Privacy policy

Ember is built to be forgotten. Your account and profile persist so you can join any night with one tap, but everything that happens during a night (who you waved at, who you matched with, your presence in a room) is deleted from the live service within minutes of the venue closing, and in any event within 24 hours. What survives is aggregate numbers, such as how many people joined a room, plus a count of how many times you have been to each venue. That count is how a venue learns it has regulars, and how it can send you an offer for being one, without ever learning who you are. Points you earn from matches also stay, as a balance on your account, never as a record of who you met. We do not sell data.

One thing is kept aside: a sealed record of each night, retained solely so we can answer a lawful request from the authorities, such as a court order or a police investigation. We guarantee it is never shown to you, to other guests, to venues, or anywhere in the product, and no screen or feature can reach it. It exists for the law, and for nothing else.

Ember is operated by PubCrush™, a trading name of FA Creative & Technologies LTD, 3rd Floor 86-90 Paul Street, London EC2A 4NE. That company is the controller of the personal data described here, and is registered with the Information Commissioner's Office under reference ZC201466. This policy covers the Ember website, the Ember app, and venue accounts. For anything in it, write to [email protected].

Account: a phone number, or the name and email we receive if you sign in with Google, Microsoft or Apple. Used to sign you in and nothing else.

Profile: the first name, photos and interests you choose. You can change or delete these at any time from your profile page.

Date of birth: asked once, before anything else, to confirm you are 18 or older. It is never shown to other guests and cannot be edited; deleting your account deletes it. If the date you declare puts you under 18 we keep only an anonymous marker (a scrambled form of your sign-in email or phone number and the date you turn 18) so the age limit holds; it expires on that date.

Location: checked once when you join a room, to confirm you are physically at the venue. We compare your position against the venue's and store only the yes/no outcome, never your coordinates. If you take part in a hunt, your position is compared with the runner's in the same way, at that moment only; what we keep of a win is your first name, your rank and the time, never where you were.

Night activity: waves, matches, icebreaker messages and reward codes, all scoped to a single room and deleted with it.

Points: when a match earns points, we record the award on your account: the amount, the venue and the date. Once the night is purged the award keeps no link to the person you matched with.

Reports: if you report someone, we keep the report and enough context to act on it.

Venue accounts: the venue's name, coordinates, photo, opening hours and staff PIN, plus subscription billing handled by Stripe. We never see full card numbers.

Technical: standard server logs (IP address, browser, timestamps) kept briefly for security and debugging, and, only with your consent, Google Analytics usage data as described in the cookie policy.

To run the service (performance of our contract with you): signing you in, showing your profile to the room you joined, creating matches and reward codes, and billing venues.

To keep the service safe (legitimate interests): reviewing reports, enforcing our terms, preventing fraud and abuse, and securing our systems.

To understand usage (consent): analytics cookies, only if you accept them, and you can withdraw at any time on the cookie policy page.

To meet legal obligations: keeping billing records for tax law, retaining the sealed record of each night described above, and responding to lawful requests from authorities.

We do not use your data for advertising or profiling, and we do not make automated decisions with legal effects about you.

Other guests: your profile is visible only to people in the same room on the same night. Your matches see the icebreakers you send them. Nothing about you is public.

Venues: never receive guests' personal data. Their staff see only whether a reward code is valid. A venue can see how many of its guests are returning ones, and can ask us to send an offer to a group of them, for example everyone who has been five times or more. We send it on their behalf. They never receive the list, your name, your photo or your contact details.

Service providers, acting under contract and only as needed to run Ember: cloud hosting and photo storage, an SMS provider that delivers sign-in codes, the sign-in providers you choose (Google, Microsoft or Apple), Stripe for venue payments, and Google Analytics if you consent.

Authorities: if the law requires it, or where necessary to protect someone's safety. We do not sell or rent personal data to anyone, full stop.

We do not sell your data. We do not track your location in the background. We do not show anyone a history of who you met: once a night is purged, nothing in Ember can display it again, to you, to the people you met, to venues, or to our own staff through the product. The sole remnant is the sealed legal record described above, which is stored apart from the service, is never used for features, analytics or marketing, and is opened only to answer a lawful request from the authorities.

Night activity: deleted from the live service within minutes of the room closing, and in any event within 24 hours. A sealed copy is retained to meet legal obligations; it is accessible only to answer lawful requests from the authorities and is never shown to any user, venue or product feature.

Venue visits: how many times you have been to each venue, and when you were last there. Stored under a coded identifier derived from your sign-in details, not under your name, and no venue ever sees the individual entries. If you delete your account the counter keeps no visible link to you; if you later return with the same phone number or sign-in, your count simply continues, so a venue's regulars numbers stay honest.

Points: kept as your balance until you spend them or delete your account. When a night is purged its awards lose their link to the match, so the balance says where and when, never who.

Account and profile: kept until you delete them; deletion takes effect immediately.

Reports: kept up to 12 months so patterns of abuse are visible, or longer where the law requires it.

Venue billing records: kept for six years, as UK tax law requires.

Server logs: kept up to 30 days. Aggregate metrics (counts per night, no personal data): kept indefinitely.

Our servers and photo storage run in the UK and EU. Some providers (for example SMS delivery or analytics) may process data outside the UK; where they do, the transfer is covered by UK-approved safeguards such as the UK Addendum to the EU standard contractual clauses.

Under UK GDPR you can ask for access to your data, correction, deletion, restriction of processing, a portable copy, and you can object to processing based on legitimate interests or withdraw consent at any time. Email [email protected] and we will respond within 30 days. Most of it you can do yourself: profile edits and account deletion live in Settings on your profile.

If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.

Ember is for adults. You must be 18 or older, and we remove accounts that are not. If you believe someone under 18 is using Ember, tell us.

We may update this policy; material changes will be announced in the app before they take effect, and the date at the top always tells you when it last moved.

Questions about this policy: [email protected]