This explains what BuddyUp collects, why, and who can see it. We wrote it to match how the app actually works.
What we collect
- From sign-in: your email address (and your first name from Google, if you use Google).
- From your profile: display name, birth date, new-in-town or local, home country, university, languages, interests, bio, home district, gender (optional) and profile photo (optional).
- From using the app: plans you host, join, ask to join or save; people you block; reports you send.
- From planning and chatting: saved outing drafts, templates, group membership, messages, shared photos, message reactions, shared polls, hangout cards, retained shared revisions, your own votes and manual arrival updates.
- From friendship tools: requests/connections, private dates you record, shared-date proposals/confirmations and your optional in-app catch-up reminder settings.
- From bill tools: selected financial participants, expense versions/allocations, disputes/correction agreements, sent-payment claims, recipient-confirmed receipts, shared bill references and balance-pin preferences. We do not receive bank credentials or move money.
- Only when you turn Nearby on: your chosen approximate-area size, sharing expiry and one current coarse location. We overwrite that coarse position rather than keeping a location history. The browser coarsens its position before sending it.
- Technical data: session cookies to keep you signed in, and the IP address and browser of your sessions.
Nearby is your choice
Sharing starts off. Turning it on defaults to a 500-metre approximate area for one hour; you can choose 100 metres, 500 metres or one kilometre and a 15-minute, one-hour or three-hour session. You need to share to browse other people who are sharing.
Stop removes your visible presence and ends Nearby browsing. Sharing pauses when this app goes into the background or you leave it, and reopening requires Resume. If the stop request cannot reach us, the server excludes a position after two minutes without an update or at your chosen expiry, whichever happens first. Expired/stale stored coarse positions are removed by scheduled cleanup.
Approximate areas may still be recognizable. Location comes from the device and does not prove identity or attendance. Nearby does not enable background tracking; event check-in, if introduced, requires its own action.
Nearby heads-ups need a separate opt-in and do not turn on location. They are quiet from 10pm to 8am Hong Kong time. Minimal member/session references and creation time expire after one hour and are removed by scheduled cleanup; no position is copied into an alert. Stopped, expired, stale or blocked people are excluded when alerts are read. Turning alerts off clears your alert records.
Optional GIFs and stickers
When you use the GIF and sticker picker, your browser contacts KLIPY directly. KLIPY receives your explicit search words, a stable pseudonymous identifier, recently sent-item requests and send confirmations, along with the network information needed to deliver its service. We do not send your conversation text, email address, group name or location to KLIPY.
BuddyUp stores the selected public item identifier and type with your message. KLIPY supplies the images directly and can remove them later. These public images are not private uploads and cannot be recalled from the provider or from saved copies. First-message requests stay text-only; GIFs and stickers unlock after the recipient replies. KLIPY ads are disabled. See KLIPY’s privacy policy.
Shared group polls
Current group members can create and edit a poll. The latest 20 versions show who changed the question, choices or closed state. A changed question or choice does not turn an earlier vote into consent to its new wording; the voter can choose again. Closing prevents new choices, while members can still withdraw their own vote.
Visible votes and a bounded list of voter names follow your block settings. Your earlier choice can remain marked as needing an update until you replace or clear it. Leaving stops new group access and actions; your earlier vote remains part of the poll history. Export includes your retained authored revisions and own choice snapshots, without restoring access to later group changes. Deleting your account removes your votes; shared poll content and retained revisions can remain with author references cleared.
Shared hangout cards
Current group members can edit a shared meeting point, map link, itinerary, next stop and manual checklist. Responsibility names are editable group notes, not proof that someone accepted an assignment or made a booking. Only drafts already shared with the same group can be newly linked. Card edits do not change the linked draft, published event, attendance or bills; a linked draft keeps its own access rules.
“I'm here” is your own explicit, timestamped declaration. It does not request GPS or enable Nearby. Changing the meeting place, time or map marks earlier declarations as stale and asks their owners to update them. Only current accepted members' declarations for the current meeting appear publicly, with blocked members filtered and up to five names shown. You can clear your own declaration. Leaving removes current group access and public arrival display; export can include your own retained declaration and authored revisions. Account deletion removes your arrival row, while shared card history can remain with author references cleared. The latest 20 shared versions are kept.
Shared photo recaps
Accepted event members can view and curate the event recap, including members who did not check in. Private-group recaps are for current group members. A friendship can surface a recap you can both already access; it does not grant access to another group.
Removing a photo from a recap leaves the chat message intact and keeps the photo excluded until someone explicitly restores it. The uploader, current event host or a current private-group admin can edit its caption. Leaving or removal ends new gallery access. Already downloaded copies cannot be recalled.
Automatic collection starts off. The host or a group admin can enable a named recap and time window for newly posted photos in that same chat. It does not sweep earlier messages or copy media into a different group. Senders can skip automatic collection for a message; current members can still add the photo manually. Uncertain screenshots stay included and removable. No AI image classifier is used.
Recaps reuse the private photo file rather than store another original. Curation actor/action/version pointers expire after 90 days. Excluded references remain to prevent automatic reappearance while their gallery and source exist. Deleting your account removes your uploaded photos from recaps and queues their storage deletion; another member’s shared gallery can remain with its creator reference cleared.
Why
- To run the app: show plans, let you join, and show hosts who wants to come.
- Birth date: to make sure everyone is 18 or older. Gender: only for women-only plans in the future.
- Interests and home district: to suggest plans for you.
- Reports and blocks: to keep people safe.
We don’t sell your data or show you ads.
Who can see what
| What | Who can see it |
|---|---|
| Your email, birth date, age and gender | Not shown to other members. |
| Your profile (name, photo, country, university, languages, interests, bio) | Signed-in members, unless one of you blocked the other. There is no public member directory. Nearby shows only people currently sharing with each other. |
| Who is going to an upcoming plan | Signed-in members who can see the plan. |
| Who went to a plan that has ended | Only the people who went and the host. |
| Your request to join, a decline, or that you left | You and the host. |
| Plans you saved, people you blocked | Only you. |
| Private outing drafts | You and any group you explicitly share the draft with. Publishing an event alone does not share its planning notes or itinerary. |
| Reusable templates | Personal templates: you. Team templates: eligible signed-in members. Template review shows the reusable fields before saving. |
| Chat messages, shared media and reactions | Currently accepted conversation members, subject to blocks. Accepted private-group newcomers can see the earlier history. |
| Nearby presence | Other eligible members with fresh active sharing. Only an approximate-area match and permitted profile details are shown; no exact coordinate or distance is returned. |
| Private hangout dates and catch-up reminders | Only their author. Logging a private date does not notify the other person or change their history. |
| Shared hangout dates | The two connected people, subject to blocks. A proposed date or correction affects confirmed shared history only after the other person confirms it. |
| Optional Nearby heads-ups | Only you, inside the app while sharing. They show no exact pin or lock-screen identity and send no email or background push. |
| Group bills | Current financial participants see recorded group balances. Expense versions, allocations and disputes are visible to that expense’s participants and poster. Joining a chat alone grants no financial history. |
| Repayment claims and notes | Only the sender and intended recipient. Leaving a group preserves your own financial evidence and repayment actions, without restoring chat or media access. |
| Premium access and usage | Your access period and own request status are private to you and service operations. Joining a group or following a checkout link grants no subscription. |
| AI outing previews | Only their requester, with current access to the source outing. A preview expires after 24 hours. Saving or sharing it is a separate choice. |
| Reports | Only our team. |
| People who aren’t signed in | Only a plan’s title, cover photo, time, district, host name and how many are going, when they have its link. |
Where it’s stored
On Cloudflare (database, photo storage and hosting). Data may be processed outside Hong Kong. Our team can access the database to run the service and review reports.
When you report a message, recap photo or taxi group, the selected content, its visible reaction summary and photos or pickup/fare notes are shared with our moderation team. This does not give moderators access to the rest of a private conversation. Reporting does not notify the other member or show them who reported it.
Reported photos remain linked to their originals. Closing the case or removing the original stops further photo access through the report. Text evidence can remain for review; closed reports are removed after 90 days.
Optional service allowances
Premium access and usage controls record the access period, feature, operation identifier, request fingerprint, status and timestamps. The allowance ledger contains no plan text, chat, receipt image or capsule content. Failed work releases its feature allowance, while incurred or uncertain provider cost remains in operational accounting.
Your export includes your own access and request-status metadata. Account deletion removes the access period and clears the member reference and request fingerprint from retained cost records. Bounded scheduled cleanup removes terminal usage records older than 90 days. These controls do not charge a card or move money.
When you ask for AI planning help
When this optional service is available, requesting a draft sends your brief and chosen planning details to a Cloudflare-hosted AI model. A revision sends the current outing you can access and your change request. We remove account and outing identifiers; we do not include unrelated chats, Nearby location or capsules. Avoid adding private information about other people to a brief.
We disable prompt logging and shared caching for these requests. To finish a request if your connection drops, we keep its selected brief, a snapshot of the outing you chose to revise, and intermediate checks privately for 24 hours from the request. The preview has the same expiry. Scheduled cleanup removes this content. Your export includes your unexpired planning requests, checks and successful previews while you still have access to their source outing. Deleting your account or the source outing removes this private planning content.
Saving a preview keeps it as an ordinary editable outing with the audience you review. AI does not publish, book, pay or contact anyone. Live venue search is not connected; check suggested places, costs, opening hours, transport and access yourself.
Your financial record
Shared bill cards link to the actual financial record. Only that bill's authorized poster or participants see its description, amounts and own allocations in chat; other group members see a generic shared-bill notice. A selected-message report can include only the financial details its reporter can already see, without copying full ledger history or private repayment notes.
A group can pin its balance view, but every member sees only their own authorized balance. The pin stores placement and edit attribution, not a separate balance. Joining a chat does not enroll someone in old bills. Expenses affect recorded balances immediately, and sent-payment claims change them only after the intended recipient confirms receipt.
Bill postings and receipt confirmations form a shared record. Deleting an account removes its member reference from financial parties; necessary expense, dispute and repayment evidence remains available to the remaining authorized participants. It does not cancel an unsettled recorded balance. Blocks hide identity links without erasing financial evidence.
New expenses require current group membership and explicitly selected people. Former participants can view their own past expenses, dispute their own share and complete repayments. They receive no unrelated new bills, chat messages or private payment notes.
Deleting your account
Me → Delete account revokes sessions and removes your profile, saves, blocks, memberships, Nearby state, owned outing drafts and personal templates, and cancels the events you host. Private media is queued for deletion. Shared text and necessary report evidence can remain with your account reference removed. Published team templates remain reusable with their creator reference cleared. Copies other people already saved or downloaded cannot be recalled.
Your rights
Under Hong Kong’s Personal Data (Privacy) Ordinance you can ask for a copy of your data or ask us to correct it. Contact: [contact email to be added].