OUTBND PRIVACY NOTICE

1. INFORMATION WE COLLECT

The information we collect depends on the features you use.

Information you provide

• Account and contact information. Depending on how you sign in or use OUTBND, we may collect your name, display name, email address, phone number, and authentication-provider account identifier.
• Staff account information. Approved venue staff may provide a work email address and password. We store a one-way password hash, not the readable password. We also process email or SMS verification codes and related verification records.
• Venue and account activity. If you claim, manage, or work for a venue, we collect your venue role or membership and the venue information or live-status updates you submit. We also collect profile changes and account-deletion requests.
• Communications. If you contact us, we collect the content of your message and the contact details you use.
• Product dispatches and launch updates. If you subscribe, we collect your email address and record when and where you signed up, the subscription scope, the version of the consent notice, consent status, and unsubscribe status. Your subscription is recorded immediately when you submit the form; no confirmation email is required. This does not verify your email for account or staff access. You do not have to subscribe to use OUTBND or our websites.

Information collected from your device or use of the Services

• Location. If you grant iOS location permission, OUTBND receives your device location while you use the app to center the map, show nearby venues, display your position, and calculate walking directions. OUTBND requests location with approximately 100-meter accuracy, but coordinates sent by iOS can still qualify as precise geolocation under privacy laws and App Store definitions. Coordinates may be sent to our API to return nearby venues and to Mapbox when you use map search. Tyrus LLC does not intentionally store your device coordinates in your OUTBND account or create a location-history profile. Coordinates may be processed transiently, including in short-lived network or security logs, to deliver and protect the Services.
• Search information. When you search for a city, neighborhood, or place, OUTBND sends the search terms and a nearby map coordinate to Mapbox to return suggestions. Search results are kept in memory and are not saved to your OUTBND account by Tyrus LLC.
• Network and security information. Our servers automatically receive information needed to communicate with your device, such as IP address, user-agent information, request date and time, and authentication method. We retain sign-in security events, which may include IP address and user agent, to prevent abuse, investigate failed sign-ins, and protect accounts.
• Website activity. When you visit our websites, our hosting and security providers process information such as your IP address, browser and device type, requested page, referring page, and request date and time to deliver and protect the sites. We do not currently use advertising cookies or third-party analytics on our public websites.
• Launch-signup security check. Cloudflare Turnstile processes browser and network signals to distinguish legitimate requests from automated abuse. We send the requesting IP address to Cloudflare's verification service when available, but Tyrus LLC does not store or log the raw IP address as part of the launch-signup record.
• Tokens and identifiers. We create an internal user ID and process session and refresh tokens. Server-side refresh tokens are stored in hashed form. If you use Sign in with Apple or Google, we receive a provider-specific identifier and, depending on your choices and provider settings, your name and email address. Apple may provide a private relay email address.
• App, website, and map-service data. Third-party map, operating-system, authentication, font-delivery, and infrastructure services may receive device, network, location, diagnostics, or usage information under their own privacy notices when their services are used. Tyrus LLC does not use this information to track you across other companies' apps or websites.

Information from other sources

We may obtain venue names, addresses, hours, amenities, and other venue information from public sources, data providers, venue representatives, and business partners. We may also receive the account information described above from Apple, Google, phone-verification providers, or email-verification providers when you choose those services. We do not buy personal profiles from data brokers.

Information we do not collect for advertising

OUTBND does not contain third-party advertising, does not sell personal information, and does not share personal information for cross-context behavioral advertising. We do not use the App Tracking Transparency identifier to track you across other companies' apps or websites.

2. HOW WE USE INFORMATION

We use personal information to:

• create, authenticate, secure, and maintain accounts;
• provide maps, nearby-venue results, area search, walking directions, and live venue information;
• verify phone numbers and staff email addresses;
• manage venue claims, roles, and venue updates;
• operate, troubleshoot, protect, and improve the Services;
• respond to support requests and send important service or policy communications;
• send occasional OUTBND product dispatches and the launch announcement you requested and manage your subscription and unsubscribe preferences;
• detect fraud, abuse, unauthorized access, and security incidents;
• comply with law and establish, exercise, or defend legal rights; and
• carry out another purpose that we describe when collecting information, with consent where required.

We do not use precise location, phone numbers, email addresses, or authentication data for targeted advertising.

3. LEGAL BASES

Where applicable law requires a legal basis, we process information as necessary to provide the Services you request and perform our agreement with you; with your consent, including for device location and requested OUTBND product and launch updates; for our legitimate interests in operating, securing, and improving the Services where those interests are not overridden by your rights; and to comply with legal obligations. You may withdraw location consent through iOS settings. You may withdraw email-subscription consent through an unsubscribe option or by contacting us. Withdrawal does not affect processing that was lawful before withdrawal.

4. HOW WE DISCLOSE INFORMATION

We disclose personal information only as described below.

Service providers

We use service providers to operate the Services. Depending on the feature you use, these may include:

• Apple for Sign in with Apple, MapKit and walking directions, and music-search or preview services;
• Google for Google account sign-in;
• Mapbox for map rendering and place search;
• Twilio for phone-number verification by SMS;
• Cloudflare for website delivery, Turnstile bot protection, request processing and, for older subscription requests, job queues and transactional confirmation-email delivery;
• Fly.io for API hosting and operational logs;
• Supabase for hosted PostgreSQL storage of subscription email addresses, consent records, scopes, and subscription or unsubscribe status;
• Upstash for Redis-based rate limiting and real-time message delivery; and
• A marketing-email provider, when product dispatches or the launch announcement are sent, with appropriate consent, suppression, and unsubscribe controls.

These providers receive only the information reasonably needed to perform their services. We require service providers that process personal information for us to use it only for authorized purposes and to provide privacy and security protections consistent with this Notice and applicable law. Some providers, such as Apple, Google, and Mapbox, may also process information as independent businesses under their own privacy notices when you directly use their features.

Other disclosures

We may also disclose information:

• when you direct us to do so or consent to the disclosure;
• to professional advisers who are bound by confidentiality obligations;
• to comply with law, legal process, or a valid government request;
• when reasonably necessary to protect users, Tyrus LLC, the Services, or the public from fraud, abuse, or security threats; or
• in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality and notice where required.

We do not sell personal information. We do not disclose personal information to data brokers or advertising networks.

5. RETENTION AND DELETION

We keep personal information only as long as reasonably necessary for the purposes described in this Notice, including to provide the Services, maintain security, resolve disputes, and comply with legal obligations.

• Account information is generally kept while your account is active. When you delete your account, we delete the account and associated active sessions and venue memberships from active systems, subject to the exceptions below.
• Sign-in security events containing IP address or user-agent information are generally retained for up to 90 days.
• Verification records and operational logs are retained for limited periods appropriate to security, fraud prevention, and service operation.
• Older pending subscription records are deleted from active storage after their confirmation link has expired and 30 days have passed. Active subscriptions are generally kept until you withdraw, the subscription list is discontinued, or the information is no longer needed. We may retain a minimal suppression record and consent history as reasonably necessary to honor your choice and document compliance.
• Device coordinates used for nearby results are not intentionally stored in your account or maintained by Tyrus LLC as a location-history profile.
• Venue information and status history that is not linked to an identifiable user may be retained as an operational record of the venue and the Services.

Deletion from encrypted backups and provider systems may occur on the next scheduled deletion cycle. We may retain limited information longer when required by law or reasonably necessary to prevent fraud, enforce agreements, resolve disputes, or document compliance. When retention is no longer necessary, we delete or de-identify the information.

6. YOUR CHOICES AND CONTROLS

• Location. You can deny or revoke location access at any time in iOS Settings. OUTBND remains usable with a selected city or map area, although location-based features may be less convenient. Revoking permission stops future access by OUTBND but does not affect earlier lawful processing.
• Account information. You can update available profile information in the app or contact us for help.
• Account deletion. You can delete your account from OUTBND's account menu. You may also request deletion by emailing [email protected].
• Provider accounts. You can manage permissions for Apple or Google through the applicable provider. Deleting OUTBND does not automatically delete your Apple or Google account.
• Communications. We may send transactional messages needed to verify or secure your account. If you subscribe to OUTBND updates, we may send occasional product dispatches and a launch announcement. You can withdraw at any time using the unsubscribe option in the message or by emailing [email protected]. We will honor the request as required by law. Unsubscribing from marketing does not stop necessary transactional or security messages.

Our websites do not currently collect personal information about your activity over time across third-party websites for targeted advertising, so they do not respond differently to browser Do Not Track signals. Where applicable law requires us to recognize another opt-out preference signal, we will do so. OUTBND does not sell personal information or use it for cross-context behavioral advertising.

7. YOUR PRIVACY RIGHTS

Depending on where you live and whether a law applies to Tyrus LLC, you may have the right to:

• confirm whether we process your personal information;
• access the personal information we maintain about you;
• correct inaccurate personal information;
• delete personal information;
• receive a portable copy of certain information;
• withdraw consent;
• opt out of sale, targeted advertising, or certain profiling;
• limit certain uses of sensitive personal information; and
• appeal a decision on a privacy request without discrimination for exercising a right.

To exercise a right, email [email protected] with "Privacy Request" in the subject line. We may ask for information reasonably necessary to verify your identity and authority. An authorized agent may submit a request where permitted by law; we may require proof of authorization and direct verification with you. If we deny an appeal, you may have the right to contact your state attorney general or another privacy regulator.

United States state disclosures

In the preceding 12 months, depending on the features used, we may have collected the following categories of personal information: identifiers and contact information; internet or other electronic network activity; geolocation; account credentials; and user-provided venue or support content. We collect these categories from you, your device, authentication providers, service providers, and public or venue sources. We use and disclose them for the business purposes described in Sections 2 and 4.

Precise geolocation and account credentials may be treated as sensitive personal information under some laws. We use them only to provide requested location or account services and for security, not to infer characteristics about you. We have not sold personal information or shared it for cross-context behavioral advertising in the preceding 12 months and do not intend to do so.

8. SECURITY

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. These include encrypted network connections, restricted access, hashed passwords and refresh tokens, encrypted storage of certain provider credentials, and rate limiting. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur.

9. CHILDREN

OUTBND is intended for people age 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided personal information, contact us so we can investigate and delete it as appropriate.

10. INTERNATIONAL PROCESSING

Tyrus LLC and many of our service providers operate in the United States. If you use the Services from another country, your information may be processed in the United States or other countries where privacy laws may differ. Where required, we use appropriate safeguards for international transfers.

11. CHANGES TO THIS NOTICE

We may update this Notice to reflect changes to the Services, our practices, or applicable law. We will change the "Last updated" date and provide additional notice of material changes when required.

12. CONTACT US

For questions, privacy requests, or complaints, contact: