Privacy policy

Last updated: 9 November 2026

What we keep, why we keep it, and how to make us stop.

1. Who is responsible for your data

The controller of the personal data described here is Fieldfare ("Pubmigo", "we", "us"), the maker of the Pubmigo mobile app, a company registered in the European Union. You can reach us at support@fieldfare.cc.

Pubmigo is a small independent project based in the EU. This policy is written to meet the EU General Data Protection Regulation (GDPR) and the national data protection law that applies to us. It has not been reviewed by a lawyer; we will say so plainly rather than imply otherwise.

2. What we collect and why

• Your sign-in. You sign in with Sign in with Apple or with Google. From Apple or Google we receive an account identifier and your email address (with Apple's "Hide My Email" this is a relay address that forwards to you), and from Google also your name and profile picture. We use the identifier and email to recognise your account and to answer you if you contact support. The name and picture only pre-fill your profile card during sign-up; you can change or remove them before anything is saved. There is no password sign-up: the one email-and-password login in the app belongs to the account we hand to Apple's and Google's app reviewers, and its password is stored only as a hash by our authentication provider.
• Date of birth. Used only to check you are old enough for the country you select and to work out your age. Your date of birth is never shown to anyone — other users see an age in years, nothing more.
• Country. Used to apply the right minimum age (21 in the United States, 20 in Japan and South Korea, 18 elsewhere).
• Profile content — display name, bio, photos, drink tags, vibe tags, intent. This is the part of Pubmigo other people are meant to see. You are only shown to other people nearby while you're "going out tonight" — from the moment you switch it on until 05:00 local, or until you switch it off, whichever comes first. Outside that window nobody sees your profile in the app, though anyone you already matched with can still see it and message you.
• Approximate location. The app only ever asks your phone for approximate location (roughly within a few kilometres), never precise, and even if your phone offers a precise position, the app rounds it to about a kilometre before it leaves the phone. When you allow it, the app sends that rounded position to us. We do not keep it: we store only the centre of the square, roughly 1 km across, that you are in, refreshed when you open the app. We use it only to work out who is nearby. Coordinates are never shown to other users — they see a distance between those squares, rounded to 500 m ("<1 km", "1.5 km"), so nobody can narrow down where you are, even by moving around. You can use the app without location; you just won't get a useful list of people near you. Before you allow location, Tonight asks our website once which of our cities your internet connection is in, so it can say how many people there are going out; our hosting provider works that out from your IP address, and the app gets back only a city we run or nothing. Neither we nor the app keep your IP address or that answer.
• Your tonight status. What you're drinking, an optional venue name (never an address), party size and time window. Shown to nearby users while it is active, then it expires by itself. If you choose to share it, the link shows your first name and that plan — nothing else about you, no photo, no age, no location — to anyone who has the link, whether or not they use Pubmigo, until the plan ends or you stop sharing it. You can stop sharing it at any time from the app.
• Invites, passes, matches and messages. Needed to run the service: an invite is the cheers you send somebody and their answer to it, a pass decides who you see next, and messages are the conversation with your match.
• Blocks and reports. Who you blocked, and the reports you file (reason, optional details, who they concern). We use these to keep people safe and to act on patterns of abuse.
• Push notifications. If you allow notifications, your phone gives the app a push token, an address for notifications to this installation of Pubmigo, and we store it with your account, together with which version of the app the phone runs (for example "0.2.5 (26)"), so we know which fixes have reached people. We use it only to tell you that somebody sent you a cheers, said yes to yours or wrote to you, and only for the kinds you leave switched on in Settings. If you tap "I'm in" for one of our evenings or join its waitlist, we also use it to remind you on the day, to tell you if the evening is called off or the table is full, and to tell you if a seat opens for you. A notification names nobody unless you turn on "Show names", and it never contains the text of a message. If you turn on "Ping me when someone's out", we also store your device's time zone (for example "Europe/Tallinn"), so the one daily nudge lands around 6 pm your time; it never says who is out or when they posted, only that a few people nearby have a plan. On the evening of one of our hosted evenings, if your stored location is in a city where we host them (Berlin, Tallinn), that same nudge becomes a notification at noon on the day of the evening and, at 18:00 on an evening that is on (unless you had the noon one), one that names the venue and says you are welcome to drop by (the venue is public; it still says nothing about who is out or who is in), at most once each per hosted evening; on Friday evenings it asks whether you have plans, at most once a week. Elsewhere, on a Friday evening after a quiet week (no nudge in the last seven days), it may instead say roughly how many people near you went out that week, as a range, never who, and only if anyone did. To count that, when you go out we keep the day and your rough area (the same square of about 1 km as your stored location) for 8 days. When you finish signing up, we also send ourselves a notification through the same services with your first name, the country your phone is set to and how you signed in (Apple or Google), so we notice new people and a broken sign-up quickly; it never contains your email or your photo.
• Our evenings. In a city where we host evenings (Berlin, Tallinn), we note, for that evening only: that you tapped "I'm in" (shown to everyone only as a total, "N going", never who), that you opened Tonight in the city that evening, and that you went out. If you tapped "I'm in" or joined an evening's waitlist, we note when, remind you on the day, and tell you when sign-up closes (17:00 unless it says otherwise) if the evening is called off, because it goes ahead only if enough people are in. If you turned on the evening nudge, we also send you a notification at noon on the day of an evening, and one at 18:00 on an evening that is on if you did not get the noon one. If you matched someone that evening, the app may ask you the next day, in the app only, whether you met up. We use this to see whether the evenings work, as weekly totals (including how many of that evening's matches turned into a two-way chat, counted without reading the messages), and nothing of it is shown to anyone else. For the evening and Friday notifications we also note, for each one we send you, whether you opened Tonight and whether you went out within two hours of it, so we can tell which of them helps; that note is deleted after 14 days and only totals are kept.
• Hosted evenings and See again. Our evenings are dated (any day of the week). If you tap "I'm in" for one, we note it, and which version of the line under the button you saw. That line says what tapping shows: on the evening, if it is on, from an hour before it starts until 05:00 the next morning ("Who's in tonight"), the other people who are in see your first name and first photo in the app, and a tap opens your profile, where they can send you a Cheers; you see theirs. People on the waitlist are not shown and see nobody; people who joined on the website appear only as a number; and blocking, reporting, or an age or country rule that keeps two people apart elsewhere in the app keeps them off each other's list. If you leave the evening, or tap "Hide me from this list", you are off the list at once. We count, per evening, how many people saw the list and how many Cheers were sent from it, only as totals. Tapping "I'm in" is not an agreement to be shown on See again, which asks separately. The morning after, the app offers See again on Tonight (and, if you allow notifications and at least two people tapped "I'm in", we send one push that morning). Before you answer, the offer says what is shown (your first name and first photo), to whom (the other people who tapped "I'm in" for that evening and also say yes; we do not check that anyone was at the evening, so it does not say they were), what you get (you see theirs), how long (until 23:59 on the second day after the evening) and the way out (you can hide yourself at any time, and a no is final for that evening). You say yes ("Share") or no ("Not this time"). We note your yes, and that is the agreement. From the next morning until the end of the day after that, the people who said yes for that evening and you see each other's first name and first photo, in a screen called See again, and can privately mark whom they would like to meet again. People who did not say yes are shown to nobody. A mark is only ever revealed if the other person marked you too, and then a chat opens; otherwise they never find out. Nothing else about you, and never your location, is shown there. You can withdraw at any time from that screen ("Hide me from this list"), which also deletes your marks and the marks made about you. Blocking someone, reporting them, or an age or country rule that keeps two people apart elsewhere in the app keeps them off each other's list. Marks are deleted a day after the See again window closes, the note that two people connected after 11 days, and the "I'm in" notes after 14 days; we count them only as totals. Some evenings have a limited number of seats: we count the people who tapped "I'm in", and once the table is full a further tap puts you on a waitlist, in the order of the taps. We note when you joined it; you see only your own place, and when a seat frees up the first person waiting gets it, with a notification. People on the waitlist are not counted and do not appear on See again. An evening that is called off at 17:00 has no See again. If you give a seat back after sign-up closes, we note that and count it only as a total.
• Tonight nearby. If you tap "I'm going" on one of the public events we list for your city, we note which event and which evening. Others see only a total, and only once at least two other people are going, never who. The note is deleted after 14 days.
• Bug reports. If you use Report a problem, we get what you write, the screenshot you attach (if any), the app version and your phone's system version. "Include what the app was doing" is on by default and, if you leave it on, also sends a short log kept only on your phone — the last few minutes of errors and which screens you were on, never your messages or anything that identifies you or anyone else; "See what's sent" shows you the exact thing before you send it, and you can switch it off. We use all of it only to fix the app, and delete it after 90 days.
• Crash records. If the app crashes, it saves a small record on your phone — the error message, a few code locations, your app and system version, and that same short on-phone log — and sends it once, the next time you open the app signed in. It never contains your messages, a name, an email address, an id of another person, a coordinate or a venue name. We use it only to find and fix what crashed, and delete it after 90 days. A few errors the app survives but that would stop you signing up or getting notifications (your Google photo not loading, your profile not saving, your phone getting no notification token) send the same kind of record at once, with any web address cut down to its site name.
• "How did you hear about Pubmigo?" Right after you set up the app we ask this, with five one-tap answers (the app store, an Instagram or Facebook ad, TikTok, a friend, something else). Whatever you tap, we add one to that day's total for that answer (for example "a friend: 3 today") and remember only that your account has answered, so it counts once, never what you said. If you came through a friend's link (see "Bringing a friend" below), we skip the question and count the answer as "a friend". People who joined before this was a screen of its own get the same question once, as an optional card on Tonight. The totals carry no names, ids or times, and we use them only to see which ways of finding Pubmigo work.
• Apple's attribution check (iPhone). Once, after you set up the app on a new install, the app asks Apple whether the install came from an Apple Search Ads campaign. It does this with a token that Apple's own AdServices framework hands the app and that identifies no person; no tracking permission is involved and no advertising identifier is read. Apple answers with the campaign, ad group and keyword numbers if there was an ad. We keep only those numbers, as a count per day (for example "campaign 1234: 2 today", or "not from an ad"), and remember only that your account has reported, so it counts once. Nothing is tied to you, and the answer is not used for anything else.
• Bringing a friend. When you are going out, you can share a link (pubmigo.com/f/ followed by a short code) with someone you would like along. Until 05:00 the next morning, whoever opens that link sees your first name, and nothing else; after that the link says it has expired. If a friend joins through it, you are paired for that night: your card shows to them, and theirs to you, as "with" plus the other's first name, and the two of you see each other that night. The app never sends the link for you, by message or email: you send it. We count how many times a link was opened (the time and your browser's user agent, so link previews and search engines can be told apart from people), how many installs came through links and how many friends joined through one, as totals with no names.
• Joining an evening on this website. If you say "I'm in" for one of our evenings on a city page, without the app, we collect the first name and email address you type, that you ticked "I'm 18 or older", the page's language and, if you came through one of our pubmigo.com/go/ links, that link's code. We also keep a one-way hash of your IP address, mixed with a secret only our database knows (never the address itself), to stop one connection signing up over and over. We use your email address only for that evening: a link to confirm, a note if the evening is called off, and one email the day after ("how was it?", with links to the app). Nothing counts until you tap the link; from then on you count towards the evening like somebody who tapped "I'm in" in the app, and others see only the total. Your first name is shown only on the page behind your link. The same link lets you drop out. You never get an account, a password or newsletters.
• Basic technical data. The usual server-side records that come with running an app: timestamps such as when you were last active, and short-lived request and error logs from our hosting provider.

We do not ask for your phone number, your address, your contacts, your photo library beyond the pictures you pick, or any identity document.

3. Legal bases

• Performance of a contract (GDPR Art. 6(1)(b)) — your account, profile, statuses, invites, passes, matches and messages. Without these there is no service to provide.
• Legal obligation (Art. 6(1)(c)) — age verification where local rules require it, and responding to lawful requests from authorities.
• Legitimate interests (Art. 6(1)(f)) — safety and abuse prevention (blocks, reports, hiding repeatedly reported profiles), keeping the service secure and working, and learning from anonymous daily totals how people find Pubmigo. We think these interests are ones you would expect and that they do not override your rights; you can object at any time (section 8).
• Joining an evening on this website (Art. 6(1)(b)) — your name and email address, to do what you asked: put you on the evening and tell you what happens to it. The one email after the evening is said on the form before you send it, and is the last; the IP hash that limits sign-ups is a legitimate interest (Art. 6(1)(f)) in keeping the evenings free of fake sign-ups.
• Consent (Art. 6(1)(a)) — location and push notifications. You give it through the operating system's permission prompt and you can withdraw it at any time in your phone's settings (for notifications also in Pubmigo's own Settings), without affecting anything we did before you withdrew it.

4. What other people can see

Your display name, age, bio, photos, drink and vibe tags, intent, current status and a rounded distance. That is the whole list. Your email address, your date of birth, your exact location and your reports are never visible to other users. Blocking someone hides both of you from each other immediately, in both directions.

If you tap "I'm in" for one of our hosted evenings and the next day say yes to sharing (see section 2), the other people who tapped "I'm in" for that evening and also said yes see your first name and first photo until 23:59 on the second day after the evening, in See again, and you see theirs. They see no more than that, and you can hide yourself at any time from that screen. We do not check that anyone was at the evening. On the evening itself, tapping "I'm in" shows your first name, first photo and profile to the other people who are in, under "Who's in tonight" (see section 2), from an hour before it starts until 05:00 the next morning; leaving the evening takes you off at once.

If you share a link to bring a friend along (see section 2), whoever opens it sees your first name until 05:00 the next morning, and nothing else. A friend who joins through it appears on your card that night as "with" plus their first name, and you on theirs.

If you choose to share a plan link, whoever holds the link sees your first name and that one plan — not your photo, age, bio, tags or location, and not your account otherwise — whether or not they use Pubmigo, until the plan ends on its own or you stop sharing it.

5. Who processes data for us

We keep the list of companies involved as short as we can. Today it is:

• Supabase — database, authentication and photo storage. This is where your account and content actually live. Your data is stored in Supabase's Frankfurt, Germany (EU) region.
• Expo (650 Industries, Inc., United States) — build and over-the-air update services for the app itself, and the push service that hands our notifications to Apple and Google for delivery. It receives your push token and the notification's text, which is described in section 2.
• Cloudflare (Cloudflare, Inc., United States) — hosts this website and answers the app's "which city is this connection in?" question. It sees your IP address when you visit the site or the app asks, as any web host does.
• Resend (Resend, Inc., United States) — sends the emails for evenings joined on this website (section 2). It receives the email address, the first name and the text of each email, and nothing else.
• Apple and Google — sign-in (Sign in with Apple, Sign in with Google), distribution of the app through the App Store and Google Play, and delivery of push notifications to your phone (Apple Push Notification service, Firebase Cloud Messaging). They apply their own privacy policies to what they collect as sign-in providers, distributors and notification services.

These providers act as processors on our instructions. Where a provider stores or accesses data outside the European Economic Area, that transfer relies on the European Commission's standard contractual clauses.

We do not sell your personal data, and we do not share it with advertisers. There is no advertising in Pubmigo, and no third-party analytics or tracking SDK in the first release. The App Store and Google Play buttons on this website carry a short label of the page or post you came from, or of the app you opened the link in (for example "instagram" or "web-berlin"), so the stores can count installs per channel; it says nothing about you, and nothing is stored on your device. Links that start with pubmigo.com/go/ (on posters and posts) also add one line to our own count: the link's code, the time and your browser's user agent (the line every browser sends saying which browser and system it is), so link previews and search engines can be told apart from people. There is no IP address and nothing else about you, and the user agent is deleted after 30 days.

6. How long we keep things

• Your account and profile — for as long as your account exists.
• Messages — deleted within a day after you or the other person unmatches or blocks, and at once if either account is deleted. If one of you reported the other, we keep that conversation until the report has been reviewed, or longer if the police ask us to preserve it.
• Statuses — they expire on their own (a few hours to a few days) and are deleted within two days of expiring.
• Invites and passes — a pass for 7 days, an invite for 7 days after it was sent or 30 days after it was declined (so the app can keep its cool-downs), then deleted.
• Sign-in records — our authentication provider's sign-in log is kept for 30 days; entries about a deleted account go within a day.
• Reports — 12 months from the date of the report, so we can spot repeat behaviour, or longer if the police ask us to preserve one. Each report keeps a copy of the reported profile as it was when reported. If the person who filed a report deletes their account, the report stays without any link to them.
• Push tokens — until you sign out on that phone, delete your account, remove the app (we stop as soon as Apple or Google tell us), or go 90 days without opening it. The record of each notification we sent is deleted after 2 days.
• Our evenings — the per-person notes and your answer and line are deleted 14 days after that evening, and the notes about our evening and Friday notifications 14 days after each one; only the totals (how many, never who) are kept.
• Hosted evenings and See again — your "I'm in" note (with the version of the line you saw) and agreement are deleted 14 days after the evening, your See again marks a day after the window closes (the evening plus four days) and the note that two people connected after 11 days; only totals (how many, never who) are kept.
• Evenings joined on this website — your first name, email address and IP hash are deleted when the evening starts if you never confirmed, and three days after the evening if you did. What stays is the evening, the /go/ link code and whether the sign-up was confirmed, with nothing that identifies you. The record of which kind of email went out (never to whom) is deleted after 7 days.
• Tracking links — the user agent of a pubmigo.com/go/ or pubmigo.com/f/ link fetch is deleted after 30 days; the code, the time and whether it was a link preview stay.
• Friend links — a link, and the first name it shows, stop working at 05:00 the next morning, and so does the pairing for the night. Only totals (how many opens, installs and friends, never who) are kept.
• Tonight nearby — your "I'm going" taps are deleted 14 days after that evening.
• Going out — the day and rough area of each evening you went out are deleted after 8 days.
• Bug reports — 90 days, screenshot and diagnostic log included. If you delete your account sooner, they stay without any link to you until then.
• Crash records — the one on your phone is sent and cleared the next time you sign in; on our servers, 90 days.
• "How did you hear about Pubmigo?" — the daily totals have no link to anyone, so they are kept. The note that your account has answered goes when you delete your account.
• Bans — if we ban an account, we keep a one-way hash of its email address for as long as the ban stands, so the same address can't sign up again.
• Deletion requests — when you delete your account the data goes immediately from the live service, and within 30 days from backups. One exception: if an underage or child safety report against your account is under review, we lock the account instead and keep what is relevant to that report for up to 90 days, or longer if the police ask us to (GDPR Art. 17(3)(b) and (e)); then it is deleted.

7. Security

Everything travels over TLS. Data is stored in Postgres with row-level security, so the database itself enforces that you can only read your own row, the public parts of other people's profiles, and the messages in your own matches. Photos are held in a storage bucket where you can only write under your own prefix. You sign in through Apple or Google, so there is no Pubmigo password of yours for anyone to steal.

No service is perfectly secure. If a breach ever puts your rights at risk we will tell the competent data protection authority within 72 hours and tell you without undue delay.

8. Your rights

Under the GDPR you can ask us to:

• Access the personal data we hold about you, and get a copy.
• Correct anything wrong — most of it you can edit yourself in the app.
• Erase your data. Profile → Settings → Delete account does this yourself; see deleting your account.
• Restrict or object to processing based on legitimate interests.
• Port your data — receive what you gave us in a structured, machine-readable format.
• Withdraw consent for location, at any time, in your phone's settings.

Write to support@fieldfare.cc and we will answer within 30 days. There is no charge.

If you think we have got it wrong you can complain to a data protection authority — usually the one in the EU country where you live or work (the European Data Protection Board keeps the list).

9. Automated decisions

We do not make decisions about you by automated means with legal or similarly significant effects. One automated safety measure exists: a profile that receives three reports within 24 hours is hidden until a human looks at it. You can contest that by writing to us.

10. Children

Pubmigo is for adults. You must be at least 18, and older where local law says so — 21 in the United States, 20 in Japan and South Korea. We do not knowingly collect data from anyone under those ages. If we learn that an account belongs to a minor we delete it. See our child safety standards, and tell us at support@fieldfare.cc if you believe a minor is using the app.

11. Changes to this policy

If we change this policy in a way that matters we will update the date at the top and tell you in the app before the change takes effect. The current version always lives at pubmigo.com/privacy.html.

12. Contact

Privacy questions, requests and complaints: support@fieldfare.cc.