1. Who is responsible for your data
2AM (2am.social) is the controller of the personal data described in this policy. If you have any privacy question or want to exercise your rights, contact our privacy team at privacy@2am.social.
2. The data we collect
We collect the following categories of personal data:
- Profile information — your name or display name, username, bio, photos, and the details you choose to add to your profile.
- Age — your date of birth / age, used to confirm you are 18+ and for age-appropriate features.
- Gender & preferences — gender, who you want to meet, and other matching preferences.
- Location — approximate or precise location (with your permission) to show nearby venues, events, and people.
- Posts & media — the posts, moments, comments, and photos/videos you upload.
- Swipes & matches — the people you swipe on, your matches, and your dating activity.
- Direct messages — the content of DMs you send and receive on the platform.
- Device & technical data — device type, operating system, app version, IP address, and push tokens.
- Usage & analytics — how you use the app, screens viewed, and feature interactions, to keep the service working and improve it.
- Peer shop listings — title, photos, price, and condition if you post on the 2AM marketplace. We are not the merchant for those sales unless checkout says otherwise.
- Event catalog — public listing fields and ticket deep-links ingested from licensed Ticketmaster and Eventbrite discovery APIs. 2AM does not sell those tickets and is not the official promoter app.
3. Why we use your data & our legal bases
We use your data for these purposes:
- To provide the service — create your profile, power the feed, deliver messages, run swiping and matching, and show nearby venues/events. (Legal basis: performance of our contract with you.)
- Safety & integrity — verify you are 18+, detect fraud and abuse, enforce our guidelines, and respond to reports. (Legal basis: legitimate interests; legal obligations.)
- Personalization — recommend people, events, and content based on your preferences and activity. (Legal basis: legitimate interests, or consent where required.)
- Location features — show nearby content. (Legal basis: your consent, which you can withdraw in device settings.)
- Analytics & improvement — understand usage and improve the product. (Legal basis: legitimate interests, or consent where required.)
- Communications — send service messages, push notifications, and (with your consent) marketing. (Legal basis: contract; consent for marketing.)
4. Who we share data with
We do not sell your personal data. We share it only with service providers who process it on our behalf under contract, and only as needed to run 2AM:
- Supabase — hosts our database, authentication, and file storage.
- Vercel — hosts and serves the application.
- Stripe — processes payments for subscriptions and purchases.
- Anthropic — provides AI features (e.g. content suggestions and safety classification).
We may also share data with other users as part of how the app works (for example, your public profile and posts), and with authorities where required by law, to enforce our terms, or to protect the safety of users and the public.
5. International transfers
Our providers may process data in countries outside your own, including the United States. Where we transfer data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses to protect it.
6. How long we keep your data
We keep your data for as long as your account is active. When you delete your account, we delete or anonymize your personal data and user-generated content, except where we must retain certain information to comply with legal obligations, resolve disputes, prevent fraud or abuse, or as held in routine backups for a limited period. Backups roll off on their normal cycle.
7. Your rights
Depending on where you live (including under the GDPR and CCPA/CPRA), you have the following rights:
- Access — get a copy of the data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure— delete your account and data (“right to be forgotten”).
- Portability — receive your data in a machine-readable format.
- Objection & restriction — object to or limit certain processing.
- Opt-out — withdraw consent, opt out of marketing, and (where applicable) opt out of the sharing of personal data.
You can exercise the core rights yourself in the app under Settings → Privacy & Data — download a full export of your data, or delete your account. For any other request, email privacy@2am.social. You also have the right to lodge a complaint with your local data protection authority.
8. Security
We use technical and organizational measures — including encryption in transit, access controls, and row-level security — to protect your data. No system is perfectly secure, but we work to keep your information safe and to notify you and the authorities of any breach as required by law.
9. Children
2AM is for adults 18 and older. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete it and remove the account.
10. Changes to this policy
We may update this policy as the product and the law change. We will revise the “Last updated” date above and, for material changes, notify you in the app.
11. Contact
For any privacy question or to exercise your rights, contact privacy@2am.social.