Privacy Policy

• Account data: name and email address. We do not store passwords. Authentication is handled entirely by an OAuth 2.0 / OIDC-compliant identity provider — whether you sign in with email or a third-party account, your credentials never touch our servers.
• Usage data: pages visited, events saved, RSVPs — used solely to operate the service.
• Location data: city-level location you provide when searching. We never request GPS or background location access. Location is not persisted unless you explicitly save it to your profile.
• Organiser content: events, organisations, and venues you submit as an event host.

• To operate your account and authenticate you securely
• To show you relevant local events based on your search preferences
• To send transactional communications (account verification, opt-in event reminders)
• To improve the platform using aggregated, anonymised analytics

We do not sell your data. We do not build advertising profiles from personal data.

• Scorers, route tools and sticker maker: run in your browser. Scores, routes, GPX files and sticker images are processed on your device and are not uploaded to us. Game history and preferences are kept in your browser's local storage.
• Route planning: street data is requested from OpenStreetMap services (Overpass, Nominatim) and map tiles from OpenStreetMap, so those services see your IP address and the area you search.
• Strava stats: you connect your own Strava API app. Your Strava keys, tokens and activities stay in your browser and are sent only to Strava. We never receive them. “Disconnect” erases them.
• Lucky Dip: your swiped interests are saved in your browser, and to your account if you are signed in, to personalise suggestions.
• Tool usage statistics: only if you accept analytics, we record which tool you opened and key actions (for example “reroll”) against a random per-browser id, plus your account id if signed in. We use aggregated figures to improve the tools and to show advertisers and partners how many people use them. We do not sell personal data.

We work with carefully selected sub-processors. All handle personal data under appropriate data processing agreements and are either UK/EU-based or covered by adequate transfer mechanisms.

• Database infrastructure — account and event data stored on SOC 2-certified, GDPR-compliant hosting within the UK/EU region.
• Edge network & DDoS protection (Cloudflare) — all web traffic routed through Cloudflare's globally distributed edge network.
• OAuth 2.0 / OIDC sign-in (Google) — optional third-party authentication. Only your name and email are shared with us; no passwords.
• Mapping — anonymous map tile requests to render event locations. No personal data is transmitted.
• Analytics (Google Analytics) — aggregate usage statistics. Only activated with your explicit consent via our cookie banner.
• Session recording (Microsoft Clarity) — anonymised heatmaps to improve UX. Only activated with your explicit consent.
• Error monitoring — anonymised crash reports to improve reliability. No personal data is included.

• Session cookie — strictly necessary to keep you signed in. Cannot be disabled while you are logged in.
• Analytics & recording cookies — used to understand how visitors use the site and improve the experience. Only set after you give consent via our cookie banner.

You can withdraw consent at any time via the cookie banner. For questions, contact service@get-out-there.app.