Privacy notice

The short version

We hold a phone number so you can sign in, a username, who you are friends with, and which parties you saved. Your phone number is never shown to another person. Who you are going with is visible only to friends you have accepted. Deleting your account deletes all of it immediately.

1. Who is responsible

Nightquest is a product. The organisation legally responsible for it (the “controller” under UK GDPR) is {{LEGAL ENTITY — UNDECIDED}}. Contact: {{CONTACT_EMAIL}}.

This notice is written under the UK GDPR and the Data Protection Act 2018. The service covers London and is for people aged 18 or over.

2. What we hold

Your phone number

Held in the authentication system only, where it exists in two places (the user record and its linked sign-in identity). There is no phone column on your profile, and there is no request any account can make that returns somebody else’s number. It is used to send a one-time sign-in code and for nothing else.

Your date of birth

Never stored. The 18+ check runs on our server and only the resultis kept — in a cookie your browser’s JavaScript cannot read, which expires in fifteen minutes and is deleted the moment your profile is created. What reaches the database is a timestamp saying the check passed.

Your username, display name and avatar

The username is required and is how friends find you. A display name is optional. Avatars are not in use today.

Your RSVPs

Which event, whether you are “interested” or “going”, and a per-RSVP setting of friends or only me.

Your friends and blocks

One record per pair of people, with its state.

Reports you file

The subject, the reason, and anything you wrote.

Your invite code

One permanent code per account, and any redemption of it.

Access records

Whether you have access, from what, and until when. We never see or store card details. There is no payment provider connected today; when there is, they hold the card, not us.

Abuse counters

A per-account count of how many username lookups and reports you have made in the current hour, so the limits can be applied.

Calendar feed token

The storage for it exists; the calendar feed itself is not shipped.

3. What we do not do

• No third-party product analytics. No PostHog, no Google Analytics, no Meta pixel, nothing of that kind. This is a decision, not an omission: streaming who-attends-what from a queer nightlife product to an analytics vendor would say something about people that they did not choose to say.
• No crash reporting today. Sentry is not installed. If it ever is, this notice changes first.
• No advertising, and no advertising cookies.
• We do not sell or share personal data.
• No contact upload today. If contact matching ever ships it will be opt-in and mutual — you would only be discoverable to someone who had also opted in.
• No profiling and no automated decision-making, with one exception: two independent reports about the same event or account hide it automatically, before a person has looked. A person then reviews it within 24 hours and can restore it. That is described in the community guidelines and you can ask us to look again at {{CONTACT_EMAIL}}.

4. Cookies

Three kinds, all strictly necessary, and all set so that page JavaScript cannot read them:

• Sign-in cookies — your session. They are what keep you signed in.
• A pending phone number — held for ten minutes between the two sign-in steps. It is a cookie rather than part of the web address on purpose, so your number never appears in a link, in browser history, or in the referrer header a page sends onwards.
• An 18+ confirmation — a yes/no, for fifteen minutes.

There are no analytics or advertising cookies, so under the Privacy and Electronic Communications Regulations there is no consent banner to show you. We are saying that explicitly because its absence would otherwise look like an oversight.

5. Why we are allowed to hold it

• Performing our contract with you — your account, your RSVPs, your friends.
• Our legitimate interests — safety, moderation, preventing abuse and fraud, and keeping the service secure. The balancing test is recorded at {{DPIA REF}}.
• Legal obligation — where we are required to keep something.
• Consent — only where we actually ask for it, which today is nowhere.

6. Special category data, said plainly

We do not ask for and do not store anyone’s sexual orientation or gender identity as data. But Nightquest is a queer nightlife product, and being a user of it can imply something about a person.

So we treat the whole dataset as if it were special category. That is why phone numbers are never exposed to other users, why RSVP names are visible only to accepted friends, why anything tagged sensitive saves as private, why there is no third-party analytics, and why deletion is immediate. {{LEGAL REVIEW: confirm whether an Article 9 condition is engaged.}}

7. Who else touches it, and where

• Database and sign-in: Supabase, London region. Your account data is stored in the UK.
• Hosting: Vercel. {{OPEN: the server functions have no pinned region and default to a US one. Pin them to London or state the transfer here before this page is published.}}
• SMS: Twilio, once sign-in codes go live. Twilio is a US company and a UK transfer mechanism is needed. {{PENDING}}
• Flyer images are loaded directly from promoters’ own image servers. That means your browser contacts them, and they can see your IP address. We tell your browser not to pass on which page you were looking at. Serving flyers from our own domain instead is planned.
• The map screen loads its map tiles from CARTO (built on OpenStreetMap). Your browser contacts their servers, which can see your IP address and which area of the map you are viewing — and if you let the map centre on you, that area is roughly where you are. We tell your browser not to pass on which site you came from, and we never send them your actual location fix. Serving tiles from our own domain is planned alongside the flyer change.
• Ticket links go to other companies’ sites, and they carry a parameter identifying Nightquest as the referrer. That is how the product is paid for, and it is also said in the terms.

8. How long we keep it, and deleting your account

You can delete your account from the “You” screen. It is immediate and permanent, with no grace period. It removes your phone number, your profile, your RSVPs, your friends and blocks, your reports, your invite code and your access records.

Two honest exceptions:

• our internal curation and moderation records keep the fact that something happened, with your identity removed from the record;
• if you had a paid subscription, we keep the payment provider’s own reference for it — not your name, number or account — only until we have confirmed the billing is cancelled, and then we delete that too. Continuing to bill someone who has left would itself be unlawful, which is why this one thing survives for a short time.

Otherwise, data lives for as long as the account does. One side effect worth stating: the “going” count on an event is worked out live, so deleting your account reduces it. We do not keep a stored total, because a stored total would be a record of you that outlived you.

9. Your rights

You have the right to access your data, to have it corrected, to have it erased (which you can do yourself, immediately), to restrict or object to how we use it, and to portability. To exercise any of them, email {{CONTACT_EMAIL}}.

You can also complain to the Information Commissioner’s Office at ico.org.uk.

10. Children

Nightquest is 18+ only and this is checked at sign-up. If we find an account belonging to someone under 18, we delete it.

11. Security

Sign-in cookies cannot be read by page JavaScript. There is no database key in your browser at all. And the privacy rules — who can see whose RSVP, who can see whose profile — are enforced inside the database rather than in the screens, so a bug in a screen cannot leak them.

12. Changes

If this notice changes we will update the date at the top, and we will tell you in the app if the change is significant.