This Privacy Policy explains how [COMPANY NAME] ("Juke," "we," "us") collects, uses, and shares information when you use the Juke mobile application and related services (the "Service"). It applies to all users, including users in the United States, the European Economic Area (EEA), and the United Kingdom.
Controller: [COMPANY NAME], [COMPANY ADDRESS] — contact: [SUPPORT EMAIL]
EU representative (GDPR Art. 27): [EU REPRESENTATIVE]
The short version: we collect what you give us (account, profile, posts, photos, messages, events) plus limited technical data needed to run the app. We use your device's location only with your permission. We do not sell your data, we show no ads, and we currently use no advertising or analytics trackers. Your content is hosted by Supabase; place searches are processed by Google; the app is distributed by Apple.
1. Information We Collect
Information you provide:
- Account data — your email address and a password. Passwords are stored only in hashed form by our authentication provider (Supabase); we never see or store your plaintext password.
- Profile data — your username/display name, profile photo, bio, profile gallery photos, and any privacy settings you choose (such as activity visibility).
- Content you create — posts, comments, likes, event details (including titles, descriptions, times, and locations you enter), RSVPs and guest-list entries, event photos, music requests and upvotes, group information (names, descriptions, avatars, your role), and messages (direct messages, group conversations, and event chats).
- Social graph data — who and which groups you follow, group memberships, event favorites, users you block, and invite codes you create or redeem.
- Reports — if you report content or a user, we record what you reported and the reason you give.
- Support communications — anything you send to [SUPPORT EMAIL].
Information collected with your permission (device features):
- Location — if you grant location permission, we access your device's approximate or precise location while you use the app, to center the event map and support location features. We do not collect location in the background. You can revoke this at any time in your device settings; the map and place features degrade gracefully without it. Note that event locations themselves are typed in by event hosts, not derived from your device.
- Camera and photo library — if you grant permission, we access your camera or photo library only to let you capture or choose images you actively upload (profile photos, group avatars, event photos). We do not scan your photo library.
Information collected automatically:
- Technical and log data — when the app talks to our backend, our hosting provider (Supabase) processes your IP address and standard request metadata in server logs. The app also records your installed app version.
- App update checks — the app uses Expo's update service (EAS Update) to fetch bug fixes. Update requests send basic, non-identifying device and app metadata (such as platform, app version, and update channel) to Expo.
What we do NOT collect: we currently use no advertising SDKs, no third-party analytics or tracking SDKs, no crash-reporting SDKs, and no push-notification service. We do not collect contacts, precise location in the background, or biometric data. We do not sell or rent personal information, and we do not "share" it for cross-context behavioral advertising.
2. How We Use Information — Purposes and Legal Bases
Where GDPR or UK GDPR applies, our legal bases are noted in parentheses.
- Providing the Service — operating accounts, showing your profile and content to the intended audience, delivering messages, running events, groups, feeds, and the map (performance of a contract, Art. 6(1)(b)).
- Location features — using your device location for the map and nearby-place features (consent, Art. 6(1)(a) — withdrawable at any time via device settings).
- Safety and moderation — reviewing reports, enforcing our Terms of Service, applying blocks, preventing spam, fraud, and abuse, and protecting users (legitimate interests in a safe service, Art. 6(1)(f); legal obligation, Art. 6(1)(c), where we must act under laws such as the EU Digital Services Act).
- Security — authenticating you, enforcing row-level access controls, issuing time-limited signed URLs for photos, and investigating security incidents (legitimate interests, Art. 6(1)(f)).
- Communications — responding to your support requests and sending important service or legal notices (contract performance and legitimate interests).
- Legal compliance — complying with applicable law, lawful requests from authorities, and establishing or defending legal claims (legal obligation, Art. 6(1)(c); legitimate interests, Art. 6(1)(f)).
We do not use your personal information for automated decision-making that produces legal or similarly significant effects, and we do not use it to train AI models.
3. Who Can See Your Content
Visibility inside the app is a core part of how Juke works:
- Public content — posts to public feeds, public profiles, public group content, and public events (including their guest lists, photo feeds, chats, and music queues) are visible to other Juke users.
- Invite-only events — visible to users who have been invited or have redeemed a valid invite code, including their guest lists, photos, and chat.
- Groups — content and membership information is visible according to the group's settings and membership.
- Messages — direct messages and group conversations are visible to their participants. Event chats are visible to event participants. Messages are encrypted in transit but are not end-to-end encrypted; like most social apps, message content is stored on our backend and can be accessed by us where necessary for moderation of reported content or where required by law.
- Photos of you — other users may upload event photos in which you appear. You can report any photo in-app; see also your rights in Section 8.
Please post accordingly: anything visible to other users can be screenshotted or shared by them outside the app.
4. Who We Share Information With
We share personal information only with:
- Other users, as described in Section 3.
- Service providers (processors) acting on our instructions:
- Supabase — hosts our database, authentication, file storage, and server functions. Your account data, content, and logs are stored in [SUPABASE REGION].
- Google (Google Places API) — when you use place search while creating an event, the text of your search query is sent through our backend to Google to return place suggestions. We do not send your identity with the query. Google's processing is described in Google's own privacy policy.
- Expo (EAS Update) — receives basic device/app metadata for app update checks, as described in Section 1.
- Apple — distributes the app through the App Store and provides the map tiles displayed in the app (Apple Maps). Apple's processing is governed by Apple's privacy policy.
- Authorities and other parties where required — we may disclose information if we believe in good faith it is necessary to comply with law or a valid legal request, to enforce our Terms, to protect the rights, safety, or property of users, the public, or Juke, or to report suspected child exploitation to relevant authorities.
- Business transfers — if Juke is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction; this Policy will continue to apply and we will notify you of material changes.
We do not sell personal information and we do not share it with third parties for their own advertising or marketing.
5. International Data Transfers
We are based in the United States and our service providers process data primarily in [SUPABASE REGION]. If you use the Service from the EEA, the UK, or elsewhere outside that region, your personal information will be transferred to and processed in the United States, where data-protection laws may differ from those of your country.
Where GDPR or UK GDPR applies to such transfers, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK Addendum/IDTA) entered into with our processors, and, where a provider is certified, the EU-U.S. Data Privacy Framework. You can request more information about these safeguards at [SUPPORT EMAIL].
6. Data Retention
- Account and content data — retained while your account is active.
- Account deletion — you can delete your account in-app (Settings). Deletion removes your profile, and your content and uploaded files are deleted or de-identified as part of the deletion process. Deletion is permanent and cannot be undone.
- Backups — residual copies may persist in encrypted backups for a limited period before being overwritten.
- Reports, blocks, and moderation records — may be retained after content or account deletion where necessary for safety, to prevent ban evasion, to comply with legal obligations, or to establish or defend legal claims.
- Server logs — retained for a limited period for security and operations.
- Legal holds — we may retain specific data longer where required by law or a valid preservation request.
7. Security
We take reasonable technical and organizational measures to protect personal information, including encryption in transit (TLS), hashed passwords, database row-level security policies that restrict each user's access to what they are entitled to see, and time-limited signed URLs for private images. No system is perfectly secure, and we cannot guarantee absolute security. If we learn of a personal-data breach that risks your rights, we will notify you and the relevant authorities as required by law (including GDPR Arts. 33–34).
8. Your Rights
If you are in the EEA or UK (GDPR / UK GDPR), you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten") — largely self-service via in-app account deletion;
- restrict or object to processing based on legitimate interests;
- data portability — receive data you provided in a structured, commonly used, machine-readable format;
- withdraw consent at any time (e.g., disable location permission), without affecting prior processing; and
- lodge a complaint with your national supervisory authority (for example, your country's data protection authority, the Irish DPC, or the UK ICO). We would appreciate the chance to address your concern first via [SUPPORT EMAIL], but you are not required to contact us before complaining.
We will respond to rights requests within one month (extendable as the GDPR permits). We will not discriminate against you for exercising your rights.
If you are a California resident (CCPA/CPRA) or a resident of another U.S. state with a comprehensive privacy law, you have comparable rights to know/access, correct, and delete personal information, and the right to opt out of "sales" or "sharing" of personal information — we do not sell or share personal information as those terms are defined in those laws, and we have no actual knowledge of selling data of minors under 16. You will not be discriminated against for exercising your rights. You may use an authorized agent where the law provides for one.
Everyone else: we extend access, correction, and deletion rights to all users regardless of location.
To exercise any right: use the in-app tools (profile editing, account deletion) or email [SUPPORT EMAIL] from the email address on your account. We may need to verify your identity before acting on a request. If a photo you appear in was uploaded by someone else, contact us and we will assess removal, balancing the rights involved.
9. Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 — or from anyone below the applicable age of digital consent in their EEA/UK country (up to 16 in some countries) without valid parental consent. If you believe a child below the applicable age is using the Service, contact [SUPPORT EMAIL] and we will delete the account and associated data.
10. Changes to This Policy
We may update this Policy from time to time. If we make material changes, we will notify you through the app or by email before the changes take effect, and update the "Last updated" date above. If a change materially expands how we use personal data in ways that require consent under applicable law, we will ask for it.
11. Contact
Privacy questions and rights requests: [SUPPORT EMAIL]
Postal: [COMPANY NAME], [COMPANY ADDRESS]
EU representative (GDPR Art. 27): [EU REPRESENTATIVE]