Privacy Policy

Joinue is operated by Joinue LLC, an Arizona limited liability company (“Joinue,” “we,” “us”). We are the company responsible for the personal data described in this policy, and we can be reached at privacy@joinue.com or by mail at Joinue LLC, PO Box 40441, Tucson, AZ 85717, United States.

Joinue is built and operated in the United States and is intended for people in the United States. We don’t target the service to the European Economic Area, the United Kingdom, or Switzerland, and we don’t offer it in local currencies or languages for those regions.

We collect only the data that helps us provide a better experience for you and your community. Here’s what we gather and why:

Account Info (email, password, or a linked Google/Apple account)

For secure login and important communications about your account and events. You can sign in with a password or with your Google or Apple account.

Phone number (optional)

If you add and verify a phone number, we use it to send the text-message notifications you opt into. You can remove it anytime in Settings.

Profile Info (name, handle, photo)

So your friends can find and connect with you, and you can build meaningful relationships.

Date of birth

We ask for it when you create your account, to check you are at least 18, and, if you choose, to show your birthday to your connections. If an account has no date of birth on file, or one that says the person is under 18, that profile stays visible to their connections only. We never show your birth year or your age to anyone, and we never share your date of birth with other users. You can correct it once yourself in Settings, under Privacy; after that, contact us at privacy@joinue.com.

Your birthday (the day, not the year)

We show the day and month of your birthday to people you are connected with, on your profile and as a reminder on their home screen around the date. You choose this when you create your account, where it starts switched on, and you can change it anytime in Settings, under Privacy. It is never shown to anyone outside your connections, whatever your profile visibility is set to, it never includes your birth year or your age, and it is never shown at all for accounts under 18.

Location (optional, precise or city-level)

If you turn on location features, we use your device's precise GPS location to find nearby places and events. A live session location is held in a temporary, secure cookie and is not saved to your profile unless you choose to set a home location. You can clear it anytime in Settings.

Event interactions

RSVPs, invites, and clicks help us suggest relevant events you'll actually want to attend.

Usage and analytics

We record basic events about how people use Joinue and our website, such as pages visited, buttons clicked, and the steps of signing up. We use this first-party data to understand what works and improve the product. Some of it is collected before you create an account and is not linked to your identity. We do not sell it, share it with advertisers, or use it to track you across other sites.

Connections (your Orbit)

Who you connect with helps us surface events from people you know and suggest who to invite.

Messages and content you create

Direct and group messages, plus photos and other content you post, so you can coordinate events with others.

Payment information

If you make a payment (for example, a donation), our payment processor handles your card details. We never see or store your full card number. If you add a peer-payment handle (like Venmo or Cash App) to settle costs with friends, we store that handle so it can be shown to people you choose to share it with.

Technical and device data

We process your IP address and basic device information to keep accounts secure, prevent abuse, and rate-limit requests.

Business engagement (for business accounts)

Helps Joinue match events to the right local audiences and support local businesses.

Device tokens (mobile app)

To send push notifications about events, messages, invitations, and updates you've opted into.

Joinue uses cookies and similar local storage only to make the app work. We do not use advertising cookies or third-party tracking cookies, so there is nothing here to opt into or out of.

Sign-in and session cookies

Keep you logged in securely and remember your session between visits.

Preference cookies

Remember choices like your theme so the app behaves the way you left it.

Demo cookies

Hold temporary state if you explore the demo, and are cleared when you leave it.

You can clear these at any time through your browser settings. Because they are essential to running Joinue, clearing them will sign you out and reset your preferences.

• Sell your personal data
• Let advertisers track you
• Share your personal data with third parties for profit

• Suggest events based on what's near you, what you attend, and who you know
• Let users and businesses reach interested people only inside Joinue

To show you events that match your interests, location, or social circles

We analyze your preferences and connections to surface events you'll actually want to attend.

To surface local businesses, venues, or recurring events you may like

We help you discover great local spots and regular events in your area.

To help business accounts reach relevant, nearby users (no outside ad networks)

Businesses can promote events to interested local users, but only within Joinue.

Your Settings put you in control. From there you can:

• Set or clear your home location and control location-based suggestions
• Hide your online status from others
• Stop sharing your birthday with your connections
• Choose which notifications you receive, by category and channel
• Export your data or delete your account at any time

If you opt into text-message notifications, we use your mobile number only to send the notifications you asked for. We do not sell your mobile number, and we do not share your mobile number or your SMS opt-in and consent with any third parties or affiliates for their own marketing or promotional purposes. The only third party that receives your number is our SMS delivery provider (Twilio), and only to transmit the messages you opted into.

You can opt out anytime by replying STOP to any message, or by turning off the “Also text me” toggles in Settings. For details, see our SMS Messaging Policy.

Depending on where you live, you may have specific rights regarding your personal data. We honor these rights for all users, regardless of location.

Right to Access

You can request a copy of the personal data we hold about you.

Right to Deletion

You can request that we delete your personal data. We will comply unless we have a legal obligation to retain it.

Right to Correction

You can update or correct inaccurate personal data through your account settings or by contacting us.

Right to Data Portability

You can request your data in a commonly used, machine-readable format to transfer to another service.

Right to Opt Out

We do not sell your personal data. If this ever changes, you will have the right to opt out.

To exercise any of these rights: You can export your data and delete your account yourself anytime in Settings. For anything else, email us at privacy@joinue.com with your request. We will respond within 30 days. We will not discriminate against you for exercising these rights.

Account Data

Retained while your account is active. Removed promptly when you delete your account from Settings, except as required by law.

Event Data

Public events remain visible. Your RSVPs and attendance history are deleted with your account.

Messages

Messages you've sent stay visible to other participants in a conversation, shown as from a deleted user once you leave. May be retained longer if part of an active report or investigation.

Backups

Encrypted backups are retained for a limited period for disaster recovery, then permanently deleted. Deleted data may persist in a backup until that backup rotates out.

Consent records

A limited record that you accepted our Terms and opted into texts (the date, the version you agreed to, and the number you consented to) is kept even after you delete your account, so we can honor those choices and, if ever needed, show they were made. The same limited record is kept when you leave a phone number on an event RSVP form as a guest, without an account. It is not used for anything else.

• All data transmitted using TLS/SSL encryption
• Passwords hashed by our authentication provider using industry-standard algorithms, with optional two-factor authentication
• Who can read your profile is enforced by row-level rules in the database itself, not only in app code, so a bug in the app can't hand out what you haven't shared
• Sensitive fields (email, phone number, precise location) are restricted at the column level, so the app's browser-side client cannot read them at all
• Automated bot protection on sign-in, sign-up, and account-security forms
• Automated probes we run against the live database to confirm those access rules are actually holding

Joinue is small and independently run. Access to production data is limited to the people who operate the service, and is used only to run and support it.

No service can promise perfect security. We can’t guarantee that unauthorized access will never happen, and you play a part too: keep your password to yourself, and turn on two-factor authentication in Settings.

Joinue is operated from the United States, and your data is stored and processed on infrastructure located in the United States. If you use Joinue from another country, you understand that your data is transferred to and handled here.

We rely on a small set of trusted service providers to run the app. They process your data only to provide their service to us, never for their own purposes:

Hosting and database (Supabase, Vercel)

Stores your account, profile, events, and messages securely, and runs the app.

Email delivery (Resend)

Sends account, verification, and event emails you have opted into.

SMS delivery (Twilio)

Sends the text-message notifications you opt into, to your verified phone number.

Push notifications (Google Firebase Cloud Messaging, Apple Push Notification service)

Delivers app notifications to your device. On iOS the notification is relayed through Apple's Push Notification service to reach your phone. A notification can include a short preview, such as a sender's name or message snippet.

Sign-in providers (Google, Apple)

If you choose to sign in with Google or Apple instead of a password, that provider verifies your identity and tells us the basic account details you approve (such as your email). We do not post anything to those accounts.

Weather forecasts (Open-Meteo)

Powers the weather shown on a trip itinerary and outdoor plans. To return a forecast, the coordinates of a place on your plan, or a place name you search, are sent to Open-Meteo. It receives no account details and does not identify you.

Maps and location (Mapbox, OpenStreetMap)

Powers place search, event maps, and the small map previews shown with a shared location. Place search and those location previews are routed through our servers, so your device's location and IP are not sent directly to Mapbox. Interactive maps you can pan and zoom load their map tiles from Mapbox in your browser, so Mapbox sees your IP address, the same as any website that shows a live map, but not your account or your precise location. Where Mapbox has no coverage (searching for a place abroad, for instance), the same search is also answered from OpenStreetMap through Photon, routed through our servers the same way, so what leaves us is the search text and nothing about you.

GIF search (Giphy)

Powers the optional GIF picker in chat. When you search for or view GIFs, the request is made from your device to Giphy, so Giphy receives your search terms and your IP address to return and show the results. If you never open the GIF picker, nothing is sent to Giphy.

Music search (Spotify, Songlink)

Powers the song picker on an event's playlist. When you search for a song, the words you type are sent from our servers to Spotify to find matching tracks, so Spotify receives the search text but not your device's IP address, your name, or anything else about your account. Once a song is added, we ask Songlink for that track's links on Apple Music and YouTube Music, so someone who uses a different service can open it there. Neither service is told who searched.

Product analytics (Vercel Analytics and Speed Insights)

Measures aggregate, privacy-friendly usage and performance, like page views and load times, with no advertising cookies and no tracking of you across other sites. It helps us see what works and keep the app fast.

Payments (Stripe)

Securely processes payments such as donations. Stripe handles your card details directly; we never receive your full card number.

Content moderation (OpenAI)

Helps keep the community safe. Automatic screening follows who can reach something, not how sensitive it is, and it covers these surfaces: messages in a shared conversation tied to an event, space, or trip, messages to a performer or venue page, public posts on your gallery, and comments on a post that a visitor to a page can read. On those, the text is sent to OpenAI's moderation service to be classified, along with the photos on a public gallery post or attached to one of those messages. Content you kept to a chosen audience is not sent for automated screening: private direct messages and group chats, posts limited to your connections, posts inside a private Space, and the comments under them. You can still report any of it, and reporting reaches every audience. OpenAI processes what it receives only to return a safety classification, does not use it to train its models, and receives nothing else from your account.

Error monitoring (Sentry)

Helps us find and fix crashes and errors. When something goes wrong, technical diagnostic data is sent to Sentry. We mask text and media in any session recordings, and do not send it your messages or account details.

Bot protection (hCaptcha)

Protects our sign-in, sign-up, and account-security forms from automated abuse. When you complete one of those forms, hCaptcha (operated by Intuition Machines) receives your IP address and interaction signals from that page to tell a real person from a bot. It is used only to verify the request, not to build an advertising profile of you.

We work to keep Joinue free of harmful and abusive content. This involves both automated screening and human review.

• Content that reaches beyond your own circle is automatically screened for harmful material as you post it, using the moderation service noted above. This covers messages in shared conversations (events, spaces, trips, and pages), public posts on your gallery, and comments on a post that a visitor to a page can read. Private direct messages and group chats, and anything you limited to a chosen audience, are not sent to that automated screening service, though we may check any content against known-illegal-material databases as the law requires, and you can still report it.
• You can report a person, a message, or an event, and you can block anyone, from the menus throughout the app.
• Reports go to our safety team for review. We may remove content, warn, or remove accounts that break our rules.
• Content tied to an active report or investigation may be retained longer so we can act on it.

To report something or reach our safety team, use the in-app report and block tools or email legal@joinue.com.

Joinue is not for children or teenagers. You must be at least 18 years old to use Joinue, and we do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has provided us with personal data, contact us at privacy@joinue.com and we will delete it.

We ask for your date of birth when you sign up so we can check your age, and we keep it. We do not show it to anyone. If you have turned birthday sharing on, the people you are connected with see the month and day only, never the year and never your age.

If an account has no date of birth on file, or one that says the person is under 18, we treat that profile as restricted: it stays visible to their connections only, and the wider options (friends of friends, and fully public) are not available to it.

In the unlikely event of a data breach that affects your personal information, we commit to:

• Notifying affected users without undue delay, and within the timeframes required by law
• Clearly explaining what data was affected
• Describing what steps we're taking to address the breach
• Providing guidance on how you can protect yourself
• Notifying relevant authorities as required by law

We believe event discovery should feel helpful, not creepy. That’s why your personal data stays inside the platform: it is never used for outside ad targeting and never handed to data brokers.

We may update this Privacy Policy as Joinue changes, as we add or replace a service provider, or as the law requires. The date at the bottom of this page always tells you when it was last revised.

If a change materially affects how we handle your personal data, we will tell you in the app or by email before it takes effect, and where the change is significant we may ask you to accept it before you keep using Joinue. Continuing to use the Service after an update means you accept the revised policy. If you don’t agree with a change, you can export your data and delete your account from Settings.

We’re committed to transparency. If you have questions about how we handle your data, we’re here to help.

Contact our privacy team at privacy@joinue.com