Privacy Policy

1. Data We Collect

• Email address — obtained from the Google account you sign in with (Sign in with Google). We never receive or store your Google account password.
• Profile — your display name and profile photo (optional). The profile photo you upload is public — see section 6.
• Location — accessed only while you have actively started a Session, never in the background. See section 3 for details.
• Message content — Ice Breaker, Chat, and Event/Instant Match messages you send inside the app.
• Device technical data — push notification token and platform type (Android/iOS), used to deliver notifications to your device.
• Activity data — your history of Sessions, Ice Breakers, Connections, reputation ratings, and reports you file or receive, used to run the app's core features.

2. How Data Is Used

The data above is used solely to run Nowby's core features: account authentication, showing other users on Radar by approximate distance, sending and receiving Ice Breakers and Chat, delivering relevant notifications, running the reputation and moderation systems, and responding to abuse reports. We do not use your data for targeted advertising, and we do not sell personal data to any third party.

3. Location

Your precise location coordinates are never shown to other users in any form. Distance to other users is only ever shown as a range (for example “500m–1km”), never as a precise distance or coordinates. Location is accessed only while you have actively started a Session — the app never requests or uses background location access. You are visible to other users only while your Session is active; once it ends you no longer appear on anyone's Radar, and precise location data is not retained longer than the running Session operationally requires.

4. Sharing Data with Third Parties

We do not use any third-party advertising or analytics SDKs. Data is processed through the following infrastructure providers, solely to operate the app:

• Google Sign-In — authentication. We only receive your email and an identity confirmation from Google, never your account password.
• Supabase — database storage.
• Expo Push Notification Service (routed through Firebase Cloud Messaging on Android) — notification delivery.

We do not send your profile photo or message content to any third-party content moderation service. The automatic moderation currently running is only simple word filtering on our own server for text such as display names — profile photos are not screened automatically before they become visible to other users. Violating content is handled through user reports and moderator review. If we begin using a third-party moderation service in future, this policy will be updated first.

We may disclose data where required by applicable law, or to protect other users' safety from abuse.

5. Data Retention & Deletion

You can delete your account at any time from the Profile page inside the app, or by email request if you have already uninstalled the app. After deletion, your Chat and Connection history is permanently deleted within 30 days — this window gives you a chance to reverse the deletion if it was unintentional. Data tied to active reports or moderation may be retained longer as an investigation requires, kept separate from general account data.

6. Security & the public nature of profile photos

The profile photo you upload is public. It needs to be displayable to other users on Radar, in Chat, and on profile pages, so the file is kept in publicly-readable storage: anyone holding the photo's URL can open it, including people who do not use Nowby and are not signed in to any account. The URL contains a random identifier so it is not easily guessed, but we cannot guarantee the photo stays private if its URL is circulated. Do not upload a photo you would not want seen outside the app. You can replace or remove your profile photo at any time from the Profile page.

Data other than your profile photo (message content, location, account data, and activity data) is NOT public — all of it is reachable only through APIs that verify your identity first, with role-based access restrictions at the database level so each piece of data is reachable only as the relevant feature requires. All data traffic is encrypted in transit (HTTPS/TLS).

7. Your Rights

You have the right to request access to, correction of, or deletion of your personal data. Requests relating to your account or data can be submitted through in-app support (Profile menu) or via the email address listed on the Delete Account page.

8. Minimum Age

Nowby requires users to be at least 18 years old. We do not knowingly collect data from anyone below that age.

9. Changes to This Policy

This policy may be updated from time to time. Material changes will be announced in the app before they take effect.

10. Contact

Questions about this policy, or requests relating to your account or data, can be submitted through in-app support or to the email address listed on the Delete Account page.