OUTBND PRIVACY NOTICE

1. INFORMATION WE COLLECT

The information we collect depends on the features you use.

Information you provide

• Account and contact information. Depending on how you sign in or use OUTBND, we may collect your name, display name, email address, phone number, and authentication-provider account identifier.
• Staff account information. Approved venue staff may provide a work email address and password. We store a one-way password hash, not the readable password. We also process email or SMS verification codes and related verification records.
• Venue and account activity. If you claim, manage, or work for a venue, we collect your venue role or membership and the venue information or live-status updates you submit. We also collect profile changes and account-deletion requests.
• Communications. If you contact us, we collect the content of your message and the contact details you use.

Information collected from your device or use of the Services

• Location. If you grant iOS location permission, OUTBND receives your device location while you use the app to center the map, show nearby venues, display your position, and calculate walking directions. OUTBND requests location with approximately 100-meter accuracy, but coordinates sent by iOS can still qualify as precise geolocation under privacy laws and App Store definitions. Coordinates may be sent to our API to return nearby venues and to Mapbox when you use map search. Tyrus LLC does not intentionally store your device coordinates in your OUTBND account or create a location-history profile. Coordinates may be processed transiently, including in short-lived network or security logs, to deliver and protect the Services.
• Search information. When you search for a city, neighborhood, or place, OUTBND sends the search terms and a nearby map coordinate to Mapbox to return suggestions. Search results are kept in memory and are not saved to your OUTBND account by Tyrus LLC.
• Network and security information. Our servers automatically receive information needed to communicate with your device, such as IP address, user-agent information, request date and time, and authentication method. We retain sign-in security events, which may include IP address and user agent, to prevent abuse, investigate failed sign-ins, and protect accounts.
• Tokens and identifiers. We create an internal user ID and process session and refresh tokens. Server-side refresh tokens are stored in hashed form. If you use Sign in with Apple or Google, we receive a provider-specific identifier and, depending on your choices and provider settings, your name and email address. Apple may provide a private relay email address.
• App and map-service data. Third-party map, operating-system, authentication, and infrastructure services may receive device, network, location, diagnostics, or usage information under their own privacy notices when their services are used. Tyrus LLC does not use this information to track you across other companies' apps or websites.

Information from other sources

We may obtain venue names, addresses, hours, amenities, and other venue information from public sources, data providers, venue representatives, and business partners. We may also receive the account information described above from Apple, Google, phone-verification providers, or email-verification providers when you choose those services. We do not buy personal profiles from data brokers.

Information we do not collect for advertising

OUTBND does not contain third-party advertising, does not sell personal information, and does not share personal information for cross-context behavioral advertising. We do not use the App Tracking Transparency identifier to track you across other companies' apps or websites.

2. HOW WE USE INFORMATION

We use personal information to:

• create, authenticate, secure, and maintain accounts;
• provide maps, nearby-venue results, area search, walking directions, and live venue information;
• verify phone numbers and staff email addresses;
• manage venue claims, roles, and venue updates;
• operate, troubleshoot, protect, and improve the Services;
• respond to support requests and send important service or policy communications;
• detect fraud, abuse, unauthorized access, and security incidents;
• comply with law and establish, exercise, or defend legal rights; and
• carry out another purpose that we describe when collecting information, with consent where required.

We do not use precise location, phone numbers, email addresses, or authentication data for targeted advertising.

3. LEGAL BASES

Where applicable law requires a legal basis, we process information as necessary to provide the Services you request and perform our agreement with you; with your consent, including for device location; for our legitimate interests in operating, securing, and improving the Services where those interests are not overridden by your rights; and to comply with legal obligations. You may withdraw consent at any time through iOS settings or by contacting us. Withdrawal does not affect processing that was lawful before withdrawal.

4. HOW WE DISCLOSE INFORMATION

We disclose personal information only as described below.

Service providers

We use service providers to operate the Services. Depending on the feature you use, these may include:

• Apple for Sign in with Apple, MapKit and walking directions, and music-search or preview services;
• Google for Google account sign-in;
• Mapbox for map rendering and place search;
• Twilio for phone-number verification by SMS;
• Cloudflare for staff verification email delivery;
• Fly.io for API hosting and operational logs;
• Supabase for hosted PostgreSQL database infrastructure; and
• Upstash for Redis-based rate limiting and real-time message delivery.

These providers receive only the information reasonably needed to perform their services. We require service providers that process personal information for us to use it only for authorized purposes and to provide privacy and security protections consistent with this Notice and applicable law. Some providers, such as Apple, Google, and Mapbox, may also process information as independent businesses under their own privacy notices when you directly use their features.

Other disclosures

We may also disclose information:

• when you direct us to do so or consent to the disclosure;
• to professional advisers who are bound by confidentiality obligations;
• to comply with law, legal process, or a valid government request;
• when reasonably necessary to protect users, Tyrus LLC, the Services, or the public from fraud, abuse, or security threats; or
• in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality and notice where required.

We do not sell personal information. We do not disclose personal information to data brokers or advertising networks.

5. RETENTION AND DELETION

We keep personal information only as long as reasonably necessary for the purposes described in this Notice, including to provide the Services, maintain security, resolve disputes, and comply with legal obligations.

• Account information is generally kept while your account is active. When you delete your account, we delete the account and associated active sessions and venue memberships from active systems, subject to the exceptions below.
• Sign-in security events containing IP address or user-agent information are generally retained for up to 90 days.
• Verification records and operational logs are retained for limited periods appropriate to security, fraud prevention, and service operation.
• Device coordinates used for nearby results are not intentionally stored in your account or maintained by Tyrus LLC as a location-history profile.
• Venue information and status history that is not linked to an identifiable user may be retained as an operational record of the venue and the Services.

Deletion from encrypted backups and provider systems may occur on the next scheduled deletion cycle. We may retain limited information longer when required by law or reasonably necessary to prevent fraud, enforce agreements, resolve disputes, or document compliance. When retention is no longer necessary, we delete or de-identify the information.

6. YOUR CHOICES AND CONTROLS

• Location. You can deny or revoke location access at any time in iOS Settings. OUTBND remains usable with a selected city or map area, although location-based features may be less convenient. Revoking permission stops future access by OUTBND but does not affect earlier lawful processing.
• Account information. You can update available profile information in the app or contact us for help.
• Account deletion. You can delete your account from OUTBND's account menu. You may also request deletion by emailing [email protected].
• Provider accounts. You can manage permissions for Apple or Google through the applicable provider. Deleting OUTBND does not automatically delete your Apple or Google account.
• Communications. We may send transactional messages needed to verify or secure your account. OUTBND does not currently send promotional marketing messages. If that changes, we will provide any opt-out required by law.

Browser-based Do Not Track signals generally do not apply to a native mobile app. Regardless, OUTBND does not sell personal information or use it for cross-context behavioral advertising.

7. YOUR PRIVACY RIGHTS

Depending on where you live and whether a law applies to Tyrus LLC, you may have the right to:

• confirm whether we process your personal information;
• access the personal information we maintain about you;
• correct inaccurate personal information;
• delete personal information;
• receive a portable copy of certain information;
• withdraw consent;
• opt out of sale, targeted advertising, or certain profiling;
• limit certain uses of sensitive personal information; and
• appeal a decision on a privacy request without discrimination for exercising a right.

To exercise a right, email [email protected] with "Privacy Request" in the subject line. We may ask for information reasonably necessary to verify your identity and authority. An authorized agent may submit a request where permitted by law; we may require proof of authorization and direct verification with you. If we deny an appeal, you may have the right to contact your state attorney general or another privacy regulator.

United States state disclosures

In the preceding 12 months, depending on the features used, we may have collected the following categories of personal information: identifiers and contact information; internet or other electronic network activity; geolocation; account credentials; and user-provided venue or support content. We collect these categories from you, your device, authentication providers, service providers, and public or venue sources. We use and disclose them for the business purposes described in Sections 2 and 4.

Precise geolocation and account credentials may be treated as sensitive personal information under some laws. We use them only to provide requested location or account services and for security, not to infer characteristics about you. We have not sold personal information or shared it for cross-context behavioral advertising in the preceding 12 months and do not intend to do so.

8. SECURITY

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. These include encrypted network connections, restricted access, hashed passwords and refresh tokens, encrypted storage of certain provider credentials, and rate limiting. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur.

9. CHILDREN

OUTBND is intended for people age 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided personal information, contact us so we can investigate and delete it as appropriate.

10. INTERNATIONAL PROCESSING

Tyrus LLC and many of our service providers operate in the United States. If you use the Services from another country, your information may be processed in the United States or other countries where privacy laws may differ. Where required, we use appropriate safeguards for international transfers.

11. CHANGES TO THIS NOTICE

We may update this Notice to reflect changes to the Services, our practices, or applicable law. We will change the "Last updated" date and provide additional notice of material changes when required.

12. CONTACT US

For questions, privacy requests, or complaints, contact: