what's the vibes? · privacy

Privacy policy

This is the plain-English version of how we handle your data. We're a New York-based nightlife app and we keep what we collect to the minimum needed to run the service.

What we collect

• Account info: your email and password (or your Apple ID name and email, or Apple's relay address, if you use Sign in with Apple), a username, and an optional display name, photo and bio. Your username, display name, photo, bio and nameplate (see below) make up your public profile, which other members can see. The record behind your profile also carries the scenes you picked when you signed up and the party series, DJs and promoters you follow, and other members' apps can read those; a "queer nightlife" pick is the exception: it is kept in a private record only you and we can read. The venues you mark as familiar are private to you.
• Home city: when you sign up you pick a home city (New York, Houston, Los Angeles, DC or Miami). It decides which city the app opens on and which city's picks and alerts you get, and it is kept in a private record only you and we can read. It also shows next to your name on each comment you post (for example "NYC"), so other members can see it there. Change it any time in Settings → home city; comments you already posted keep the city they were posted with.
• Date of birth: collected once at sign-up for the 18+ check (21+ before 2026-10-07). It is stored in a private record only you and we can read, is never shown on your profile, and is never shared.
• Location: your device's precise location (to about 10 to 100 metres depending on what you are doing: the finer reading is only used while the check-in sheet is open), only while you're using the app and only after you grant permission. We use it to confirm you're in a coverage area, to show and sort nearby venues, and to let you file a crowd report from inside a room. We don't attach coordinates to your account, your posts or your reports. The one record we keep of where you were is the private nights list behind nameplates (below): which room you checked in to or posted from, and on which night, never your coordinates. If you join the waitlist for a city we don't cover yet, we store your email together with the city and state we detected and the location fix we detected them from, so we know where demand is.
• Contacts (optional): if you choose "connect contacts," the app reads your address book on your phone, turns each email and phone number into a one-way hash (SHA-256) and sends only those hashes to our servers, where each one is keyed again with a secret that never leaves the server before it is matched or stored. A contact is never stored as a raw number or email, and the stored values cannot be matched to numbers or emails outside our servers. Unmatched hashes are kept so we can tell you when one of those contacts joins, and expire after 180 days; a connected address book is re-matched about once a day while the app is in use. Connecting also makes you findable: the keyed hash of your verified account email (and of your phone number, if you add one) is stored so members who have you in their contacts can find you. Tap "disconnect" in the friends sheet to undo all of it: we delete the hashes from your address book and take you out of the match index. Everything is deleted with your account. We never receive names, raw numbers or raw emails from your contacts.
• Your phone number (optional): after you connect contacts, the app offers to add your number (your phone can fill it in with one tap). It is hashed on your phone before it is sent, keyed again on the server and stored only in that form, so people who have your number in their contacts can find you. You can skip it, change it, or remove it in the friends sheet at any time.
• Updates by text and email (optional): when you sign up, you can give us an email address and a phone number so we can send you the weekend's picks and news about the app by text message and email, and tell us which boroughs or areas you go out in so we send you the right nights. These are stored as you typed them (the number in international form) in a private record only you and we can read; they are never shown on your profile, never shared with other members, and never used to find you through anyone's contacts (that is the hashed system above, which stays separate). Message and data rates may apply. Reply STOP to any text, use the unsubscribe link in any email, or open Settings → texts + emails in the app to change the addresses or stop both; stopping deletes them from the list. The list is used only for these updates: we never sell it or share it with advertisers.
• Content you post: clips (video, photos and their audio), captions, crowd and line reports (which venue, when, and what you reported), comments, and recaps. These are public by design. That's the product. When you post, its photo (or three frames of a video) and its caption are checked automatically for adult or violent content by third-party AI services. A post that trips the check can be hidden, removed or held for a person to look at. Only the picture and the caption are sent, and only for that check.
• Engagement: likes, saves, RSVPs, follows, blocks and reports, used to run the features they belong to.
• Nameplates: the plates on your profile are earned from what you do in the app: check-ins (the 750 m crowd report), posts made with the camera at the room once they are up, parties you save, shares, and the scenes you follow. To work that out we keep, for your last two weeks only, which rooms you checked in at or posted from on each night and whether it was late or early; after two weeks a night becomes counts (nights out, nights per room, per borough and per sound) with no dates and no list of where you were. Only you and we can read any of it; none of it is shown to anyone and it is deleted with your account. What is public: the plate you wear, the plates you have unlocked, and a "hibernating" status after 30 nights without a check-in or a post. Your nights-out count is shown only to people you follow who follow you back; it is not on your public profile. The date of your last night out is never public.
• Usage & analytics: in-app activity such as screens you open and features you use, collected through Google Analytics for Firebase when it is enabled, so we can understand how the app is used and plan what to build next. We also count which event pages you open and which ticket links you tap, in our own database, so venues and promoters can see the app's referrals in aggregate; those counts carry your account id and are deleted after 90 days.
• Diagnostics & crash data: crash logs and basic performance diagnostics, collected through Firebase Crashlytics, so we can find and fix bugs.
• Device data: app version, OS version, a per-install device identifier (used to manage your signed-in devices), and a push token so we can deliver notifications you've opted into.

How the "vibe" is made

A venue's vibe word starts from a typical-for-this-hour estimate for rooms like it and moves with what comes in from the floor: clips, comments on those clips, and crowd reports from the last thirty minutes. When nothing has come in, the app says "typical for this hour" instead of "live." Short "what to expect" lines and weekly venue summaries are written by a third-party AI model from the venue's public description and from public comments. Comments you post may be sent to that AI service for that purpose and for automated safety checks, without your name or account details. AI-written text is labelled as such in the app.

What we don't do

• We don't sell your data. Period.
• We don't track you across other apps or websites, and we don't share your data with data brokers or advertising networks.
• We don't store your password. Our sign-in provider keeps only a scrypt hash of it, and we never see the password itself.
• We don't show ads. Venues and promoters can pay to be featured; featured placements are always labeled "featured", nobody can pay to change a room's live vibe, and nobody can pay to hide another room.

Where your data lives

Your account, your profile and the photos and text you post are stored with our cloud provider in the United States, and videos with our video host. A few service providers help us run the app, each only for its own job: cloud hosting, database and file storage; video hosting and streaming; email delivery for verification and password-reset emails (it receives your email address for that purpose only); third-party AI services that write venue text from public content and run the automated checks described above; a team chat service where our moderation alerts land (a flagged post's handle, venue and caption, never a picture); app analytics and crash reports (Google Analytics for Firebase and Firebase Crashlytics; see how Google uses data from apps that use its services); and Apple's push notification service. We use these providers only to operate the app, never to advertise to you or to link your activity to other companies' data. Email us for the current list of providers by name.

How long we keep it

We keep your account data for as long as your account is active. Crowd reports are used for thirty minutes and kept for moderation and venue history; the private nights list behind nameplates is kept as long as your account is. Moderation alerts in our team chat service are kept for up to a year, then deleted. When you delete your account (see below), your profile, clips, recaps, comments, reports, RSVPs, contact hashes, devices and notifications are removed, and your videos are deleted from our video host. Analytics and crash records are retained in aggregate/de-identified form for a limited period and are not used to re-identify you. One exception to all of this: when the law requires us to keep something, for example a post we have to report as suspected child sexual abuse material, we keep that post and the account details that go with the report, out of sight, for as long as the law requires, even after the post or the account is deleted.

Your rights

• Delete your account: Settings → delete account. This permanently removes the data listed above (except anything the law requires us to keep, see how long we keep it), including your likes, votes, saves and helpful marks on other people's posts, in the same deletion. You can also email support@whatsthevibes.app from your registered email if you'd prefer we do it for you.
• Export your data: email the same address from your registered email and ask. Within 30 days we send you a JSON file of what your account holds: your profile, your vibes and recaps, your comments, check-ins, saves, follows, notifications and settings. It never includes anything about other people.
• Access, correct, or object: wherever you live, you can email us to ask what we hold about you, correct it, or ask us to stop a particular use. We honor these requests regardless of your region (including rights under laws like the GDPR and CCPA).
• Be found, or not: connecting contacts is the only way other members can find you through their contacts; "disconnect" in the friends sheet opts you out and deletes the hashes.
• Block someone: tap the ⋯ menu on any clip, or on their profile → block. You won't see their clips or comments.
• Report content or a profile: same menus, "report." Every report goes to our moderation queue; a clip reported by several people is hidden automatically while we look.

Children

What's The Vibes? is for adults 18+ (it's a nightlife app; many rooms and events are 21+ at the door and say so in the app). We gate sign-up behind a date-of-birth check and don't knowingly collect data from anyone under 18. Alcohol-led notifications and placements (drink deals, door deals, alcohol brands) go only to accounts whose birthday makes them 21 or older; that check happens at send time from the private birthday and nothing else is stored about it. If you believe an underage user has signed up, email support@whatsthevibes.app and we'll close the account.

Contact

Privacy questions: support@whatsthevibes.app
Mailing address available on request.

Last updated: 2026-10-26 (your home city: what it is for, and that it shows next to your name on your comments; on 2026-10-24: updates by text and email: the email, phone number and boroughs you can give us at sign-up, what they are for, and how to stop them; on 2026-10-22: your nights-out count is off the public profile; only camera posts from the room count toward nameplates; on 2026-10-21: what your public profile carries, and a "queer nightlife" pick kept private; moderation alerts never carry a picture and are kept for up to a year; what we keep when the law requires it; on 2026-10-18: service providers are described by what they do, with the list by name on request; photos, video frames, captions and comments get automated AI checks when they're posted; moderation alerts go to a team chat service; on 2026-10-07: age floor 18+, nameplates: what they keep and who sees what; featured placements; contact hashes keyed on the server, unmatched ones expire after 180 days; on 2026-10-06: video frames go through the same screen as photos). We'll notify users in-app before any material change.