Privacy Policy

Account & Profile Data

When creating and maintaining your account, we collect:

• Name;
• Email address;
• Phone number (optional);
• Profile photo;
• Date of birth (to verify minimum age of 18);
• Instagram handle (optional);
• Any additional details you voluntarily provide.

Demographic Data (Optional & Anonymous)

You may optionally provide:

• University or educational institution;
• Relationship status;
• Gender.

Together with your age range (derived from your date of birth), this information is used to enable demographic filtering of poll results (e.g., "see results for students only"). Filtering is always aggregated and never identifies an individual. This data is never used for advertising or profiling, and you can update or remove it at any time from your profile settings.

Visibility: Your university, relationship status and gender are visible to users you are friends with. They are not shown to anyone else.

Poll & Voting Data

When you participate in a weekly poll, we record:

• The venue you voted for;
• The poll date;
• Your user ID (to associate the vote with your account and display it on your profile).

Promotions and Claims

When you claim a promotion at a partner venue, we record:

• Your user ID;
• The partner whose offer you claimed;
• The date and time of the claim, in the partner's local time.

This record is what enforces the one-claim-per-partner-per-night limit and lets a partner reconcile what was handed out. Be aware that it says more than a vote does: a vote is where you said you were going, a claim is a venue you were actually at, on a given night.

Instagram Handle (Optional)

You may add your Instagram handle to your profile, or state that you do not have one. If you add it, users you are friends with can see it and open your Instagram profile. Users who are not your friends are only shown whether you have added a handle, not the handle itself. Opening a handle leaves the App for Instagram, which is operated by Meta under its own terms and privacy policy - we do not share any of your data with Meta.

User Content

When you create posts within the App, we collect:

• Text and captions;
• Images or photos you choose to upload;
• The location you select for the post.

Location Data

Location During a Poll: While a poll is open, we access your device's GPS coordinates to connect you to the poll for your area. Your precise coordinates are not stored. We do store the wide geographic area they fall in - a cell of roughly 22 km across - alongside your vote, because poll results are grouped by area. That area is retained for as long as the vote is.

Post Location Data: When you manually tag a location in a post, that place is stored and linked to your post.

Location for Promotions: Promotions are listed nearest first, so we send your coordinates to find the ones around you. Claiming one sends them again, to check that you are at the venue rather than at home - that check is the only thing standing between the offer and someone claiming it from their sofa. In both cases the coordinates are used to answer the request and then discarded. They are not written to your account, to the record of your claim, or to our logs.

Contacts (Optional)

If you choose to look for friends from your address book, the App asks for contacts permission and reads the names and phone numbers stored on your device. Only the phone numbers are sent to our servers, over an encrypted connection, so that we can check which of them belong to FOMO accounts. On arrival they are converted into irreversible cryptographic hashes in memory and compared against the equally hashed numbers of existing accounts.

We never write your address book to our database or to our logs, the names never leave your device, and we do not use your contacts to build a social graph, to send invitations, or for any purpose other than showing you the FOMO users among them at that moment. The permission is optional, you can revoke it at any time in your device settings, and every other part of the App works without it.

Usage Data

We may automatically collect certain technical and interaction data:

• User interactions within the App (e.g., features used, actions performed);
• Device ID (managed by AWS Cognito for authentication);
• Device model, operating system version and app version;
• Your IP address, from which an approximate country or city may be derived.

The last two categories are collected by our analytics and error-reporting providers, described in the next section, and are not stored in our own database. We do not track how long you spend on individual screens, and none of this data is used for advertising, ad targeting or profiling.

Diagnostic Data

When the App hits an error we send a diagnostic report containing the technical details of the failure, the sequence of actions that led to it, and your user ID, so that we can reproduce and fix it. These reports can incidentally contain personal data that was on screen at the time.

Data Retention

We store your personal data only for as long as necessary:

• Account data: retained until you delete your account or request removal;
• Voting history: retained as long as your account is active or until you request deletion;
• Promotion claims: retained as long as your account is active or until you request deletion;
• User content: retained until you manually delete it or close your account;
• Demographic data and Instagram handle: retained until you remove them from your profile or delete your account;
• Usage data: retained for shorter periods unless required for security or service improvements;
• Analytics events: retained by our analytics provider for up to 14 months from your last activity;
• Diagnostic and error reports: retained for up to 90 days;
• Server logs: retained for 14 days;
• Encrypted database backups: retained for 7 days, after which deleted data is also gone from the backups.

International Data Transfers

Your account data, posts, photos and votes are stored in the European Union, in AWS's Ireland (eu-west-1) region.

Some of the providers listed above are established in the United States, namely Google, Sentry and Expo. Transfers to them rely on the EU-US Data Privacy Framework where the provider is certified under it, and on Standard Contractual Clauses (SCCs) together with supplementary technical measures otherwise.