GroupUP Privacy Policy

What we collect

When you sign up

• Your email address, and a password or a sign-in through another provider if you use one.

Your profile

• Display name.
• Profile photo, if you upload one.
• A short bio, if you write one.
• Your city, state and country. For finding things near you, GroupUP works at the level of a town, not a street address.
• Your exact location, but only at one moment, and only if you choose it. Some events let you check in when you arrive. If you tap that button, your browser asks your permission and then sends your precise coordinates once, and we store them on your attendance record so the host can see the check-in was real. That is the only time GroupUP reads exact location. It is never read in the background, never while the app is closed, and never without you tapping check in. If you refuse the browser prompt, nothing is sent and you can still attend.
• The interests you tick, which is how you get shown things nearby that you might like.

What you do here

• Events you say you are going to, and whether you actually went, cancelled or were declined.
• Groups you join, and events you host yourself.
• People you follow, and people you block.
• Anything you report to us, and anything reported about you.

Messages

• Messages in event chats, messages in group chats, and direct messages between two people, along with any photos, files or voice notes attached to them.
• These are stored on our systems in a readable form. They are not end-to-end encrypted, and you should not treat GroupUP as a private, secure messenger.

Notifications

• If you turn on push notifications, your browser or phone gives us a subscription — an address for your device plus the keys needed to send to it. We keep one of those per person, and we use it only to send you GroupUP notifications. Turn notifications off and it stops being used.

Ordinary technical information

• The usual things any website records when a page loads or an app makes a request — IP address, rough device and browser details, timestamps and error logs — kept so the service works and so we can find abuse and bugs.

What other people can see

This is the part worth being sure about before you post anything.

• Anyone at all, with no account: your profile page — display name, photo, bio, city and interests. Public events and public groups, including who is hosting and how many people are coming. City pages listing what is happening near you.
• Search engines: some of those pages, not all of them. Event pages, group pages, business and project pages and city pages are built to be found, so Google and others can index them, and copies can linger in search results and web archives after you change or delete something. Personal profile pages are deliberately kept out. Every profile page carries a “do not index” instruction and our robots file tells crawlers to skip them, so your profile should not turn up in a search for your name. That is not the same as private: your profile still opens for anyone who has the link, with no account, and we cannot force a crawler that ignores those instructions to behave.
• Everyone in an event or group you join: that you are there, and everything you say in that chat.
• The host of an event: that you asked to come, your profile, and — unlike anyone else — your reliability score. That score is worked out from how often you turned up to things you said you would attend. It is hidden from everyone else looking at your profile, but a host organising something needs to know whether the people who said yes tend to show up, so they see it for the people on their own guest list.
• Nobody but you and the other person: direct messages.

Two switches in your profile settings control the rest: whether the events you have attended and the groups you have joined are listed on your public profile. Both are on by default. Turning them off hides those lists from your profile, but it does not hide you from the people who were actually at the event.

How we use it

• To run the thing — show you events near you, let you join, host, message and follow.
• To send notifications you asked for, and a small number of necessary emails such as password resets.
• To keep people safe: look into reports, deal with abuse and spam, and enforce the terms.
• To fix what is broken and understand which parts of the product people use.
• To meet legal obligations.

We do not sell your personal information, we do not rent it out, and we do not use it to target you with advertising.

Who else gets to see it

• Other people on GroupUP, as described above.
• Businesses, when you join an event or offer they posted. They see the same thing any host sees: that you are coming, and your profile.
• The companies that host and power GroupUP, which handle your data on our behalf and under contract, not for their own purposes. These are Supabase (the database, logins and file storage), Vercel (hosting and delivery of the site), Mapbox (the map on the feed, which sees the request from your browser when a map loads), the push services run by Apple, Google and browser makers (which carry a notification to your device), and Stripe if you ever pay for something.
• The law, where we are legally required to hand something over, or where we believe in good faith that it is needed to stop someone being seriously harmed.
• A future owner, if GroupUP or ACG is ever sold or merged. Whoever it is stays bound by this policy until they tell you otherwise.

How long we keep it

• Profile and account information: while your account exists.
• Events, RSVPs and messages: while they are part of the product, so other people in the same conversation still see a chat that makes sense.
• Technical logs: a short period, long enough to investigate a problem.
• Safety records: if we removed someone for hurting or endangering other people, we may keep a minimal record of that so they cannot simply come straight back.
• Backups: deleted data can sit in routine backups for a while before those backups age out.

Deleting your account

You can delete your account yourself, at any time, from your account settings page at /settings — look for “Delete account” at the bottom. It asks you to type DELETE to confirm.

That screen will look wrong, and it is not. Settings is shared with ACG, the business side of the same product, so it arrives in ACG’s colours with an ACG logo at the top and none of GroupUP’s navigation. You have not landed somewhere you should not be — it is the same account and the same login, and the delete button on it is yours. Your browser’s back button returns you to GroupUP.

One thing worth knowing: groups you started. A group belongs to the people in it, so it does not vanish when you go. Instead we hand it over. Each group you created goes to someone else who is still in it — the admin who has been there longest, or if it has no admins, the member who has been there longest — and they become its creator, able to run it exactly as you did. If you were the last person in a group, there is nobody to hand it to, so it stays without an owner rather than being destroyed. Either way your deletion goes through. Starting a group does not tie you to your account.

Deleting removes:

• your login and email address;
• your profile, photo, bio, city and interests;
• your RSVPs, group memberships, follows and blocks;
• events you were hosting — so please cancel and tell people first, rather than leaving them turning up to nothing;
• everything you said in GroupUP chats. Your messages in event chats and group chats are deleted outright, so the threads other people are still reading close up around the gaps where you were. A direct message thread goes further and disappears in one piece — from the other person’s inbox as well as yours, because it was a conversation between two people and one of them is gone;
• your push notification subscription.

ACG works the opposite way. If you also run a business on ACG, the delete screen will tell you so: that business’s messages in shared project chats are kept when it leaves, with its name stripped off, so those threads still read correctly for the other companies in them. That rule is about ACG business chats only. It does not apply to your GroupUP chats, which are removed.

What deleting cannot reach: anything other people have already saved or screenshotted, pages already copied by search engines or web archives, and backups until they age out. The image file behind your profile photo is deleted along with everything else — it used to be left behind in our file storage, where it stayed reachable by anyone holding its address, and that is now fixed. If the delete button does not work for you for any reason, email us and we will do it by hand.

Your other choices

• Edit or clear most of your profile at any time in your profile settings.
• Turn off the two public lists on your profile — events attended and groups joined.
• Turn push notifications off in the app, your browser, or your phone settings.
• Block anyone you do not want to hear from.
• Ask us for a copy of what we hold about you, or ask us to correct it. Depending on where you live you may have stronger rights than that — ask and we will deal with it.

Keeping it safe

Logins, data and uploaded files are held with our hosting providers, protected by access rules so that people can only reach what they are supposed to. No system is perfect, and we will not pretend otherwise. If something goes wrong in a way that affects you, we will tell you.

Under 18

GroupUP is for adults. You must be 18 or older to have an account, and we do not knowingly collect information from anyone younger. If you think a minor has an account, tell us and we will remove it.

Where your data lives

GroupUP is operated from the United States and your information is processed there and wherever our providers operate. If you are using GroupUP from somewhere else, that is where your data goes.

Changes to this policy

If this policy changes we will update the “last updated” date at the top, and tell you in the app if the change is a significant one.

Getting in touch

Privacy questions, data requests, or anything on this page you want explained: email hello@aggregatecommunitygroups.com with “GroupUP privacy” in the subject line. That address reaches ACG, the team that runs GroupUP.

[PLACEHOLDER] GroupUP has no dedicated privacy contact address and no published postal address yet. Both are usually expected of a consumer product and need to be set up, and this section updated, before launch.

This policy describes what the product actually does today, in plain words. It has not been reviewed by a lawyer, and it should be before GroupUP opens to the public.