Privacy Policy

When you register, we collect the information you provide directly:

• First and last name
• Username (3–20 characters, alphanumeric and underscores only)
• Email address
• Phone number
• Date of birth (used to verify minimum age)
• Password (stored as a secure hash — we never store it in plain text)

You may choose to provide additional information on your profile:

• Bio
• Profile picture and header image
• Address, city, state, and ZIP code
• Latitude and longitude (derived from your address or GPS)
• Location sharing preference (locationSharingEnabled flag)

Important: Disabling location sharing stops new location data from being sent to our servers, but does not automatically clear address or coordinate data that was previously stored on your account. To remove stored location data, please contact us at the address below or delete it directly in your profile settings.

Avryq requests foreground location permission to power core features:

• Discover feed — filter nearby posts and events within a 5, 10, or 15 mile radius you choose
• Event creation and display — pin events on the in-app map
• Distance calculations shown on event and membership cards
• Map search — finding places by name or reverse-geocoding a map pin

Precise GPS coordinates and associated addresses are stored on user, event, membership, and ad records to power location-based features. We only access your location while the app is open (foreground). Location is not tracked in the background. You can revoke location permission at any time in your device settings.

We request access to your camera and photo library so you can upload images to:

• Posts (up to 3 images per post)
• Events (cover images)
• Chat messages
• Your profile picture and header
• Membership profile pictures and headers

Uploaded media is stored securely on Cloudflare R2 object storage. We do not scan or analyze the content of your images beyond delivering them to the intended recipients.

Content you create and actions you take are stored to operate the platform:

• Posts, post media, tags, likes, and reposts
• Events — dates, location, cover media, attendees, and followers
• Memberships — business or group profile data, members, and roles
• Direct messages and chat photos
• Notifications and their read/delivery state

Draft posts and draft events are saved locally on your device using secure on-device storage and are not transmitted to our servers unless you publish them.

We record interactions to deliver and improve the service:

• Follows and followers
• Memberships joined
• Likes and reposts
• Event attendance and following
• Online status and last-active timestamp
• Ad impressions and clicks

If you create a Business, University, or Group membership you may provide:

• Membership name, description, and category
• Physical address and contact email or phone
• Hours of operation
• Custom branding and theme colors

• Internal user and membership IDs
• Authentication tokens and refresh-token hashes stored securely on-device
• A generated device identifier used to manage push notification registrations
• Expo push notification token and device platform (iOS / Android)
• Push-registration diagnostics — if a push token fails to register, we log the userId, app version, and device context to investigate the failure
• Calendar access — used only when you explicitly choose to add an event to your device calendar; no calendar data is sent to our servers

A Face ID / biometric permission string is declared in the app for potential future use; biometric authentication is not currently active in the app.

Public content you create — posts, events, comments, your profile, and public membership pages — is visible to other Avryq users. Private or hidden memberships limit visibility to approved members only.

Note on search: Authenticated search within the app can surface user email addresses and membership contact information (email and phone) to logged-in users. Only logged-in Avryq members can perform these searches.

We use trusted third-party services to operate Avryq. They receive only the data necessary to perform their specific function and process it on our behalf:

• Cloudflare R2 — stores uploaded media files
• MongoDB Atlas — hosts our database
• Expo — receives your push token and notification content to deliver push alerts to your device
• Resend — receives your email address and first name to send transactional emails (verification, password reset)
• Mapbox — receives typed place-search queries and GPS coordinates when you use the in-app map search to find locations

We may disclose information if required by law, court order, or to protect the rights, property, or safety of Avryq, our users, or the public.