CasuallySocial Privacy Policy

Information we collect

• Account information, including your email address, account type, and the profile information you choose to provide.
• Precise foreground location when you ask to discover nearby places, view your map position, create or capture a Beacon, centre an Activity venue map near you, check in, or optionally provide location context with a report. Activity map centring is optional.
• Gameplay and participation records, including faction membership, Beacon interactions, reports, Activity reservations, selected attendance method, entry-pass issuance and redemption, check-ins, completions, Creation Credits, Player XP, and Faction Points.
• Public profile information, including your display name, username, profile image, account age, email-confirmation indicator, Activity creation count, and Player XP. Confirmation indicates control of an email address and is not identity verification.
• Brand-verification application information, including brand name, your relationship to the brand, public websites or supporting links, application status, and review communications. A verified-brand badge records an administrative review of a representation claim and is not a safety endorsement.
• Content and media you submit, such as Beacon names, Activity details, meeting information, report notes, profile photos, and optional Activity posters.
• Technical information needed to operate and secure the service, such as authentication sessions, request timestamps, IP-derived service logs, app version, device and operating-system details, crash stack traces, and error information produced by our infrastructure providers.

How we use information

• Provide location-based discovery and map features.
• Validate proximity-sensitive creation, capture, and self-check-in actions, and validate host-scanned QR attendance.
• Operate account, faction, scoring, Activity, safety-reporting, and anti-abuse features.
• Protect the integrity and security of CasuallySocial and investigate misuse.
• Maintain, troubleshoot, and improve the service.

Location information

CasuallySocial currently requests foreground location only. We do not request background location. Your device may show your live position locally on the Play map, while coordinates submitted for proximity-sensitive actions are checked by our server.

When you create a Beacon, its stored coordinate comes from the device's fresh foreground location and may be shown to other users for maps, distance, discovery, and gameplay. When you create an Activity, you choose its stored venue coordinate by moving a map pin; using device location to centre that map is optional, and only the selected venue pin is submitted as the Activity location. Beacon capture coordinates may be retained as gameplay-integrity evidence. Coordinates used only to attempt Activity self-check-in are evaluated by the server and are not stored as a check-in coordinate in the current system. Optional Beacon-report location is reduced to distance evidence rather than retaining the submitted report coordinate.

A published Activity's selected venue coordinate, venue name, and address information may be displayed to other users and sent to their chosen maps provider for directions. Activity hosts must select a publicly accessible gathering place and must not publish a home, private residence, restricted location, or another place attendees cannot lawfully and safely access.

Raw personal capture and participation history is not intended to be publicly exposed. GPS and map data can be inaccurate, so always use your own judgment about whether a place is safe and accessible.

Photos, camera, and QR entry passes

Selected profile photos and optional Activity posters are resized and re-encoded before upload to reduce file size and remove source metadata such as embedded photo location. They are stored and delivered through Cloudinary and may be publicly visible with your profile or Activity.

When an Activity uses host-scanned QR attendance, an eligible attendee can display a short-lived unique entry pass. The server stores a cryptographic hash rather than the displayed token and records issuance and redemption information. Camera access is requested only when a host opens the scanner. CasuallySocial reads the QR payload on the device and does not intentionally capture, retain, or upload a camera image during scanning.

Service providers and sharing

We use service providers to operate CasuallySocial, including Supabase for authentication and database infrastructure, Cloudinary for profile-photo and Activity-poster storage and delivery, map-data providers used by MapLibre, and Sentry for production crash and error diagnostics. These providers may process technical request information needed to deliver their services. We configure Sentry not to intentionally receive exact location, authentication tokens, request contents, email addresses, or session replay. We do not sell personal information or use third-party advertising SDKs in the current app.

We may disclose information when reasonably necessary to comply with law, protect users or the public, investigate abuse, or defend legal rights. We may also transfer information as part of a merger, financing, acquisition, or sale, subject to appropriate protections.

Retention and deletion

We retain account information while your account is active and retain operational records as needed for safety, fraud prevention, dispute resolution, legal obligations, and the integrity of shared gameplay history. When an account is deleted, personal information that is not required to be retained will be deleted or de-identified. Some shared gameplay records may remain in de-identified form so other users' history and competition results remain coherent.

Safety reports and enforcement

Activity and Beacon reports may contain the selected reason, an optional note, the reporter's account identifier, timestamps, review status, and internal moderation notes. We use these records to investigate concerns, identify repeated misuse, preserve an audit trail, and decide whether to restrict content or suspend or terminate an account. We do not disclose a reporter's identity to the reported user except where legally required.

Your choices

You can deny or revoke location access in your device settings, although location-based features will not work without it. You can permanently delete your account from the You page. You may contact us to request access, correction, export, or other privacy assistance.

Security and international processing

We use technical and organizational safeguards designed to protect information, but no system is completely secure. Our providers may process information in countries other than your own, where data-protection laws may differ.

Changes and contact

We may update this policy as CasuallySocial changes. Material changes will be reflected by a new effective date and, when appropriate, an in-app notice.

Questions or privacy requests: hello@casuallysocial.com