Privacy Policy

Rost is operated from British Columbia, Canada. If you have a question about this policy, or you want a copy of your data or want it deleted, email rozt.info@gmail.com.

You can RSVP to an event by giving only a display name and a phone number. We create a guest record so the host can see who is coming and contact you about the event. You are not required to create an account, set a password, or give an email address.

If you later sign up with the same phone number, that guest record is linked to your account so your history follows you.

• Your name and phone number. Required to RSVP. The phone number is also stored as a one-way hash so we can match you across events without comparing the number itself.
• Your email address, if you create an account. Used for sign-in and account recovery.
• Events and attendance. Which events you signed up for, whether you were waitlisted, and whether the host marked you as attended or a no-show.
• Things you write.Comments on events, direct messages to other members, and reports you submit about other people’s content.
• Location. Hosts may save a location on their profile. Events carry a location so people can find them nearby. See the section on location below, which explains the precision we store.
• WhatsApp information, if a host connects a group: the group identifier, and a record of messages we send about an event, including the recipient phone number.
• Usage analytics. Pages visited and actions taken, to understand how the product is used.

We do not collect payment details, and we do not ask for identity documents or dates of birth.

This is deliberate design, not an accident, so it is worth stating plainly.

• Public: your display name on the attendee list of a public event, and any comment you post on one. Anyone can see these, including people who are not signed in.
• Not public: your phone number, your email address, and your saved profile location. Other members see your display name; these fields are visible only to you. The exception is deliberate and described below: a host you have signed up with can see your name and phone number for that event.
• Private events are reachable only by their link. They are not listed, not searchable, and not discoverable by guessing.
• Group membership listsare visible to the group’s host and to active members of that group, not to the public. A group’s member count is public.
• Your host sees your name, your phone number and your attendance for events you sign up to, and can export that to a file.

When an event has a venue address, we store the coordinates of that address so the event appears in nearby searches. That address is information the host chose to publish.

When an event has no venue, it inherits an approximate position so it is not invisible to everyone searching nearby. That inherited position is deliberately rounded to a grid roughly one kilometre across and shown as a city name, so it describes an area rather than an address.

If you allow your browser to share your location while browsing events, those coordinates are sent to us so the search can rank events by distance, and to BigDataCloud so the filter can show the name of your area. We do not attach them to your account or keep them after the search runs. You can browse without granting location and search by typing a place name instead.

We do not sell your data and we do not share it for advertising. We use the following service providers, each of which processes data on our behalf:

• Supabase— database, authentication and file storage.
• Vercel— application hosting.
• PostHog— usage analytics.
• Komoot (Photon) and BigDataCloud— turning addresses into map coordinates and back. They receive the address or coordinates being looked up, not your identity.
• ipapi.co— approximate region from an IP address. Used to place an event that has no address, and to suggest a starting area when you browse events or complete onboarding without sharing a location.
• WhatsApp (Meta)— only if a host connects a WhatsApp group. Messages sent to that group are handled under WhatsApp’s own terms.

We may also disclose data where the law requires it, or where it is necessary to investigate abuse of the service.

• Account and event data is kept while your account exists, because your attendance history is part of how the service works.
• Guest deletion requests are scheduled and then purged by an automated job. There is a delay before the purge runs, so a request made in error can be reversed. The purge removes the guest record and its sign-ups. Message records created before 7 September 2026 may retain a phone number and message text; email us and we will remove those too.
• Administrative records of moderation actions are kept as an audit trail for accountability.

• See your data. Hosts can export their data from Settings. If the export is unavailable for your account, email us and we will send it to you.
• Correct it. Your name, phone number and profile location are editable from your profile.
• Delete it. Email rozt.info@gmail.com and we will delete your account and its associated data. We aim to act on requests promptly.

Depending on where you live, you may also have the right to object to processing, to restrict it, to receive your data in a portable form, or to complain to a data protection authority. Email us and we will help.

Access to your data is enforced in the database itself, not only in the application, so a bug in one screen cannot expose records that screen was never meant to show. Phone numbers are additionally stored as one-way hashes for matching. No system is perfectly secure, and we will tell affected people if we become aware of a breach involving their data.

Rost is not intended for children under 13. If you believe a child has given us personal information, email rozt.info@gmail.com and we will remove it.

If we make a material change we will update the date at the top of this page and, where the change significantly affects you, tell you in the app. This policy is governed by the laws of British Columbia, Canada.