Privacy Policy

1. Information We Collect

We collect three categories of information: (a) information you provide to us, (b) information we collect automatically when you use the Service, and (c) information we receive from third parties.

1.1 Account and Profile Information

When you create an account, we collect:

• Your email address and a password (or, if you sign in with Google or Apple, the identifier from that provider and the basic profile information they share, such as name and email);
• Your display name;
• Your account role (individual or business);
• Your personal phone number (required for all accounts; see §1.10 below);
• The fact that your email has been confirmed;
• The fact that your phone has been verified, and your two-factor authentication preference (on or off).

If you have an individual profile, we may also collect:

• An optional profile photo (avatar);
• An optional short bio;
• The fact that you completed (or skipped) post-signup profile onboarding.

If you have a business profile, we may also collect:

• Business name, address, formatted address, and latitude/longitude of the business;
• Google Place ID (when the business was selected from Google Places during signup);
• Business phone number(s) displayed on your profile;
• Google voice phone number (google_voice_phone) — the phone number returned by Google Places at signup, used for business voice verification (separate from your publicly listed business phone);
• Website URL and business email;
• Business logo and up to 15 showcase images;
• Business description;
• Business category, price range, operating hours, year established, capacity, parking information, and special features;
• Social media handles (Facebook, Instagram, X/Twitter, TikTok);
• Verification status, approval status (whether your business has been approved to publish events), and the timestamp of phone verification;
• City and state parsed from your business address (used for filtering and administration); and
• Whether you have chosen to display your business email publicly.

1.2 Event, RSVP, and Activity Information

When you use the Service, we collect information about how you interact with events, including:

• Events you create or edit (as a business), including title, description, start and end time, timezone, location (latitude/longitude and address), category, images, pricing fields, ticketing fields, recurrence settings, draft/published status, and cancellation status and reason;
• Saved events (RSVPs) — when you tap the heart to save an event, we record an RSVP with status going and a timestamp;
• Businesses you follow;
• Calendar add actions — when you tap "Add to calendar," we record that you did so, the time, the calendar source (platform), and (where applicable) the calendar event id, so we don't ask you again;
• Event views — we record that an event was viewed, with a timestamp, and (if you are signed in) your user id; we do not currently record views by business owners on their own events;
• Event interactions — taps on share, map, ticket, or organizer buttons (with the action type and an optional source label).

Comments and ratings: Users cannot currently post comments or ratings in the app. Legacy database structures may exist for future use but are not exposed in the current product.

1.3 Location-Related Information

To power the map view, "nearby" filtering, and city/region features, we may collect:

• Your device location (when you grant the app permission). On iOS this is "When In Use" only — we do not track your location in the background;
• A manually specified location (latitude, longitude, label, city, state) if you set one in the app instead of using your device location;
• Your location-permission state and the timestamp of the most recent location update;
• Approximate location derived from the geographic content you view (for example, the centroid of the map area you are browsing);
• Reverse-geocoded city and state corresponding to coordinates, retrieved through Google's Geocoding API.

We do not sell location data.

1.4 Business Verification Data

If you operate a business account and initiate phone verification (after admin approval), we collect:

• The phone number used for verification — typically the Google voice phone from your Places listing when available, otherwise the business phone you provided;
• A record of each verification attempt (business id, phone number, status, timestamp) for rate-limiting and abuse prevention (currently up to 5 attempts per business per hour);
• The outcome and timestamp of successful verification.

The verification call itself is placed by our verification provider (currently Twilio Verify); we do not record the contents of the call.

If your business listing does not include a Google Places phone number suitable for automated voice verification, automated verification may not be available and your account may be marked for manual review until you contact info@localeapp.io.

1.5 Uploaded and Submitted Content

We collect anything you upload to the Service, including profile photos, business logos, business showcase images, and event images. Files are stored in our cloud storage (currently Supabase Storage) and may be served via public or signed URLs.

1.6 Notifications, Push Tokens, and Preferences

If you enable push notifications, we collect:

• An Expo push token associated with your device, which lets us send you notifications;
• Your notification preferences, including:

- Master on/off, sound, and vibration toggles;

- Event reminders, new events from followed businesses, event changes, and event cancellations;

- For business accounts: notifications when someone saves your events (shown in Settings as "New Saves for My Events") and when someone new follows your business;

• A history of notifications delivered to you (title, body, type, status, timestamps, related event/user).

Quiet hours: The database supports quiet-hours preferences, but the quiet-hours settings UI is not currently exposed in the app. You cannot configure quiet hours in Settings today.

1.7 App Settings and Preferences

We store in-app preferences that you set through the map/filter UI or that the app syncs automatically, including:

• Default search radius and default event category (saved when you apply filters on the Discover map);
• Location preferences: whether to use your device location or a manually specified location, plus the manual location's coordinates, label, city, and state, and your location-permission state (configured in the Discover map's location panel, not in the Settings modal).

Our database schema includes additional preference fields (such as theme, language, search history, last search query, saved filter presets, profile visibility, location sharing, online status, friend-request preferences, auto-refresh interval, distance units, event-card density, and location accuracy threshold), but the app does not currently expose settings screens that read or write those fields, so we do not collect meaningful values for them beyond schema defaults. If we ship features that use them, we will update this section.

1.8 Device, Log, and Usage Data

Backend and infrastructure logs. When your app communicates with our backend and infrastructure providers (such as Supabase), those systems automatically generate technical logs that may include your IP address, request timestamps, error codes, and similar network and request metadata.

Activity we record ourselves. As described in §1.2, we record certain first-party engagement signals in our own database — specifically event views and event interaction taps (such as share, map, ticket, and organizer taps).

Product analytics (not currently active). Our app includes an integration with a product-analytics provider (Amplitude), but it is not currently enabled: no analytics key is configured, the integration is inactive, and we do not currently send product-usage telemetry to Amplitude. The integration is also designed to drop direct identifiers (such as email) and to hash user and event IDs before any event would be sent. If we enable analytics in the future, we will update this Policy.

Crash and diagnostic data. We do not currently operate our own crash-reporting or error-monitoring service, and our app does not transmit crash logs or stack traces to us. Diagnostic and crash data may still be collected by the Apple App Store and Google Play in accordance with their own policies and your device settings.

1.9 Cookies and Similar Technologies

The Locale mobile app does not rely on browser cookies, but it does use device storage (including AsyncStorage and SecureStore) to keep you signed in, remember preferences, and cache data.

Website (localeapp.io). Our marketing site and static pages (including /privacy and /terms) do not use advertising, analytics, or marketing cookies, and we do not display a cookie consent banner on those pages. On password-reset and email-confirmation pages (/reset, /confirm-email), we use browser local storage (not HTTP cookies) through our authentication provider (Supabase) to complete those flows; session data is cleared when the flow finishes. Some pages load fonts from Google Fonts, which may cause your browser to connect to Google's servers (see Google's privacy policy). We do not use local storage on our marketing homepage or on other static landing pages such as /auth/change-phone or /event.

1.10 Personal Phone Number (Required)

We collect and store your personal phone number at signup. A verified phone number is required for every account, regardless of whether you turn on two-factor authentication.

We use your personal phone number only to:

• Verify your phone at signup (a one-time SMS code); and
• Send sign-in codes if you turn on two-factor authentication (off by default; you can toggle it anytime in Settings → Sign-in & Security).

Phone number changes are confirmed through an email link sent to your account email address (via SendGrid), not by SMS. Changing your phone number in the app requires re-entering your password and completing that email confirmation step.

We do not display your personal phone number publicly, share it with other users or businesses, or use it for marketing. SMS codes are sent through Twilio Verify as the delivery provider, routed through our authentication infrastructure (Supabase).

A "personal" phone number is distinct from any business phone number a business account submits for public listing or for the separate business voice verification flow described in §1.4.

2. How We Use Information

We use the information we collect to:

1. Provide the Service, including signing you in, loading your profile, showing the map and feed, geocoding addresses, displaying nearby events, sending RSVPs, adding events to your calendar, sharing events, and serving uploaded images;
2. Operate business accounts, including admin approval gating, helping businesses publish, edit, and manage events; track event views, RSVPs, calendar adds, share/map/ticket/organizer interactions; and view their own engagement analytics;
3. Send notifications and emails, such as event reminders, RSVP/save updates, event changes, cancellations, new-follower alerts, account confirmation emails, password reset emails, and phone-change confirmation emails;
4. Verify your personal phone number at signup and send SMS sign-in codes if you turn on two-factor authentication, including rate-limiting these messages to prevent abuse;
5. Verify business identity (business voice verification, separate from personal phone verification) and rate-limit verification attempts;
6. Improve, debug, and secure the Service, including diagnosing errors from our backend logs, monitoring abuse, and developing new features;
7. Personalize the experience, such as remembering your location mode and default map filters;
8. Communicate with you about service updates, policy changes, security alerts, and support requests;
9. Enforce our Terms and protect Locale, our users, and the public; and
10. Comply with legal obligations and respond to lawful requests.

We do not sell your personal information. We do not use your personal information for cross-context behavioral advertising.

3. How We Share Information

We share information only as described below.

3.1 With Other Users and Businesses

By design, certain information is visible to others on the Service:

• Your display name and (if you set one) your avatar may appear in connection with RSVP signals, content you submit, or content you share;
• Event listings and business profile information that a business publishes are public to other users in the app and via shareable links;
• RSVP and view counts are displayed on event cards (in the aggregate);
• Business owners can see aggregate analytics for their own events in the app — including view counts, save/RSVP counts, calendar-add counts, and counts of share/map/ticket/organizer taps. The app does not currently show a named attendee list; calendar-add analytics are counts only (not which users added an event);
• Business owners may receive in-app or push notifications when someone saves an event or follows their business. Push payloads are designed to omit direct identifiers where possible;
• Follower counts are visible on a business profile; the app does not currently expose a full follower directory to businesses.

Your personal phone number is never displayed publicly or shared with other users or businesses.

3.2 With Service Providers ("Processors")

We share information with vendors who process it on our behalf. As of the Last Updated date, our primary providers include:

Each provider is bound by its own contract, terms, and privacy policy. We do not authorize them to use your personal information for their own marketing purposes.

3.3 For Legal and Safety Reasons

We may disclose information when we reasonably believe it is necessary to:

• Comply with a law, regulation, court order, subpoena, or other legal process;
• Respond to lawful requests from public authorities, including for national security or law enforcement;
• Enforce our Terms;
• Detect, prevent, or address fraud, abuse, security, or technical issues; or
• Protect the rights, property, or safety of Locale, our users, or others.

3.4 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction. We will notify users of any such transfer that materially changes how their information is handled.

3.5 With Your Consent

We may share information for other purposes with your consent or at your direction.

4. Data Retention

Our default rule: we keep personal information for as long as your account is active. When you delete your account, we delete the personal information associated with your account.

In practice this means:

• While your account exists, we retain your profile data, business data (if applicable), events you have created, RSVPs and saves, follows, calendar action records, event views and interactions, notification history, app settings, and uploaded images, so that the Service works as you expect.
• When you delete your account from inside the app (Profile → Settings → Danger Zone → Delete Account, with password confirmation) or through a verified request to info@localeapp.io, we delete the personal information associated with your account from our primary systems, and we delete your record from our authentication system.

There are a few narrow exceptions:

• Backups and server logs. Routine backups and operational logs may contain residual copies of data for a short period after deletion. Those copies expire on a rolling basis and are not used to restore deleted accounts.
• De-identified or aggregated data. Information that can no longer reasonably be associated with you may be retained — for example, aggregate event view counts, or event_views rows where your user id has been cleared after deletion.
• Shared content. Content that has already been shared with or by other users (for example, an event listing that other users have already saved or shared) may continue to exist in those contexts after your account is deleted.
• Records we are required to keep. We may retain limited records (such as verification attempt logs) where needed for fraud prevention, abuse mitigation, or legal compliance.
• Vendor and platform logs. Our subprocessors (Supabase, Twilio, SendGrid, Expo, and others) may retain data according to their own retention schedules.

We have not yet implemented automated category-specific purge jobs for all data types. If we adopt fixed retention windows in the future, we will update this section before enforcing them.

5. Your Choices and Rights

5.1 In-App Controls

From inside the app you can:

• Edit your profile, including name, avatar, and bio (Profile → Settings → Edit Profile);
• Edit your business profile, including all business details and showcase images;
• Change your email or password (Settings → Sign-in & Security; both require your current password);
• Change your phone number (password required; we email a confirmation link to your account email before applying the change) and turn two-factor authentication on or off from Settings → Sign-in & Security;
• Manage notification preferences per category (Settings → Notifications);
• Manage location preferences — use device location or set a manual location (Discover → map filters → Location panel);
• Download a copy of your data (Settings → Support → Download My Data);
• Sign out; and
• Delete your account (Profile → Settings → Danger Zone → Delete Account), which requires your account password.

If you signed up with Google or Apple and do not have a Locale password on file, use info@localeapp.io to request account deletion, email change, or phone change. Download My Data (§5.3) works in-app without a Locale password.

When you delete your account, we attempt to delete your associated data in our database and storage layers, and we delete your record from our authentication system.

5.2 Device-Level Controls

You can revoke permissions you previously granted to the app (location, camera, photo library, calendar, and notifications) from your device's operating system settings at any time. Some features may not work without those permissions.

5.3 Privacy Rights (U.S.)

Depending on where you live, you may have the right under state privacy laws (for example, California's CCPA/CPRA, Virginia's VCDPA, Colorado's CPA, Connecticut's CTDPA, Utah's UCPA, and similar laws) to:

• Know / access the personal information we have about you;
• Correct inaccurate personal information;
• Delete personal information we hold about you;
• Port your personal information to another service;
• Opt out of "sale" or "sharing" of personal information for cross-context behavioral advertising (we do not engage in either); and
• Limit the use of sensitive personal information.

Self-service access/portability: use Settings → Support → Download My Data in the app for a complete JSON export of your account data.

To exercise other rights, or if you cannot sign in, contact us at info@localeapp.io. We may need to verify your identity before responding. We will not discriminate against you for exercising any of these rights.

5.4 Communications

We currently send transactional emails only (no marketing email list). You can disable push notifications inside the app (Settings → Notifications) or in your device settings. Some communications (for example, account confirmation, security alerts, and important policy changes) are required to use the Service and cannot be turned off.

SMS messages. By creating an account, you consent to receive transactional SMS messages from Locale at the phone number on file for the purposes described in §1.10 — phone verification at signup and sign-in codes when two-factor authentication is enabled. We do not send marketing SMS. Standard message and data rates may apply. Message frequency depends on your activity (typically only at signup and when you sign in with 2FA enabled). You may stop SMS sign-in codes by turning off two-factor authentication in Settings. The verification SMS at signup is required to create an account.

6. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, contact info@localeapp.io and we will take steps to delete it.

7. Security

We use reasonable administrative, technical, and physical safeguards to protect your information, including encryption in transit, access controls, Row Level Security policies on our database, and rate-limiting on sensitive flows like phone verification. No system is perfectly secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact info@localeapp.io immediately.

8. International Data Transfers and U.S.-Only Audience

The Service is offered only to users located in the United States, and we currently distribute the Locale mobile app only through the U.S. storefronts of the Apple App Store and Google Play.

We are based in the United States, and we and our service providers process information in the United States. We do not target the Service to users outside the United States, do not localize the Service for non-U.S. markets, and do not offer the Service in languages other than English.

If you access the Service from outside the United States, you do so on your own initiative, and you understand and consent to information about you being transferred to and processed in the United States, where data protection laws may differ from those in your country. If you are located in the European Economic Area, the United Kingdom, or another region with cross-border transfer rules, the Service is not directed to you, and you should not use the Service.

We will revisit this section if and when we expand the Service to additional countries.

9. Third-Party Links and Services

The Service may link to third-party websites and services (such as business websites, social media, and external ticketing pages). This Privacy Policy does not apply to those services, and we are not responsible for their content or privacy practices.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you in the app, by email, or by posting an updated version on localeapp.io/privacy, and we will update the "Last Updated" date at the top. Your continued use of the Service after changes take effect means you accept the updated Policy.

11. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at:

• Email: info@localeapp.io
• Entity: Locale Development LLC