Privacy
The privacy promise
Profiles are never public.
There is no profile page and no way to look a member up. If you opt in to public posts, the only public view shows your handle, your avatar, and those posts: no bio, no area, no friends, no counts.
We collect the minimum.
An account is an email (for logging in, never shown to anyone), a handle, an optional avatar, and a home area picked from a fixed list. No real name, phone number, birthdate, or GPS.
Your location never reaches our servers.
The map centers on your device, in your browser. Searches send the box you are looking at, nothing about you, and nothing per-user is logged about it.
Photos are stripped of metadata before upload.
Images are re-encoded on your device so camera and GPS data never leave it. Video is transcoded, and the original file is never served.
Everything defaults to private.
Posts go to friends by default. Public posting is a switch you turn on, then a choice per post. Place lists are private. RSVPs are private: the organizer sees who is coming, everyone else sees a count.
Messages are encrypted at rest and expire.
Direct messages are stored encrypted and deleted after 90 days. End-to-end encryption is on the roadmap and documented as an open decision.
The companion forgets.
Conversations with Ivy are not stored unless you pin them, and unpinned ones expire after 24 hours. Ivy is told your handle and your stated interests, never your email, area, or friends.
No third-party analytics.
No trackers, no advertising pixels, no analytics SDKs, no fonts from a CDN. We keep aggregate counts (how many places, how many events) and nothing per person.
Deleting your account deletes it.
One action in settings removes your account, sessions, friendships, RSVPs, posts, comments, reactions, messages, action log, and companion conversations. Places and reviews you submitted stay, detached from you.
The system is public. The people are not.
The code, the docs, the data inventory, and the roadmap are published so anyone can check these claims. Who is a member, who went where, and who talks to whom are not.