Privacy Policy

1. Information you provide

• Account information: email address, authentication information and account identifiers. Email/password registration sends credentials to Supabase Authentication. ATX Social does not display your password or login email in member search.
• Google sign-in: Google and Supabase process sign-in, and ATX Social receives account identity information, such as your email, name and identifier, needed to create and access your account. The sign-in integration is not a request for your Gmail messages or Google contacts.
• Profile information: first name, optional last name, biography, interests, neighborhood, profile picture and privacy choices. You choose what optional information to provide.
• Community information: organizations you create or manage, descriptions, website/social links, pictures, meeting locations, memberships, manager assignments, connection requests and connection relationships. Member-block records may also be stored.
• Event information: event titles, descriptions, dates, times, locations, prices, recurrence choices and occurrence edits, together with RSVP selections, guest counts and saved-event choices when you use those controls. See the current storage limitations below.
• Private community messages: messages to accepted connections, authorized organization/event announcements, read status and timestamps are stored to provide conversation history. Announcements use organization membership or Going/Maybe attendance access; they do not expose contact details or create connections.
• Messages to us: information you include in an inquiry or privacy request. Please do not send passwords or unnecessary sensitive information.

2. How information is used

Information is used to authenticate members, maintain profiles, show organizations and meeting locations, support authorized organization management, process memberships and connection requests, apply privacy and blocking rules, and respond to inquiries. Event and calendar controls use the information you enter to display relevant activities. Technical information helps operate the website and investigate errors or unauthorized activity.

3. What other people can see

Published organization listings and regular meeting locations are publicly readable, including names, descriptions, available pictures, links and meeting addresses or coordinates. Imported directory information comes from the supplied running-organization directory; an imported listing is not evidence that an organization has claimed or verified it.

Member profiles, including names and optional biography, interests, neighborhood and profile pictures, are available to signed-in members, not to logged-out visitors. Blocking rules restrict discovery and profile/photo access between blocked members. Login email addresses are not included in public member-profile or connection-search results.

Joined-organization visibility, event-attendance identity visibility and connection visibility are separate preferences. Available choices are All ATX Social site members, accepted connections only, or Nobody. New members’ attendance, organization and connection settings default to All ATX Social site members. Existing members’ choices are preserved. This audience excludes anonymous visitors. Authorized organization managers can access membership information needed to manage their organization. An organization owner can use a registered member's email to appoint a manager; this does not publish that email to other members.

Privacy preferences do not make public organization information private. Event pages are intended for public activity discovery, with public locations and aggregate Going/Maybe counts. Attendance identities are restricted by member privacy while aggregate totals remain public. Avoid entering sensitive information in public activity descriptions or addresses.

4. Authentication, pictures and current storage

ATX Social uses its connected external Supabase project for Authentication, account-linked profiles, privacy preferences, organizations, regular meeting locations, memberships, managers and real connection records. Profile pictures use a private Supabase Storage bucket with signed-in member access and owner-restricted uploads.

New organization and event picture uploads use Supabase Storage, with references saved to the corresponding records. Published organization and event pictures are available through linked public displays; unpublished records and uploads use management access rules. Member-created events and their explicitly generated occurrences are saved permanently in Supabase. RSVPs and guest counts are permanently stored per member and occurrence. Private messages, read status, announcements and activity records also use Supabase with participant, connection, management and privacy access rules. Unsaved drafts and saved-event selections still use temporary browser memory and may disappear on refresh. These limitations are not a promise that information has been securely erased from every system or browser.

Uploading pictures can reveal personal information about you or others. Only upload pictures you have permission to share. Profile, organization and event upload controls re-encode supported pictures before saving; do not rely on that process to remove every possible identifying detail visible in a picture.

5. Service providers and external websites

• Supabase: handles authentication, database records and picture storage.
• Lovable and its hosting infrastructure: deliver the website. Hosting and error-reporting systems may process request and diagnostic information, such as IP addresses, page paths, timestamps and error details.
• Google: processes Google sign-in when selected. Google Fonts supplies the website fonts and receives the requests needed to load them.
• OpenStreetMap services: provide map tiles and Nominatim location search. An address, ZIP code or city you submit for distance search is sent to the geocoding service. Map providers receive ordinary connection metadata, including your IP address. The current application does not request your device's precise GPS location.
• Linked websites: organization websites, Instagram, Facebook and directions links are operated independently. Opening a link subjects your interaction to that service's own practices.

Providers may process information in locations outside your home state or country. Their own policies and service configurations govern their processing and retention. This policy does not claim a particular hosting region, provider retention period or certification.

6. Browser storage and cookies

The application stores Supabase authentication-session information in browser local storage to keep you signed in and uses session storage for the intended destination after Google sign-in. Shared search address and distance preferences and pending join/RSVP intentions use local storage. Search preferences are private browser preferences, not public profile fields. Unsaved drafts and saved-event selections exist in browser memory. In the Lovable editor preview, authentication storage may communicate with the editor; ordinary public browsing uses the website's browser storage.

Hosting or third-party services may use their own cookies or related technologies. No advertising-tracking or optional analytics integration was identified in the application code reviewed for this policy; this is not a guarantee that every provider uses no cookies. You can clear site storage or adjust browser controls, but doing so may sign you out or interfere with access.

7. Retention, requests and account deletion

Permanent account and community records remain in the connected services until changed or removed through available controls or an administrative process. ATX Social does not currently publish a fixed deletion schedule for account data, server logs or backups. Unsaved drafts and temporary saved-event selections may be lost when its browser session ends or the page reloads.

You can edit available profile fields and privacy choices, replace or remove your profile picture, leave organizations, and remove connection relationships through existing controls. There is currently no self-service account-deletion feature. To request access, correction or deletion, contact arayconsult@gmail.com. We may need to verify that a request concerns your account before acting. Available rights and any exceptions depend on applicable law and the information involved.

A request is not an assurance of immediate or complete erasure: shared content, copies held by other people, provider logs or backups and information that must be retained may require separate handling. Do not send your password to verify a request.

8. Security

The application uses Supabase authentication and database access rules to restrict private records and unauthorized changes. Profile pictures have separate storage permissions; organization management follows ownership and assigned manager access. Public registration does not automatically grant platform administrator privileges.

No website or security measure can guarantee absolute protection. Use a strong unique password, protect your email and Google account, and report suspected unauthorized access to arayconsult@gmail.com. This policy is not a security certification or a promise that all risks have been eliminated.

9. Adult eligibility

ATX Social accounts are intended for adults 18 and older. The website does not currently perform identity-based age verification. If you believe a child has provided account information, contact arayconsult@gmail.com so the issue can be reviewed.

10. Changes and contact

This policy may be updated as functionality or practices change. The date above identifies the latest version; review it before providing additional information. Privacy questions and requests can be sent to arayconsult@gmail.com.