Your privacy

Updated 2026-10-06

Contact the Who’s Out team at info@pinesystems.org.

Development release: operator details are being finalised before public launch.

What we collect and why

We store your email address, a protected password hash if you set a password, verification and account-recovery records, and the profile information you choose to provide. We use these to run your account, authenticate you and connect your plans and content across devices.

If you choose Google or Apple sign-in when available, that provider authenticates you and shares an account identifier and email address with us. We store the identifier to connect future sign-ins to your account. Apple may supply a private relay email address. We do not receive your Google or Apple password, and we do not request access to your contacts, files or messages.

We store the plans, plan invitations, join requests, membership decisions, saved plans, friend requests and connections, story likes and comments, meeting-place submissions, messages and media you create, along with related timestamps. These records let us provide the service you request. We also keep security, blocking, moderation and data-request records to protect members, investigate misuse and respond to requests.

Administrators use aggregate counts of accounts, plans, participation and messaging activity to understand service usage and manage the community. The analytics dashboard does not display private message content or shared coordinates.

Account and plan features involve processing needed to provide the service. Optional email updates and location sharing are controlled by your choices. Security and moderation processing supports our interest in operating a safe service; applicable legal obligations may also require specific records to be retained.

Who can see your information

Your profile, public plans and approved meeting-place listings can be visible publicly, including to people who are not signed in. Profiles show public hosted-plan history, including past and cancelled plans. Your email address and password hash are not published in your profile. Pending listing submissions and review feedback are available to their submitter and authorised reviewers.

Private plans are visible to their host, members with a current invitation, and pending or approved participants, subject to safety controls. They do not appear in Discover, nearby results, place plan lists or counts, or another visitor’s view of your profile. You can still see them on your own profile. A copied link alone does not grant access.

Plan stories are short videos attached to a plan, with the author’s public profile and an optional caption. They follow the plan’s current visibility and safety controls. Recent public stories appear by author on Discover for 24 hours; the videos remain in that plan’s story history afterward. Private-plan stories never appear in the public story row. We save which stories you watch to your signed-in account so you can distinguish new and watched clips across devices. This watched history is private to you, is included in your account export, and is kept for up to 365 days. Guests keep watched status only in the current page. Authors and hosts can remove stories; reported video may be retained separately for authorised moderation review.

Story like totals and comments are visible to people who currently have access to the story. Your comments link to your profile. Likes and comments remain with the story in plan history, and your own likes and comments are included in your account export. You can remove your like or delete your comment. The story author, plan host and authorised moderators can also remove comments. Reported comments may be preserved separately as moderation evidence. Sharing a story link does not grant access to a private plan.

Friend requests and connections are visible only to you and the other member involved. Your friends list is not public. Becoming friends does not give someone access to your plan conversations or shared locations.

Shared public plan links include public details and a cover preview, which other services may cache. Private plans have no public plan preview. Invitations sent inside Who’s Out are private to the sender and recipient and appear as in-app updates. An invitation allows the recipient to view the plan and request to join; it does not confirm a place or grant access to group messages. The host still reviews join requests.

“Invite someone to Who’s Out” shares a generic homepage link using your device’s sharing options or Copy link. The link does not identify you or track referrals. This feature does not upload contacts, send invitation emails from Who’s Out or automatically add friends.

Group messages, attachments and shared locations are available to the host and approved participants while they retain access. A recipient may save or share what they see, so avoid posting information you do not want the group to receive. Authorised administrators can inspect reported content and the evidence preserved with a report.

Direct text conversations are available only to the two members involved while their accounts and profiles retain access. The recipient must accept a chat request before either member can send new direct messages. The recipient can decline instead. Blocking either member prevents further access and sending between them. A recipient can still save text they have already received. Direct messages can be reported, and authorised administrators can review the message preserved with that report.

Photos, voice, video and location

Photos are resized and converted to JPEG without their original metadata. Audio and video are stored in their uploaded encoding and may contain metadata. Microphone and location access require browser permission and a sharing action. Live locations update only while the page is visible; closing the page or locking your phone stops updates from that device.

Stopping or expiry clears a live share’s coordinates from the ordinary message. A fixed location message remains part of the conversation. A report may preserve the reported location separately as private moderation evidence.

“Plans near me” asks for browser permission when you choose it. Your current coordinates are sent to our server only to calculate approximate distances to listed meeting places; we do not store them or share them with other members. Clearing the filter removes the location held temporarily in the page. This feature does not start live-location sharing.

Email, hosting and external services

Hostinger supplies the website hosting and configured email transport. Account emails are sent from orders@pinesystems.org. Optional plan activity emails and reminders start only after you enable them in Privacy & email settings. You can disable them there. These choices do not disable verification or password-recovery messages.

The main application loads fonts from Google Fonts, which receives the network information needed to serve those files. Opening a place’s website, a photograph’s source, a Google Maps link or an external link in a message takes you to that provider. Maps and message-link previews are not loaded automatically. The app does not include advertising trackers or analytics cookies.

Cookies and storage

A necessary session cookie keeps you signed in and protects requests. Account sessions expire after inactivity or their maximum lifetime. Your browser may temporarily hold form drafts, preferences and navigation state. Account changes clear private interface state. Server security controls also process request information, such as IP addresses for rate limits.

Retention and deletion

Account content is retained while needed to operate your account and shared plans. A deletion request is reviewed by the team; submitting it does not immediately close your account or delete the records. We consider shared content, other people’s rights and any applicable retention duties when deciding what to erase, anonymise or retain, and explain the result.

Live-location coordinates expire as described above. Expired account tokens are cleaned up. Scheduled backups are rotated under the service’s backup policy; historical deployment snapshots and moderation evidence require a separate review. Restoring a backup must also reapply completed deletion decisions. Moderation evidence is not publicly accessible and must be reviewed for continued necessity.

Your choices and requests

You can edit your profile, change email choices, download a JSON copy of your information and submit or cancel a deletion request in Privacy & email settings. The download includes media metadata rather than the media files themselves; contact support for help obtaining a fuller copy.

For access, correction, erasure, restriction, objection or portability requests, contact info@pinesystems.org. We may need to confirm your identity. We aim to respond without undue delay, ordinarily within one calendar month, and will explain any applicable extension or exception. You may also contact the data-protection authority where you live or work or where an alleged infringement occurred.