Privacy

STROBE operates this service. The controlling entity is not yet incorporated — this section cannot be completed until Phase 0 finishes, and a privacy policy without a named controller and a contact address is not a valid one.

• Your account — a phone number or email address, a username, and the date you confirmed you are 18 or over. Sign-in is handled by Supabase Auth.
• Your bookings — the night, the venue, the table, the party size, the committed minimum and the deposit, plus an append-only record of every state the booking moved through.
• Split payments — the phone number and display name of each person invited to a split, and what each of them owes and has paid. A person can pay a share without holding an account.
• Your lists — rooms you save, people you follow, and nights you mark yourself interested in. These are private to you; venues do not see them. If you ask us to tell you when a table opens up on one of those nights, we keep that choice with the night; it is off unless you turn it on, and one switch in Profile turns every one of them off.
• Arrivals — whether the venue’s door checked you in on the night.
• Your people — who you are connected to, requests sent and received, and anyone you have blocked. A connection requires both people to agree; there is no way to follow a person who has not agreed. Your list of connections is visible to you and to nobody else, including them.
• Your contacts, if you ask us to check them — when you tap to find people you know, the phone numbers from your address book are sent to us, matched against accounts, and discarded in the same request. We do not keep your address book, we do not build a list of people who are not our users, and we never contact anyone in your address book. You are only findable this way if you switched that on.
• Requests to pay — when someone on a table asks another person on it to pay their share, we keep who asked, whose share it was, the amount and the note they wrote, if any. A note is at most 80 characters, and we refuse one that carries a link, an email address, a phone number or bank details.
• Your messages — what you write in a table’s chat or in a one-to-one chat, when you sent it, and whether you deleted it. Messages are text only, at most 280 characters, and we refuse one that carries a link, an email address, a phone number, bank details or an @handle. For each chat we also keep how far you have read and whether you muted it; nobody else is ever shown either.
• Reports, decisions and appeals — when you report a message or the note on a request: your reason, anything you add, whether you say it is illegal and which law, and a copy of the reported message or note as it was — its words, who sent it and when — for a person at STROBE to review. When we act on something you posted or on your account, a statement of reasons: what we did, why, the rule it rests on and when; and your words if you ask us for a second look.
• Notices from the public form — anyone, with or without an account, can tell us about content they believe is illegal. We keep the sender’s name and email (both may be left out only for child sexual abuse material), where the content is, their explanation, its category, the language of the form, a keyed fingerprint of the internet address it came from (never the address itself), and a fingerprint of the code they check its status with (never the code).
• Your phone, if you turn on notifications in the app — the device token Apple gives the app for your phone, whether it is a test build or the App Store one, the language the app is set to, and which sign-in it belongs to. Signing out stops notifications to that phone. We keep at most ten phones per account.
• Your table code in Apple Wallet, if you add it — the pass, and the device identifier and push token Apple Wallet gives us for each device it is on, so that we can update it. We keep at most ten devices per pass.
• Your phone number, as a keyed fingerprint — if you verified a number, we store a one-way fingerprint of it computed with a secret key held outside the database. It is what lets a block keep working if someone deletes their account and signs up again on the same number. It cannot be turned back into your number without that key.

Card details are never held by us. Payments go directly to Stripe, which is the payment processor.

Which venue you were in, on which night, can imply things about you that European law treats as a special category of data. We therefore keep attendance at venue level only — the room, never a table, never a position — and never publish it.

There is now a “who is out” feature, and it is off unless you turn it on. When it is on, only people you have mutually accepted as connections can see which room you are in, only while you are out, and only until the night closes or eight hours pass, whichever is sooner. You can turn it off in one tap from the main screen, which also ends whatever is running at that moment. You can hide from one specific person without disconnecting from them, and they are not told.

Two separate things you can agree to, and either without the other. The first is that your connections may see which room you are in — the venue’s own door check-in can answer that with no access to your phone at all. The second is that your phone may work out which room that is, for clubs you did not book through us. That second one is checked once, while the app is open — never in the background — and your position never leaves your phone: it is matched to a venue on the device, and what reaches us is the venue. We hold no coordinates at any precision, and there is nowhere in our database to put them.

We never send anyone a notification that a named person has arrived somewhere, and we send no notification about where your connections are.

The iOS app can send you notifications, and only if you allow them on your phone. We send them when somebody does something that concerns you — someone on your table asks you to pay your share, a share of your table is paid, your table is confirmed, the venue or STROBE replies to your support request, someone asks to connect or accepts your request, someone writes in a chat you belong to and have not muted — when STROBE decides something about what you posted or about your account, or deals with something you reported, or when something you asked to be told about happens, such as a table opening up on a night you marked. None of them is sent on a timer, and none is sent between two people when either has blocked the other.

A notification names the person who did the thing and, where there is one, the amount, the venue and the night, and a request’s note. A message’s notification carries the sender’s name and the message itself. A notice from STROBE says what we did in general terms, and an outcome says whether what you reported was removed, never what was done to anybody. Each is written on our servers and delivered by Apple’s push notification service, so its text passes through Apple on its way to your phone. We send no text messages and no emails of this kind, and a link you share still reaches only the people you send it to.

• The venue you booked — your name, party size, table and arrival status for that night. They need it to seat you.
• People on your table — the first names of the people on it and where each one stands (paid, coming, not yet answered, cannot make it), with the venue, night and table and what each of them owes. Never anybody’s phone number or surname; the organiser, who typed them in, is the only exception.
• Everyone holding a place on your table — every request to pay on it: who asked whom, the amount, the note and who has paid; and the table’s chat, where each message carries its sender’s first name. People who only chipped in without a place see only what concerns their own payment, and someone who only has a link sees none of it. Someone you ask to pay also sees your request on their payment link and in a notification if they have the app.
• Someone you chat with one-to-one — your name, or your username, and your messages. A one-to-one chat is possible only between two connections who have already shared a table or a request to pay.
• STROBE’s staff — read only what somebody reported: the reported message or note, never the chat around it. A statement of reasons about you is read by you; a venue’s or a partner’s, by the people who run it.
• Your connections — your username, and a photograph if you add one. People who are not connected to you see your username and city but never a photograph. If sharing is on, your connections also see which room you are in while you are out. Nobody, at any level, can see who else you are connected to.
• Stripe — payment processing. Supabase — database, authentication and storage, hosted in the EU. Vercel — application hosting. Apple — delivers app notifications (the Apple Push Notification service), and so carries their text. It also tells Apple Wallet when a pass you added has changed; that message is empty, and your device then fetches the new pass from us.

We do not sell personal data and we run no advertising.

Booking and payment records are kept for as long as Italian tax and accounting law requires, because they are financial records and we are not permitted to delete them on request. Everything else — your username, your saved rooms, the people you follow — is erased when you delete your account.

Where you have been — the record of which room you were in, on which night — is deleted after 90 days, automatically. What survives is a count of how many times you have been to a venue, with no dates and no nights attached. There is no product reason to keep a per-night attendance log longer than that.

Contact details on a booking — the phone number and name of everyone on a split — are erased 180 days after the night closes, automatically and without anyone having to ask. That covers the period in which a card payment can still be disputed, with margin. It applies whether or not the person ever created an account, which matters because someone who paid a share without one has no account to delete.

The amount, the payment and the booking itself remain, because those are accounting records and tax law requires them. A phone number is not an accounting record.

A request to pay, with its note, is deleted 30 days after the night closes. A line in the booking’s history that it was made — who asked, whose share it was and the amount, never the note — stays with the booking’s own records, as above, and is not part of the copy of your data described below. A notification’s text is cleared from our servers the moment it is sent, or once we stop trying to send it, and the record that a notification went out is deleted after 30 days. A phone’s device token is deleted once the app has not renewed it for 120 days, and straight away when Apple tells us it is no longer valid. For a pass in Apple Wallet, the device identifiers and push tokens are deleted a day after the night closes, and the pass itself 30 days after.

A table’s chat — its messages, how far each person has read and who muted it — is deleted 30 days after the night closes. A message in a one-to-one chat is deleted a year after it was sent. You can delete your own message at any time, for everyone.

One exception, so that a report can be reviewed: the words of a reported message or note, and who wrote them, are kept until 180 days after the report is closed, and never more than a year after it was reported — even if the sender deletes the message, its chat or the request reaches its deletion date, or the sender deletes their account. We keep them longer only when someone reported a threat to somebody’s life or safety and a person at STROBE has recorded that the evidence must be held. Reports themselves are deleted a year after they are closed.

A statement of reasons about you is kept for a year after we made the decision, or after we decided your appeal, and for as long as what it explains is still in force — a restriction not yet lifted — so you can always read why. Deleting your account does not delete it sooner. A notice from the public form is deleted a year after we decide it.

You can access, correct, export, restrict or erase your personal data, and object to processing. Deletion is available in the app under Profile, and on the web from your account page.

Deleting your account erases your username, your lists and your identifying details from past splits, and permanently prevents sign-in. It also deletes your phones’ device tokens, your notifications, and the notes of any requests you made, erases the words of every message you sent — they disappear from every chat, with nothing left in their place — and the name and line on your profile, and deletes your place in each chat. Some things stay until their own deadlines above: a statement of reasons about you; the copy of a message or a note of yours that somebody reported, which keeps your name as its sender; the reports you made, with what you wrote in them; and the reports others made about you. Your Apple Wallet passes are voided, without your name or code on them; their device identifiers and push tokens are deleted a day later, and the passes a week later. The financial record of nights you already paid for remains, as above, with your personal details removed from it.

A copy of your data is available immediately, as a file, from Profile in the app or from your account page. It covers your account, your bookings and their history, shares you paid, saved rooms and who you follow, the requests to pay you made and the ones made of you (with their notes), the phones you turned notifications on for (never the device token itself), the record of notifications meant for you, your table alerts, your Apple Wallet passes and how many devices hold each (never a device identifier or push token), the messages you sent and the ones you can still read, the chats you belong to, the reports you made, the decisions about you with your appeals, whether your account is restricted, and what you have agreed to and when. Other people on your bookings are counted rather than named — their details are their personal data, not yours, and a request made of you comes without the name of whoever asked.

Still needed for review: a postal and email contact for rights requests we cannot serve automatically, and for complaints to a supervisory authority. Both depend on the controller identity from Phase 0.

Cookies that are strictly necessary to keep you signed in are always set. We run no advertising and sell nothing to anyone.

Product analytics is optional and off until you say yes. We use PostHog, hosted in the EU, to measure how people move through booking — mainly where it goes wrong. Nothing is loaded and no analytics cookie is set before you answer, refusing is one tap and exactly as easy as accepting, and you can change your mind at any time.

Events are keyed to a booking or account identifier and carry no phone number, name, email address or payment link. Session recording and automatic click capture are both switched off, because both would record the payment form. Analytics never runs on the form for reporting illegal content or on its status page, whatever you answered.

Your answer applies to the version of this policy you were shown. If we change it materially we ask again rather than carrying the old answer forward.