Privacy Policy
Last updated September 28, 2026
something based is currently in private testing. This policy describes what the app actually does today, and will be updated as the app changes and before any public launch.
1. Who we are
something based ("we," "us") operates the something based mobile application. You can reach us at benjamin.houck801@gmail.com with any privacy question or request.
2. What we collect, and why
| Data | Source | Why | Retention |
|---|---|---|---|
| Username, display name, phone number, and a password (stored only as a one-way hash by our authentication provider) | You enter them when you create your account. Phone matching compares one-way hashes, never the raw number | Account identity, and letting friends find you | Until account deletion |
| Birth date | You enter it, once, at first app launch and again if you sign in | Age eligibility (13+ to use the app; 18+ for nearby-discovery features) | Until account deletion; cannot be edited once set |
| Location, rounded to about 111 meters | Only when you tap "I'm out and free" (foreground GPS, one reading) | Placing an approximate pin for you on the in-app map, showing you people nearby the same way, and showing others roughly where you are (subject to your visibility setting) | Auto-deleted after 3 hours; a daily job removes anything older than 1 day regardless |
| Location, unrounded (a single GPS reading) | Only when you tap "Discover local events" — sent directly from your device to Ticketmaster's event-search API for that one search | Finding real-world events happening near you | Not stored by us; retained per Ticketmaster's own privacy policy, since it's sent directly to them |
| Push notification token | Generated by Apple or Google when you turn on notifications (during setup, or later in Settings) | Delivering notifications for things like a new friend request | Until you turn notifications off or delete your account |
| Public events you create — title, description, location, link, and photo | You enter them when you create an event and choose to make it public | Shown to any user who can see public events nearby, along with your name/avatar and a list of who's attending | Until you delete the event or your account |
| Check-in photo (optional) | Only if you choose to attach one when checking in — always skippable | Shown alongside your check-in to whoever can already see it | Same schedule as the check-in: auto-deleted after 3 hours, with a daily job removing anything older than 1 day regardless |
| One-word "mood" (optional) | You optionally type one word when checking in | Shown to your mutual friends, alongside similar words from your other friends, for about a week — never ranked or scored, never shown beyond mutual friends | The app only ever displays words from roughly the last 7 days |
| Your usual city | Derived automatically from reverse-geocoding your location at check-in time, on your device — we never store the raw coordinates behind it, only the resulting city name | Shown on your profile as "Usually in [city]" — your most recent city if you have fewer than 5 logged check-ins, otherwise your most common one | Kept indefinitely as a running log used only to compute this value; deleted on account deletion |
| Drawn avatar | The strokes you draw when creating or weekly-redrawing your avatar, stored as vector path data, not an image file | Displayed as your avatar to other users | Until you redraw it (once a week at most) or delete your account |
| Your contacts, temporarily | Only when you tap "Find friends from contacts" (device address book, or Google Contacts if granted) | Checking which of your contacts already use the app | Emails are one-way hashed on your device before being sent; raw contact data is never uploaded or stored |
| Bluetooth proximity signal (opt-in, off by default) | Only if you enable it in Settings, and only while the app is open | Checking whether an already-connected friend who also has this on is physically nearby right now | Deleted the moment you turn it off, and auto-deleted after 1 day regardless |
| Contact names & phone numbers, for the "plan with a friend" picker | Device address book, read locally when you open that picker | Letting you text anyone in your phone a suggested time | Never uploaded — stays entirely on your device |
| "Did you hang out?" answer | You tap Yes/No a few hours after texting someone through the planner | Personal record shown back to you, not shared | Stored only on your device |
| Bio, interests, visibility setting | You enter it | Shown to other users per your visibility setting; used to suggest people with shared interests | Until you change or delete it |
| Blocks you make | You tap "Block" | Prevents that person from appearing to you again, and hides your visibility from them | Kept indefinitely (safety); you can unblock at any time |
| Reports you file | You tap "Report" | Trust & safety review | 2 years from the date filed |
| Match suggestions | Generated by our matching logic from the data above | Shown to you as suggested people to meet | Regenerated periodically; not kept once replaced |
| Audit log (blocks, visibility changes, account deletion) | Generated automatically | Security investigations, abuse prevention, and demonstrating compliance with deletion requests | Kept indefinitely |
What we do not collect: email content, text/SMS/iMessage content or metadata, notification content from any app, browsing or search history from any provider, or continuous/background location or Bluetooth scanning (both only ever run in the single, opt-in, foreground moments described above).
3. Who we share data with
We do not sell personal data and do not use behavioral or surveillance advertising. Data is shared only with:
- Supabase, Inc. — our database and authentication infrastructure, hosted in the United States.
- Expo (650 Industries, Inc.) — relays push notifications to your device; receives only your device's push token, never the content or context behind a notification beyond its title and body text.
- Ticketmaster, LLC and Humanitix — if you use "Discover local events," we query their APIs for nearby events. Ticketmaster receives a single, unrounded GPS reading directly from your device for that search; Humanitix does not receive your location at all.
- Other something based users, but only what you've explicitly made visible: your name/avatar (per your visibility setting), your approximate location (rounded to about 111m — never your exact GPS fix) if you're checked in and they're nearby or a connected friend, your check-in photo and mood word if you chose to add them (mood words are visible only to mutual friends), your usual city, your free/busy windows if you choose to plan something with a contact, and anything you post to a public event you create (title, description, location, link, photo, and your attendance).
4. International data transfers
Our infrastructure is hosted in the United States. If you use something based from outside the US, your data will be transferred to and processed in the United States.
5. Your rights
- Access & export: the app has a self-service "Export my data" button (Settings) that returns everything described above as a single file.
- Deletion: "Delete my account" (Settings) permanently removes your account and cascades through every data type listed above. This is irreversible.
- Correction: bio, interests, phone number, and visibility are directly editable in Settings. Contact us if your username or display name needs correcting. Birth date is locked after it's first set, to preserve age-verification integrity — contact us if you need it corrected.
- California (CCPA/CPRA) and equivalent state rights: right to know, delete, correct, and opt out of sale/sharing. something based does not sell or share personal information within the meaning of the CCPA/CPRA.
6. Children's privacy
something based requires everyone to confirm they are at least 13 years old before using any part of the app. The nearby-discovery and stranger-matching features require confirming you are 18 or older, enforced both in the app and at the database level. We do not knowingly collect personal information from children under 13.
7. Security
- Row-level security enforced at the database layer, not just in the app.
- Coordinates of other users are rounded to about 111 meters before ever reaching your device — your precise GPS fix is never transmitted to anyone.
- Rate limiting on location-adjacent queries and on filing reports.
- Encryption in transit and at rest, via our hosting provider's platform defaults.
8. Changes to this policy
We may update this policy as the app changes. If we make a material change, we'll notify you in the app or by email before it takes effect.