Six Flags

"When you download the App, we may ask for your permission to track your precise, real-time location. If you consent, we may track your location even when you are not using the App unless you choose to restrict such tracking. You may change your location-tracking preferences at any time through the settings on your device or through the settings section in the App."

Six Flags tracks precise GPS location continuously in the background, even when the app is not actively being used, which goes well beyond what's needed for a theme park app.

"We may use any of the categories of Personal Data listed under Information We Collect for purposes of cross-context behavioral advertising, profiling, or targeted advertising. We also contract with third party advertising or analytics companies to serve you online ads on other websites. These companies use cookies or similar technologies to collect information about your interactions with our Site and interactions with other websites."

Six Flags uses all collected personal data categories for cross-context behavioral advertising and works with third-party ad companies that track users across multiple websites to build interest profiles.

"We partner with third parties to assist with many aspects of our business, including providing you products and services, fulfilling your orders, operating this Site, conducting surveys, advertising, analyzing your interests and activity on our Site and Social Media Pages, and helping us communicate with you. These third parties may provide services related to any of the purposes described in How We Use Your Information, and we may share with them any types of information described in Information We Collect."

Six Flags shares all categories of collected information with a broad range of third-party vendors for purposes including advertising and interest analysis, with no meaningful limits on what data can be shared.

"We learn about your browser type and version, type of computer or mobile device, browser language, IP address, and other technical information about your device. Internet or other electronic network activity information (such as your IP address, device identifiers, device advertising identifiers, mobile network, operating system details, language preferences, referring URLs, length of visits, anonymous traffic data, pages viewed)."

Six Flags collects extensive device data including device advertising identifiers, mobile network information, and detailed browsing behavior beyond what is needed for a theme park website and app.

"From time to time, we may change this Policy to accommodate new technologies, industry practices, regulatory requirements or for other purposes. We will provide notice to you if these changes are material and, where required by applicable law, we will obtain your consent. Notice may be by email to you at the last email address you provided us, by posting notice of such changes on our sites and applications, or by other means, consistent with applicable law."

Six Flags reserves the right to change the privacy policy at any time, with notice only required for material changes, and consent only where legally mandated — non-material changes can take effect silently.

"Our general retention of information is guided by our Record Retention Policy; however, we may utilize other criteria when necessary to determine a retention period, including (i) the length of time we have an ongoing relationship with you; (ii) whether there is a legal obligation to which we are subject; and (iii) whether a longer retention period is required or permitted by law. There may also be residual data that will remain within our databases and other records, which will not be removed."

Six Flags provides no specific retention timelines, references an internal policy not shared with users, and explicitly states that residual data will remain in their systems even after deletion requests.

"Under applicable law, we may decline to delete your Personal Data under certain circumstances, for example, if we need the Personal Data to complete transactions or provide services you have requested or that are reasonably anticipated, for security purposes, for internal business purposes (including maintaining business records), to comply with law, or to exercise or defend legal claims. Note also that we are not required to delete your Personal Data that we did not collect directly from you. There may also be residual data that will remain within our databases and other records, which will not be removed."

Deletion requests face numerous broad exceptions including 'internal business purposes' and 'reasonably anticipated' services, data collected from third parties is exempt, and residual data explicitly survives deletion.