Privacy Policy

• Account & sign-in. Your email address. If you sign in with Google, Google provides your name, email address, profile photo, and Google account identifier; if you use an emailed sign-in link, we use your email address only. We do not receive or store your Google password.
• Your profile. The details you choose to add — name, photo, city and country/region, bio, social handles, skills/interests and other tags, dietary preferences, and (only if you turn on contact sharing) contact email, phone, and address.
• Community activity. Your membership, event RSVPs, the names of any guests you register for an event, volunteer sign-ups, relationships you confirm with other members, direct messages you send, member nominations, and members you block.
• Payouts (event hosts only). If you set up payouts to receive ticket revenue, you complete onboarding hosted by Stripe. Stripe collects your identity, bank, and tax details directly; we do not receive or store your bank account or full identity documents. We store a reference to your Stripe account and its payout-readiness status. Ticket buyers pay through Stripe; we never receive or store payment-card numbers.

We use strictly necessary cookies to keep you signed in and to secure your session. We also use privacy-friendly, aggregate analytics from our hosting provider (Vercel Web Analytics and Speed Insights) to understand overall usage and performance. We do not use these for advertising, and we do not sell your information.

• To provide the service: authenticate you, run your community, events, RSVPs, volunteering, and messaging.
• To show your profile and activity to other members of your community, according to your visibility settings.
• To send transactional email — sign-in links, invitations, and notifications — through our email provider (Resend).
• To enable event hosts to receive payouts through Stripe.
• To keep the community safe: enforce blocks, support moderation by community stewards, and prevent abuse.
• To maintain, secure, debug, and improve the platform, and to comply with legal obligations.

• With other members. Your profile and community activity are visible to other members of your community, subject to the visibility settings you control (for example, contact details are hidden unless you turn on sharing). Community stewards can access member information needed to moderate and administer the community.
• With service providers (processors) who operate the platform on our behalf: Supabase (authentication, database, and file storage), Vercel (hosting and aggregate analytics), Resend (email delivery), Stripe (payments and payouts), and Google (only if you choose Google sign-in). These providers may process your information only to provide their services to us.
• For legal and safety reasons — to comply with the law, enforce our terms, or protect the rights and safety of our members and the public.
• In a business transfer — if Umami is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We do not sell your personal information, and we do not share it for advertising.

We keep your information for as long as your account is active. If you are off-boarded from a community, your profile stops being shown to other members. You can ask us to delete your account and associated personal information by contacting us at the address below; some records may be retained where required for legal, security, tax, or payment-reconciliation purposes (payout records are also held by Stripe under its own terms).

We use reasonable technical and organizational safeguards to protect your information, and rely on the security programs of our providers (Supabase, Vercel, Stripe, Google, Resend). No method of storage or transmission is perfectly secure. Our providers process data in the United States and may process it in other countries where they operate.

You can view and update most of your information at any time from your profile, and control what other members can see through your visibility settings. Depending on where you live, you may have rights to access, correct, delete, or export your personal information, or to object to certain processing. To exercise any of these, contact us at the address below and we will respond as required by applicable law.

Umami accounts are for adults — you must be at least 18 to create one (see our Terms). The service is not directed to children, and we do not knowingly collect personal information from children under 13. A member may enter the name of a guest they bring to an event, including a minor; that information is provided and controlled by the member. If you believe a child has provided us information, contact us and we will delete it.

We may update this policy from time to time. When we do, we will revise the “Last updated” date above, and significant changes may be communicated in the app.

Questions or requests about this policy or your information: contact Threepenny Labs LLC at privacy@tastysf.org.