PRIVACY POLICY

Effective Date: 09 SEPTEMBER 2026

This Privacy Policy outlines the internal data handling protocols, information flow practices, and user data protection standards applied by Silver State Apps Inc. ("we", "us", "our"), the operator of the Rocco platform, in connection with all user access to and engagement with our digital platform and associated service offerings (collectively, the "Platform"). Individual users of the Platform are addressed here as "you" and "your". Interacting with or utilizing any part of the Platform constitutes your voluntary acknowledgment and affirmative consent to the data collection, usage, retention, and protection practices defined below. This document has been drawn up by reference to applicable U.S. federal privacy standards and to the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA).

[ 1 ]   OVERVIEW OF INFORMATION FLOW & DATA COLLECTION MECHANISMS

Our platform operates through standardized data workflows that capture two primary streams of user information across all service interactions: information actively submitted by users during platform engagement, and contextual data passively captured through automated system protocols to sustain platform functionality. Data collection is directed at what is reasonably necessary to operate, maintain, and secure the Platform. All collected information is categorized as either user-provided personal identifiers or passive operational data for consistent privacy management.

Active user-submitted information includes all profile-related identifiers, custom user content, account credential data, and textual or interactive material voluntarily shared while utilizing platform features. This category also encompasses all user-initiated communications submitted through platform support or interactive channels. Passively collected operational data includes device metadata, access session metrics, platform interaction patterns, network connection parameters, and system log data generated during every platform visit. Additionally, all user inputs, system prompts, and algorithmic interactions tied to the platform’s automated and intelligent processing systems are captured as operational interaction data to refine service stability and algorithmic performance.

Three further streams flow from the Platform's interactive components:

▪  Interactive exchange data — electronic messages addressed to a fellow User, check-in entries, shared daily entries, the record of participation in joint activity, and whichever profile particulars you elect to render visible across the user base.

▪  Figure engagement records — the nicknames you adopt, the personalisation settings you choose, a history of your engagement, tallies of streaks and of milestones reached, together with the register of Digital Asset Offerings standing to your platform access profile.

▪  Visual asset data — images you elect to introduce, and milestone or commemorative visuals assembled for you inside the Platform.

Biometric identifiers, facial geometry, and voiceprints fall outside what is captured; so does position, save where Section 2 describes it. Neither an address book nor a contact list is requested by the Platform, captured by it, or uploaded to it.

Material to be withheld by you. Government-issued numbers, the particulars of any account you maintain with a financial institution, records touching health or treatment, the street on which you actually reside, and any credential that grants access to anything: all of these are to be kept out of the intelligent processing features and out of whatever you transmit to a fellow User. Anything of comparable sensitivity belongs in the same list.

[ 2 ]   DEVICE-LEVEL AUTHORISATIONS

Four authorisations upon your device underlie optional components, each remaining yours to grant, withhold, or subsequently revoke through your device system settings. None is sought in advance of use; each is sought at the moment the component concerned is reached. Withholding one costs that component alone.

▪  Photos, media, and storage. It is raised twice, and for nothing besides: when a picture of yours comes into the Platform, and when a visual assembled for you is written out to your device. The one file at issue is all that is touched; the remainder of what you hold on the device is neither indexed nor scanned.

▪  Camera. Capture of something new without leaving the application is the sole occasion on which it is raised.

▪  Push notifications, whose purpose is the delivery of reminders, activity alerts and service announcements. Shutting the channel again is a matter of your device system settings and takes effect whenever you choose.

▪  Location. A component that turns upon knowing where you are is the occasion for it, and precise location is what it supplies; nothing beyond that component draws on it. The authorisation is optional: withheld, the location may be typed in by hand — the ZIP code, the city, or the neighborhood — and the component then proceeds on that entry. No reading is taken in the background, and once the application is closed no location is gathered.

[ 3 ]   AUTHORIZED DATA USAGE & OPERATIONAL PROCESSING

All collected user information is processed only for legitimate operational, security, and service enhancement purposes that directly support platform delivery. We utilize stored user data to administer secure account access, validate user identity, sustain core platform operations, resolve user inquiries, and maintain consistent service functionality across all user interactions. Data processing activities further include anonymous trend analysis, service performance optimization, algorithm refinement for automated platform features, and proactive security monitoring to mitigate unauthorized access, fraudulent activity, and platform misuse.

Delivery of your messages to the addressees you name, and display of entries you have chosen to put on view, constitute a further purpose. So does the running of joint activity together with the award and exhibition of Digital Asset Offerings. So does the assembly of milestone and commemorative visuals from your records and submissions, and their placement where you can retain or extract them. So, finally, does the weighing of escalations lodged by Users and the consideration of material or conduct running counter to our operating rules or to law, whereupon whatever measure strikes us as fitting may be adopted at discretion. Legal claims brought, defended or answered, and enforcement of the terms upon which the Platform is furnished, account for the remainder.

Sale of personal information does not occur here, nor does its rental or its lease, to an external party or to anyone else, under any circumstance whatever. Cross-context behavioural advertising receives nothing. Targeted advertising is not conducted at all. Profiling directed at decisions of legal or similarly significant effect is not undertaken.

[ 4 ]   CONTROLLED DATA SHARING & THIRD-PARTY LIMITATIONS

User personal data is only shared with external third-party entities under limited circumstances. Disclosure may be made to service providers and operational partners delivering essential backend, technical, or analytical support for the Platform; such parties are engaged on terms that bind them to confidentiality and confine their use of the data to the work they perform for us.

User data may also be disclosed when legally required to comply with governmental regulatory requests, court mandates, or federal and state legal obligations. Disclosure may additionally occur to protect the legal rights, property, and safety of our platform, users, and the general public. De-identified, aggregated user data that cannot be linked to any individual user may be used for internal analytics and service reporting.

Exposure across the user base. The name you display, the particulars on your profile, the messages you exchange, the entries you make visible, the Digital Asset Offerings you exhibit — whatever of these you place on view through an interactive component travels to the Users you have named, or to whoever else has a part in that component. It then lies open to them to read, to retain, to capture as an image, and to circulate onward. What they do with it after that is past our reach and no responsibility of ours. Once a recipient holds something, it is not open to us to recall it.

Practices belonging to others. How Google handles data — Google Play being the channel through which the application is distributed — and how any sign-in service you choose to use handles it, are matters for their own policies. Those policies are not ours to direct, and no responsibility under them falls on us.

[ 5 ]   INTELLIGENT SYSTEM DATA HANDLING PROTOCOLS

The Platform integrates automated and intelligent processing systems to deliver enhanced interactive service capabilities. User inputs and interactions passing through those systems are handled under this policy. Generation of platform outputs, responsiveness of the system, accuracy of the algorithms and refinement of the service experience account for the processing in the first instance. Threat screening, abuse detection, fault diagnosis, quality assessment and the general betterment of the Platform account for it thereafter. A portion of it may be handled for us by whoever supplies the models or the infrastructure.

Access stands narrowed. Three occasions permit authorised personnel, few in number, to look at an input or an output: an abuse or safety question wanting investigation, a support request wanting settlement, and a legal requirement wanting compliance. Outward distribution for commercial modelling does not happen, and neither does transfer to a data broker. Users acknowledge that intelligent system outputs are algorithmically generated for platform convenience only, and all associated data processing is a necessary component of platform service delivery.

[ 6 ]   CLOSURE OF YOUR PLATFORM ACCESS PROFILE

A self-service closure control resides within the settings area of the Platform, by which your platform access profile may be expunged permanently, upon your own initiative and at whatever moment you elect, with no need to correspond with us and no need for any procedure outside the application. Removing the application from your device, of itself, expunges nothing.

Closure admits of no reversal. Four things lie beyond its reach: records we have a right or a duty to keep, for whatever reason — legal, fiscal, security, anti-fraud, a dispute, or enforcement — copies held in backup or archive until the ordinary cycle overwrites them, material already sent by you to a fellow User which now rests with that person, and aggregates or records stripped of identifiers from which nobody can be made out. Every Digital Asset Offering attaching to the profile is extinguished with it.

[ 7 ]   DATA RETENTION & USER CONTROLLED DATA LIFECYCLE

We maintain a structured data retention lifecycle designed to preserve user data only for the duration required to fulfill operational, legal, and security obligations. Active account data is retained for the full duration of a user’s active platform membership. Operational logs, session data, and algorithmic interaction records are retained for a limited operational window before de-identification or deletion.

Upon a valid request for data removal or profile closure, identifiable personal data is erased from active platform systems, save where retention is required by law or is necessary for compliance, dispute resolution, security review, anti-fraud purposes, or the establishment or defence of a legal claim. Residual copies may persist within backup systems until overwritten in the ordinary cycle.

Four rules of thumb govern duration. A profile record lasts as long as the profile does, plus a short tail thereafter across which closure is finished off and disputes are settled. An operational or diagnostic log lasts a rolling window set by what security and troubleshooting actually demand. Correspondence with support lasts until the matter, and anything growing out of it, is done with. An input or output of the intelligent processing features lasts no longer than those features have use for it.

[ 8 ]   DATA SECURITY SAFEGUARDS & RISK MITIGATION

We maintain a layered security framework combining technical, administrative, and operational safeguards directed at protecting stored user personal data from unauthorized access, modification, disclosure, or destruction. These safeguards may include data encryption, role-based internal access restrictions, and security monitoring. Personnel holding authorised access are subject to confidentiality obligations.

No digital storage or data transmission system can guarantee absolute security, and no such guarantee is given here. Anything transmitted to the Platform travels at your own risk. The safekeeping of your access credentials and of the device upon which you use the Platform rests with you.

[ 9 ]   CALIFORNIA RESIDENT PRIVACY RIGHTS (CCPA/CPRA) & USER AUTONOMY

Residents of California possess statutorily protected consumer privacy rights in respect of personal data collected and maintained by our platform, grounded in the CCPA and the CPRA. These rights include the ability to access records of collected personal data, to request correction of inaccurate stored information, to pursue deletion of eligible personal data, and to obtain disclosure of data sharing practices.

Sale and sharing. The statutory opt-out presupposes an underlying activity to opt out of. Here that activity is absent: nothing is sold, and nothing goes out for cross-context behavioural advertising. A request aimed at such an opt-out therefore meets nothing, and the same holds for a preference signal arriving from a browser or a device.

Sensitive personal information. A right of limitation under California law answers to uses and disclosures of a particular description. None of that description takes place here, and nothing of the kind is turned to account in building a picture of what sort of person you are.

Automated decision-making. No automated processing is turned to decisions that carry legal consequences, or consequences of a similarly significant order, for you.

Categories collected and disclosed across the preceding twelve (12) months. Six categories describe the whole of it. First, identifiers — an email address, an IP address, a device identifier. Second, activity upon an electronic network, meaning records of interaction and measurements of performance. Third, whatever Users have submitted by way of content or communication. Fourth, visual material, reaching no further than images introduced by you and visuals assembled on your behalf. Fifth, precise location, taken through the device authorisation described in Section 2 and from no other source. Sixth, inferences resting on the five preceding. Providers of hosting, of storage, of diagnostics and of security receive these categories; no recipient beyond them does.

Exercising a statutory privacy right brings no penalty with it: service is not curtailed, no feature is withdrawn, and nothing is refused you for having asked. Inquiries and formal requests of the California kind go to roccoandfeedback@roccovo.com. Nothing is acted upon until identity has been settled, and a request unusual or sensitive in character may call for evidence past what is already held. The period for resolution, and the footing on which resolution proceeds, are those the statute lays down. Three grounds permit refusal, whether entire or partial — an exemption that reaches the request, an identity that cannot be settled, and a request plainly excessive, or one without foundation. An agent acting under written proof of authority may proceed for you, and confirmation may be sought from you directly.

[ 10 ]   PRIVACY RIGHTS IN OTHER STATES

Comprehensive consumer privacy statutes stand enacted in a number of states beyond California, and residents there may hold rights of a familiar cast: to reach what is held, to have it put right, to have it deleted, to obtain a portable copy, and to stand aside from advertising that is targeted, from any sale of personal data, and from particular kinds of profiling. Not one of those last three activities is carried on here. A request directed to roccoandfeedback@roccovo.com is dealt with as the statute governing you requires; where that statute gives an appeal against a refusal, a reply to the answer you receive lodges it, and the attorney general of your state remains available thereafter.

[ 11 ]   PROCESSING AND STORAGE LOCATION

The Platform is operated from the United States, and the servers and analytical systems supporting it may stand within the United States or within other territories where our infrastructure suppliers maintain facilities.

[ 12 ]   AGE VERIFICATION & MINOR DATA PROTECTION

The Platform is exclusively designed and intended for use by adult individuals aged 18 years or older. We do not knowingly collect, store, or process personal data belonging to minors under the age of 18. Where the presence of minor data comes to our notice, the associated records may be deleted and the platform access profile closed, as we judge fit, without notice. Any party identifying minor data presence on the Platform may notify us at roccoandfeedback@roccovo.com.

An absolute bar stands against material that shows a person under eighteen (18) or puts such a person in sexual terms. Four steps lie open to us should any surface: the material taken down, the platform access profile behind it closed, the surrounding records preserved, and any report the law demands of us made to the competent authorities.

[ 13 ]   POLICY AMENDMENTS & TRANSPARENCY UPDATES

We reserve the right to amend, update, or revise this Privacy Policy at any time to reflect changes in platform data workflows, security protocols, industry best practices, or regulatory privacy compliance requirements. All policy revisions will be posted directly within the Platform. Continued platform usage following the publication of updated policy terms constitutes user acceptance of all revised data handling practices.

[ 14 ]   PRIVACY INQUIRIES & USER SUPPORT

All questions, formal inquiries, data right requests, and privacy-related correspondence may be directed to our dedicated privacy support channel at roccoandfeedback@roccovo.com. Valid user privacy submissions are answered in accordance with applicable U.S. federal and state privacy regulations.