. By submitting content, you:

• Confirm the content does not violate OPSEC (Operational Security) guidelines
• Grant us a non-exclusive license to display the content in the App
• Acknowledge that content may be visible to other verified users

We reserve the right to remove any content that violates these guidelines without notice.

7. Children's Privacy (COPPA)

BaseRecon is available to users aged 13 and older. We comply with the Children's Online Privacy Protection Act (COPPA).

• We do not knowingly collect personal information from children under 13.
• If you are under 13, do not use this App or provide any information.
• If we learn we have collected information from a child under 13, we will delete it promptly.
• Parents who believe their child has provided information may contact us at feedback@baserecon.app.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out: Opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

To exercise these rights, contact us at feedback@baserecon.app. We will respond within 45 days. We may need to verify your identity before processing your request.

9. Data Security

We implement industry-standard security measures to protect your information:

• All data in transit is encrypted using TLS 1.2 or higher
• Firebase Authentication handles credential security
• Sensitive tokens (auth, ID.me, session codes) are stored exclusively in device-level secure storage (iOS Keychain / Android Keystore) — never in plaintext
• Our website uses Cloudflare's Full (Strict) SSL, HSTS, and TLS 1.2 minimum

No method of data transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

10. Data Retention

We retain your personal information for as long as your account is active, or as needed to provide the App's services. Upon account deletion:

• Account data and personal information is deleted within 30 days
• Community content (reviews, tips) may be retained in anonymized form
• Certain records may be retained longer as required by law

You may request deletion at any time by contacting us at feedback@baserecon.app or using the account deletion feature within the App.

11. Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Notify affected users within 45 days of discovery
• Describe what information was compromised and steps taken
• Provide guidance on steps you can take to protect yourself
• Comply with applicable state and federal breach notification requirements

12. Your Rights & Choices

• Account access: Review and update your profile information within the App.
• Push notifications: Opt in or out of push notifications in your device Settings.
• Location: Revoke location access at any time in device Settings.
• Account deletion: Request full account deletion via the App or by emailing us.
• Data export: Request a copy of your data by emailing feedback@baserecon.app.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Effective Date" at the top of this page
• Send an in-app notification and/or email to registered users

Your continued use of the App after changes become effective constitutes acceptance of the updated policy.

14. Contact Us

For privacy questions, requests, or concerns:

• Email: feedback@baserecon.app
• Company: Aviex Solutions LLC
• App: BaseRecon (baserecon.app)

We aim to respond to all privacy-related inquiries within 5 business days.