Privacy Policy

Last updated 29 October 2026

CanIJoin helps people find and join local activities. This policy explains what we collect, why, who sees it, and the choices you have. We have tried to write it in plain language.

The short version

• We collect only what we need to run meetups safely: your account, a verified photo, your favorite activities, your location while you use the app, and what you do in the app.
• Other people in the app can see your name, verified photo and activity. They cannot see your email or your exact location.
• We do not sell your data, show ads, or track you across other apps and websites.
• Your live selfie is used once to check it matches your profile photo, and is not stored by us.
• You can delete your account and your data at any time, inside the app.

1. Who we are

CanIJoin is operated by Yinlok Lau ("we", "us"). You can reach us at hello@canijoin.app.

2. What we collect

• Account: your email address, a password (kept scrambled by our login provider, we never see it) or your Google or Apple account sign-in, your name, your date of birth, your gender and your nationality. Optionally, a short bio and your Instagram name.
• Photos: your profile photo, and a copy of it that we keep once it has been verified.
• Live selfie: taken during verification and used only for the face comparison described below.
• Favorite activities: the activities you pick.
• Location: your phone's location while you use the app, to show events near you. It is sent to our server to work out distances and is not saved. If you say no, you can pick a city instead. We then save that city's name and its map point, and the date you picked it (a picked city stays fixed for 30 days). When you create an event, the meeting point you choose is saved with the event.
• What you do in the app: events you host, join, wait for or leave, whether you showed up (decided by what the other guests say, never by the host alone), friendly tags other guests give you, friend requests and friends, group chat messages, direct messages, and any reports or blocks you make.
• Technical data: our service providers keep standard logs (such as IP address and app version) for security and to keep the service running.

We do not collect your contacts, advertising identifiers or analytics about how you use the app.

3. How we use it

• To run the app: show events near you, let you join and host, and let people chat.
• To keep people safe: verify photos, review reports, and remove people who break the community rules.
• To show your age and a fair record: how many events you have attended and whether people usually show up. Guests say who they saw at an event. Nobody can see how an individual guest answered, and tags only appear once three different people gave them.
• To meet legal obligations and protect our users, our service and our rights.

4. Face comparison (biometric data)

To confirm that your profile photo is really you, we ask for a live selfie and compare it with your profile photo using Amazon Rekognition, a face-matching service from Amazon Web Services. A face is sensitive personal data, so we only do this with your consent, which we ask for before the selfie is taken.

• The selfie is sent to Amazon for the comparison and is not stored by us. We keep only the result: whether it matched, and when.
• We do not build a face database. We keep a copy of your verified profile photo so it can be shown to other people.
• You can withdraw consent at any time by deleting your account. Without a verified photo you cannot join or host events.

5. Who can see what

• Everyone in the app can see: your name, verified photo, age, nationality (as a flag), bio and Instagram name if you added them, favorite activities, and achievements (badges earned from events attended and hosted, and from friendly tags other guests gave you). People you have been to events with also see how many you shared. Your friends list is private: only how many friends you have can show, as a badge.
• People in an event can see who is going, and the event's group chat shows your name, photo and messages to the others in it.
• Events you host, including the meeting point, are visible to people nearby.
• A direct message is visible to you and the person you wrote to.
• Nobody can see your email address, your date of birth, your gender, your exact location or the city you picked.
• Photos are stored in a file store that uses web links, so anyone who has the link to your verified photo can open it.
• You choose who sees the events you are going to (everyone, friends only, or only you) and whether anyone can start a conversation with you or only people you know. You can change both under Settings, Privacy controls.
• "My month" is a picture you create and share yourself. It is made on your phone and is not stored by us.

6. Who we share data with

We use a small number of service providers to run CanIJoin. They handle data only on our behalf, and for the reasons below.

• Supabase: our database, login, file storage and server functions.
• Amazon Web Services (Rekognition): the face comparison in section 4.
• Google (Sign-in, Maps and Places): signing in with your Google account, the map, and place and city search. If you continue with Google we receive your name and email address from your Google account, and nothing else. What you type when searching for a place or city, and the part of the map you look at, are sent to Google, whose own privacy policy applies.
• Apple (Sign in with Apple): if you continue with Apple we receive your name and an email address, which can be a private relay address if you choose to hide your email. Apple's own privacy policy applies.

We may share information if the law requires it, or to protect someone's safety. We do not sell personal data and we do not share it with advertisers or data brokers.

7. How long we keep it

• Your account data: until you delete your account.
• Group chats: they disappear from the app 14 days after an event (7 days if it was cancelled). We then keep the messages for 7 more days in case someone reports one, and delete them after that.
• Direct messages: until you delete your account. If you tap Delete conversation it is hidden for you, but the other person keeps their copy.
• Reports and bans: kept as long as needed to keep the community safe, even after the people involved delete their accounts. They hold only the minimum needed.
• Backups: copies in routine backups are overwritten on our provider's normal schedule.

8. Deleting your account

Go to Profile, then Delete account. This erases your name, photos, saved city, favorite activities, direct messages and the messages you wrote in event chats. Events you host that have not started are cancelled, you are removed from events you were going to, and your login is deleted. Past events stay for the other guests, shown as hosted by "Deleted user".

9. Your rights

Depending on where you live (including under Thailand's Personal Data Protection Act, and the GDPR in the EU and UK), you can ask us to:

• show you the data we hold about you, and give you a copy;
• correct data that is wrong (you can change your name and photo in the app);
• delete your data (you can do this yourself in the app);
• limit or stop how we use your data, or withdraw a consent you gave.

Email us at hello@canijoin.app and we will reply within 30 days. If you are unhappy with our answer you can complain to Thailand's Personal Data Protection Committee or to the data protection authority where you live.

10. Why we are allowed to use your data

• To provide the app you signed up for (a contract with you).
• Your consent, for the face comparison and for using your location.
• Our legitimate interest in keeping people safe and preventing fake accounts and abuse.
• Legal obligations.

11. Where data is processed

Our providers may process data on servers outside your country, including outside Thailand and the EU. We choose providers that protect data to a high standard.

12. Age

CanIJoin is for people aged 18 and over. We ask for your date of birth when you sign up to check this, and we do not let anyone younger in. We do not knowingly collect data from anyone younger, and will delete it if we find out we have.

13. Security

Data is encrypted in transit, and access is limited by account and by role. No online service can promise perfect security, so please use a strong password.

14. Changes

If we change this policy in a way that matters, we will tell you in the app before it takes effect. The date at the top shows when it was last updated.

15. Contact

Questions about your privacy: hello@canijoin.app.