Privacy policy

This policy describes how Afterset (“we”, “us”) handles personal data when you use our website and apps. Afterset is operated from the United Kingdom and processes data under UK GDPR. This is a product draft — final legal review is required before public launch.

What we collect

When you browse without an account

Public catalogue pages do not require an account. We may collect essential technical data (IP address, browser type, pages viewed) to operate the service and prevent abuse.

When you create an account

• Email address and authentication credentials (via our auth provider)
• Handle, display name, and profile settings you choose
• Age band from our age-assurance process (not your full date of birth)
• Logs, ratings, and reviews you submit
• Follow relationships and privacy settings

What we do not collect

• Live location, background GPS, or “currently here” status
• Passports, selfies, or raw identity documents
• Contact lists or address books
• Full date of birth (we use age bands only)

How we use your data

• To provide the service: your diary, ratings, reviews, and social features
• To display public contributions you choose to publish
• To enforce community standards and keep the service safe
• To improve the product through aggregated, anonymised analytics

We do not sell your data. We do not use attendance data for advertising. We do not infer protected characteristics (sexuality, religion, politics, health) from where you go.

Defaults for minors (13–17)

Accounts for people aged 13–17 receive high privacy defaults:

• Private profile
• No public search indexing
• Private log visibility by default
• No identity-level co-presence
• No personalised feed ranking
• No marketing or re-engagement notifications

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account and associated data
• Export your data in a portable format
• Object to or restrict certain processing
• Lodge a complaint with the ICO (ico.org.uk)

Account export and deletion are available in your settings on web and iOS.

Data retention

We retain account data while your account is active. When you delete your account, we remove personal data within 30 days, except where we must retain records for legal or safety reasons. Anonymous drafts expire after 30 days.

Processors and transfers

We use third-party services for hosting, authentication, and analytics. A full processor list will be published before launch. Data is stored in the UK/EU where possible.

Contact

For privacy questions or to exercise your rights, email privacy@afterset.app.