Your privacy

Updated 2026-10-19

Who’s Out is operated by Abby Hey Investments LLC. Contact: Tornike Minadze. Email: info@pinesystems.org.

Development release: the operator’s public contact address is still being finalised before public launch.

What we collect and why

We store your email address, a protected password hash if you set a password, verification and account-recovery records, and the profile information you choose to provide. We use these to run your account, authenticate you and connect your plans and content across devices.

If you choose Google or Apple sign-in when available, that provider authenticates you and shares an account identifier and email address with us. We store the identifier to connect future sign-ins to your account. Apple may supply a private relay email address. We do not receive your Google or Apple password, and we do not request access to your contacts, files or messages.

We store the plans, plan invitations, join requests, membership decisions, saved plans, friend requests and connections, story likes and comments, meeting-place submissions, messages and media you create, along with related timestamps. These records let us provide the service you request. We also keep security, blocking, moderation and data-request records to protect members, investigate misuse and respond to requests.

Administrators use aggregate counts of accounts, plans, participation and messaging activity to understand service usage and manage the community. The analytics dashboard does not display private message content or shared coordinates.

In the signed-in iOS and Android app, optional activity measurement counts visits, screen categories and active foreground time separately from website traffic. This measurement is on by default and can be turned off in Account settings on each phone. It pauses in the background and after 60 seconds without interaction. Administrator activity is excluded. Reports group activity by platform and approximate network country; they never include messages, plan titles, shared coordinates or individual activity histories. Incoming events use your authenticated session, and a protected marker derived from that session prevents repeat counting. This short-lived collection is therefore associated with your account even though dashboard reports are aggregate. Markers expire after 30 minutes of inactivity and are removed during measurement cleanup; online status only counts the last 90 seconds. Aggregated app counts are retained for a rolling 183 days. We use our own server, with no additional analytics SDK or advertising tracker.

We count website page views and browsing visits using the existing session, grouping activity until 30 minutes of inactivity. These are visits, not unique people. We also measure active time by page category and estimate how many browsing sessions were active in the last 90 seconds. Only visible pages with recent activity contribute to active time. A short-lived random session marker prevents duplicate counting across tabs; it is not linked to your account, and inactive markers expire after five minutes and are removed during measurement cleanup.

We estimate the country of a visit from its network address using a local database on our server. No address is sent to a geolocation provider, and VPNs or mobile networks can affect accuracy. Country, page-view and active-time reports contain aggregate counts retained for a rolling 183 days, with older counts cleaned up during routine measurement. They do not store IP addresses, browser strings, full page addresses or referring addresses. Known bots, administrator browsing and browsers sending Do Not Track or Global Privacy Control signals are excluded. Bot filtering is not perfect. This uses no additional analytics cookie or third-party tracking service. Country data: IP Geolocation by DB-IP, licensed under CC BY 4.0.

Account and plan features involve processing needed to provide the service. Optional email updates and location sharing are controlled by your choices. Security and moderation processing supports our interest in operating a safe service; applicable legal obligations may also require specific records to be retained.

Who can see your information

Your profile, public plans and approved meeting-place listings can be visible publicly, including to people who are not signed in. Profiles show public hosted-plan history, including past and cancelled plans. Your email address and password hash are not published in your profile. Pending listing submissions and review feedback are available to their submitter and authorised reviewers.

Business activity posts in Explore show the activity, business, availability, group size and price information after review. Pending, rejected and withdrawn posts remain available to their business owner and authorised reviewers; expired posts stop appearing in Explore. We retain these submissions and their review history to manage the business service and investigate reports. Business owners can include their own activity records in an account export. Your selected discovery city helps order Explore results; it is not shared with business owners.

Private plans are visible to their host, members with a current invitation, and pending or approved participants, subject to safety controls. They do not appear in Discover, nearby results, place plan lists or counts, or another visitor’s view of your profile. You can still see them on your own profile. A copied link alone does not grant access.

Plan stories are short videos attached to a plan, with the author’s public profile and an optional caption. They follow the plan’s current visibility and safety controls. Recent public stories appear by author on Discover for 24 hours; the videos remain in that plan’s Plan memories afterward, without automatic deletion based on age. Private-plan stories never appear in the public story row. We save which stories you watch to your signed-in account so you can distinguish new and watched clips across devices. This watched history is private to you, is included in your account export, and is kept for up to 365 days. Guests keep watched status only in the current page. Authors and hosts can remove stories; reported video may be retained separately for authorised moderation review.

Story like totals and comments are visible to people who currently have access to the story. Your comments link to your profile. Likes and comments remain with the story in plan history, and your own likes and comments are included in your account export. You can remove your like or delete your comment. The story author, plan host and authorised moderators can also remove comments. Reported comments may be preserved separately as moderation evidence. Sharing a story link does not grant access to a private plan.

Friend requests and connections are visible only to you and the other member involved. Your friends list is not public. Becoming friends does not give someone access to your plan conversations or shared locations.

Shared public plan links include public details and a cover preview, which other services may cache. Private plans have no public plan preview. Invitations sent inside Who’s Out are private to the sender and recipient and appear as in-app updates. An invitation allows the recipient to view the plan. Accepting it confirms a place and opens group messages if the plan is still available and has space. Ordinary join requests still require host approval.

“Invite someone to Who’s Out” shares a generic homepage link using your device’s sharing options or Copy link. The link does not identify you or track referrals. This feature does not upload contacts, send invitation emails from Who’s Out or automatically add friends.

Group messages, attachments and shared locations are available to the host and approved participants while they retain access. A recipient may save or share what they see, so avoid posting information you do not want the group to receive. Authorised administrators can inspect reported content and the evidence preserved with a report.

Direct conversations, including text, photos, videos, voice messages and shared locations, are available only to the two members involved while their accounts and profiles retain access. The recipient must accept a chat request before either member can send new direct messages. The recipient can decline instead. Blocking either member prevents further access and sending between them. A recipient can still save content they have already received. Direct messages can be reported, and authorised administrators can review the message preserved with that report. Messages are protected by access controls and encrypted connections to our server; they are not end-to-end encrypted.

Photos, voice, video and location

Photos are resized and converted to JPEG without their original metadata. Videos may be converted and trimmed for playback; conversion removes source metadata, but accepted originals and voice recordings may still contain metadata. Camera, photo-library, microphone and location access use your device’s permission controls. Selecting media or sharing a recording or location in a conversation requires your action. Live locations update only while the relevant page or app is in the foreground; closing it or locking your phone pauses updates from that device.

Stopping or expiry clears a live share’s coordinates from the ordinary message. A fixed location message remains part of the conversation. A report may preserve the reported location separately as private moderation evidence.

“Plans near me” asks for browser permission when you choose it. Your current coordinates are sent to our server only to calculate approximate distances to listed meeting places; we do not store them or share them with other members. Clearing the filter removes the location held temporarily in the page. This feature does not start live-location sharing.

The mobile app can find your city and country when you open it, after you allow foreground location access. Your device’s location service resolves the area; only the city and country are used to filter Discover. This lookup does not send precise coordinates to our server, change your public profile or start background tracking. You can choose another area, and Discover still works if location is unavailable. After local plans, Discover continues with popular public plans worldwide.

If you turn on “Open to plans”, we save your chosen city, country, radius and available time so hosts can find people who may be interested in a plan. Matching estimates distance between city centers, not between people’s live GPS positions. Hosts review suggestions before sending invitations. Turning availability off stops new matching; your last choices remain saved for next time.

Showing that you are active for spontaneous plans is a separate choice, off by default. When you enable it during an available time, the visible website or foreground app sends a short-lived activity signal. Eligible members in your selected city area can see a count of recently active, available members and review public profiles when inviting people to a published plan. The count includes an account once across its tabs and devices, excludes blocked or unavailable members, and expires after 90 seconds without a new signal. It is an estimate of recent activity, not a promise that someone will accept. Your precise location, last-seen time and private availability schedule are not shown. Turning this choice or availability off removes you from new live suggestions; it does not send, accept or cancel invitations for you. This feature is separate from visit analytics.

Random-plan suggestions use the city, activity and time you choose. An eligible business with an active paid promotion has a higher chance of being selected, and sponsored suggestions are labelled. We save suggestions against your account, including the selected venue and sponsorship flag, to support creating a plan and prevent misuse. Unused suggestions are eligible for cleanup after 90 days; a suggestion used to create a plan stays with that plan. This contextual promotion does not use activity from other companies’ apps or websites.

Adding a plan to your calendar opens your device’s calendar editor or a calendar file. We do not upload your calendar or address book. Friend connections are the social graph you create inside Who’s Out, not contacts imported from your phone.

Automated content checks

New text you submit, including messages, and new photos and sampled video frames are checked on our server before publication or delivery. Checks look for explicit abusive language, repetitive spam, nudity and violent imagery. They can make mistakes and miss harmful content, so reporting and human review remain important.

These checks do not send your text or media to an external moderation provider. When an eligible check blocks a submission, we may retain the rejected text, photo or video privately for up to 30 days so authorised administrators can review mistakes. The review records include your account, the affected field, the reason for the block and the decision. Storage limits may prevent a review copy being kept. This content is not published or delivered to other members. Temporary uploads and extracted frames are removed through processing cleanup; reported content follows the evidence rules above. Contact info@pinesystems.org if you think a check was wrong. An administrator can approve the exact content for you to submit again in the same context for up to seven days, within its retention period. Approval does not automatically publish a draft or send a message, and normal access, format and safety checks still apply. Your account export includes your own retained rejection text and metadata. Completed deletion fulfillment clears this review evidence; a minimal account deletion marker prevents delayed uploads from recreating it.

Email, hosting and external services

Hostinger supplies the website hosting and configured email transport. Account emails are sent from orders@pinesystems.org. Optional plan activity emails and reminders start only after you enable them in Privacy & email settings. You can disable them there. These choices do not disable verification or password-recovery messages.

Website fonts are served from our own hosting; the native app uses bundled and system fonts. Google sign-in opens Google’s authentication service in a system browser. Your device’s location and mapping services may process location to resolve an area or display a map you open. Opening a place’s website, a photograph’s source, a directions link or an external link in a message takes you to that provider. Message-link previews are not fetched automatically. We do not sell personal information, link it with other companies’ data for targeted advertising, or share it with data brokers.

Phone push delivery is currently disabled. If enabled in a later release, we will explain the permission choice and the delivery providers before you register for it. Existing in-app updates remain available without phone notifications.

Cookies and storage

A necessary session cookie keeps you signed in and protects requests. Account sessions expire after inactivity or their maximum lifetime. Your browser may temporarily hold form drafts, preferences and navigation state. Account changes clear private interface state. Server security controls also process request information, such as IP addresses for rate limits.

The native app keeps sign-in credentials in the operating system’s secure storage and may save drafts, selected media and cached content on the phone. Device-only drafts are not posted until you submit them. Sign-out and account changes clear account-specific interface data and drafts. Server sessions retain a device label and sign-in timestamps so you can recognise and revoke sessions. Server and hosting logs may retain request and error information for security and troubleshooting, separately from the aggregate analytics dashboard.

Retention and deletion

Account content is retained while needed to operate the service. To request deletion, open Account settings and confirm with your password or a code sent to your account email. The team reviews and processes your request, ordinarily within one calendar month. Submitting a request does not immediately erase your account, and you can cancel before fulfillment starts. Once approved for fulfillment, deletion is irreversible: your account, profile, hosted plans and their group conversations, owned listings and activity posts, stories, comments, sent messages and media, friendships, invitations, sign-in sessions and linked-provider records are removed. Private upload files and moderation copies are cleared with retries if cleanup is interrupted. Other members’ accounts remain; copies they saved outside Who’s Out are outside our control.

We email you after the deletion and media cleanup finish. If delivery fails, we retry; the deleted account remains inaccessible. Your email address is kept only as needed to send that completion message, then removed from the completion queue. A minimal receipt records the deletion status and timestamps without your profile or content. A protected hash of the former account’s internal identifier and an erasure marker prevent delayed uploads or backup recovery from recreating deleted data. Aggregate counts that no longer identify an account may remain.

Live-location coordinates expire as described above, and expired account tokens are cleaned up. Restricted backups can retain deleted information until rotation. The scheduled backup process targets 14 verified managed snapshots; this is a number of recovery copies, not a guaranteed 14-day deletion deadline. Failed backups and manual recovery copies require separate review. Before a restored backup returns to service, completed deletion decisions must be reapplied. Backup copies are not available through the app and must remain access restricted. If a specific legal retention obligation prevents part of a request from being fulfilled, we will explain what is retained and why rather than mark that data as erased.

Your choices and requests

You can edit your profile, change email choices, download a JSON copy of your information and submit a deletion request in Privacy & email settings. A request can be cancelled before fulfillment starts. In the mobile app, you can also switch off optional app usage analytics on that phone. The download includes media metadata rather than the media files themselves; contact support for help obtaining a fuller copy.

For access, correction, erasure, restriction, objection or portability requests, contact info@pinesystems.org. We may need to confirm your identity. We aim to respond without undue delay, ordinarily within one calendar month, and will explain any applicable extension or exception. You may also contact the data-protection authority where you live or work or where an alleged infringement occurred.