ClubPilot is a nightlife venue-discovery app. You can browse bars and clubs on a map, filter by day, music, city and distance, and see which venues are busy. This policy explains exactly what data we collect, why, where it goes, and the choices you have.
1. Who we are
ClubPilot ("ClubPilot", "we", "us") provides the ClubPilot mobile and web application. If you have any question about this policy or your data, you can reach us any time at boredbash@gmail.com. For the purposes of applicable data-protection law, ClubPilot is the controller of the personal data described here, and our backend provider Supabase acts as a processor on our behalf.
2. Data we collect and why
We collect only what the app needs to function. The table below summarises each category, whether it is required or optional, where it is processed, and the reason we collect it.
| Data | Required? | Where it lives | Why |
|---|---|---|---|
| Email address | Required to create an account | Stored on our backend (Supabase) | Account identity, sign-in, and password reset. |
| Password | Required to create an account | Stored hashed by Supabase Auth | To authenticate you securely. We never see your plain-text password. |
| Profile: username, presence (online) toggle | Optional | Stored on our backend (Supabase) | To display who you are in chats and to friends, and to let you show or hide that you are online. |
| Precise location | Optional (permission-based) | On your device only — not stored on our server | To sort venues by distance from you and draw a walking route to a venue. |
| Contacts | Optional (permission-based) | On your device only — not uploaded or stored | To let you pick a friend from your address book to text a venue invite. |
| Photos / camera | Optional (permission-based) | Images you attach are uploaded to our backend (Supabase Storage) | To attach images to venue chats and to design tickets in the venue console. |
| User content: chat messages, direct messages, friends list, claimed offers, and venues / tickets / specials you create in the venue console | Created as you use those features | Stored on our backend (Supabase) | To deliver messaging, friends, offers and the venue console, and to sync your content across sessions and devices. |
We do not collect advertising identifiers, we do not build advertising or marketing profiles, and we do not track you across other apps or websites.
3. Data processed on your device
Some sensitive permissions are used purely on your device and never reach our servers:
- Precise location. If you grant location permission, your coordinates are used on-device to sort venues by distance and to request walking directions. We do not store your location on our backend. To draw a route, the start and end coordinates are sent to a public routing service (see OSRM below); we do not save the route or your location afterwards.
- Contacts. If you grant contacts permission, your address book is read on-device only so you can choose a friend to invite. The invite is sent through your own phone's messaging (SMS) app. Your contacts are never uploaded to or stored on our servers.
You can decline or later revoke location and contacts permissions in your device settings at any time. Browsing venues does not require either permission.
4. How we use your data
- To create and secure your account and sign you in.
- To let you browse, filter and discover venues, and to show busy venues.
- To provide messaging (venue chats and direct messages), friends, and claimed offers.
- To power the venue console for venue owners who create venues, tickets and specials.
- To compute distances and walking routes on your device when you allow location.
- To let you attach images to chats and tickets when you choose photos or use the camera.
- To respond to your support requests and enforce our terms and keep the service safe.
5. Third-party service providers
We rely on a small number of infrastructure providers. We do not use advertising networks, analytics SDKs, or third-party trackers.
Supabase (backend, database, authentication, storage)
Supabase hosts our database, handles account authentication, and stores images you upload. Your email, profile, user content, and uploaded images are stored with Supabase as our processor.
OpenStreetMap + CARTO (map tiles)
The dark map is rendered from OpenStreetMap data served as tiles by CARTO. To draw the map, the coordinates of the area you are currently viewing are requested from the tile service. This is a normal part of showing any map.
OSRM (walking directions)
When you ask for walking directions to a venue, the start and end coordinates are sent to a public OSRM routing service to calculate the route. We do not store the route or those coordinates.
These providers process data on their own infrastructure under their own privacy terms. We share with them only what is technically necessary to render the map, route you, authenticate you, and store your content.
6. Sharing your information
We do not sell your personal data, and we do not share it for advertising. Content you choose to make visible to others — such as messages you send in a chat, a direct message to a friend, or a venue/ticket/special you publish in the venue console — is shared with the intended recipients or audience as part of using those features. We may disclose data if required by law or to protect the rights, safety and security of our users and service.
7. Data retention
We keep your account data (email, profile) and your user content (messages, friends, claimed offers, venues, tickets, specials, and uploaded images) for as long as your account exists, so the service works and your content stays available to you. When you delete your account, this data is permanently deleted (see below). Location and contacts data are not retained by us at all, because they are processed only on your device.
8. Deleting your account and data
You can permanently delete your account and all associated data directly in the app: go to Profile → Delete Account. This removes your account and the personal data and user content we hold for you, including messages, friends, claimed offers, venues/tickets/specials you created, and images you uploaded. This action is permanent and cannot be undone. If you have trouble deleting your account, email us at boredbash@gmail.com and we will help.
9. Your privacy rights
Depending on where you live, you may have rights to access, correct, export or delete your personal data, and to object to or restrict certain processing. You can access and correct much of your data in-app, and you can delete everything via Profile → Delete Account. To exercise any other right, contact us at boredbash@gmail.com. We do not sell personal information and do not process it for targeted advertising, so there is nothing to opt out of on that front.
10. Age requirement and alcohol references
ClubPilot is intended for adults. Because it features bars, clubs and other venues that may reference or serve alcohol, the app is rated 17+ and is not directed at children under 17. We do not knowingly collect personal data from anyone under 17. If you believe a person under 17 has provided us data, contact us at boredbash@gmail.com and we will delete it.
11. International users
ClubPilot may be used from many countries, and our providers (including Supabase, CARTO and OSRM) may process data on servers located in other countries. By using ClubPilot, you understand that your information may be processed outside your home country, including in jurisdictions with different data-protection laws. We take reasonable steps to protect your data wherever it is processed.
12. Security
Passwords are hashed by our authentication provider, and access to our backend is protected. No method of transmission or storage is completely secure, but we work to protect your information and limit access to what is necessary to operate the service.
13. Changes to this policy
We may update this policy as the app evolves or as legal requirements change. When we do, we will revise the effective date at the top of this page and, where appropriate, notify you in-app. Continued use of ClubPilot after an update means you accept the revised policy.
14. Contact us
If you have any questions, requests, or concerns about this policy or your data, email us at boredbash@gmail.com. We aim to respond within a few business days.