Privacy policy

Last updated: 22 October 2026

What we keep, why we keep it, and how to make us stop.

1. Who is responsible for your data

The controller of the personal data described here is Fieldfare ("Pubmigo", "we", "us"), the maker of the Pubmigo mobile app, a company registered in the European Union. You can reach us at support@fieldfare.cc.

Pubmigo is a small independent project based in the EU. This policy is written to meet the EU General Data Protection Regulation (GDPR) and the national data protection law that applies to us. It has not been reviewed by a lawyer; we will say so plainly rather than imply otherwise.

2. What we collect and why

• Your sign-in. You sign in with Sign in with Apple or with Google. From Apple or Google we receive an account identifier and your email address (with Apple's "Hide My Email" this is a relay address that forwards to you), and from Google also your name and profile picture. We use the identifier and email to recognise your account and to answer you if you contact support. The name and picture only pre-fill your profile card during sign-up; you can change or remove them before anything is saved. There is no password sign-up: the one email-and-password login in the app belongs to the account we hand to Apple's and Google's app reviewers, and its password is stored only as a hash by our authentication provider.
• Date of birth. Used only to check you are old enough for the country you select and to work out your age. Your date of birth is never shown to anyone — other users see an age in years, nothing more.
• Country. Used to apply the right minimum age (21 in the United States, 20 in Japan and South Korea, 18 elsewhere).
• Profile content — display name, bio, photos, drink tags, vibe tags, intent. This is the part of Pubmigo other people are meant to see. You are only shown to other people nearby while you're "going out tonight" — from the moment you switch it on until 05:00 local, or until you switch it off, whichever comes first. Outside that window nobody sees your profile in the app, though anyone you already matched with can still see it and message you.
• Approximate location. The app only ever asks your phone for approximate location (roughly within a few kilometres), never precise, and even if your phone offers a precise position, the app rounds it to about a kilometre before it leaves the phone. When you allow it, the app sends that rounded position to us. We do not keep it: we store only the centre of the square, roughly 1 km across, that you are in, refreshed when you open the app. We use it only to work out who is nearby. Coordinates are never shown to other users — they see a distance between those squares, rounded to 500 m ("<1 km", "1.5 km"), so nobody can narrow down where you are, even by moving around. You can use the app without location; you just won't get a useful list of people near you. Before you allow location, Tonight asks our website once which of our cities your internet connection is in, so it can say how many people there are going out; our hosting provider works that out from your IP address, and the app gets back only a city we run or nothing. Neither we nor the app keep your IP address or that answer.
• Your tonight status. What you're drinking, an optional venue name (never an address), party size and time window. Shown to nearby users while it is active, then it expires by itself. If you choose to share it, the link shows your first name and that plan — nothing else about you, no photo, no age, no location — to anyone who has the link, whether or not they use Pubmigo, until the plan ends or you stop sharing it. You can stop sharing it at any time from the app.
• Invites, passes, matches and messages. Needed to run the service: an invite is the cheers you send somebody and their answer to it, a pass decides who you see next, and messages are the conversation with your match.
• Blocks and reports. Who you blocked, and the reports you file (reason, optional details, who they concern). We use these to keep people safe and to act on patterns of abuse.
• Push notifications. If you allow notifications, your phone gives the app a push token, an address for notifications to this installation of Pubmigo, and we store it with your account, together with which version of the app the phone runs (for example "0.2.5 (26)"), so we know which fixes have reached people. We use it only to tell you that somebody sent you a cheers, said yes to yours or wrote to you, and only for the kinds you leave switched on in Settings. A notification names nobody unless you turn on "Show names", and it never contains the text of a message. If you turn on "Ping me when someone's out", we also store your device's time zone (for example "Europe/Tallinn"), so the one daily nudge lands around 6 pm your time; it never says who is out or when they posted, only that a few people nearby have a plan. On Thursday evenings, if your stored location is in a city where we run Thursdays (Berlin, Tallinn), that same nudge suggests a place to start instead (the venue is public; it still says nothing about who is out), and on Friday evenings it asks whether you have plans; each at most once a week. Elsewhere, on a Friday evening after a quiet week (no nudge in the last seven days), it may instead say roughly how many people near you went out that week, as a range, never who, and only if anyone did. To count that, when you go out we keep the day and your rough area (the same square of about 1 km as your stored location) for 8 days. When you finish signing up, we also send ourselves a notification through the same services with your first name, the country your phone is set to and how you signed in (Apple or Google), so we notice new people and a broken sign-up quickly; it never contains your email or your photo.
• Thursdays. In a city where we suggest a Thursday starting point (Berlin, Tallinn), we note, for that Thursday only: that you tapped "I'm in" (shown to everyone only as a total, "N going this Thursday", never who), that you opened Tonight in the city that evening, and that you went out. If you tapped "I'm in", we remind you at 18:00 with the starting point. If you matched someone that evening, the app may ask you the next day, in the app only, whether you met up. We use this to see whether the evenings work, as weekly totals (including how many of that evening's matches turned into a two-way chat, counted without reading the messages), and nothing of it is shown to anyone else. For the Thursday and Friday notifications we also note, for each one we send you, whether you opened Tonight and whether you went out within two hours of it, so we can tell which of them helps; that note is deleted after 14 days and only totals are kept.
• Hosted evenings and See again. Our evenings are dated (any day of the week), not only Thursdays. If you tap "I'm in" for one, the app tells you right under the button that people who join that evening can see your first name and photo the next day; tapping is your agreement, and we note both. From the next morning until the end of the day after that, the people who did the same for that evening and you see each other's first name and first photo, in a screen called See again, and can privately mark whom they would like to meet again. A mark is only ever revealed if the other person marked you too, and then a chat opens; otherwise they never find out. Nothing else about you, and never your location, is shown there. You can withdraw at any time from that screen ("Hide me from this list"), which also deletes your marks and the marks made about you. Blocking someone, reporting them, or an age or country rule that keeps two people apart elsewhere in the app keeps them off each other's list. Marks are deleted a day after the See again window closes, the note that two people connected after 11 days, and the "I'm in" notes after 14 days; we count them only as totals, and if you allow notifications we send one the next morning to the people who joined.
• Tonight nearby. If you tap "I'm going" on one of the public events we list for your city, we note which event and which evening. Others see only a total, and only once at least two other people are going, never who. The note is deleted after 14 days.
• Bug reports. If you use Report a problem, we get what you write, the screenshot you attach (if any), the app version and your phone's system version. "Include what the app was doing" is on by default and, if you leave it on, also sends a short log kept only on your phone — the last few minutes of errors and which screens you were on, never your messages or anything that identifies you or anyone else; "See what's sent" shows you the exact thing before you send it, and you can switch it off. We use all of it only to fix the app, and delete it after 90 days.
• Crash records. If the app crashes, it saves a small record on your phone — the error message, a few code locations, your app and system version, and that same short on-phone log — and sends it once, the next time you open the app signed in. It never contains your messages, a name, an email address, an id of another person, a coordinate or a venue name. We use it only to find and fix what crashed, and delete it after 90 days. A few errors the app survives but that would stop you signing up or getting notifications (your Google photo not loading, your profile not saving, your phone getting no notification token) send the same kind of record at once, with any web address cut down to its site name.
• "How did you hear about Pubmigo?" This question, asked once on the Tonight screen after you have used the app a few times, is optional. If you answer it, we add one to that day's total for that answer (for example "a friend: 3 today") and remember only that your account has answered, so it counts once, never what you said. The totals carry no names, ids or times, and we use them only to see which ways of finding Pubmigo work.
• Basic technical data. The usual server-side records that come with running an app: timestamps such as when you were last active, and short-lived request and error logs from our hosting provider.

We do not ask for your phone number, your address, your contacts, your photo library beyond the pictures you pick, or any identity document.

3. Legal bases

• Performance of a contract (GDPR Art. 6(1)(b)) — your account, profile, statuses, invites, passes, matches and messages. Without these there is no service to provide.
• Legal obligation (Art. 6(1)(c)) — age verification where local rules require it, and responding to lawful requests from authorities.
• Legitimate interests (Art. 6(1)(f)) — safety and abuse prevention (blocks, reports, hiding repeatedly reported profiles), keeping the service secure and working, and learning from anonymous daily totals how people find Pubmigo. We think these interests are ones you would expect and that they do not override your rights; you can object at any time (section 8).
• Consent (Art. 6(1)(a)) — location and push notifications. You give it through the operating system's permission prompt and you can withdraw it at any time in your phone's settings (for notifications also in Pubmigo's own Settings), without affecting anything we did before you withdrew it.

4. What other people can see

Your display name, age, bio, photos, drink and vibe tags, intent, current status and a rounded distance. That is the whole list. Your email address, your date of birth, your exact location and your reports are never visible to other users. Blocking someone hides both of you from each other immediately, in both directions.

If you tap "I'm in" for one of our hosted evenings and agree (see section 2), the other people who did the same for that evening see your first name and first photo for two days afterwards, in See again, and you see theirs. They see no more than that, and you can withdraw at any time from that screen.

If you choose to share a plan link, whoever holds the link sees your first name and that one plan — not your photo, age, bio, tags or location, and not your account otherwise — whether or not they use Pubmigo, until the plan ends on its own or you stop sharing it.

5. Who processes data for us

We keep the list of companies involved as short as we can. Today it is:

• Supabase — database, authentication and photo storage. This is where your account and content actually live. Your data is stored in Supabase's Frankfurt, Germany (EU) region.
• Expo (650 Industries, Inc., United States) — build and over-the-air update services for the app itself, and the push service that hands our notifications to Apple and Google for delivery. It receives your push token and the notification's text, which is described in section 2.
• Cloudflare (Cloudflare, Inc., United States) — hosts this website and answers the app's "which city is this connection in?" question. It sees your IP address when you visit the site or the app asks, as any web host does.
• Apple and Google — sign-in (Sign in with Apple, Sign in with Google), distribution of the app through the App Store and Google Play, and delivery of push notifications to your phone (Apple Push Notification service, Firebase Cloud Messaging). They apply their own privacy policies to what they collect as sign-in providers, distributors and notification services.

These providers act as processors on our instructions. Where a provider stores or accesses data outside the European Economic Area, that transfer relies on the European Commission's standard contractual clauses.

We do not sell your personal data, and we do not share it with advertisers. There is no advertising in Pubmigo, and no third-party analytics or tracking SDK in the first release. The App Store and Google Play buttons on this website carry a short label of the page or post you came from, or of the app you opened the link in (for example "instagram" or "web-berlin"), so the stores can count installs per channel; it says nothing about you, and nothing is stored on your device.

6. How long we keep things

• Your account and profile — for as long as your account exists.
• Messages — deleted within a day after you or the other person unmatches or blocks, and at once if either account is deleted. If one of you reported the other, we keep that conversation until the report has been reviewed, or longer if the police ask us to preserve it.
• Statuses — they expire on their own (a few hours to a few days) and are deleted within two days of expiring.
• Invites and passes — a pass for 7 days, an invite for 7 days after it was sent or 30 days after it was declined (so the app can keep its cool-downs), then deleted.
• Sign-in records — our authentication provider's sign-in log is kept for 30 days; entries about a deleted account go within a day.
• Reports — 12 months from the date of the report, so we can spot repeat behaviour, or longer if the police ask us to preserve one. Each report keeps a copy of the reported profile as it was when reported. If the person who filed a report deletes their account, the report stays without any link to them.
• Push tokens — until you sign out on that phone, delete your account, remove the app (we stop as soon as Apple or Google tell us), or go 90 days without opening it. The record of each notification we sent is deleted after 2 days.
• Thursdays — the per-person notes and your answer and line are deleted 14 days after that Thursday, and the notes about our Thursday and Friday notifications 14 days after each one; only the totals (how many, never who) are kept.
• Hosted evenings and See again — your "I'm in" note and agreement are deleted 14 days after the evening, your See again marks a day after the window closes (the evening plus four days) and the note that two people connected after 11 days; only totals (how many, never who) are kept.
• Tonight nearby — your "I'm going" taps are deleted 14 days after that evening.
• Going out — the day and rough area of each evening you went out are deleted after 8 days.
• Bug reports — 90 days, screenshot and diagnostic log included. If you delete your account sooner, they stay without any link to you until then.
• Crash records — the one on your phone is sent and cleared the next time you sign in; on our servers, 90 days.
• "How did you hear about Pubmigo?" — the daily totals have no link to anyone, so they are kept. The note that your account has answered goes when you delete your account.
• Bans — if we ban an account, we keep a one-way hash of its email address for as long as the ban stands, so the same address can't sign up again.
• Deletion requests — when you delete your account the data goes immediately from the live service, and within 30 days from backups. One exception: if an underage or child safety report against your account is under review, we lock the account instead and keep what is relevant to that report for up to 90 days, or longer if the police ask us to (GDPR Art. 17(3)(b) and (e)); then it is deleted.

7. Security

Everything travels over TLS. Data is stored in Postgres with row-level security, so the database itself enforces that you can only read your own row, the public parts of other people's profiles, and the messages in your own matches. Photos are held in a storage bucket where you can only write under your own prefix. You sign in through Apple or Google, so there is no Pubmigo password of yours for anyone to steal.

No service is perfectly secure. If a breach ever puts your rights at risk we will tell the competent data protection authority within 72 hours and tell you without undue delay.

8. Your rights

Under the GDPR you can ask us to:

• Access the personal data we hold about you, and get a copy.
• Correct anything wrong — most of it you can edit yourself in the app.
• Erase your data. Profile → Settings → Delete account does this yourself; see deleting your account.
• Restrict or object to processing based on legitimate interests.
• Port your data — receive what you gave us in a structured, machine-readable format.
• Withdraw consent for location, at any time, in your phone's settings.

Write to support@fieldfare.cc and we will answer within 30 days. There is no charge.

If you think we have got it wrong you can complain to a data protection authority — usually the one in the EU country where you live or work (the European Data Protection Board keeps the list).

9. Automated decisions

We do not make decisions about you by automated means with legal or similarly significant effects. One automated safety measure exists: a profile that receives three reports within 24 hours is hidden until a human looks at it. You can contest that by writing to us.

10. Children

Pubmigo is for adults. You must be at least 18, and older where local law says so — 21 in the United States, 20 in Japan and South Korea. We do not knowingly collect data from anyone under those ages. If we learn that an account belongs to a minor we delete it. See our child safety standards, and tell us at support@fieldfare.cc if you believe a minor is using the app.

11. Changes to this policy

If we change this policy in a way that matters we will update the date at the top and tell you in the app before the change takes effect. The current version always lives at pubmigo.com/privacy.html.

12. Contact

Privacy questions, requests and complaints: support@fieldfare.cc.