Privacy Policy

Last Updated: August 2026

1. Information We Collect

A. Information You Provide Directly

• Account & Identity: Display name, email address, and username. Your password is handled entirely by Firebase Authentication (Google) or by Sign in with Apple / Google Sign-In — we never receive or store your password.
• Profile Content: Profile photo, bio, pronouns, interests, vibe prompts, mood status and mood emoji, host-style tags, general location (e.g. “Brooklyn, NY”), and your visibility preferences.
• Optional Contact & Social Handles: Phone number, Instagram, X, and Threads handles. These are optional, and each has its own visibility setting that you control.
• Event Content: Events you create — title, description, cover image or emoji, category and tags, venue name and coordinates, date and time, capacity, price, age restriction, and visibility settings.
• Chat Messages: Messages you send in event group chats and direct messages, including text, timestamps, and read state.
• Photos & Media: Profile photos, event cover images, and photos you add to an event’s shared photo wall.
• Social & Connection Data: Friend requests and friendships, “met at” connections, and users you have blocked.
• Payment Information: When you buy a ticket, your card details and billing address go directly to Stripe, our payment processor. We never see or store your full card number. We retain the transaction record: amount, ticket type, purchase time, card brand, and last four digits.
• Feedback & Reports: Messages, bug reports, and any content or user reports you submit.

B. Information Collected Automatically

• Location Data: With your permission, your device’s location, used to show events near you and to place events you create on the map. Location is only used while the app is open — we do not track your location in the background.
• Push Notification Token: A device token and platform identifier (iOS or Android) so we can deliver notifications.
• Server Logs: Our servers record standard request logs — IP address and access timestamps — to run the service, diagnose faults, and prevent abuse.

C. Information from Third-Party Sign-In

• Google or Apple Sign-In: If you sign in with Google or Apple, we receive your name, email address, and profile photo where available. If you use Sign in with Apple and choose to hide your email, we only ever see Apple’s relay address.

2. How We Use Your Information

• Operate, maintain, and improve ThirdSpot
• Show you events near you and let you create, discover, and join them
• Run event group chats and direct messages
• Process ticket purchases and refunds
• Send push notifications about events, friend requests, and messages
• Enforce age restrictions on events that have them (see Section 4)
• Moderate content, review reports, and keep the platform safe
• Enforce our Terms of Service and Community Guidelines
• Contact you about your account or important service changes

3. Age Requirements & Age-Restricted Events

• You must be at least 18 years old to use ThirdSpot. ThirdSpot is not directed to children, and we do not knowingly collect personal information from anyone under 18.
• We do not require or collect your date of birth during account setup. You confirm that you are at least 18 when accepting the User Agreement.
• If we learn that an account belongs to someone under 18, we will delete the account and its personal data promptly. If you believe someone under 18 has an account, contact us at the address in Section 14.
• Organizers may additionally restrict an event to 21+ (or mark it 18+). The age restriction is shown before a person joins or buys a ticket.
• Organizers remain responsible for verifying age at the door. ThirdSpot does not perform identity verification.

4. Third-Party Services

We use these services to operate ThirdSpot. Each handles data under its own privacy policy:

• Firebase (Google): Account authentication, cloud storage for photos, and push notification delivery. We do not use Firebase Analytics or Crashlytics.
• Google Sign-In and Sign in with Apple: Optional authentication providers.
• Google Maps: Renders the map and resolves place names. Google receives map and location requests needed to draw the map.
• Stripe: Payment processing for tickets. Stripe receives and stores your card and billing details directly.
• Render: Hosts our servers and database.

5. How Your Information Is Shared

• With other users: Your name, username, profile photo, bio, pronouns, interests, mood, and the events you join are visible to other users as part of the service. Your privacy settings control the visibility of certain details, and your optional contact handles are hidden unless you choose to show them.
• With event organizers: When you join an event or buy a ticket, the organizer can see your name, profile photo, and attendance status, plus purchase details for paid events.
• With service providers: The services listed in Section 4, only as needed to operate ThirdSpot.
• For legal reasons: Where required by law, subpoena, or court order, or to protect the rights and safety of our users or the public.
• In a business transfer: If ThirdSpot is involved in a merger, acquisition, or sale of assets, your data may transfer to the acquiring entity. We will notify you before your data becomes subject to a different privacy policy.
• With your consent: Any other sharing you explicitly approve.

6. Location Data

• Location access is requested only with your explicit permission, and ThirdSpot works without it — you can browse by choosing an area manually.
• We use location to show nearby events and to place events you create on the map.
• Location is collected only while the app is in use. We never collect your location in the background.
• Your device location is not displayed to other users. Event venue locations are different: an organizer chooses whether a venue is public or revealed only to approved attendees. Guests who are not signed in receive only a general area.
• You can revoke location access at any time in your device settings.

7. Photos, Content & Moderation

• Photos are stored on Firebase Storage (Google Cloud).
• Photos added to an event’s photo wall are visible to that event’s attendees.
• We use automated tools and human review to screen images and reports for prohibited sexual or abusive content. Automated screening can make mistakes and does not replace reporting.
• Every user and piece of content can be reported in-app, and you can block any user. Reports are reviewed and we remove content and suspend accounts that break our rules.
• You can delete your photos at any time in the app.

8. Data Retention

• We keep your personal data while your account is active.
• If you delete your account, your personal data is deleted within 30 days, including your authentication record, except as noted below.
• Transaction and payment records may be kept up to 7 years to meet legal, tax, and accounting obligations.
• Limited data may be kept longer where required by law, or to resolve disputes and prevent fraud and abuse.
• When you delete your account, messages and media authored by your account are deleted from our active database. Limited encrypted backups and security logs may persist temporarily until they rotate.

9. Your Rights & Choices

• Access: Request a copy of the personal data we hold about you.
• Correction: Update your details any time in your profile settings.
• Deletion: Delete your account and personal data directly in the app under Settings → Delete Account, or by contacting us.
• Portability: Request your data in a portable format.
• Notifications: Turn any category of push or email notification off in the app or in your device settings.

You can download a machine-readable copy from the authenticated data-export endpoint, use in-app profile and deletion controls, or email info@secondlifesoftware.com. We verify requests to protect your account and respond within the period required by applicable law.

10. California Residents (CCPA/CPRA)

We voluntarily provide the access, correction, deletion, and portability controls above to all users. If the CCPA/CPRA applies to our business, California residents also have the right to know the categories and specific pieces of personal information collected, the sources and purposes, categories of recipients, to correct or delete eligible data, to limit certain uses of sensitive personal information, and not to be discriminated against for exercising those rights. Precise geolocation is sensitive personal information under California law.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA. Because we do not do either, there is no opt-out to offer — but you can still exercise every other right above by contacting us.

11. Users in the European Economic Area & United Kingdom (GDPR)

Where GDPR or UK GDPR applies, we process your data on these legal bases:

• Contract: to provide the account and features you asked for
• Consent: for location access and push notifications, which you can withdraw at any time
• Legitimate interests: to keep the platform safe and prevent abuse
• Legal obligation: to retain financial records

You have the right to access, rectify, erase, restrict, or port your data, to object to processing, and to withdraw consent at any time. You may also complain to your local data protection authority. Our servers are located in the United States, and we rely on Standard Contractual Clauses where data is transferred out of the EEA or UK.

12. Security

We use encryption in transit (TLS), authentication handled by Firebase, server-side access controls, input validation, and time-limited ticket codes. No system is perfectly secure, and we cannot guarantee absolute security, but we will notify you and the relevant authorities of a breach affecting your data as required by law.

13. Changes to This Policy

We may update this policy. We will notify you in the app or by email before material changes take effect, and the “Last Updated” date above always reflects the current version.

14. Do Not Track & Global Privacy Control

ThirdSpot does not track your activity over time across third-party websites or apps for advertising, so browser Do Not Track signals do not change our practices. We treat recognized Global Privacy Control signals as an opt-out of sale or sharing where applicable; we do not currently sell personal information or share it for cross-context behavioural advertising. Google Maps, authentication providers, Stripe, and other service providers may receive the requests described above to provide their services, subject to their own policies.

15. Contact Us

Questions, requests, or concerns about your data:

Email: info@secondlifesoftware.com
Operated by: Second Life Software

We will get back to you as soon as we can, and within 30 days for formal data requests.