Privacy policy

Last updated 28 September 2026

This explains what midnite collects, why, and what you can do about it. midnite is for people aged 18 and over. If you have a question, email jack@perkins.net.

What we collect

Your account. Email address, name, date of birth (to check you are 18 or over), and optionally your university email to get a verified badge.
Your profile. Photos (up to 9) and a cover photo, bio, prompts and answers, interests, music genres, favourite artists, an anthem, favourite venues, home area, course, year, where you live (a hall or building name only, never an address) and your Instagram, Snapchat and TikTok handles if you add them. You choose who sees your uni details, where you live and your socials: everyone, friends or only you. Your settings are stored too, such as who can see that you are going.
Your location, only if you allow it. If you give permission, the app reads your phone's precise location while you are using it, never in the background. We use it for you: to show what is near you and how far away it is, to put the most relevant events and people first, to offer a check-in when you are at a venue, and to count towards how busy a venue is. We keep your latest location and a location history for 30 days, and a private history of the venues you visited and checked in to for 12 months. Only you can see these. If you choose to share your live location, only the friends you pick can see it, and you can turn it off or use ghost mode at any time. Strangers never see your location, how far away you are, or where you have been. Without permission, we use the home area you choose instead.
Going, check-ins and plans. Events you say you are going to, venues you check in to, plans you make or join, messages in plans, and replies to plan links. If someone replies to a plan link without an account, we keep the name they type and a one-way hash of their IP address for rate limiting.
Messages. Direct messages, group chats and message requests, including photos you send, when they were read, and which chats you mute. Only the people in a chat can see it. Notifications about new messages never include the message text. If you delete a message it is blanked for everyone, and its photo is removed. A message someone has reported is kept for our safety team.
Friends. Friend requests, friendships, and people you dismiss from suggestions. If you choose to find friends from your contacts, phone numbers are hashed on your phone before matching and we do not keep the list.
Photos. Photos you add to your profile, event albums and chats. Location data is removed from every photo before it is uploaded.
Safety. Reports and blocks you make, reports about you, and actions our team takes on them.
Payments. Records of ticket resale, split payments and payouts. Card details are handled by Stripe and never stored by midnite.
Your device. A push notification token, if you turn notifications on, so alerts reach your phone.
Usage. In the app, and in the web app at midnite.fun/app, product analytics about which features and screens are used. These never include your name, messages, location or who you talk to. The rest of this website has no analytics, cookies or trackers.
The web app. midnite at midnite.fun/app collects the same things as the phone app. Your browser keeps you signed in using its own storage. Location is only read if you allow it in your browser, and only while the page is open. When you pay on the web, Stripe may set its own cookies to prevent fraud.

Why we use it

To run the app: show what's on, which friends are going, the map, your plans, your messages and your tickets.
To personalise it for you: rank events, venues and suggested friends using your interests, where you go, what your friends are doing and, if you allow it, how close things are. Suggestions shown to other people only ever give general reasons, such as "goes to similar places", never where you are or were.
To connect you with friends: check-ins, and live location only with the friends you choose.
To keep people safe: enforce the 18+ rule, handle reports and blocks, and stop spam and fraud.
To take and pass on payments, and to meet our legal and tax duties.
To improve the app using analytics.

Under UK GDPR our lawful bases are the contract with you (running the service), our legitimate interests (safety, fraud prevention, personalising and improving the app) and legal obligations (payments records). Where we ask for consent, such as for location, notifications or contacts, you can withdraw it at any time in your phone or browser settings. You can also stop sharing your location with friends in the app, under Settings, Location.

Who sees what

Going. Friends see that you are going by default. Showing this to people who are not your friends is your choice, and you can go invisible at any time.
Check-ins. Friends see the venue you checked in to for 3 hours, unless you are invisible. You can check out at any time, and ghost mode checks you out.
Live location. Off by default. If you turn it on, only your friends see it: all of them, or only the ones you pick. They see your photo on the map and when you were last seen, for locations up to 4 hours old. If you share with all friends, anyone you become friends with later can see it too. Ghost mode hides your live location and checks you out in one tap. Unfriending or blocking someone stops it straight away.
Strangers. People who are not your friends never see your location, how far away you are, or where you have been. Suggestions and people discovery only show a general area and general reasons, such as "goes to similar places".
The busy map. It only shows totals, rounded down to the nearest 5, and only when at least 10 people are going, checked in or there. It never shows names.
Your profile. You choose who sees your uni details, where you live and your socials: everyone, friends or only you.
Messages. Only the people in a chat can see it.
Blocking. People you block never see you anywhere in midnite, and you never see them.
Plan links. A plan link shows the plan and the first names only of members who switched this on.

Who we share it with

We do not sell your data. We use these providers to run midnite:

Supabase: hosting, database, sign in and file storage.
Stripe: card payments and payouts to sellers.
PostHog: product analytics in the app. Never your name, messages, location or who you talk to.
Resend: sending emails, such as university verification codes.
Expo: delivering push notifications. Notifications about messages never include the message text.
Map tiles: Apple Maps on iPhone, Google Maps on Android and OpenFreeMap in the web app. When the map is open, your device loads map images from these providers, so they see the part of the map being shown and your IP address. midnite does not send them your account or your location history. Directions open Apple Maps or Google Maps with the venue's location.
Vercel: hosting this website.

Some of these providers may process data outside the UK. Where they do, they use approved safeguards such as standard contractual clauses.

How long we keep it

Your latest location and your location history: 30 days.
Venue visits: 12 months.
Check-ins: 12 months. A check-in shows to friends for 3 hours.
Messages: until you delete your account. A message you delete is blanked for everyone straight away.
Reported content: kept for our safety team to review, and for up to 90 days after the thing reported is deleted.
Payment records: as long as the law requires.
Rate limiting records for plan links: 2 days.
Everything else: while your account is open.

Your rights

Under UK GDPR you can ask to access, correct, delete or move your data, and object to or restrict how we use it. You can delete your account in the app at any time from settings. For anything else, email jack@perkins.net. If you are not happy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

If we change this policy in a way that matters, we will tell you in the app before it takes effect.