Privacy Policy

This Privacy Policy explains how Tidbok (“tidbok”, “we”, “us”, or “our”) collects, uses, discloses, and protects information when you use our website, mobile applications, and related services (collectively, the “Service”).

1. Information We Collect

1.1 Information you provide

• Account information: email address, phone number, display name, profile photo, time zone, and — if you sign up with a password — a one-way cryptographic hash of that password (computed with argon2id). We never store or log your password in plain text and cannot recover it. If instead you sign in with Google or Apple, we receive only your basic profile and email from that provider and no password is stored at all.
• Profile content: bio, saved locations, contact groups, event details, RSVPs, and any other content you submit.
• Contacts: only contacts you explicitly select to import from a social account you have connected. We do not read your device address book.
• Guests' contact details entered by hosts: when you invite people to an event, you may enter their email addresses, phone numbers and names. We use them only to deliver that invitation (and reminders you choose), to show you who has responded, and to honour opt-outs. We keep a record of the numbers and addresses that opted out so we never contact them again.
• Invitation pictures and guest notes: hosts can add a cover picture and pictures to an invitation. We store them privately, re-encode them as JPEG images up to 1600 pixels wide, and remove hidden data such as the location a photo was taken. Anyone with the invitation link can see the pictures. We do not scan pictures automatically; reports are reviewed by people. Pictures are deleted when the event or the host's account is deleted. Guests can send a private note to the hosts when they reply; only the hosts can read it.
• Your public profile: an optional handle (the short name in tidbok.com/u/your-name), headline, bio, city, profile picture and cover picture. You choose who can open your profile (see section 1.8).
• Posts, comments and reactions: notes, activity announcements, “ask to join” posts, away notices (the dates you will be away), pictures you attach, and the comments and reactions you leave on other people's posts and events.
• Messages: the direct messages you send and receive, who they are with, and when they were read.
• Saved events and join requests: events you save, and requests you make to join someone's plan.
• Safety reports: if you report content or another user, we collect the report reason, any details you write, and what you reported, so our moderation team can review it.
• Payment information: processed by Stripe, Apple App Store, or Google Play. We never store full card numbers.

1.2 Information collected automatically

• Device identifiers, OS version, app version, IP address.
• Approximate location (city / ZIP) when you opt in.
• Usage events (pages viewed, events created, interactions with recommendations) for product improvement.
• Crash and diagnostic logs.

1.3 Information from third parties

• Identity claims from Google, Apple, and Microsoft when you sign in with those providers (name, email, and profile photo).

1.4 Guests who do not have a tidbok account

Anyone can respond to a tidbok invitation link without creating an account. If you RSVP as a guest, we collect the name and email address you enter and the number of people you are bringing. We use this only to tell the host who is coming and to send you information about that event. We do not use it to build a profile, we do not add you to marketing, and we do not sell or share it.

You have the same rights over this information as an account holder. Because you have no account to sign in to, email privacy@tidbok.com to access or delete it, and we will action the request.

1.5 Screenshots, photos and text you send to the assistant

If you send a screenshot, photo or pasted text to the assistant so it can find events, we store the file privately, read it with an AI model to propose calendar events, and show you the result before anything is added. The file is deleted as soon as you decide, and in any case within 7 days. It is never used to train a model and never shared with anyone else. See AI & your privacy.

1.6 Your tastes and preferences

You can tell us what you like by tapping through short questions about food, music, arts, the outdoors, sports, family, budget, schedule and more, or by chatting with the assistant. We store your answers as structured choices (for example “live bands over comedy”), never as free text, and use them only to rank and filter the events and places we suggest to you. Every question can be skipped, and you can see, change or clear every answer in Settings → Tastes & preferences. Your practical details there (ZIP code, how far you will go, household, budget, free time, how you get around) are used the same way.

We also learn from what you do in tidbok, such as events you save, hide, add to your calendar or say you are going to, and people and pages you follow. That tells us which kinds of events you engage with. You can see what we have noticed under Settings → Tastes & preferences → What we've learned, tell us “not me” about any of it, stop suggestions in a category, forget individual thumbs, or reset everything we learned from your activity at any time.

A few questions are more personal: diet and allergies, drinking, faith, accessibility needs and the age ranges of children in your household (age ranges only — no names or birthdays). We ask these only after you agree to them separately (our consent wording was updated in November 2026, so if you agreed earlier we ask again), every one of them is optional, we store your answers encrypted, use them only as filters and ranking signals for you, never show them on your profile, and delete them if you withdraw your consent or clear them. We never sell or share these answers. The legal basis for the personal questions is your consent; for the rest it is providing the personalised Service you asked for. If you saved diet notes in the older Preferences form, those were stored as plain text in your preferences; you can remove them, or move them into the private questions, in Settings.

To match you with events we also keep a short, de-identified description of your interests (for example “enjoys live bands and museums; usually plans family-friendly outings”) as a numeric vector. It never contains your name, email, address, ZIP code, or any of the personal answers above. It is deleted when you clear your answers or delete your account.

1.7 Public event and venue information

The venues and events we show come from public sources such as OpenStreetMap (© OpenStreetMap contributors, ODbL) and public calendars that organisations publish for others to subscribe to. We credit the source wherever its data appears.

For school sports we show only the school, sport, opponent, venue, date and time — never names, photos, rosters or statistics of players. College athletics are shown to everyone; high school athletics are shown only to people who choose to see them; middle school events are not collected at all.

1.8 Posts, comments, messages and profiles — who can see what

Posts and comments. When you post you choose an audience: friends, followers and friends, everyone, or only you. By default a post is visible to your friends. Posts and comments from public pages and public figures (restaurants, theaters, bands, comedians and similar) are visible to anyone who can open that page. People you have blocked, and people who have blocked you, cannot see your posts or comments and you cannot see theirs. If you turn on “share the events I attend” (it is on by default), we may show your friends a “went to” note after a public or friends-only event you said you were going to; you can turn it off in Edit profile, and delete any individual note.

Profiles. You choose whether your profile is private, friends-only, or public. If your profile is friends-only, people who are not your friends see only a small card with your name and picture. A profile that is public can be opened by any signed-in person. If you turn your profile into a public page, or you create an organization account, the page can also be opened by people who are not signed in and may appear in search engines and link previews. Your friends list and counts are shown only where your visibility allows. Away notices are visible to the audience you choose when you post them, and when someone is choosing guests for an event we may warn them that you are away on those dates.

Messages. Direct messages are stored on our servers so they can be delivered and shown on all your devices. They are not end-to-end encrypted: they are encrypted in transit and at rest like the rest of our data, but they are readable by the people in the conversation and, in the limited cases described below, by us. We do not read messages as a matter of routine and we do not use their content for recommendations or advertising. A moderator can see a message that someone has reported, and we may access messages when required to investigate abuse, secure the Service or comply with law.

Messages from friends go straight to your inbox. A message from someone who is not your friend arrives as a request that you can accept, decline or block; until you accept, the sender can send only two messages, and a declined request looks the same to the sender as one still waiting. You can set “who can message me” to friends only. We limit how many messages and new conversations a person can send per hour and per day to prevent spam. Deleting a message hides it for everyone right away. When you delete your account, every conversation you were in is permanently removed, including the other person's copy; other people's copies of a conversation are otherwise theirs to keep.

1.9 What we learn from how you use tidbok

To suggest things you might enjoy, we record how you interact with events and people: what you view, save, hide or mark as “not interested” or “more like this”, add to your calendar, say you are going to, follow, react to, comment on, join or search for. These signals adjust a ranked list of the kinds of events you engage with and are kept for up to 365 days; their influence fades a little every day. They are combined with the answers you give us in your tastes and the preferences you set (section 1.6) to rank suggestions, and each suggestion shows a short reason, such as “Because you like live music”. We do not use this information to build advertising profiles and we do not sell it.

You can see what we have learned, stop suggestions of a kind of event, undo a “we noticed you like this” guess, remove individual signals or reset everything in Settings → Tastes & preferences → What we've learned. Deleting your account removes these signals.

2. How We Use Information

• To create and operate your account and provide the Service.
• To deliver event invitations, notifications, and reminders, including push notifications about RSVPs, comments, reactions, messages and friend requests (you can switch push notifications off in your device settings).
• To show posts, comments and profiles to the audiences you choose, to deliver messages, and to apply your privacy choices, blocks and message settings.
• To personalize event recommendations using machine-learned preference signals and the tastes you tell us about.
• To read screenshots, photos and text you send the assistant and propose events for you to approve.
• To process payments and manage subscriptions.
• To review safety reports, enforce our Community Guidelines, and apply blocks, content removals, and account suspensions.
• To detect and prevent fraud, abuse, and security incidents.
• To comply with legal obligations.

2.2 Text messages

If a host invites you by text message, we send one invitation (and, if the host turns it on, one reminder if you have not responded) containing a link to RSVP. Reply STOP at any time and we will not text that number again. We do not use phone numbers for marketing and mobile information is not shared with third parties or affiliates for marketing or promotional purposes. Details: Text message terms.

2.1 Reports, blocks, and suspensions

If you block someone, we record that so we can stop showing you to each other. The person you block is not told that you blocked them.

If you report content, the reviewing moderator sees what you reported and why. We do not show your identity to the person you reported. We keep resolved reports so we can recognise repeat behaviour and so we can show you the outcome of an appeal — this means a report can outlive the content it was about.

If your account is suspended we retain the reason for that decision for as long as the suspension stands.

3. How We Share Information

We do not sell your personal information. We share information only:

• With other users as you direct (e.g. inviting friends to an event, joining a public event, posting for your friends, followers or everyone, messaging someone). Public pages, and anything you post publicly, can be seen by anyone who can open the page.
• With service providers under contract (Microsoft Azure, Stripe, Google Maps Platform, Apple Push Notification service, and Azure Communication Services for email and text messages).
• With map and weather services when you plan a day: approximate coordinates (your saved location, or Morristown if you have none, and the venues in your plan) go to Apple Maps for drive times and to the US National Weather Service for the forecast. Neither receives your name or account.
• To comply with legal process or protect rights, safety, and property.
• In connection with a merger, acquisition, or sale of assets, subject to the same protections in this Policy.

4. Your Rights and Choices

• Access & portability: download a copy of your data from Settings → Your data.
• Correction: edit your profile at any time.
• Deletion: permanently delete your account from Settings → Your data or the mobile app. Your account and personal data are removed immediately and the deletion cannot be undone; residual copies in encrypted backups are purged within 35 days.
• Visibility and messaging: in Edit profile you choose who can open your profile (private, friends or public), who can message you (everyone, with approval for non-friends, or friends only), and whether we show your friends the events you attend. You can delete any post, comment or message you wrote, block or report anyone, and decline or ignore message requests.
• What we learned: see, correct and reset your interests and suggestion signals in Settings → Tastes & preferences.
• Marketing: opt out of promotional email from any message footer.
• EU/UK (GDPR): you have the right to object, restrict, or lodge a complaint with your supervisory authority.
• California (CCPA/CPRA): right to know, delete, correct, and opt out of “sharing”. We do not sell or share personal information for cross-context behavioral advertising.

5. Children

The Service is not directed to anyone under 16. We do not knowingly collect personal information from children. If you tell us the age ranges of children in your household, we use only the range (for example “5–8”) to suggest age-appropriate things to do; we do not ask for their names, birthdays or photos. Posts, messages and public pages are available only to people 16 and older. If you believe a child has provided us information, please email privacy@tidbok.com.

6. Security

We use industry-standard safeguards including encryption in transit (TLS 1.2+) and at rest, application-level envelope encryption for sensitive PII, and managed-identity-based access controls. No system is perfectly secure; please use a strong, unique password.

7. Retention

We retain personal information for as long as your account is active and as needed to provide the Service. Backups are purged within 35 days after account deletion. Aggregate, de-identified analytics may be retained indefinitely.

Posts, comments, reactions, messages and the pictures attached to them are kept until you delete them or delete your account. Something you delete is hidden immediately; we keep the hidden copy so we can review reports about it, and remove it permanently when you delete your account. Suggestion signals are kept for up to 365 days.

Two categories outlive the account they relate to, and we want to be plain about why. Safety reports and suspension decisions are kept after resolution so we can recognise repeat behaviour and handle appeals; a report can therefore survive the content it was about, and deleting your account does not erase a report someone else filed about you. Guest RSVP details are kept for as long as the event they belong to, so the host retains an accurate record of who attended.

8. International Transfers

tidbok is operated from the United States. By using the Service you consent to the transfer of your information to the U.S. and other countries where our service providers operate, subject to appropriate safeguards (e.g. Standard Contractual Clauses).

9. Changes

We may update this Policy from time to time. Material changes will be announced in-app and by email at least 30 days before they take effect.

10. Contact

Email: privacy@tidbok.com
Postal mail: Tidbok, Privacy Office, United States.