Privacy policy
The short version. We collect what we need to run Klubbit: your account details, the clubs you're in, and what you post and pay for. We don't sell your data or show you ads. Your club's members and organisers see what's needed to take part in the club. Payments are handled by Stripe, so we never see your full card number. You can see, correct or delete your data at any time.
1. Who we are
Klubbit is provided by Klubbit Ltd, a company registered in England and Wales (company number 17554598), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are the controller of the personal information described in this policy.
For anything about your data, email privacy@klubbit.co.uk.
2. What we collect
Information you give us
- Account details: your name, email address and password (stored securely, never in readable form), or the details your sign-in provider shares if you use Google or Apple sign-in. We also record that you've confirmed you're 18 or over.
- Profile: your photo and anything else you add to your profile, such as contact details, and who you choose to show them to.
- Club activity: the clubs you join or create, your roles and permissions, event RSVPs, lift shares, badges, and club information you add as an organiser.
- Content: messages in club chats and direct messages, photos, reactions, routes, and anything else you post.
- Payments: memberships and event payments you make or collect, amounts, dates and status. Card and bank details are collected and held by Stripe, not by us; we only see limited details such as the card type and last four digits.
- Reports and safety: reports you make or that are made about your content, blocks, and moderation decisions.
- Messages to us: anything you send us through Message Klubbit in the app (including pictures you attach), or to our support or privacy email addresses. Each in-app message also records your app version, phone platform (iOS or Android) and operating system version, to help us fix problems.
Information collected when you use Klubbit
- Device and app information: your device type and operating system, app version, a push notification token if you allow notifications, and basic technical logs we need to keep the service running and secure.
- Location: only if you allow it, your device's location is used to centre the Explore map near you so you can find clubs. We don't store your location history. Places you choose to enter, such as an event venue or a pick-up point for a lift, are saved as part of that club content.
- Device features: if you allow access to your camera, photos, microphone or calendar, we only use it for the thing you asked to do, such as taking a photo, attaching a file or adding an event to your calendar.
We don't use advertising trackers, and we don't sell your personal information.
3. How we use it, and why
UK data protection law requires us to have a lawful basis for each use of your information:
- To provide Klubbit (contract): creating your account, letting you join and run clubs, showing your messages and photos to the right people, events and RSVPs, notifications you've chosen, and processing payments between you and clubs.
- To answer your questions and fix problems you report (legitimate interests, and our agreement with you where it's about your account): replying to Message Klubbit conversations and support emails. We limit how many in-app support messages can be sent an hour, to prevent spam.
- To keep people safe and Klubbit secure (legitimate interests): handling reports, moderation and suspensions, preventing fraud and misuse, and protecting accounts.
- To run and improve the service (legitimate interests): fixing problems, understanding which features are used so we can improve them, and sending service messages about important changes.
- To meet legal obligations (legal obligation): keeping financial records, and responding to lawful requests from authorities.
- Optional contact (consent): if you turn on "Klubbit can contact me by email", we may email you about Klubbit, such as new features or research. You can turn this off at any time in the app.
4. Who can see your information
- Members of your clubs see your name, photo and what you post in that club, and your contact details only if you've chosen to show them.
- Club organisers also see what they need to run the club, such as membership and payment status for their club, join requests, and reports made in their club. They don't see who reported something.
- People you message directly see those messages.
- Anyone using Explore can see public club information, such as a club's name, logo, description and location. Your personal details aren't shown on Explore.
- Klubbit's moderators can see reported content and who reported it, to deal with reports.
- Klubbit's staff see your Message Klubbit conversation, with your name, profile photo, email address and the device details above, so they can help you. Club organisers never see support messages. Staff replies show the staff member's first name.
Clubs are run by their own organisers. If organisers use members' information outside Klubbit, for example in their own spreadsheets or emails, they're responsible for that use. Organisers must only use members' information to run the club.
We may also share information if the law requires it, to protect someone's safety, or as part of a sale or reorganisation of our business, in which case this policy would continue to protect it.
5. Service providers
We use trusted companies to run Klubbit. They process data only on our instructions, under contracts that protect it:
- Supabase: hosting our database, sign-in and file storage.
- Stripe: payment processing. Stripe is also responsible in its own right for some payment data, as described in its own privacy policy.
- Expo, Google (Firebase Cloud Messaging) and Apple (Push Notification service): delivering app updates and push notifications. Push notifications about support messages don't include the message itself.
- Google Maps Platform: maps, place search and route maps.
- Brevo: sending account emails, such as sign-up confirmations and password resets.
- Fastmail: our email inbox, if you email us.
- Cloudflare: hosting our website and domain.
- Google and Apple sign-in: only if you choose to sign in that way.
6. International transfers
Some of these providers process data outside the UK, including in the European Economic Area and the United States. Where they do, we rely on protections recognised by UK law, such as UK adequacy regulations (including the UK–US data bridge for certified companies) or the UK's approved data transfer agreements.
7. How long we keep it
- Your account and profile: until you delete your account.
- When you delete your account: we delete your profile, memberships, saved payment methods, Message Klubbit conversation and other personal data straight away, as described on our Delete your account page. Messages you sent in club chats stay but are shown as from a "Deleted user", and photos a club accepted stay in its gallery.
- Payment records: kept without your name, normally for six years, as UK law requires for financial records.
- Handled reports: deleted after 12 months.
- Message Klubbit conversations: kept while open. Once resolved, a conversation and its pictures are deleted after 24 months with no new messages (a new message reopens it and restarts the clock). Support emails are kept for up to 24 months.
- Suspended accounts: we keep the minimum needed to stop the same person rejoining, for as long as the suspension lasts.
- Backups: deleted data can remain in our providers' encrypted backups for a short time before it's overwritten.
8. Your rights
You have the right to:
- access the personal information we hold about you;
- correct it if it's wrong (you can edit most of it in the app);
- delete it (see Delete your account);
- restrict or object to how we use it, including where we rely on legitimate interests;
- receive a copy of information you gave us in a portable format; and
- withdraw consent at any time, where we rely on it.
Email privacy@klubbit.co.uk to use any of these rights. We'll respond within one month, and we may need to confirm your identity first. It's free in almost all cases.
9. Security
We protect your information with encryption in transit, access controls that limit who can see what, and secure handling of passwords and payment details. No system is perfectly secure, but if a breach affects your data, we'll tell you and the ICO where the law requires it.
10. Children
Klubbit is only for people aged 18 and over. We don't knowingly collect information from children. If you think a child has an account, email privacy@klubbit.co.uk and we'll close it.
11. Changes to this policy
We'll update this policy as Klubbit changes. If a change is significant, we'll tell you in the app or by email.
12. Contact and complaints
Email privacy@klubbit.co.uk, or write to Klubbit Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
If you're unhappy with how we've handled your information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint.