ClubPilot Privacy Policy Effective date: 6 July 2026 ClubPilot is a nightlife venue-discovery app. You can browse bars and clubs on a map, filter by day, music, city and distance, and see which venues are busy. This policy explains exactly what data we collect, why, where it goes, and the choices you have. Short version: You can browse ClubPilot without an account. Creating an account requires an email address. Location and contacts access are optional. We do not sell your account data. Map services, embedded YouTube videos and external ticket websites process information under their own policies, as described below. 1. Who we are ClubPilot ("ClubPilot", "we", "us") provides the ClubPilot mobile and web application. If you have any question about this policy or your data, you can reach us any time at boredbash@gmail.com (mailto:boredbash@gmail.com). For the purposes of applicable data-protection law, ClubPilot is the controller of the personal data described here, and our backend provider Supabase acts as a processor on our behalf. 2. Data we collect and why We collect only what the app needs to function. The table below summarises each category, whether it is required or optional, where it is processed, and the reason we collect it. Data | Required? | Where it lives | Why Email address | Required to create an account | Stored on our backend (Supabase) | Account identity, sign-in, and password reset. Password | Required to create an account | Stored hashed by Supabase Auth | To authenticate you securely. We never see your plain-text password. Profile: username, presence (online) toggle | Optional | Stored on our backend (Supabase) | To display who you are in chats and to friends, and to let you show or hide that you are online. Precise location | Optional (permission-based) | On your device only — not stored on our server | To sort venues by distance from you and draw a walking route to a venue. Contacts | Optional (permission-based) | On your device only — not uploaded or stored | To let you pick a friend from your address book to text a venue invite. Photos / camera | Optional (permission-based) | Images you attach are uploaded to our backend (Supabase Storage) | To attach images to venue chats and to design tickets in the venue console. User content: chat messages, direct messages, friends list, claimed offers, and venues / tickets / specials you create in the venue console | Created as you use those features | Stored on our backend (Supabase) | To deliver messaging, friends, offers and the venue console, and to sync your content across sessions and devices. ClubPilot does not use your account email, messages or uploaded photos to build advertising profiles, and does not send those account details to the embedded video player. Third-party video providers have separate data practices described below. 3. Data processed on your device Some sensitive permissions are used purely on your device and never reach our servers: • Precise location. If you grant location permission, your coordinates are used on-device to sort venues by distance and to request walking directions. We do not store your location on our backend. To draw a route, the start and end coordinates are sent to a public routing service (see OSRM below); we do not save the route or your location afterwards. • Contacts. If you grant contacts permission, your address book is read on-device only so you can choose a friend to invite. The invite is sent through your own phone's messaging (SMS) app. Your contacts are never uploaded to or stored on our servers. You can decline or later revoke location and contacts permissions in your device settings at any time. Browsing venues does not require either permission. 4. How we use your data • To create and secure your account and sign you in. • To let you browse, filter and discover venues, and to show busy venues. • To provide messaging (venue chats and direct messages), friends, and claimed offers. • To power the venue console for venue owners who create venues, tickets and specials. • To compute distances and walking routes on your device when you allow location. • To let you attach images to chats and tickets when you choose photos or use the camera. • To respond to your support requests and enforce our terms and keep the service safe. 5. Third-party service providers We use the following services to provide account features, maps, directions and video playback. Third-party services have their own privacy policies. Supabase (backend, database, authentication, storage) Supabase hosts our database, handles account authentication, and stores images you upload. Your email, profile, user content, and uploaded images are stored with Supabase as our processor. OpenStreetMap + CARTO (map tiles) The dark map is rendered from OpenStreetMap data served as tiles by CARTO. To draw the map, the coordinates of the area you are currently viewing are requested from the tile service. This is a normal part of showing any map. OSRM (walking directions) When you ask for walking directions to a venue, the start and end coordinates are sent to a public OSRM routing service to calculate the route. We do not store the route or those coordinates. YouTube / Google (optional DJ video playback) When you open a YouTube video in ClubPilot, the embedded player connects to YouTube and Google. Google receives information such as the page or app origin and IP address, and may process cookies, device/browser identifiers and playback activity. Its uses can include delivering and improving video, security, measurement, and personalised content or advertising, depending on your settings. The player may display advertisements. ClubPilot does not send your ClubPilot account email, messages or uploaded photos to this player, and public venue browsing does not require opening a video. See Google's Privacy Policy (https://policies.google.com/privacy), how Google uses information from partner sites and apps (https://policies.google.com/technologies/partner-sites), and YouTube's Terms of Service (https://www.youtube.com/t/terms). You can manage Google activity and advertising preferences through your Google account settings. External ticket and offer websites Ticket and offer buttons open the provider's website. Information you enter there, including booking and payment details, is handled by that provider under its own privacy policy. ClubPilot does not receive your payment-card details through these links. These providers process data on their own infrastructure under their own privacy terms. The services receive information needed for the feature you choose, such as a map request, route coordinates, authentication request, uploaded content or video request. 6. Sharing your information We do not sell your personal data, and we do not share it for advertising. Content you choose to make visible to others — such as messages you send in a chat, a direct message to a friend, or a venue/ticket/special you publish in the venue console — is shared with the intended recipients or audience as part of using those features. We may disclose data if required by law or to protect the rights, safety and security of our users and service. 7. Data retention We keep your account data (email, profile) and your user content (messages, friends, claimed offers, venues, tickets, specials, and uploaded images) for as long as your account exists, so the service works and your content stays available to you. When you delete your account, this data is permanently deleted (see below). Location and contacts data are not retained by us at all, because they are processed only on your device. 8. Deleting your account and data You can permanently delete your account and all associated data directly in the app: go to Profile → Delete Account. This removes your account and the personal data and user content we hold for you, including messages, friends, claimed offers, venues/tickets/specials you created, and images you uploaded. This action is permanent and cannot be undone. If you have trouble deleting your account, email us at boredbash@gmail.com (mailto:boredbash@gmail.com) and we will help. 9. Your privacy rights Depending on where you live, you may have rights to access, correct, export or delete your personal data, and to object to or restrict certain processing. You can access and correct much of your data in-app, and you can delete everything via Profile → Delete Account. To exercise any other right, contact us at boredbash@gmail.com (mailto:boredbash@gmail.com). We do not sell personal information and do not process it for targeted advertising, so there is nothing to opt out of on that front. 10. Age requirement and alcohol references ClubPilot is intended for adults. Because it features bars, clubs and other venues that may reference or serve alcohol, the app is rated 17+ and is not directed at children under 17. We do not knowingly collect personal data from anyone under 17. If you believe a person under 17 has provided us data, contact us at boredbash@gmail.com (mailto:boredbash@gmail.com) and we will delete it. 11. International users ClubPilot may be used from many countries, and our providers (including Supabase, CARTO and OSRM) may process data on servers located in other countries. By using ClubPilot, you understand that your information may be processed outside your home country, including in jurisdictions with different data-protection laws. We take reasonable steps to protect your data wherever it is processed. 12. Security Passwords are hashed by our authentication provider, and access to our backend is protected. No method of transmission or storage is completely secure, but we work to protect your information and limit access to what is necessary to operate the service. 13. Changes to this policy We may update this policy as the app evolves or as legal requirements change. When we do, we will revise the effective date at the top of this page and, where appropriate, notify you in-app. Continued use of ClubPilot after an update means you accept the revised policy. 14. Contact us If you have any questions, requests, or concerns about this policy or your data, email us at boredbash@gmail.com (mailto:boredbash@gmail.com). We aim to respond within a few business days. © 2026 ClubPilot. All rights reserved. · Support (https://tnbogilipykpodiqztjn.supabase.co/functions/v1/legal/support)