Privacy Policy

Last updated: July 14, 2026

Waddle is built to know as little about you as possible while still keeping the community safe. This page describes the main categories of data we collect, who processes it, and what happens to it.

What we collect

• Phone number (SMS sign-in) or email address (Google/Apple sign-in), used only to verify and sign in to your account.
• Profile: your handle, age range, gender (optional to display), three interests, and a chosen animal avatar. No photos, no real names required.
• Plans: the Huddles you post or join: venue, time, category, and your note.
• Group chat messages (see retention below).
• Reliability signals: attendance reports (showed up / no-show) between attendees of the same event.
• A device push token, if you enable notifications, so we can send you alerts.
• Basic technical logs: your IP address and request metadata are processed transiently by our hosting provider to run the service and prevent abuse.

What we never collect

• Your GPS location. Map pins are always the public venue's coordinates, never your device's. (Note: when the map loads, your device requests map tiles directly from our maps provider, which necessarily sees your IP address — see Service providers.)
• Photos, contacts, or anything from other apps. We use no third-party advertising or analytics SDKs.

Retention

• Chats self-destruct: messages in an event chat are permanently deleted from our servers 2 hours after the event ends. The one exception: if a message is part of a safety report, we may preserve the relevant content while we investigate and, where appropriate, share it with law enforcement.
• Verification codes expire after 10 minutes.
• Profiles, plans, and reliability records are kept while your account exists.

Your rights

• Export: request a full copy of your data in the app (or via GET /api/users/me/export with your session).
• Delete: Profile → Delete account immediately removes your profile, plans, messages, push tokens, invite codes, and the reports you filed. Safety records — reports filed about you and verified no-show records — may be retained in de-identified form to keep the community safe. There is no undo.

Service providers

We don't sell your data or share it for anyone else's marketing. To run the service we rely on a small set of providers who process data on our behalf:

• Twilio — delivers your SMS verification code.
• Expo — delivers push notifications (receives your device push token and notification text).
• CARTO and OpenStreetMap — map tiles and venue search; map-tile requests reveal your IP address to CARTO, and venue searches send your query text to OpenStreetMap.
• Fly.io — hosts our servers and database (processes all data at rest and in transit).
• Apple — the App Store and push delivery (APNs).

We may also disclose information when required by law or to respond to a valid legal request, or where we believe it necessary to prevent harm.

Changes to this policy

If we make material changes we'll update this page and the "last updated" date, and note significant changes in the app.

Contact

Questions or requests: contact@waddle.nyc.