Privacy Policy

1. Who's the data controller

John Dreic, trading as Dreic Labs, based in London, United Kingdom, is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Reach us at [email protected].

2. What we collect

Account data. Email address, hashed password (or your Google account identifier if you sign in with Google), and the date you joined.

Profile data you give us. Things you tell Palaner during onboarding or chat — for example your home area, hobbies, favourite music or comedians, what you don't like, and similar. You choose what to share. You can edit or delete this from your profile settings at any time.

Activity data. Events you save, plans you build, feedback signals you give (thumbs-up / thumbs-down / hide), the events you open or share and which part of Palaner you found them in (for example your For You feed, Popular or search), chat messages exchanged with Palaner, voice transcripts if you use voice mode.

Likes. When you tap 👍 on an event, your friends can see that you liked it, on the event and on your profile. People who aren't your friends see it only on your profile, and only if you chose to show your plans to everyone on Palaner. Nobody sees it if "Share my plans" is off. Likes you gave before 21 October 2026 stay private.

Hearts. When you tap ❤️ on an event, your friends can see that you're interested. Other signed-in Palaner members can see it too, on your profile and on that event's page. Turn on Private account in Settings and only your friends will see the events on your profile and which events you're interested in. Members who aren't your friends also don't see it if "Anyone can find me by @handle" is off. If "Share my plans" is off, nobody sees it, friends included.

Going. When you mark yourself as going to an event, your friends can see it. Other signed-in Palaner members can see it too, on your profile and on that event's page, unless you turn off "Show other Palaner users", for that one event or for every event under "When you're going to an event" in Settings. Private account, "Anyone can find me by @handle" and "Share my plans" work the same way as they do for hearts.

Email you give us without an account. If you ask to hear about events near you from an event page, we store that email address, the area and radius it was captured for, and which event you were looking at. No account is created and no password is set. We keep it for 12 months unless you unsubscribe first, and every email we send will carry a one-click unsubscribe.

Events you save without an account. Events you save before signing in are stored in your own browser, not on our servers. Clearing your browser data removes them. If you later create an account, they move into it.

Location for nearby searches. If you allow location access and ask Palaner for something nearby, the app can send your current coordinates with that request. We use them only to answer that request, do not add them to your chat history, and do not retain a movement history.

People you tell Palaner about. If you mention friends, partners, or others in chat (e.g. "my friend Marko likes techno"), or upload a screenshot of someone else's dating profile to help plan a date, Palaner extracts those details and stores them in your account so it can remember next time. We do not contact those people, and we don't persist any images you upload — they're passed to the AI provider that analyses them (OpenRouter, named in "Who we share it with" below) and deleted in the same request.

Contacts you sync ("People You May Know"). If you choose to let the iOS app check your phone contacts, we never see or store a raw phone number or email address from your address book. Your device hashes each contact's phone number and email (one-way SHA-256, computed on your phone) and sends us only those hashes. We compare them against hashes of our own registered users' contact details to suggest people you may already know — nothing about your OTHER contacts (the ones who don't match) is ever transmitted or retained. This is opt-in: it only runs after you grant the Contacts permission, and you can turn it off any time in iOS Settings. See "How long we keep it" below for how long the matching index is kept.

Technical data. IP address, browser user-agent, broad device type, and basic page-load timings, collected through our hosting and content-delivery providers. We also count page views and key actions with analytics (PostHog, and Google Analytics where you allow it). Without your consent this is cookieless: nothing is stored on your device and you cannot be recognised from one day to the next. With it, an analytics cookie lets us recognise the same browser across visits (see "Cookies and similar technologies" below). Neither records session replays, and neither is told your name, email address or account. We never use advertising or cross-site tracking SDKs.

AI assistants you connect. If you connect Palaner to an AI assistant such as ChatGPT or Claude, we receive the requests it makes to Palaner for you and keep a record of the connection. Section 6, "AI assistants and connectors", sets out exactly what passes between Palaner and your assistant.

3. Why we use it (and the lawful basis)

• To provide the service — running your account, personalising your event feed, holding chat history, syncing your saved plans across devices. Lawful basis: performance of contract.
• To make the service better — debugging errors, improving the ranking algorithm, monitoring cost. Lawful basis: legitimate interest.
• To measure how Palaner is used — counting visits, which pages people arrive on and which features they use. Lawful basis: for anything that stores an identifier on your device, your consent where the law asks for it (the UK, the EEA and Switzerland); elsewhere, and for cookieless counting, legitimate interest. You can withdraw or object at any time from Cookie settings.
• To keep it safe — preventing abuse, enforcing rate limits, investigating suspected fraud. Lawful basis: legitimate interest.
• To tell you about service news — important account or product changes. Lawful basis: legitimate interest. Marketing emails (if we ever send them): explicit opt-in.
• To comply with law — responding to lawful requests from regulators or law enforcement.

4. Who we share it with

We share personal data with the following sub-processors, strictly to operate the service. Each is bound by a data processing agreement and processes data on our instructions only. We do not sell your data.

• OVH (hosting, France) — rents Palaner the server that runs the API, Palaner's own sign-in service and the database, in a data centre in Gravelines. So OVH holds your sign-in credentials (a hashed password, or your Google or Apple account identifier), your account record, profile, plans, chat history, connections, and everything else described in this policy that isn't specifically named under another provider below. Photos you upload are stored there as files. Each night OVH also keeps a second, encrypted copy of the database and a copy of the photos you upload on its backup storage; see “How long we keep it” below. Region: France.
• Hetzner (web hosting, Germany) — runs the server that delivers the Palaner website and web app to your browser.
• Cloudflare (DNS and edge proxy) — every request to Palaner's website, app, sign-in and photos passes through it on the way to our servers, so it handles those requests as they pass, including your IP address, the page address and your browser details. If a signed-out chat asks you to show you are not a bot, that check is Cloudflare's Turnstile, which reads technical signals from your browser. Cloudflare also stores two things for us in its R2 storage: the public event pages, and the database backups, which are encrypted on our server before they are sent (we ask for Western Europe, which Cloudflare treats as a preference, not a promise). Profile photos pass through it too, and it may keep a copy for up to an hour.
• Brevo (email delivery) — sends the emails Palaner sends: your sign-in code or link, the "Tell me if anything changes" emails about an event you chose to watch, the emails about feedback you asked us to answer, and the invitation when someone types your address into Palaner to invite you. It receives the address each email goes to, who it is from, and the email itself, which can include your sign-in code or link, an event's title, time and venue, or the name of the person who invited you. Region: EU (France, Germany and Belgium).
• OpenRouter — the AI provider behind Palaner's chat. Receives your chat messages and the profile context Palaner uses to personalise replies, and any image you upload: a screenshot or a picture of your CV for Palaner to read, and any photo you add to your profile or to something you post, which is checked before it is shown to anyone. It does not receive your sign-in credentials. OpenRouter is OpenRouter, Inc., a US company based in New York. It does not run the AI model itself: it passes each request to a company that does. Our settings send every request to Together AI (Together Computer, Inc., San Francisco). Only when Together AI is busy or unavailable may OpenRouter pass a request instead to Baseten (Baseten Labs, Inc., San Francisco), and never to any other company. Together AI and Baseten are used only through endpoints that OpenRouter lists as keeping no copy of requests (a zero-data-retention policy). OpenRouter's terms state that it does not store the content of requests or replies unless a customer opts in to logging, and that it does not use them to train AI models. Those statements are the provider's own; we have not independently verified them. All three are US companies, so this data leaves the UK and EEA to reach them, and none of them is certified under the EU-US Data Privacy Framework or its UK Extension. OpenRouter's data processing agreement applies to every OpenRouter customer and covers the transfer with the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Together AI and Baseten handle requests for OpenRouter. Together AI does not publish a data processing agreement of its own; Baseten publishes one for its own customers.
• NextBit (GLM) — Palaner's backup for chat. When OpenRouter fails, is overloaded, runs out of credit or cannot route a message, that message and the profile context sent with it go here instead, so you still get a reply. It is never sent images or your sign-in credentials. NextBit is NEXTBIT 256, S.L., a Spanish company registered in Valencia. The model Palaner uses from NextBit runs on its global endpoint, and NextBit's data processing agreement says requests to that endpoint are processed on infrastructure outside the European Economic Area, without saying in which country; which endpoint serves a model is something NextBit can change. That agreement applies to every NextBit customer and covers the transfer with the EU Standard Contractual Clauses; it does not include the UK International Data Transfer Addendum. It states that neither NextBit nor the companies it uses keep the content of a request once it has been answered, unless the law requires it, and then for no more than 30 days, and that NextBit does not use that content to train, fine-tune, evaluate or otherwise develop AI models. Those statements are the provider's own; we have not independently verified them.
• OpenRouter — runs the short, one-off AI tasks Palaner does beside the chat itself: noting what you tell Palaner about yourself so it can remember it (for this it reads your latest message and the few before it), reading the text of a CV or document you upload, turning what you ask for into search filters, and summarising web search results. This is the same company as Palaner's chat, on the same account and the same routing, so what the chat entry above says about it applies here too.
• Perplexity (Perplexity AI, Inc., San Francisco, US) — Palaner's first-choice engine for live web searches during a chat. Receives only the search terms drawn from your question, never your chat history, and before they are sent Palaner removes the names and usernames of the people in the conversation, @mentions, email addresses, phone numbers and street addresses. Perplexity's terms for this service allow it to keep, copy, share and otherwise use the searches it receives, and the plan we use offers no way to stop that. Perplexity is a US company, so the search terms leave the UK and EEA to reach it; it is certified under the EU-US Data Privacy Framework and its UK Extension.
• Exa (Exa Labs, Inc., San Francisco, US) — the engine Palaner uses for live web searches during a chat when Perplexity cannot answer (for example, when it is unavailable, too slow, or past the monthly spending limit we set). Receives the same search terms, with the same details removed first. Exa's privacy policy says it uses the searches it receives to improve its services, including by training and fine-tuning the AI models behind them; not keeping them is offered only on Exa's enterprise plans, which we do not use. Exa is a US company, so the search terms leave the UK and EEA to reach it. It is not certified under the EU-US Data Privacy Framework; its data processing addendum, which it says forms part of its terms, covers the transfer with the EU Standard Contractual Clauses and the UK Addendum.
• Google Search (through Google's Vertex AI) — the engine Palaner uses for live web searches during a chat when neither Perplexity nor Exa can answer (for example, when they are unavailable, too slow, or past the monthly spending limits we set). Receives the search terms drawn from your question — not your full chat history. Google's terms say it keeps the queries it derives from them for up to three days, may use them to debug the search service, and offers no way to turn that off.
• Google Maps Platform (Places) — when you ask for nearby restaurants, bars, shops, or similar places, receives the search category and either your city or your current coordinates if you allowed location access. Palaner shows the returned place details with Google Maps attribution and a source link, but does not save those live details in your chat history. See the Google Privacy Policy.
• Geoapify — the fallback for the Google Maps search above when Google's live results aren't used: supplies names, addresses, categories, and coordinates for nearby places. Never supplies ratings, price, or opening-hours information.
• OpenAI (Whisper speech-to-text, TTS voice) — receives audio you record for voice mode and any text Palaner reads aloud. OpenAI's API terms say they do not train models on API inputs by default.
• Tavily — the next engine Palaner tries for live web searches when Google's is unavailable. Receives the search terms drawn from your question — not your full chat history — and falls through to other search engines if it's unavailable.
• ScrapingAnt — used to fetch public event pages on our behalf. Does not receive your account or profile data.
• PostHog (product analytics and error tracking, US) — page-view and event counts. Cookieless unless you consent (or, outside the UK, EEA and Switzerland, unless you switch it off): with consent it keeps a random identifier in a first-party cookie so it can tell a returning browser from a new one. Never a session replay, and nothing linking it to your name, email or account. It also receives server error reports, which can include your pseudonymous user id.
• Google Analytics (Google LLC, US) — loaded only with your consent in the UK, EEA and Switzerland, and by default elsewhere unless you switch it off. It receives the pages you view, your browser and device type, an approximate location derived from your IP address, and the actions listed above (for example a sign-up, a share, or that an email address was left — never the address itself), linked to a random identifier in its first-party _ga cookie. We switch off Google signals and ad personalisation, and we never send it your name, email address or account id. Google is certified under the EU-US Data Privacy Framework and its UK Extension. Google Privacy Policy.
• Sentry (error and performance monitoring, EU) — receives crash reports and latency traces (which can include your user id, URL, and technical context) so we can fix bugs.
• MusicBrainz (and Last.fm) — we look up the genres of artists you like to translate your music taste into real-world event categories. We send artist names, never your identity.
• Spotify — if you choose to connect your Spotify account, we read your top artists, top tracks, and liked songs to build your music taste profile. We never see your Spotify password. You can disconnect Spotify at any time from your account settings, which forgets the connection immediately. If you import from a screenshot, your device reads the artist names; only those names are sent to Palaner and checked against Apple Music's catalogue. The picture itself never leaves your device.
• YouTube (Google) — if you choose to connect YouTube Music, Palaner reads your liked music videos and music-related subscriptions through Google's YouTube Data API, so it can learn which artists and genres you like. We store the artist names and genres we infer, and the YouTube channel each artist came from so we can match them — never the videos themselves, your watch history (YouTube doesn't allow apps to see this), or your Google password. That taste information is used the same way information from Spotify is: to personalise your event feed, to tell you when an artist you like is playing near you, and to give Palaner something real to talk about in chat, which means it can appear in the profile context sent to the AI provider that answers your messages (named above). You can disconnect YouTube at any time from your account settings: disconnecting stops us reading anything new straight away and deletes the artists and genres Palaner learned from YouTube.
• Event sources (Resident Advisor, Eventbrite, Luma, Skiddle, Ticketmaster, Bandsintown, etc.) — when you click an event link, you are sent to that site, which has its own privacy policy.

Old copies we are clearing out. Palaner moved to its own servers in October 2026. The companies below no longer take part in running it, but until we delete what they hold they still keep older copies of data. Anything you deleted after the move can still be in those copies until they are gone.

• Backblaze B2 (older backups) — holds copies of Palaner's earlier databases, made before we moved to our own server. They can hold anything the database held then, including sign-in credentials and profile photos. The nightly database copies are encrypted before they are uploaded and are deleted automatically; the rest stay until we delete them. The live database is no longer backed up here; see “How long we keep it” below. Region: EU (eu-central-003).
• Supabase (our former host for sign-in, photos and the database; London, UK) — still holds an old copy of the database as it was on 15 October 2026, the sign-in accounts as they were on 17 October 2026, and older copies of photo files, until we delete the project. Region: London (UK).
• Fly.io (our former host for the API; London) — its servers for Palaner are switched off. It still keeps the disks they used, which can hold older copies of the database, until we delete them. Region: London (LHR).

Several of these providers process data outside the UK and EEA (typically in the United States). Where they do, the transfers are covered by Standard Contractual Clauses or the UK International Data Transfer Addendum, except where this section says otherwise above. OVH (France) and Hetzner (Germany) are inside the EEA, and the UK treats EEA countries as providing adequate protection for personal data, so sending data to them needs no further safeguards.

Services that work under their own terms. The services below also receive personal data, each for one feature. The promise at the top of this section (a data processing agreement, and work on our instructions only) does not apply to them: each handles what it receives under its own terms and privacy policy, and some are outside the UK and EEA.

• freeipapi.com (approximate location from an IP address) — when someone uses Palaner without signing in, receives their IP address so we can guess their town and show nearby events. Never told anything else about them.
• Apple (Sign in with Apple) — if you sign in with Apple, Apple confirms who you are and gives us an Apple account identifier and the email address you choose to share, which can be a private relay address. When you delete your account, we tell Apple to end Palaner's access.
• Nominatim (OpenStreetMap's place lookup) — turns place names into map positions and back. Receives the names of places you search for or save, and, for a spot where Palaner has not collected events yet, that position, so it can find the town's name. It is not told who you are.
• postcodes.io — turns a UK postcode you give Palaner, such as your home postcode, into a map position. Receives the postcode only.
• TfL Journey Planner (Transport for London) — in London, works out travel times for group plans and date ideas. Receives the start and end points (a postcode or map position for each person, and the venue), never who anyone is.
• Maps (OpenStreetMap on the website, Apple Maps on iPhone, Google Maps on Android) — when you open a map in Palaner, your device loads it straight from that provider, which sees your IP address and the area the map shows.
• Apple Music — if you connect Apple Music, your phone or browser reads the artists in your library (on iPhone also your heavy rotation and what you played recently) and sends Palaner each artist's name and how prominent they are in your listening, to build your music taste. Palaner never holds your Apple Music sign-in. Palaner also looks artist names up in Apple Music's catalogue, sending names only, never who you are.
• Stripe (payments on the website) — if you buy a Palaner plan on the website, Stripe takes the payment. It receives your email address and your Palaner account ID so we know who paid, and the card details you type into its checkout, which we never see.
• Apple and Google (in-app purchases) — if you subscribe in the iPhone or Android app, the App Store or Google Play takes the payment under its own terms. To confirm a Google Play subscription we send Google its purchase reference.
• Apple, Google and your browser's push service (notifications) — if you turn notifications on, these deliver them to your iPhone, Android phone or browser. They receive each notification's text and an address for your device, not your account details.

YouTube API Services. Palaner's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we only use YouTube data to personalise your Palaner recommendations, never to serve ads, and never to train AI models. You can review or revoke Palaner's access to your Google account at any time at myaccount.google.com/permissions, in addition to disconnecting inside Palaner itself. Palaner uses YouTube API Services; see the YouTube Terms of Service and the Google Privacy Policy.

AI assistants you connect. If you connect Palaner to an AI assistant such as ChatGPT or Claude, Palaner sends that assistant the answers to the requests it makes for you. Your assistant's provider is not one of our sub-processors: it works for you, under its own terms and privacy policy, not on our instructions. See AI assistants and connectors below.

5. How long we keep it

We keep personal data only while it does its job, then delete it:

• Account, profile and plans (including your name, handle, taste profile and saved plans): for as long as your account is open. Deleted immediately when you close your account.
• Chat history with Palaner: kept while your account exists so Palaner remembers context; deleted immediately when you close your account. You can also clear it in-product.
• Voice recordings — never persisted. Audio is sent to OpenAI, the transcript stored, audio discarded in the same request.
• Uploaded images — never persisted, same pattern as above.
• Location: your home area/postcode is kept as part of your profile (deleted with the account). Live location shared with friends is held only while sharing is on and is not retained as a movement history. A current coordinate used for a nearby place search is processed for that request and is not written into your chat history.
• Server logs & error reports: server logs are kept for up to 30 days for debugging and abuse-prevention, then deleted or aggregated. Server logs and error reports rotate automatically within ~30 days and reference you only by a pseudonymous ID.
• Analytics (PostHog, Google Analytics): page-view and event counts carry no ID linked to your name, email or account — at most the random cookie identifier described in §8, which you can delete at any time. Google Analytics keeps event-level data for the retention period set in our account, no more than 14 months. Error reports can carry a pseudonymous ID, not your name or email. After account deletion the link between that ID and you is destroyed; ask [email protected] and we'll purge those records within 30 days.
• Backups — the database holding your profile, plans, and chat history is backed up to encrypted storage at Cloudflare (R2), continuously and with a full copy every night, and to a second encrypted copy at OVH every night. Both keep the last 7 days and delete anything older automatically. We haven't tested on the storage itself that older copies disappear on schedule, so we won't quote a tested maximum for how long a deleted record can stay in these backups. Photos you upload are copied to OVH every night, and a photo you delete leaves that copy the next night. The nightly database copies at Backblaze B2 are destroyed on a fixed schedule we have verified on the storage itself: a deleted record can still exist in one for at most 33 days. Every other older copy, at Backblaze B2, Supabase and Fly.io (named above), stays until we delete it.
• YouTube-derived taste (artists, genres, and the YouTube channels they came from): kept while YouTube stays connected and refreshed from YouTube at least every 30 days. Deleted when you disconnect YouTube, when Google tells us you've revoked Palaner's access, or when you delete your account.
• Contact-hash matching index: we keep a hash of your OWN email (and phone number, if we ever collect one) so other users' contact scans can find you — never a raw value, never your contacts' details. Deleted with your account. The people-you-may-know results shown to YOU from scanning your own contacts are computed fresh each time and are never stored.
• AI assistant connections (section 6): the record of each assistant you connect (its name, when you connected it, when it was last used and, if you disconnect it, when) is kept while your account is open, including for assistants you have disconnected, and deleted immediately when you close your account. So are the counts of searches and event lookups your assistants have used. What a search asked for is not kept with your account. Feedback you ask an assistant to send us is kept in our product feedback log, without your account attached, for 12 months and then deleted automatically. Email us and we will delete it sooner.

Location sharing has its own consent: sharing your location with friends is off by default and only happens when you switch it on (Article 6(1)(a) consent). You can turn it off any time in settings and the shared location stops being available immediately. Signing in with Apple? Deleting your account also destroys the sign-in link on our side.

Contacts matching has its own consent, too: checking your phone contacts against our users only happens after you grant the iOS Contacts permission (Article 6(1)(a) consent) — we never ask for or receive your contacts any other way. Revoking the permission in iOS Settings stops all future matching immediately.

7. Your rights

Under UK GDPR you have the right to:

• Ask for a copy of the personal data we hold on you. You can also see what Palaner knows about you in-app at any time.
• Ask us to correct anything that's wrong.
• Ask us to delete your account and the data tied to it. You can also delete your account directly from your account settings — deletion happens immediately.
• Restrict or object to certain processing.
• Receive your data in a portable format and ask us to send it to another controller.
• Withdraw consent at any time, where we relied on consent.
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk. We'd ask you to tell us first so we can try to put things right.

To exercise any of these rights, email [email protected]. We'll respond within one month.

9. Children

Palaner is not for under-18s. We don't knowingly collect data from anyone under 18. If you believe a child has signed up, please email us and we will remove the account.

When you sign up you confirm you're 18 or over. We keep a record of that confirmation with your account: when you gave it, which sign-up screen showed it, and which version of the wording you saw.

10. Security

We use HTTPS in transit, encrypted off-site backups of our database (at Cloudflare and OVH), and least-privilege access controls. Access to production data is restricted to Palaner's operator. No system is perfectly secure. If we become aware of a breach affecting your data we will notify you and the ICO as required by law.

11. Changes to this policy

We may update this policy. If a change is material we'll tell you by email or in-product before it takes effect. We'll always update the "last updated" date at the top.

12. Contact

Anything about your data, [email protected] gets you to the right place.