Privacy Policy

The short version

• We collect what's needed to run your groups: who you are, which groups you're in, what you've paid, and what you share with the group.
• We never see or store full card or bank account numbers — Stripe does. We keep only the brand, last four digits and expiry.
• We don't sell your personal information and don't show ads.
• You can download your data or delete your account yourself, any time.

What we collect

• Account: your name, email address, password (stored hashed by our authentication provider), optional phone number and photo, and — if you sign in with Apple or Google — the name and email they share with us.
• Membership: the groups you belong to, your roles, membership level, the contact details and emergency contact you or an organizer entered, and your privacy choices (who can see your contact details).
• Payments: charges assigned to you, what you paid and when, refunds, credits, receipts, autopay authorizations (including the exact consent wording and when you agreed), and saved payment methods (brand, last 4, expiry and Stripe's reference only).
• Group activity: messages and files you share in chat, reactions, announcements you read, event RSVPs and check-ins, form answers, poll votes, and reimbursement requests.
• Households: people you've linked as a responsible payer (for example a parent paying for a child), and their relationship to the member.
• Devices and usage: push-notification tokens for the MyClub app, device type and app version; server logs with IP addresses and browser/app information for security and troubleshooting; and a one-way (keyed) hash of your IP address stored with consent records and for rate limiting.
• Email delivery: whether emails we sent were delivered, bounced or marked as spam.

Organizers add information about their members (for example names and emails when inviting people). For that information, the group decides what is collected and why; MyClub processes it on the group's behalf.

How we use it

• To run the service: show you your groups, send the messages, reminders and receipts you and your groups rely on, and process payments.
• To keep people safe: detect fraud and abuse, verify identity for sensitive actions (two-step verification), and meet Stripe's and the card networks' requirements.
• To meet legal duties: keep financial records, respond to lawful requests, and handle disputes.
• To improve MyClub: understand, in aggregate, which features groups use.

You control optional notifications in Settings → Notifications. Receipts, payment confirmations and security alerts are always sent.

Who we share it with

Your group's organizers and members see what the group's settings allow (for example organizers see who has paid; members only see contact details you've chosen to share). We use these service providers, who process data only on our instructions:

• Supabase — database, sign-in and file storage.
• Stripe — payment processing, saved payment methods, payouts to groups, and identity verification of organizers who connect payouts.
• Resend — sending email.
• Expo (with Apple Push Notification service and Google Firebase Cloud Messaging) — app push notifications.
• Vercel — hosting of the website and API.
• Apple and Google — only if you choose to sign in with them.
• Cloudflare — domain name service.

We may disclose information when the law requires it, to protect people from harm, or as part of a merger or acquisition (you'd be told).

How long we keep it

See the Data Retention Policy. In short: your personal information is kept while your account exists; financial records are kept for 7 years, with your name removed if you delete your account.

Your choices and rights

• See and correct your details in your profile.
• Download a copy of your data (Settings → Account → Download my data).
• Delete your account (Settings → Account, or Profile → Privacy & account in the app).
• Turn off optional emails and notifications.
• Ask us anything, or make a request we don't offer in the app, at support@usemyclub.com. Depending on where you live (for example California or the EU/UK) you may have additional rights; we'll respond within the time the law requires.

Children

MyClub isn't directed at children under 13, and we don't knowingly let them create accounts. Organizers may list minors as members with a parent's or guardian's agreement. If you believe a child under 13 has given us information directly, contact us and we'll delete it.

Security

We encrypt data in transit, restrict access inside the database so people only see what their role allows, require two-step verification for sensitive money actions, and log administrative actions. No system is perfect; if a breach affects you, we'll tell you as the law requires.