Privacy Policy

We collect information that is needed to operate Outly:

• Consumer accounts: email address, first name, sign-in provider, self-reported date of birth, gender, and the server-calculated result of our 19+ eligibility check.
• Plans and activity: venues you view, your selected nightly plan, check-in attempts, verified check-ins, offers you open or claim, and related dates and times.
• Check-in location: when you choose to check in, the app sends a precise location sample to our server to compare it with the venue boundary. We do not store the raw latitude and longitude from that sample. We retain the result and supporting measurements, such as distance from the venue, accuracy, permission state, and time of the attempt, to operate and protect the check-in system.
• Venue accounts: business and representative contact details, legal business information, venue profile content, location, hours, offers, account approval records, and subscription status.
• Technical information: authentication cookies, IP address and server logs, browser or device information, app version, push-notification token, and website or app usage events.
• Reports and support: content reports, support messages, the venue or offer involved, and the information you include when contacting us.

Payment details are collected and processed by Stripe. Outly does not store full payment card numbers. If you sign in through another provider, that provider handles your password and sends us the account information you authorize it to share.

We use personal information to:

• create and secure accounts and confirm 19+ eligibility;
• show venues, crowd context, plans, and available offers;
• verify arrival at a venue and prevent location or offer abuse;
• provide aggregated attendance and campaign analytics to venues;
• operate venue approvals, subscriptions, support, and billing;
• review reports and moderate unlawful, unsafe, or misleading content;
• send service messages and, with the required consent, marketing;
• debug, secure, measure, and improve the service; and
• meet legal, tax, accounting, and regulatory obligations.

Precise location is requested when you start a check-in. If you decline location access or provide reduced accuracy, you can still browse Outly, but you cannot complete a verified check-in or unlock a check-in offer. You can change location access in iOS Settings.

Venues receive aggregated information such as plan counts, verified check-ins, repeat visits, check-in times, and age or gender distributions only when group-size safeguards are met. They do not receive a consumer’s name, email, date of birth, individual gender, live location, or location history through the dashboard.

We may share limited information with:

• Service providers that support hosting, authentication, maps, email, analytics, payments, and security, including Supabase, Mapbox, Vercel, Resend, Stripe, and enabled sign-in providers.
• Venues through the aggregated reporting described above.
• Campaign partners through aggregated or de-identified performance reporting. We do not give partners consumer names, email addresses, or precise location unless we clearly disclose that use and obtain any consent required by law.
• Authorities or transaction parties where required by law, needed to protect rights and safety, or connected with a financing, merger, acquisition, or sale of the business under appropriate safeguards.

A partner offer may open an external app or website. Information collected there is governed by that partner’s privacy policy. Outly does not sell personal information. We require providers that process personal information for us to protect it in a manner consistent with this policy and applicable law.

• You can manage device permissions and opt out of promotional emails at any time. We may still send account, security, billing, or offer-service messages.
• You may request access to or correction of your personal information. Date of birth is not editable in the app because it controls eligibility; contact us if it is incorrect.
• Consumers can delete their account in the app. Venue accounts can request deletion from dashboard settings after cancelling any active paid subscription.

When a consumer account is deleted, we remove the Auth account, analytics tied to it, and push tokens. We detach the user identifier from historical plans, check-ins, and claims so non-identifying attendance records can remain. We may retain limited records where reasonably required for fraud prevention, legal compliance, disputes, or financial reporting.

We keep personal information only for as long as needed for the purposes in this policy, then delete or anonymize it. Retention depends on the type of record, account status, fraud and safety needs, and legal requirements.

We use administrative, technical, and organizational safeguards designed for the sensitivity of the information. No online service can promise absolute security, so please use a unique password and protect your account credentials.

Outly consumer accounts are for people aged 19 or older. We use a self-reported date of birth to calculate eligibility; this is not identity or age-document verification. If we learn that an ineligible person created an account, we may suspend and delete it.

Some service providers process information outside Canada, including in the United States. Information in another country may be subject to that country’s laws and lawful access by its authorities. Outly remains responsible for personal information transferred to providers for processing and uses contractual and other safeguards appropriate to the service.

We may update this policy as Outly changes. We will post the revised date here and give additional notice when a change is material.

For access, correction, deletion, or a privacy concern, contact Outly’s Privacy Officer at admin@getoutly.app. Outly Labs Inc. is based in Toronto, Ontario, Canada. If we cannot resolve a concern, you may contact the Office of the Privacy Commissioner of Canada.