Effective date: June 14, 2026 | Version 1.3
Nearfield Labs LLC, a Wyoming limited liability company ("Nearfield Labs," "we," "our," or "us"), operates the Eventuality mobile and web application at eventualityapp.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your information. We process personal data only when we have a valid legal basis; where we rely on consent, we ask for it explicitly and you may withdraw it at any time.
Content visibility — at a glance. Events you mark public and their chat are visible to anyone on the Service. Content in private events is visible only to the creator and the invited pool (attendees, invited users, maybe users). Direct messages are visible only to you and the recipient — we treat their contents as sensitive personal information.
Information you provide directly:
Information collected automatically:
CCPA categories of personal information: Identifiers (name, email, and IP address — logged by our infrastructure for security and diagnostics, and additionally shared peer-to-peer during a voice call to establish the connection); geolocation (approximate, obfuscated to 1.5 km); internet or network activity (device info, usage); visual information (profile and event photos you upload); audio information (microphone input during voice calls, processed in real time and not recorded); preferences (interests you add); age-gate data (birth month and year, signup country — not full date of birth); contents of private communications (direct messages only — see below).
Public vs private content: Content you post to a public event (including chat) is treated as publicly disclosed by you. Under CCPA §1798.140(v)(2), information you make available to the general public is not "personal information" for the purposes of the Act; we apply the same principle globally. Content in private events is restricted to the invited pool. Direct messages are 1:1 personal communications; under CCPA they are sensitive personal information, and we process them only to deliver them between you and the recipient.
We use the information we collect to:
We do not use automated decision-making that produces legal or similarly significant effects on you. The map shows events by geographic proximity; the optional "For You" feature additionally suggests events based on your interests, your connections, and your in-app activity. This is light, non-binding personalization — it never produces legal or similarly significant effects, and you can ignore the suggestions entirely.
We do not sell, rent, or trade personal information and have not sold or shared personal information in the preceding 12 months as defined under CCPA/CPRA. Limited sharing occurs in these cases:
Data is stored primarily in the United States on infrastructure operated by Supabase and Vercel. We use HTTPS/TLS, row-level security policies, and secure authentication flows. No electronic system is 100% secure; we cannot guarantee absolute security.
We retain account information and content while your account is active. If you delete your account, we will delete or anonymize your personal data within 60 days, except where a shorter period is required by applicable law (see §6) or where we are legally obligated to retain it. Push subscriptions are removed when they expire or become invalid.
Depending on your jurisdiction, you may have rights to:
Exercising rights: email eventualityapp2026@gmail.com from the address associated with your account. We may ask for additional verification if the request comes from a different address.
Response timeframes:
| Jurisdiction | Response deadline |
|---|---|
| EEA / UK / Switzerland (GDPR) | 30 days |
| California (CCPA / CPRA) | 45 days |
| Brazil (LGPD) | 15 days |
| South Korea (PIPA) | 10 days |
| Thailand (PDPA), India (DPDP), all others | 30 days |
If we require additional time due to complexity, we will notify you of the extension within the initial period.
Legal bases for processing: your consent (location, push notifications), performance of a contract (to provide the Service), and our legitimate interests (improving and securing the Service). You have rights to access, rectification, erasure, restriction, portability, objection, and to lodge a complaint with your local data protection authority. Cross-border transfers outside the EEA/UK rely on Standard Contractual Clauses (SCCs) incorporated into our sub-processor agreements. We will appoint an EU Article 27 representative and publish contact details once the EEA user base reaches the relevant threshold.
California residents have rights to know, correct, delete, and opt out of sale or sharing. We do not sell or share personal information. The only category of sensitive personal information we process is the contents of direct messages, and we use those contents only to deliver messages between you and the intended recipient — you may request that we limit use and disclosure of that sensitive information to that purpose by contacting us at eventualityapp2026@gmail.com. To submit a verifiable consumer request, contact us at the same address.
Rights under Lei Geral de Proteção de Dados include confirmation of processing, access, correction, anonymization, portability, deletion, and information about third-party sharing. Processing is based on your consent or the controller's legitimate interests. Our LGPD Encarregado is reachable at eventualityapp2026@gmail.com.
Personal data is stored and processed on servers outside mainland China (primarily in the United States). Cross-border transfers under PIPL may require a security assessment, standard-contract filing, or certification; we will pursue the mechanism applicable to our scale of operations. Location data is treated as sensitive personal information under PIPL and requires your separate explicit consent before collection. You may access, correct, delete, port, and withdraw consent at any time.
We collect and process personal information with your consent. You may request access, correction, suspension, or deletion at any time. Personal data of Korean users is destroyed within 5 days of account deletion or fulfillment of the collection purpose.
We handle personal information in accordance with the Act on the Protection of Personal Information. You may request disclosure, correction, or cessation of use. Cross-border transfers to our sub-processors are made under contractual safeguards.
We process personal data based on your consent or other lawful bases. You have rights to access, correct, delete, restrict, and port your data, and to withdraw consent as simply as granting it via device settings or by contacting us.
We process digital personal data based on your consent, which you may withdraw at any time with the same ease with which it was given. You have the right to access, correct, erase, and nominate another person to exercise your rights. Users in India must be at least 18 years old. If we learn we have processed a child's data without verifiable parental consent, we will delete it promptly. We will comply with DPDP cross-border transfer restrictions, 72-hour breach notification, and consent-manager obligations as they come into force.
Canadian, Australian, and South African residents have rights under their respective laws to access, correct, and (where applicable) delete or object to the processing of personal information. You may complain to the Privacy Commissioner of Canada, the Office of the Australian Information Commissioner, or the South African Information Regulator. We handle data in accordance with PIPEDA, the Australian Privacy Principles, and POPIA respectively.
If your local law grants privacy rights not listed above, we will honor those rights to the extent required.
We rely on consent (location, push notifications), contractual necessity (providing your account and the Service), legitimate interests (improvement, security, diagnostics), and legal obligation (compliance). Withdrawing consent does not affect prior lawful processing.
Location permission is optional — the Service works without it, with a limited map experience. We do not track your location in the background. Precise coordinates stay on your device; we only receive and store location obfuscated to a 1.5 km radius. In jurisdictions classifying location as sensitive (PIPL, and as applicable under GDPR), we request separate explicit consent.
You may opt in to receive notifications about events and messages. Disable anytime via device or browser settings. On iOS, push requires the app to be installed as a home-screen PWA.
The Service offers optional 1:1 voice (audio) calls between users. When you start or accept a call, we request microphone access — you may decline, and you can revoke the permission at any time in your device or browser settings. Calls use WebRTC and connect peer-to-peer: audio streams directly between the participants and is not recorded or stored by us. To establish the connection we use public STUN servers (currently provided by Google) and route call set-up ("signaling") through our infrastructure (Supabase); as part of standard peer-to-peer connectivity, your IP address is shared with the other participant. There is no video calling, and we do not access your camera for calls.
You may upload still images for your profile and for events you create, using your device's camera or photo library (with your permission). We store these images to display them in the Service; you can change or remove them at any time.
We use a minimal set of strictly necessary cookies and local storage:
| Storage | Purpose | Duration |
|---|---|---|
| Supabase auth token | Authentication and session | Session / up to 7 days |
| Service worker cache | Offline PWA functionality | Until app update |
No advertising, analytics, or third-party tracking cookies. Because these are strictly necessary, they do not require separate consent under the EU ePrivacy Directive. If we introduce non-essential cookies, we will update this section and implement consent before deploying them.
The Service is adults-only: you must be at least 18 to use it, and it is not directed to anyone under 18. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected data from a person under 18, we will delete it promptly and terminate the account. We have zero tolerance for child sexual abuse and exploitation; see our Child Safety Standards and Terms of Use §5.
In the event of a breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours (as required under GDPR) and affected users without undue delay. For other jurisdictions we will comply with applicable timelines (LGPD, PIPL, PDPA, POPIA, PIPA, DPDP). Notifications will describe the nature of the breach, categories and approximate number of individuals affected, likely consequences, and remediation measures.
Your information is transferred to and processed in countries other than your own, primarily the United States. We protect transfers via Standard Contractual Clauses (EU), contractual commitments with sub-processors, and — where required (e.g., PIPL) — the applicable cross-border transfer mechanism. We do not rely solely on consent for systematic international transfers.
We may update this Privacy Policy. When we make material changes, we will notify you through the Service or by other appropriate means at least 30 days before changes take effect. The effective date and version at the top indicate the latest revision. Continued use after the notice period constitutes acceptance.
You may request deletion of your Eventuality account at any time through Settings → "Delete my account". The deletion process complies with GDPR Article 17, CCPA §1798.105, LGPD Article 18 V, and equivalent global regulations.
Request deletion without the app. If you no longer have the app installed or cannot sign in, email eventualityapp2026@gmail.com from the address associated with your account and ask us to delete it. We will verify the request and delete your account and personal data on the same basis described below.
How it works:
What happens to other users' data: Other users' messages, RSVPs, photos, and conversation history are NEVER deleted by your account deletion. Where their data references you (e.g., a message they sent to you), only your identifier is anonymized; their content is preserved. This is required to honor their rights to their own data, as recognized under GDPR Article 17(3)(a) and CCPA §1798.105(d)(4).
Account deletion does not include data export. To request a copy of your data under GDPR Article 20 separately, contact eventualityapp2026@gmail.com.
You can delete parts of your Eventuality (operated by Nearfield Labs LLC) data while keeping your account active:
What is kept: content other users created (their messages and their event RSVPs) is preserved as their own data; where it references you, your identifier is anonymized rather than their content removed (see §15). Data you delete is removed from the Service when you delete it; consistent with §4, any residual copies are deleted within 60 days. Deleted profile photos are removed from storage and not retained.
If you have questions, want to exercise data rights, or need to report a data protection concern, contact us:
Nearfield Labs LLC
Operator of Eventuality
Data Protection / LGPD Encarregado
Privacy: eventualityapp2026@gmail.com
Support: eventualityapp2026@gmail.com