Privacy Policy

1 Who we are and what this policy covers

JNUP Inc. (“JNUP,” “we,” “us”) operates jnup.co and the JNUP iOS app. We help adults discover, reserve and attend real-world activities (“Activities”) operated by independent hosts (“Hosts”). This policy describes our handling of personal information about participants, Hosts, applicants and website or app visitors. It applies to both free and paid Activities.

Our Privacy Officer is James Field. Contact privacy@jnup.co or write to JNUP Inc., 171 Sunrise View, Cochrane, Alberta T4C 0T7. We are responsible for personal information under our control, including information processed by service providers on our behalf. Hosts and some providers, including payment and sign-in providers, also have their own privacy responsibilities.

2 Information we collect

Account and eligibility information. We collect your first name, email address, self-declared date of birth, sign-in information and account identifier. Optional information can include your photo, phone number, city, home neighbourhood and category preferences. We use date of birth to determine eligibility; we do not independently verify age or identity. When you use Google sign-in, or Apple sign-in where available, we receive the account information the provider supplies, such as name and email, which may be an Apple relay address.

Waitlist. If you join the waitlist, we also record your founding number, your invite code, whose invite link you joined from, which concepts you said you would join, how you prefer to attend and, if you tell us, how you heard about JNUP.

Location. When you sign up we ask which city you are in. We keep the city, its province or state, its country and the city’s own centre point, which locates the city, not you. When you search for your city, what you type is sent to Google to suggest matching cities. If you use “Use my location” on the website, your browser shares your device’s location with us once; we use it only to find the nearest city, send it to Google to look that city up, and do not store it, log it or share it with anyone else. You can skip the question.

Reservations and participation. We collect Activities you save, join, waitlist, cancel or attend; reservation and waitlist status; join and cancellation times; attendance and no-show information supplied by Hosts; attendance counts; visibility and notification preferences; and blocks. We record acknowledgements relating to physical Activities and legal-document versions, timestamps and IP addresses associated with acceptance.

Communications and content. We collect messages between you and a Host about a reservation, Host broadcasts, reports, supporting information, moderation records, feedback, support requests, and content you submit. Reports can contain information about other people. Please do not include unnecessary health, financial or other sensitive information.

Payment information. Stripe collects payment credentials through its payment interfaces. JNUP does not receive or store your full card number or security code. We receive and retain transaction identifiers, reservation references, prices, fees, currency, payment status, refund and dispute information needed to administer bookings and records. Stripe collects Host identity, bank and tax information directly for onboarding and compliance. We receive connected-account identifiers, onboarding and capability status, and information Stripe makes available to operate the integration.

Host information. We collect business and representative names, contact information, venue addresses, application answers, websites or social links, Activity listings and images, and compliance or insurance information supplied to us.

Technical and usage information. We collect IP addresses, browser or device information, request logs, app usage events, identifiers, error reports and diagnostic information. We also collect referral or first-visit attribution information and device push tokens if you register for notifications. Diagnostic information can incidentally include a user identifier, URL or submitted content. Analytics events are configured to limit unnecessary personal information; an identifier can still make an event linkable to you.

On the website, a first-party cookie (jnup_t) records how your browser first arrived at JNUP and the most recent visit that said where it came from: the page you landed on, and any campaign tag, invite code or referring website. It is signed so it cannot be altered, lasts 30 days, and holds no name or contact details. When you create an account, we copy it to your account.

Email updates. You can sign up for our event emails with only your email address, without an account. Tapping Sign up under the sentence that says so is your consent. We keep your email address, the categories and hosts you choose to hear about, and a record of each consent and each withdrawal: the time, the IP address it came from, the event page you signed up on and the version of the sentence you were shown. We also record when we emailed you and when you last followed a link in one of our emails. If you later create an account with the same verified email address, your sign-up joins your account and your categories join your account’s preferences.

3 How we collect and use information

We collect information directly from you, automatically through the website and app, and from Hosts, sign-in providers, payment providers and people submitting reports or support requests.

We use it to create and secure accounts; assess eligibility; show and manage Activities, reservations and waitlists; process payments and refunds; communicate about bookings; calculate attendance information; support Hosts and participants; investigate reports and disputes; enforce rules; detect fraud and errors; improve the service; maintain required records; and meet legal obligations.

Optional preferences help us provide relevant Activity content. We do not use the service to rank or match people with each other. Human reviewers make Host approval and disciplinary suspension decisions. Operational systems automatically apply capacity limits, waitlist processes and the disclosed cancellation calculations; you can contact us about an error.

We use your city to decide whether you join the Calgary waitlist or a list for your own city, to tell you when JNUP opens there, and to decide where to open next. We count people by city; we do not show your city to Hosts or other people.

We send marketing communications only with consent or another lawful permission, and provide an unsubscribe method where required. Reading this policy or agreeing to the Terms does not by itself constitute consent to every optional use of information.

If you sign up for our event emails, we send them about once a week, choosing events by the categories and hosts you picked, and most weeks include an event outside them. Every email has a one-click unsubscribe link and a link to change what you hear about. Unsubscribing takes effect at once.

4 Consent and choices

We explain purposes when we collect information and obtain consent where required. Consent can depend on the information and context; sensitive or unexpected uses require appropriate specific notice and consent. We may process information without consent where the law permits or requires it.

You may decline optional fields, update available preferences, hide yourself from the public guest list, disable push through device settings, unsubscribe from marketing, or contact our Privacy Officer to withdraw consent. Withdrawal is subject to lawful or contractual restrictions explained to you and may prevent us from providing a requested feature. Booking changes, cancellations and essential payment or safety messages remain necessary while we manage a reservation; they are separate from marketing.

You can change your city in your profile at any time, remove it there on the website, or delete your account, which removes it.

5 What Hosts and other people can see

For their Activities, Hosts can see your first name, photo, reservation status, waitlist position, join time, total JNUP attendance count and attendance count for that recurring Activity. The second count concerns that Activity series, not every Activity at the venue. JNUP does not provide Hosts your surname, email, phone number or date of birth through the attendee list. Hosts can communicate with you through the reservation thread.

If you join from someone’s invite link, we email them your first name to say you joined. We share nothing else about you with them.

An Activity page’s guest list shows visitors who are not signed in only how many people are going. People who are signed in can see your first name and photo. A short attendance-derived line, such as “First JNUP,” “3rd time here” or “Been to 5,” is shown only to people booked on that Activity. Here, “booked” means holding a reservation or a waitlist place on any date of that Activity, or having attended one. It does not display your complete attendance history. Hiding your guest-list entry does not hide it from the Host or JNUP personnel who need it to administer the Activity.

Blocking is mutual and silent and hides guest-list entries from the two people involved. It does not prevent either person from reserving or attending the same Activity or meeting offline. It does not erase information already seen or captured.

Hosts can see the messages you send them. Private notes identified as being for JNUP are not shared with Hosts through the feedback interface. Where you are told that feedback may be published, it can appear on a Host page attributed to “a guest.” Context can sometimes identify a person even without a name. Reports may be disclosed in a limited way where necessary and lawful to address an incident or legal process; we do not promise absolute confidentiality.

6 Service providers and other disclosures

Our providers include:

We require providers processing information for us to use it for authorized purposes and provide protection consistent with this policy and applicable law. Some providers also process information for their own payment, security, authentication or legal purposes under their own notices.

Host writing assistance sends submitted text to an AI provider. Hosts should not submit unnecessary participant information. Before sending personal information to this feature, we provide the disclosure and obtain permission required by applicable law and platform requirements.

We may disclose necessary information to professional advisers; authorities where required or permitted by law; parties involved in preventing fraud or addressing serious safety concerns; or a prospective purchaser or successor in a legitimate business transaction, subject to appropriate safeguards and applicable law. We do not sell personal information or provide participant lists to Hosts for unrelated marketing.

7 Processing outside Canada

Our primary Supabase project is hosted in Montreal, Canada. Website processing and several providers process information in the United States or other countries. These include email, analytics, diagnostics, payments, push, sign-in and assisted-writing services. Database location does not mean every copy, request or processing activity remains in Canada.

Information processed abroad may be subject to access by courts, law enforcement or government authorities under those countries’ laws. Our Privacy Officer can explain our policies and practices concerning service providers outside Canada, including the countries and purposes of processing. Provider locations and subprocessors can change; we keep our provider records and required notices current.

8 Cookies and device permissions

The website uses authentication and session technologies, attribution technologies, analytics technologies and payment-provider technologies where applicable. The app uses local storage, service identifiers and notification tokens. These support sign-in, security, payments, measuring use and remembering preferences. Browser controls may block some technologies but can interfere with essential functions. We use PostHog for product analytics on the basis of this notice rather than a consent prompt. You can turn analytics off at any time with the Analytics switch under Privacy and safety, in the app and on the website. While it is off, we stop sending analytics events about you, from your device and from our servers.

On the website, a first-party cookie (jnup_vid) holds a random identifier for your browser and nothing else: no name, contact details or other personal information. It lasts 180 days. We use it only to show the email sign-up prompt no more than once, to count how many different people follow a link to an event’s own website, and to tell whether someone came back. We also use it to try two versions of that prompt and keep the one that works better, and to note whether a browser signed up, without the email address. We do not set it if your browser sends a Do Not Track or Global Privacy Control signal, or while Analytics is turned off.

If a feature requests access to notifications, a photo library or another device capability, the permission prompt explains the request. You can change permission in device settings. We do not collect precise device location merely because you enter a city or neighbourhood. Any future location-permission feature requires appropriate notice and permission before collection.

9 Retention and account deletion

We retain identifiable information only as long as reasonably needed for the stated purposes or required by law. We consider active reservations, accounting and tax requirements, disputes, safety incidents, statutory retention and legal holds. We delete or irreversibly anonymise information when those reasons no longer apply. Our retention schedule distinguishes account information, transaction records, messages, analytics, reports and backups.

You can initiate account deletion from the account or profile settings in the iOS app or website. You can also request assistance at privacy@jnup.co. Deletion closes your account and removes or anonymises identifying information that we no longer need. Payment, refund or other records may remain linked to a non-public reference where retention is necessary; we do not describe linkable records as anonymous. We restrict access and use of retained personal information to its retention purpose.

If you signed up for our event emails without an account, you can delete your email address from the link in any of those emails; deleting your account does the same for an account. We then delete your address, categories and hosts. We keep a one-way scrambled copy of the address so that it is never emailed again, and we keep the record of your consent, without your address, for three years after the last email we sent you, as proof of consent for the emails already sent. Then it is deleted.

Copies in backups are removed through the backup lifecycle and are not returned to ordinary use after deletion. Independent providers and recipients may retain information for their own lawful purposes. Account deletion does not itself create a different refund entitlement; we explain the effect on active reservations before you confirm deletion. We provide the applicable completion period when you request deletion and notify you of legally justified exceptions or delays.

10 Security and incidents

We use reasonable administrative, technical and physical safeguards appropriate to the information, including access restrictions and provider controls. No system can guarantee complete security. We assess suspected breaches and notify regulators and affected individuals as required by applicable law. Report a suspected privacy or security issue to privacy@jnup.co.

11 Access, correction and complaints

You may request access to your personal information and information about its use and disclosure, ask for correction, or raise a complaint with our Privacy Officer. We may verify identity proportionately and protect other people’s information. We respond within the time required by applicable law and explain lawful exceptions, extensions or refusals.

You may complain to the Office of the Information and Privacy Commissioner of Alberta, or the Office of the Privacy Commissioner of Canada where federal law applies. Other competent authorities may be available under the law applicable to you.

12 Adults and international privacy rights

Accounts are for people aged 18 or older who can legally use the service. We do not knowingly permit under-18 accounts. Contact us if you believe a child has provided information so we can assess and remove it, subject to lawful retention.

JNUP’s initial Activities are in Canada. Access from another country does not by itself establish that every law of that country applies. Where another privacy law applies to our processing, we honour its required rights, which may include erasure, restriction, portability, objection, withdrawal of consent and a complaint to a supervisory authority.

Where the GDPR or UK GDPR applies, JNUP is the controller for its platform processing. We rely, as appropriate, on contractual necessity for requested bookings and account functions, legal obligations for required records, legitimate interests for proportionate security and service administration after assessing your rights, and consent for processing that requires it. You can object to processing based on legitimate interests and request information about the assessment. Transfers subject to those laws use a legally available adequacy decision or appropriate safeguards, such as applicable standard contractual clauses, with supplementary measures where required. Information about applicable safeguards is available from our Privacy Officer. We obtain required consent for optional technologies. We do not use solely automated decisions producing legal or similarly significant effects without the safeguards required by applicable law.

13 Policy changes

We publish the current policy and effective date at jnup.co/privacy and make it accessible in the app. We give appropriate notice of material changes and seek new consent where required. A policy update does not authorize an incompatible new use of previously collected information without a lawful basis.