Privacy Policy

Who we are

The Night App is a nightlife discovery and booking platform connecting users, venues, and DJs — based in Spain. This policy applies to everyone who uses the app: people discovering nights out, venues managing their profile and events, and the staff working under a venue’s account.

Because we’re based in the EU, this policy is written to meet the standard set by the General Data Protection Regulation (GDPR) for anyone in the EU/EEA using the app, and we apply the same standard to everyone regardless of where they’re using it from.

Operating entity: to be confirmed. A dedicated corporate entity for The Night App is pending incorporation — this section will be updated with the registered company name, address, and registration details once that’s complete.

What we collect

We only collect what the features you actually use require. Here’s the full list:

Account & profile information

• Email address and password (or your Apple/Google account identifier, if you sign in that way)
• Display name and username
• A self-attestation that you’re 18 or older, given via a checkbox at sign-up (see Age requirement) — your exact date of birth is optional and not required to create an account
• Optional profile details you choose to add: bio, displayed age, date of birth, nationality, gender, phone number, contact email, profile photo, banner image
• Your privacy setting choices (e.g., private account, message request settings)

Content you create

• Posts, stories, comments, and the photos or videos attached to them
• Direct messages and group chat messages, including media shared in them
• Guest list requests, RSVPs, and reviews you leave for venues

Social connections

• Who you follow, who follows you, your close friends list, and anyone you’ve blocked or restricted

Venue & event activity

• Tickets and VIP tables you purchase, and check-ins scanned by venue staff at the door
• Your location, if you enable it — used two ways: your foreground location to show nearby venues and let you check in, and, if you grant “Always” location access, background location to detect when you arrive at or leave a venue and prompt an automatic check-in. Background location is optional: it’s only requested for this specific feature, and you can turn it off at any time from Settings in the app, or from your device’s permission settings. We don’t use location data for advertising, and we don’t sell it.

Device permissions

We ask for camera, photo library, and microphone access only when you use a feature that needs it (posting a photo, recording a story, picking an image from your library). You control these permissions in your device settings at any time.

Venue account information

If you manage a venue on the platform, we also collect the venue’s business details, team member roles and permissions, and the venue’s Stripe account status (used to receive payouts — see Payments & subscriptions).

If you join our waitlist, contact us, or file a report

Joining the launch waitlist collects your name, email, phone number, and Instagram handle, used only to notify you when the app launches and to award any launch offer you signed up for. Contacting support, reporting content, or filing a copyright or illegal-content notice collects whatever you provide in that form (typically your name and email) so we can respond to you and, where relevant, to the person the report concerns.

Information we don’t collect

We never see or store your full payment card number — that’s handled entirely by Stripe and Apple (see below). We don’t buy or use third-party advertising or tracking data about you, and we don’t use analytics or advertising cookies on this website (see our Cookie Policy).

How we use it

• To run the app: authenticate you, show you venues and events, deliver messages, process guest list requests and check-ins.
• To show who’s at a venue right now: your check-in is visible to other users by default — this is a core discovery feature, not a background analytics use — and you can turn it off at any time in Settings → “Block Others From Seeing Your Location.”
• To process transactions: tickets, VIP tables, and subscriptions (Premium, Venue Pro/Elite) — see Payments & subscriptions.
• To keep the platform safe: reviewing reports, enforcing blocks/restrictions, and preventing abuse.
• To notify you: about your own account activity — approvals, tickets purchased, messages received.
• To send occasional announcements: with your consent, a venue you follow or a venue you’ve visited may send you a promotional update through the app (e.g., an upcoming event). We ask for this consent directly in the app — a clear yes/no prompt, not a pre-ticked box — and you can change your answer at any time in Settings → Notification Preferences, without affecting notifications about your own account activity.
• To improve the app: understanding aggregate usage (e.g., a venue’s own event attendance stats) to make the product better.

Legal basis: we process account and content data, including your check-in presence at a venue, to perform our contract with you (running the app you signed up for — the “who’s here” feature is core to that, which is why it defaults to visible rather than requiring you to opt in); payment data to comply with legal/tax obligations and perform that same contract; security/abuse data under our legitimate interest in keeping the platform safe. Venue announcements are sent only with your consent, asked for directly in the app — you can withdraw it at any time in Settings → Notification Preferences with no effect on notifications about your own account activity. Regardless of the legal basis, you always have a way to object or opt out — see the specific setting named next to each use above. Where we rely on legitimate interest, you have an absolute right to object at any time by contacting us at support@thenightapp.com.

Who we share it with

We do not sell your personal data, to anyone, ever. We share data only in these specific cases:

• Venues you interact with — your name, profile, and guest list/ticket/check-in status, so a venue can manage its own guest list and door entry. A venue’s own staff may also keep private notes on their own guest list (e.g. marking a regular as VIP) — these notes are visible only to that venue’s own team, never to other venues or other users. Venue staff can see who’s currently checked in at their own venue regardless of the setting described below, since that’s how door entry and guest-list management work.
• Other users of the app — by default, other users can see that you’re currently checked in at a venue (e.g. in a venue’s “who’s here right now” list), regardless of whether your account is public or private — check-in visibility is a separate setting from account privacy. You can turn this off at any time in Settings → “Block Others From Seeing Your Location”, which hides your check-ins from every other user (not just non-followers) and disables others’ ability to request to join your table.
• Supabase — all app data (it’s our database and backend host), bound by their own data processing agreement.
• Stripe — payment details for tickets and VIP tables, and venue subscription billing.
• Apple / RevenueCat — subscription purchase status for Premium and Venue Plan subscriptions purchased via the App Store.
• Mapbox — venue location data shown on the map.
• Google / Apple Sign-In — your account identifier, if you choose that sign-in method.
• Resend — your email address, to deliver transactional emails (ticket confirmations, receipts, and similar account-related messages).
• Expo, Apple, and Google — a device push token, so we can deliver push notifications to your phone. No message content is visible to these providers beyond what a notification displays.

Several of these providers (including Stripe, RevenueCat, Mapbox, Resend, and Expo) are based outside the EU/EEA, principally in the United States. Where we transfer personal data to them, we rely on the safeguards those providers offer under their own data processing agreements (such as Standard Contractual Clauses), consistent with GDPR’s rules on international transfers.

We may also disclose information if required by law, or to protect the rights, safety, and property of The Night App, our users, or the public.

Payments & subscriptions

Ticket and VIP table purchases are processed by Stripe — money goes from your card, through Stripe, directly to the venue’s own Stripe account, minus our platform fee. We never see or store your card number.

Consumer Premium subscriptions are processed through Apple’s In-App Purchase system (via RevenueCat, our subscription infrastructure provider). Venue subscriptions may be processed either through Apple’s In-App Purchase system or directly via Stripe billing on this website, depending on how the venue subscribes.

How long we keep it

We keep your account data for as long as your account is active. If you delete your account (from within the app, or by requesting it through support), here’s exactly what happens: immediately, your posts, stories, comments, likes, reposts, tags, reviews, check-ins, and follows are permanently erased — not just hidden — and your profile is anonymized: your name, username, photo, and optional profile details (bio, phone, contact email, nationality, gender, date of birth) are removed, and you can no longer sign back in. The one exception is direct messages, group chats, and plan chats: since a message is conversation content the other participant may still be actively relying on, those instead show a generic “Deleted User” as the sender for up to 30 days — matching the outer limit GDPR gives us to complete an erasure request — after which they too are permanently deleted. Transaction records (tickets, VIP tables, refunds) are the one further exception: those are kept for as long as tax and accounting law requires, with your name already removed at the point of deletion.

For accounts that remain active, direct messages and group chat messages are kept indefinitely rather than expiring. For a direct message, you can delete it at any time, which removes it from your own view (the other participant still sees their copy unless they delete theirs too). Plan chats (tied to a specific plan you’ve made with friends) are the one exception: that chat closes 24 hours after the plan’s start time and can no longer be read or posted to afterward.

Your rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data (most of this you can do yourself, directly in your profile settings)
• Delete your account and associated personal data
• Export your data in a portable format
• Object to or restrict certain processing of your data

To exercise any of these rights, use the in-app option where one exists (e.g., Settings → Delete Account) or contact us at the email below. We’ll act on your request within 30 days. If you’re in the EU/EEA, you also have the right to lodge a complaint with your local data protection authority.

Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS) for everything the app sends and receives, database-level access controls so a user’s data is only ever visible to that user and the people/venues it’s meant to be shared with, and short-lived authentication tokens rather than storing your password anywhere we control. No system is perfectly secure, but we treat your data as something we’re responsible for, not something we own.

Age requirement

The Night App is a nightlife platform and is not intended for anyone under 18. At sign-up, you must confirm you’re 18 or older via a checkbox before you can create an account; entering your exact date of birth is optional. This is a self-declared check, not identity verification — we do not currently verify age against a government ID or other document. If we become aware that an account belongs to someone under 18, we’ll close it and anonymize the associated personal data as described above.

To catch accounts that shouldn’t have been created in the first place, we run an automated check on messages for phrases that self-disclose being under 18 (e.g., stating an age of 17 or younger). A match is queued for a human reviewer — it doesn’t auto-delete the account — and, if confirmed, the account is closed as described above. This check looks only for that specific pattern; we do not otherwise read, scan, or moderate the content of direct messages.

Changes to this policy

If we make material changes to this policy, we’ll update the effective date at the top of this page and, where appropriate, notify you directly in the app.

Contact us

Questions about this policy, or want to exercise your data rights? Reach out: