Privacy Policy

Controller

Details of the controller will follow before the public launch. Contact: hello@roundtonight.com

Required at sign-up

• Email address – to sign in with a code and so that each person has only one account. We only store an irreversible hash, never the address itself; we only need it at the moment we send you the code.
• Date of birth – only to check that you're at least 18. It is discarded afterwards and never stored.
• A name (first name or nickname) – so your round knows who's coming. Only needed once you want to join or start a round.

Optional details

• Gender – needed for women-only rounds. Default: not specified.
• Who sees what: your optional details (gender, languages, drinks, pace, avatar) are visible to anyone viewing a round or meetup you're in – without your name or account ID. Only the host and accepted guests see your name. If you request to join, the host sees your full profile before accepting.
• Favourite drinks, pace and languages – help with finding the right rounds.
• Avatar – an emoji from a fixed selection instead of a photo; others see it wherever they see your name. There are no profile photos.
• App language.
• You can change or remove all optional details in your profile at any time.

Created while you use the app

• Rounds, requests, acceptances and check-ins – to provide the service.
• If you run a venue: the link between your account and the venue and when you accepted the partner terms (so you can create events). Guests see the venue's name on events, not yours.
• Partner news by email (venue operators only, optional): the email address you enter for it, when you requested and confirmed it (double opt-in, proof of consent, Art. 6(1)(a) GDPR) and the chosen language. Unsubscribe any time in the app or with one click in every email – we then delete the address. Unconfirmed sign-ups are deleted after 7 days. Sent via Resend, plain text only, without open or click tracking.
• If you register your venue: the venue's name, address, kind, website and phone, your role, your message and – for a new venue – the location; plus that the registration comes from your account. At most 180 days after our decision.
• Map to the venue (Google Maps): only when you tap “Load Google Maps” in the “Map & directions” window do we embed the map from Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Your IP address, your location (for the route) and the venue's location then go directly to Google; Google may set cookies and transfer data to the USA (EU-US Data Privacy Framework). Basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). We only remember your choice on your device, and you can withdraw it in the same window. We don't store your location ourselves. Alternatively, “Open in Google Maps” only opens the route at Google when you tap it.
• Map in the iPhone app (Apple Maps): the map in the "Map & directions" window comes from Apple (built into iOS). Your iPhone loads map tiles around the venue from Apple; iOS shows your location as a dot on the device, it is not sent to us. "Route in Apple Maps" or "Open in Google Maps" opens the respective maps app.
• Invitations to venues (only outside Germany, Austria and Switzerland, currently Koh Samui): we take a venue's business email address from a public directory (Overture Maps) and write at most once – only after our team approves it. Basis: legitimate interest in winning partner venues (Art. 6(1)(f) GDPR). The unsubscribe link in the email deletes the address immediately; otherwise it's deleted 12 months after the invitation at the latest.
• Invitations: if you share an invitation link, we only store an irreversible code, which round it's for and until when – deleted once the round is over. If you come via an invitation, we store who invited you (for the limit of 2 friends, sitting at the same table and the invitation bonus). We never read contacts from your address book.
• Sign-ups for scheduled meetups (which meetup, when, status and your table) – to form tables; before the meetup others only see how many have signed up, never names.
• Round chat messages – only the host and accepted guests can read them; anyone accepted who never checked in loses access when the round ends. They are deleted automatically 24 hours after the round ends, and yours immediately if you delete your account.
• Credit transactions and passes – for billing.
• Web purchases: product, amount, time, a Stripe reference and your consent to immediate delivery. We never see or store payment details (card, account).
• Purchases in the apps (App Store, Google Play): product, time, the store's transaction ID and whether it was a test purchase – to credit it, exactly once per purchase. Payment goes through Apple or Google; we never see their payment details. Refunds and withdrawal are handled by the store.
• Push notifications (in the apps and in the browser, only if you allow them): per device a token from Apple or Google and the platform – in the browser the address of your subscription with the browser's push service (Google, Mozilla, Apple or Microsoft) and its keys; notifications pass through that service encrypted – so we can send you e.g. "New message in your round"; for "New events nearby" also your area (e.g. "Berlin" – never coordinates: the app sends its location once when opened, we derive the area and discard it). Notifications contain no message text and no names. Each type can be switched off in your profile; switching off "New events" deletes the area. With "New events" you get a weekend preview for your area on Thursdays. "News & offers" (new features, promotions, now and then a heads-up when you haven't been around and something's on in your area) are only sent if you explicitly switch them on (consent, Art. 6(1)(a) GDPR); for this we see when the app was last opened on your device. Every news message sent to you can be read again under Profile → News; for this we store which message you received when and whether you've read it – for 12 months, deleted with your account. Deleted when you sign out in the app, with your account, or when Apple/Google report the token as invalid; switch them off any time in your phone's settings.
• Withdrawals: which purchase, when the withdrawal was received and the name from your notice – as proof (legal obligation, Art. 6(1)(c) GDPR), kept like payment records; if you delete your account, we remove the name.
• Reports and blocks – to protect the community. Reports contain a fixed reason and, if you like (required for illegal content), your explanation.
• Moderation decisions: what we removed or suspended, why, and your objection – so you can read the reasons and object (Art. 17 and 20 DSA, Art. 6(1)(c) GDPR).
• Texts others can see (name, bio, round titles, event titles and offers) are checked automatically for insults, links and contact details.

What we don't store

• No date of birth and no age.
• No location and no location history: your location is only used at the moment you search or check in – it is not stored or logged.
• No IP addresses in our server logs. To prevent abuse and overload we count requests and messages per email address, account and IP address – only in memory, as a hash, and forgotten after 24 hours at most.
• No drink counts.
• No analytics or advertising tools and no cookies – except Stripe's fraud-prevention cookies while you pay (see below). Fonts are served from our own server, not from Google.

Storage on your device

On your device we only store your sign-in and your chosen language. Only when you tap “Order with obligation to pay” on the web does the purchase view load Stripe's payment form (Stripe.js from js.stripe.com); Stripe then sets fraud-prevention cookies (e.g. __stripe_mid, __stripe_sid). Both are technically necessary to provide the service or the payment you requested (Art. 5(3) ePrivacy Directive and its national implementations), so no consent is required and there is no cookie banner.

Who sees what

• Anyone viewing a round or meetup you're in sees your optional details (gender, languages, drinks, pace, avatar, whether you're verified) – without your name or account ID (only a code that changes per round).
• Only the host and accepted guests – or the people at your table – see your name.
• When you request to join a round, the host sees your full profile (with name) before accepting – including who invited you.
• Venue operators only see the number of people signed up for their events, no names.
• Nobody sees your email address – not even us, we don't store it.
• In the admin area our team only sees what's needed for operations and safety (e.g. name, sign-up, purchases, suspensions). Access requires two-factor authentication and every access is logged.

Legal bases

• Account, rounds, credits and purchases: performance of a contract (Art. 6(1)(b) GDPR).
• Your location at the moment of searching or checking in, meetup sign-ups, invitations and the link as a venue operator: performance of contract (Art. 6(1)(b) GDPR).
• Keeping payment records: legal obligation (Art. 6(1)(c) GDPR).
• Optional profile details: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by removing them from your profile.
• Reports, blocks and abuse prevention (including limits on code requests): legitimate interest in a safe community and in preventing anyone from flooding other people's inboxes with codes (Art. 6(1)(f) GDPR).

Recipients and location

• Our servers are located in the EU (Amsterdam) at DigitalOcean, under a data processing agreement.
• Sign-in codes are sent by Resend (Plus Five Five, Inc., USA) as a processor under a data processing agreement. Only your email address and the message containing the code are transmitted – without open or click tracking. The transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• Web payments are processed by Stripe Payments Europe, Limited (Ireland). In Stripe's payment form (embedded in our purchase view, but connected directly to Stripe) you enter your payment details and an email address for the receipt; we only receive the amount, product and a reference. For fraud prevention Stripe acts partly as an independent controller (Stripe privacy: stripe.com/privacy).
• We don't sell data or share it for advertising.

Retention

• Account and profile: until you delete your account.
• Payment records: as long as tax and commercial law require (up to 10 years, § 147 AO, § 257 HGB) – even after you delete your account, then without any link to your name.
• Chat messages: until 24 hours after the round ends.
• Invitation links: until the round or meetup ends, then deleted automatically.
• Meetup sign-ups and who invited you: like rounds, until you delete your account.
• Sign-in codes: stored only as a hash, valid for 10 minutes at most, then deleted automatically.
• Reports: until our moderation team has handled them, then 180 more days (for follow-up and repeat violations), then deleted automatically.
• Moderation decisions and objections: one year, then deleted automatically; immediately with your account.
• Suspended accounts: if a suspended account is deleted, we only keep the hash of the email address so the suspension can't be bypassed by signing up again.
• Server logs (without IP addresses): rotated automatically after a short time.
• After deletion, only anonymous entries remain, e.g. credit transactions with no link to you, where needed for billing.

Your rights

• Access and a copy of your data (Art. 15, 20 GDPR): Profile → “Download my data”.
• Rectification (Art. 16): directly in your profile.
• Erasure (Art. 17): Profile → “Delete account” – immediately, no email needed.
• Restriction and objection (Art. 18, 21): email us.
• Lodge a complaint with a data protection authority, in particular in the country where you live (Art. 77 GDPR).