Enigma: What’s that in the Sky

"Geolocation Information. We may request access or permission to track location-based information from your mobile device, either continuously or while you are using our mobile application(s), to provide certain location-based services. If you wish to change our access or permissions, you may do so in your device's settings."

The policy explicitly states they may track location "continuously" — not just while the app is in use — which means persistent background GPS tracking of users.

"Mobile Device Access. We may request access or permission to certain features from your mobile device, including your mobile device's camera, microphone, sensors, storage, and other features. ... Device sensor data. Sensor data is information recorded from a user's device. Examples include accelerometer data, magneto-metric data, and LiDAR data."

The app requests access to camera, microphone, storage, accelerometer, magnetometer, and LiDAR — a very broad set of device sensors and hardware features that goes well beyond typical app needs.

"The categories of third parties we may share personal information with are as follows: Ad Networks, Cloud Computing Services, Communication & Collaboration Tools, Data Analytics Services, Data Storage Service Providers, Performance Monitoring Tools, Product Engineering & Design Tools, Testing Tools, User Account Registration & Authentication Services, Website Hosting Service Providers."

Personal information is shared with a broad range of third parties including ad networks and data analytics services, which can collect and use data for their own purposes including advertising.

"Enigma Labs, LLC collects and shares your personal information through: Targeting cookies/Marketing cookies, Beacons/Pixels/Tags. ... We may use cookies and similar tracking technologies (like web beacons and pixels) to access or store information."

The company explicitly uses targeting/marketing cookies and tracking pixels, which are standard tools for cross-site tracking and building advertising profiles across services.

"Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements."

There is no specific deletion timeline, and data may be retained indefinitely after account termination under broad justifications like fraud prevention and troubleshooting.

"We may update this privacy notice from time to time. The updated version will be indicated by an updated "Revised" date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification."

Changes take effect immediately upon posting, and notification of material changes is discretionary ("may notify"), meaning users could be bound by new terms without meaningful notice.

"If you would at any time like to review or change the information in your account or terminate your account, you can: Contact us using the contact information provided. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases."

There is no self-service account deletion — users must contact the company via email to terminate their account, and even then the company only commits to deactivating or deleting from "active databases" while retaining data elsewhere.