Privacy Policy

Personal information you disclose to us

In short: we collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, participate in activities on the Services (such as creating or joining an event), or otherwise when you contact us.

Personal Information Provided by You. The personal information we collect may include:

• names / display name
• username
• email address
• home city and precise home location (latitude/longitude) — used to calculate distance and travel options for events
• transport preference
• budget/cost ceiling for events you participate in
• availability windows and responses to event date proposals
• event commitment status (confirmed / declined / undecided)
• profile photo (if you choose to add one)
• [Planned, not yet built] visa/immigration status and living situation — intended to help friend groups coordinate around who can travel where and when

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In short: some information — such as your IP address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services, such as your IP address, browser and device characteristics, operating system, referring URLs, and information about how and when you use our Services. This is needed to maintain the security and operation of our Services and for internal analytics and reporting.

We also collect information through cookies and similar technologies — see our Cookie Policy for details.

The information we collect includes:

• Log and Usage Data. Service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services, recorded in log files (IP address, device information, browser type, activity such as pages viewed and actions taken, error reports).
• Device Data. Information about the computer, phone, or tablet you use to access the Services (IP address, device/application identification numbers, browser type, operating system, system configuration).
• Location Data. Your device's location, which can be precise (if you grant permission) or imprecise (derived from IP address). You can opt out by disabling Location access in your device settings, though this may limit some features (e.g. distance-based event planning).

Application data (once the mobile app ships)

If you use our mobile application(s), we may also collect, with your permission:

• Mobile Device Data: device ID, model, manufacturer, operating system, and related technical identifiers, needed for security, troubleshooting, and internal analytics.
• Push Notifications: we may request permission to send push notifications about your account or event activity. If you grant permission, we store a push token (a device identifier issued by your platform's notification service) together with a per-device identifier and your platform (iOS or Android), linked to your account. Tokens are limited to a small number of devices per account, are deleted when a device unregisters or its token stops working, and are deleted automatically if your account is deleted. You can opt out in your device settings at any time.

In short: we process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts.
• To deliver and facilitate delivery of the Services — including matching event details against your availability, home location, and preferences to help your group plan.
• To respond to user inquiries / offer support.
• To send administrative information — details about the Services, changes to our terms and policies, and similar information.
• To enable user-to-user communications — so participants in an event or group can see and coordinate around each other's shared details.
• To request feedback.
• To send marketing and promotional communications, if in line with your preferences. You can opt out at any time.
• To protect our Services, including fraud monitoring and prevention.
• To identify usage trends so we can improve the Services.
• To determine the effectiveness of our marketing and promotional campaigns.
• To save or protect an individual's vital interest, such as to prevent harm.

In short: we only process your personal information when we have a valid legal reason to do so under applicable law.

If you are located in the EU or UK, the UK GDPR/GDPR require us to explain the legal bases we rely on:

• Consent — where you've given us permission for a specific purpose. You can withdraw consent at any time.
• Performance of a Contract — to fulfil our obligations to you, including providing the Services.
• Legitimate Interests — where we believe it's reasonably necessary to achieve our legitimate business interests and those interests don't outweigh your rights and freedoms (e.g. analysing usage to improve the Services, fraud prevention).
• Legal Obligations — where necessary to comply with the law.
• Vital Interests — where necessary to protect someone's vital interests, e.g. situations involving a potential threat to safety.

In short: we share information with other participants in your events/groups, with the service providers who run the Services, and in specific situations described below.

Converge is a group-planning tool, not a public platform — your information isn't broadcast publicly. We share it in these situations:

• Other Participants. When you join an event or group, the details you share (availability, home location, transport preference, budget, commitment status, and — once built — visa status/living situation) are visible to other participants in that same event or group, so the group can coordinate. This is how the app is designed to work, not incidental exposure.
• Service Providers. We share information with the third parties who host and operate the Services on our behalf, under contract:
  • Supabase — database, authentication, and realtime infrastructure.
  • Vercel — application hosting.
  • Sentry — error monitoring and session replay (configured with Sentry's default privacy protections: text masked, media blocked).
  • OpenFreeMap — map tile hosting for the event canvas map. Every map view sends your IP address and the map area you're viewing to OpenFreeMap's servers.
  • Expo (push notification relay), Apple Push Notification service, and Google Firebase Cloud Messaging — once the mobile app ships, push notifications are delivered through Expo's push service, which relays them to Apple (for iOS devices) and Google (for Android devices). This means both your push token and the content of each notification — which can include event names and participant display names are processed by these providers, and this data may leave the UK/EEA. We send only what the notification needs; notification content never includes your availability details, home location, or budget.
• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business.

In short: yes — see our Cookie Policy for the full list and how to control them.

We use cookies and similar technologies to keep the Services secure, remember your preferences, and understand usage. Specific details are in our Cookie Policy.

In short: we keep your information for as long as necessary to fulfil the purposes in this Privacy Notice, unless a longer period is required by law.

We keep your personal information for as long as you have an account with us. When we no longer have an ongoing legitimate business need to process it, we will delete or anonymise it, or, where that isn't possible (e.g. backups), securely isolate it from further processing until deletion is possible.

In short: we aim to protect your information through organisational and technical security measures.

We've implemented reasonable technical and organisational security measures. However, no method of transmission over the internet or electronic storage is 100% secure, so we can't guarantee absolute security.

In short: depending on where you're located, you have rights over your personal information.

If you're in the EEA, UK, Switzerland, or Canada, you may have the right to: access and obtain a copy of your personal information; request rectification or erasure; restrict processing; data portability; and object to processing. Contact us using the details in "How Can You Contact Us About This Notice?" to make a request.

If you're in the UK and unhappy with how we've handled your personal information, you can complain directly to us at privacy@letsconverge.app. We will acknowledge your complaint within 30 days, investigate without unjustified delay, and keep you informed of progress and the outcome.

If you're not satisfied with our response, you can refer your complaint to the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Withdrawing consent: where we rely on your consent, you can withdraw it at any time by contacting us — this won't affect the lawfulness of processing before withdrawal.

Opting out of marketing: unsubscribe via the link in any marketing email, or by contacting us.

Account information: you can review or update your account details by logging into your account settings. Upon request to terminate your account, we will deactivate or delete your account and information from our active databases, though we may retain some information to prevent fraud, troubleshoot, assist investigations, or comply with legal requirements.

Most browsers include a Do-Not-Track ("DNT") feature. There's currently no uniform standard for how sites should respond to DNT signals, so we do not currently respond to them.

In short: if you're a resident of a US state with a comprehensive privacy law (e.g. California, Colorado, Virginia, Connecticut), you may have rights to access, correct, delete, or obtain a copy of your personal information, and to opt out of certain processing.

Categories of Personal Information We Collect (past 12 months)

We retain Category A, B, and G data for as long as you have an account with us. We have not disclosed, sold, or shared personal information to third parties for a business or commercial purpose in the preceding twelve months, and do not sell or share personal information.

Your Rights

Depending on your state, you may have the right to: know whether we're processing your data; access it; correct inaccuracies; request deletion; obtain a copy; non-discrimination for exercising these rights; and opt out of targeted advertising, sale, or profiling (we don't currently do any of these).

How to exercise your rights: email privacy@letsconverge.app. We may need to verify your identity before processing a request. Under certain state laws, you can designate an authorised agent to act on your behalf.

Appeals: if we decline to act on your request, you can appeal by emailing privacy@letsconverge.app. If your appeal is denied, you may complain to your state attorney general.

Australia and New Zealand. We process personal information under Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. You have the right to request access to or correction of your personal information — contact us using the details below. If you believe we're unlawfully processing your information, you can complain to the Office of the Australian Information Commissioner or the Office of the New Zealand Privacy Commissioner.

Republic of South Africa. You have the right to request access to or correction of your personal information. If unsatisfied with how we handle a complaint, you can contact The Information Regulator (South Africa) at enquiries@inforegulator.org.za.

Yes — we'll update this notice as necessary to stay compliant with relevant laws. The "Last updated" date at the top reflects the most recent revision. If we make material changes, we'll notify you by prominently posting a notice or sending you a direct notification.

If you have questions or comments about this notice, email us at privacy@letsconverge.app, or by post at:

Converge (pending incorporation)
[REGISTERED ADDRESS]

You may have the right to request access to, correction of, or deletion of your personal information, and to withdraw consent to our processing of it, depending on applicable law. To make a request, email privacy@letsconverge.app.