Privacy Policy

SanSpace is operated by Digital Apps LLC, a limited liability company organised in Washington. Digital Apps LLC is the business responsible for the information described here. Two people run it, and both of them can see everything in this policy.

There is no data protection officer, because there are two of us. Write to support@sanspaceapp.com and one of the two answers.

When you take the quiz

• Your first name. Not your last name — we stopped asking on 12 August 2026 and nothing in the product records one any more. If you signed up before that and gave one, it is still on your record and you can have it removed with a line to support@sanspaceapp.com.
• Your email address.
• Your mobile phone number. We require a mobile number for event operations and verify it by a six-digit text code during signup. Event SMS is a separate, optional choice. We record the number you consented to, when you agreed, the disclosure shown to you, and any withdrawal. Section 5 explains how to change your choice.
• Which five-year age range you are in — 40 to 44, 45 to 49, 50 to 54, 55 to 59, or 60 and over. Not your date of birth. Section 3 explains why, and why the range cannot be changed afterwards.
• Your gender, if you tell us. You can decline, and declining does not stop you booking a mixed group.
• Your political conversation preference and political affiliation, if you give them.You can choose not to discuss politics and you can choose not to state an affiliation. We keep these answers on your member record, do not show them to other members, and do not use them to decide eligibility, price, coverage or an automated match.
• Your postal code, so we can seat you near where you actually are.
• Your preferences: what sort of thing you would turn up to, a few interests, and a sentence about yourself if you write one.
• Your profile picture, if you add one. It is stored privately and is not shown before an event. After you and another member have both attended the same approved group, it may appear only in your 1-1 chat and private Meet Again connection page. You can replace or remove it from Profile at any time.

When you ask us to tell you when we open near you

SanSpace runs in part of the Seattle metro. If you put in a postal code we do not cover yet, we offer to let you know when we do — and if you take that offer, we keep two things: the email address and the ZIP code you typed, and nothing else.

• You do not have to be a member, and most people who do this are not. There is no account, no password and no way to sign in. It is a row with an email address, a ZIP, and the date you asked.
• We use it for exactly one message — that we have opened near you — and we send nothing else to it. No newsletter, no reminders, no marketing. Today we have sent none at all, because we have not opened anywhere new.
• It also tells us which city to open next, counted as ZIP codes rather than as people.
• Ask and we delete it, with no membership to prove and no account to close. Use the form in section 13 or write to support@sanspaceapp.com — a request by email is looked up in this list as well as in the member records.

When you book and pay

• Which meetup you booked, what you paid, and whether it was refunded. Amounts, not card numbers.
• Apple handles purchases inside the iOS app, Google Play handles purchases inside the Android app, and Stripe handles website payments. We never see or store your card number. We keep the provider’s transaction reference, the purchased product, your booking or credit entitlement, and purchase and refund status so we can apply the purchase and reconcile a refund.
• A password, if you set one on the screen straight after paying. It is hashed by Supabase and we never hold or see the password itself — section 15 says what that means and what it does not.

Around the meetup

• Whether you came, cancelled, or did not come.
• Everything you write in your group’s chat, and the time you wrote it. Section 10 is about that in full, because it is the one place on SanSpace where what we hold about you is something you said to another person rather than a fact about you.
• The short feedback you send the next morning, including anything you write in your own words.
• Impressions, if you use them. After a meetup you attended, you can pick one word or phrase from a fixed list — “Welcoming”, “Easy to talk to”, “Thoughtful”, “Good listener” and “Made the group fun” — for each person from your group who was also recorded as attending. There is no free text. We keep the one you chose for each person; the ones other people chose for you, with each giver’s first name as it was when they chose; and whether you opened, skipped or saved that step. If you clear a choice, we keep a record that there was one, with no word in it, and we note which Impressions for you you have already seen so we can mark new ones. Section 9 says who sees them.
• If you block someone, report someone and ask to be kept apart, or ask us not to group you with someone again, we record it and it is enforced: neither the software that proposes groups nor a founder assigning seats can put the two of you in a group together. A block, or a report in the app that keeps you apart, takes effect straight away; a request by email or in feedback takes effect once a founder has recorded it. Section 10 says what happens to an upcoming group you already share.
• If you or somebody else reports an incident, we keep the report. The code of conduct says who reads it, how fast, and what happens to it afterwards.

Automatically, just from visiting

Our host, Vercel, records ordinary server logs — the page requested, a timestamp, a browser string, an IP address — and keeps them for a short period. That happens on every website; it is how a server works, not a decision we made about you.

What we deliberately do not collect

We used to ask about dietary requirements, and we have stopped. The question existed to be passed to a restaurant. We no longer book anywhere and nobody from SanSpace comes along, so there was nobody to pass it to — and nothing in our systems ever read it. We removed the question on 13 August 2026. Anything already recorded is shown only to the two of us and goes to nobody outside this company; we are deleting it. Until then, if you would rather we did not have yours, write to support@sanspaceapp.com and we will remove it from your record.

SanSpace sells one promise: everyone in your group is 40 or over. The first question in the signup is which five-year range you are in, and that answer is how we keep the promise. We use it to check you are eligible, and then a person uses it when building a group, so a group of 41-year-olds and a group of 60-year-olds are not the same group.

Once you have signed up, your age range cannot be changed — not by you on the site, and not by us on request. That is enforced in the database, not by a rule somebody remembers. An answer that can be edited afterwards is not a promise, it is a preference, and the whole product rests on it being a promise.

If you picked the wrong one, write to support@sanspaceapp.com. A person will look at it. Correcting a genuine mis-tap is something we can do; quietly moving somebody across the 40 line is not.

We do not ask for a driving licence or a passport and we do not check your age against any document or database. What we have is what you told us, held to honestly.

• To propose and approve groups. Software proposes candidate partitions using age band, location, preferences, prior event history and exclusion rules. Your politics conversation preference and political affiliation are not part of that proposal. A founder reviews the reasons and approves every final group; the system does not make the final matching decision.
• To apply purchases and reconcile refunds. Through Apple in the iOS app, Google Play in the Android app, and Stripe on the website.
• To email you about your booking. Four messages, and no others: the confirmation and calendar invite when you pay; a notice at the cancellation credit cutoff, 24 hours before the meetup starts, carrying the exact date and time; one email a few hours before you meet carrying the meeting point and which group you are in, together rather than as two separate messages; and one note the next morning asking how it went.
• To make the next meetup better. Feedback tells us which meeting points are too loud or too hard to park at, which times of day work, and which groups did.
• To show you Impressions people chose for you, and to show the ones you choose to the people you chose them for. They are never totalled for a person, ranked, or used to decide who you are grouped with, and having few or none never counts against anybody. A founder reads the ones between two people only when handling a report that involves them (section 10), a request from one of them under section 13, or when the law requires it (section 14). What we do count, per meetup and inside our own database, is how many people opened, skipped or saved the step and how many of them booked again afterwards — numbers with no names or words attached.
• To keep meetups safe. Reports, notes and blocks are read by a person before a group is finalised.
• To answer you when you write to support.
• To count how the website is doing, in the limited way described in section 7.

That is the list. We do not use your information to build a profile of you, to score you, or to train anything.

Booking email and calendar invitations continue whether or not you choose text messages. Providing a phone number does not subscribe you to event texts. The SMS checkbox at signup and in Notifications is optional and unchecked unless you have already opted in for that number. You can book without it.

Signup requires verifying your mobile number. When you choose Send verification code, we send a one-time text through Twilio. Verification codes expire after 10 minutes; verifying your number does not opt you into event reminders. Message and data rates may apply. We keep keyed verification and send-limit records for up to 48 hours, then remove them when the next code request succeeds. These records contain no plaintext code or phone number.

If you opt in, SanSpace may send automated booking confirmations, meeting points, event reminders and cancellations through Twilio. Message frequency varies with your bookings. Message and data rates may apply. Reply STOP to opt out or HELP for help. You may also turn texts off in Notifications or contact support@sanspaceapp.com. Consent is not a condition of purchase. See the Terms of Service.

We retain the number you consented to, the date and time, the disclosure you saw, and withdrawals so we can respect and demonstrate your choice. Changing your mobile number stops SMS eligibility without erasing that history; you must explicitly opt in for the new number. We do not treat older consent without a recorded number as permission to text. If you previously replied STOP, reply START to our number after opting back in to restore carrier delivery.

We do not sell mobile numbers or share them for third-party marketing or promotional purposes. SMS opt-in data and consent are not shared with third parties for their marketing or promotional use. Messaging service providers, including Twilio and mobile carriers, process the number, message content and delivery or opt-out information only as needed to operate the messaging service.

You can update your mobile number in Your details and turn event texts off in Notifications. Text messages are not an emergency service, and delivery is not guaranteed. Check your booking page for event details; in an emergency call 911.

Signing in also uses Supabase authentication session cookies. The member web app uses those cookies to keep you signed in; the mobile app stores its refresh session in the device credential store. These are strictly necessary for account security. Our service providers may set their own cookies or similar technologies, including Meta when ads are enabled, as described below. Browser Do Not Track (DNT) signals do not change our strictly necessary processing; we do not sell personal information. We honor a California Global Privacy Control (GPC) signal as a request to opt out of sale or sharing, and because we do not sell or share for cross-context behavioral advertising, there is no additional opt-out action required.

We do not show a cookie banner. That is a deliberate decision, not an oversight, and here is the reasoning so you can judge it yourself. The one cookie we set ourselves is strictly functional — it does the thing you asked for by finishing the quiz — and functional cookies do not require prior consent under the law that applies to us. We serve one metro, in Washington State. If we begin advertising into a place that requires consent before any non-essential cookie is set, we will put a banner up before we run the first ad there, not after.

What that means honestly: if you are reading this from the EU or the UK, our ads are not aimed at you, and this page is not claiming to meet a consent standard we have not built.

You can delete our cookie any time in your browser settings. Nothing breaks — the site simply stops recognising you and the quiz starts fresh.

Counting visits, without a cookie

When PostHog is enabled, we count page views and signup steps without setting an analytics cookie or creating a person profile. Anonymous visits use a visit ID. After sign-in, server-side events can use a stable internal member ID, so those events can be linked across visits. PostHog does not receive your name, email, phone number, age range or anything you typed in a free-text box — those are stripped before anything is sent.

The Impressions step after a meetup is not counted in PostHog. The only counts of it are kept inside SanSpace’s own database, as section 4 describes.

The Meta pixel, when we are running ads

Most people find SanSpace through a Facebook or Instagram ad, and we have to be able to tell which ads bring people who actually book. When our advertising is switched on, our marketing pages and the signup and booking pages load Meta’s pixel. Meta’s pixel sets its own cookies in your browser — typically _fbp, and _fbc if you arrived by clicking one of our ads — and tells Meta that a browser reached that page. That is advertising technology and we are not going to describe it as anything else.

These limits are enforced in the code:

• It never runs on this page, or on any legal page. Reading a privacy policy should not be tracked by the thing the policy describes.
• It never runs anywhere in your account — your meetups, the people you have met, your settings — or in the founders’ admin tools. Those pages are about you specifically.
• It does not load inside the SanSpace iOS app. Apple in-app purchases do not send a Meta Conversions API purchase event either.
• Meta’s automatic advanced matching is turned off. Left on, it reads the form fields on the page and sends Meta whatever looks like an email address or a phone number. Our signup form has both on it. We switched it off so that cannot happen.

When Meta’s Conversions API is enabled, a paid booking triggers a server-side purchase event. It includes the amount, a hashed booking reference and a hashed internal member ID. The member ID can help Meta connect that purchase to its advertising data; we do not send your plain name, email or phone number in that event.

To limit this generally, browser settings and tracker blockers work on us as they do on any site, and Meta’s own ad preferences control what Meta does with what it collects. Blocking any of it has no effect on your booking.

These are the companies that touch your information because they run part of SanSpace. Each one gets only what its job needs.

• Stripe — takes website payments and issues refunds. Stripe gets your email and the amount; Stripe, not us, handles the card.
• Apple and Google Play — handle purchases in their respective apps. We receive transaction information to verify and apply the matching attempt or credits, and purchase-status updates to reconcile refunds. Apple also verifies Sign in with Apple and provides the account identifier and email it shares, which may be a private relay address, and a first name if supplied.
• Apple’s push notification service — delivers iOS reveal alerts and Live Activity updates. We store the app’s notification and Live Activity tokens linked to your member account so we can deliver the right update. Notification alerts require your iOS permission. The Home Screen widget and Live Activity can display your booked meetup theme and start time.
• Supabase — the database your record sits in, and where your group’s chat is stored. They host it; they are not reading it.
• Vercel — runs the website and keeps ordinary server logs.
• Resend — sends our email, so it handles your email address and the contents of what we send you.
• Twilio and mobile carriers — deliver requested signup verification codes and event texts if you opt in, processing the recipient number, message content and delivery or opt-out information for that service. They do not receive your details from us for their own marketing.
• Forward Email — forwards mail sent to our support address to the two founders, so it handles your email address and the contents of what you send us.
• OpenAI — may draft answers to ordinary in-app support questions. We remove recognizable email addresses, phone numbers and card-number patterns before a question is sent, and we ask OpenAI not to store the response. Safety, legal, privacy and payment disputes go to a founder instead.
• PostHog — the visit counting in section 7. We strip names, contact details and free text; server-side events can still include your internal member ID.
• Meta — the advertising pixel in section 7, when ads are running.
• Nobody at the meeting point. This used to read “the café, or whoever else we book with — gets a first name and a head count”. We do not book anywhere any more: we choose a public place, tell your group to meet there, and that is the end of our involvement. No café, park or anybody else is told your name, that a group is coming, or that SanSpace exists.
• A lawyer, an accountant, or the authorities — if the law requires it, or to deal with a serious safety matter. We will tell you if that happens to your information unless we are not allowed to. Section 14 says what a legal request means now that we hold messages.

If SanSpace is ever sold or merged, your information would move with the business. We would email you before that happened.

A few hours before you meet, everyone booked into your group sees the same small card about each other person: first name, decade of age, the neighbourhood you gave, and the sentence you wrote about yourself. That is about six hours ahead — or by eight the previous evening, if you are meeting early enough that six hours would put it in the middle of the night.

They do not see your email address, your phone number, your postal code, the feedback you send us, or anything you have reported to us — nor a last name or a date of birth, which we no longer hold for anybody who joined after 12 August 2026 and never show for anybody who did. Nobody outside the people you have already attended with can look you up. A prior attendee may see a limited connection page for you — your first name, the sentence you wrote about yourself, a few of your preferences and, if you added one, your profile picture — if you have enabled 1-1 chat.

The one exception is an Impression you choose for someone. Of the members, only that person sees it, with your first name as it was when you chose, and only once they have saved or skipped their own Impressions for that meetup. Nobody else in the group sees it, nobody sees how many anyone else received, and it does not appear on a connection page. You are not told whether they have seen it, and nobody is emailed, texted or sent a push notification about one; inside the app, new ones are simply marked New. Because it carries your name, the person can also tell who in the group did not choose one for them. A block, or a report that keeps you apart, hides it — section 10 says how.

Group chat opens when the meeting point is revealed. After you both attend, either person may start a private conversation if the person being contacted has enabled 1-1 chat. Nobody can search the wider membership or reach someone they did not attend with. Your next still-bookable event may appear on that private connection page so an eligible prior attendee can book the same event. That never reveals your meeting point, roster or group, and it never promises that somebody who books will be placed with you. Section 10 is about messaging in full.

Whatever you write in that sentence about yourself is the one thing your group will read. Write it accordingly.

What the chat is

Each group gets one chat, shared by the people booked into that group and nobody else — the members assigned to it. It opens when the meeting point is revealed. It is text only — no photographs, no files, no attachments — and a link someone types is shown as plain text rather than something you can tap.

Profile pictures are separate from chat: they are never attached to a message or shown in a group chat. They are visible only after recorded shared attendance, in the private 1-1 and Meet Again surfaces described above.

Group chat remains open until you leave it. No chat notifications are sent today; your mute choice will silence them if they are introduced. A 1-1 thread exists only between two prior attendees. The person receiving a message must have 1-1 chat enabled; turning their setting off stops new messages to them while leaving the thread readable.

What we store

• The words of every message, who wrote it, which group it was, and the time.
• You can take one of your own messages back at any time — there is no time limit. The group stops seeing it and sees a removed message in its place. We still hold what it said, in a place only the two of us can read. A message that caused a report at nine in the evening has to still exist when a founder reads that report the next morning, and somebody who has just frightened another member must not be able to erase the evidence by tapping twice. That copy is held for as long as we hold the rest of the conversation, and it is destroyed if you delete your account.
• If you block someone in your group, we store that you did, permanently. Nothing tells them, and they never see your name attached to it — but it works in both directions, so their side of that conversation goes quiet too and they will notice. It is not a silent step and we would rather you knew that before you took it. You will never be grouped with that person again — and if the two of you are already booked into the same upcoming group, they are taken off it there and then and one of us finds them another seat. They are not told why. Your own seat does not move.
• If you report a message, we store the report and which message it was, and it is read by a founder. The person you reported is not told who reported them.
• After a meetup, you can also report or block a person from your group list or from Impressions. A block there works exactly as above. A report there is read by a founder and keeps the two of you out of the same group in future; if you already share an upcoming group, one of us sorts it out before it starts.
• Once either of you has blocked the other, a report keeps you apart, or we have recorded a request to keep you apart, Impressions between you are hidden in both directions — the ones you chose for them and the ones they chose for you. They may notice. We keep those records rather than deleting them, because they can matter when we handle a report; section 12 says for how long.

Messages are screened automatically, and delivered anyway

A message containing a web address, a payment-app handle or something shaped like a crypto wallet is marked for a founder to look at. It is still delivered — we do not block or silently alter what you write. The mark exists because the most common way somebody is defrauded after meeting a stranger starts with exactly that sort of message.

Nothing else reads your chat. No advertising system, no analytics tool, and nothing that trains a model. It is not used to decide who you are grouped with.

If you delete your account

This is the one place where deleting everything about you and leaving five other people’s conversation intact pull in opposite directions, and you should know how we resolved it.

Your messages are replaced, not removed. Where your words were, the people in that group see a message from a member who has left, and your name comes off it. The words are destroyed, including the copies of anything you had unsent. What survives is the shape of the conversation, so the other members are not left reading half a discussion with their own replies pointing at nothing.

One exception, and we would rather say it than let you find it. If a message of yours was reported, a copy of that message is inside the report, and reports are kept — section 12 says for how long and why. So “nothing survives” is true of your group’s chat and not quite true of everything: a message somebody reported outlives your account.

If that is not good enough for you, say so at support@sanspaceapp.com and a person will talk to you about it rather than pointing at this paragraph.

• We do not sell your personal information, and we do not share it for anyone else’s advertising. Under Washington and California law you have a right to opt out of sale — there is nothing to opt out of, because there is no sale.
• We do not publish member lists, and there is no directory, feed, public profile, rating, count of Impressions or leaderboard anywhere in SanSpace.
• We do not use your information for anything romantic. SanSpace is a service for making friends. Nobody is being matched on that basis, ever.
• We do not read your group’s chat for entertainment or for research. A founder opens one when something has been reported or something is wrong, and every time one of us does, it is written down.
• We do not send marketing email to people who did not ask for it, and every non-essential email we do send has an unsubscribe link that works.

• Your member record — for as long as you are a member, and up to two years after your last meetup, so that if you come back we still know you and can avoid re-grouping you with somebody you asked to avoid.
• Your group’s chat — the same: while you are a member, and up to two years after your last meetup. It is the one thing here we keep for longer than we need to, and the reason is that it is a conversation within one small group rather than a record about one, so we cannot expire your half of it without taking pieces out of theirs. Anything a report or a court has attached itself to is kept until that is finished, which can be longer.
• Payment records — seven years. That one is not our choice; tax law requires it, and it survives a deletion request. It is the amount, the date and the Stripe reference, not your card.
• Incident reports — three years, or longer if the matter is unresolved or has become a legal one. A report is kept even if the person who filed it, or the person it is about, deletes their account, because deleting a record of harm on request is how the same thing happens to somebody else. Where the report is about a chat message, the report contains a copy of that message, and it is kept with the report.
• Impressions — the same as your member record: up to two years after your last meetup. Where one of the two people has blocked the other, we have recorded a request to keep them apart, or one of them has used Report on the other in a chat, on the group list or in Impressions, the Impressions between them are kept as incident reports are: three years, or longer if the matter is unresolved, and even if one of them deletes their account. A report made any other way — the form on our website, Support in the app, or email — counts once we have recorded a request to keep the two of them apart. Both limits are applied by us by hand; nothing deletes Impressions on a schedule.
• Operational records — RSVP responses, notification delivery records, transfer offers, regrouping and audit events, blocks, direct-chat consent, and privacy requests are kept only as long as needed to operate the event, investigate a report, demonstrate consent, or complete a legal obligation. Safety evidence and a privacy request may be retained longer when necessary for those purposes. The access inventory includes member, booking, event, chat, coverage, SMS-consent, incident, support and provider records.
• “Tell me when you open near me” — the email address and ZIP from section 2, for up to two years from the day you asked, or until we have opened near you and told you, whichever comes first. If you ask for it to go before then, it goes. Two years is our policy, and today it is enforced by us remembering rather than by anything automatic — there is no job that sweeps the list. We would rather write that here than describe a deletion schedule nothing performs.
• Server logs — a short period set by Vercel, then gone.
• Analytics — includes aggregate counts and events linked to your internal member ID. Those linked events are personal data, even without your name or email. Removing them from the analytics provider requires a separate step; deleting your SanSpace account does not automatically erase them.

Whatever state you live in, we will do all of this for you. We are not going to make you prove you live somewhere with a good privacy law first.

• Ask what we hold, and get a copy of it.
• Correct it if it is wrong — with the one exception in section 3.
• Have it deleted, apart from the payment and incident records above, and with the one thing section 10 describes: what you wrote in a group’s chat is replaced with a marker rather than lifted out of five other people’s conversation. Impressions you chose or were given are deleted too, except those between you and someone where either of you has blocked the other, we have recorded a request to keep you apart, or either of you has used Report on the other in a chat, on the group list or in Impressions: those are kept for the period in section 12, with the first name taken off. A report made any other way — the form on our website, Support in the app, or email — counts once we have recorded a request to keep you apart. The record of whether you opened, skipped or saved the step has no words in it and stays with your attendance history.
• Stop the email, or take your phone number off our records, without leaving.
• Complain, to us or to your state Attorney General. Nobody is penalised for asking any of this.

Use the form below, or email support@sanspaceapp.com. An email carries exactly the same weight as the form.

Signed-in members can delete their account from Profile without waiting for us. We first cancel any future places, then remove account access and personal information. The public form remains a human-reviewed route because typing an email address does not prove that the person typing it owns that address.

You do not need to be a member to use any of this. Every request is keyed to an email address, not to an account, and we look that address up in both places we could be holding it: the member records, and the “tell me when you open near me” list in section 2. If you only ever typed a ZIP code and an email into that box, this is still your form.

Now that we hold a conversation between members, this stops being theoretical, so here is the plain version.

A court order, a subpoena or a police request can compel us to hand over what we hold — including your group’s chat. That is true of every company that holds messages, and it is true of us. We are two people with no lawyer on retainer, so what actually happens is that one of us reads the request and takes advice.

• We do not hand anything over because somebody asked nicely. Not a spouse, not an employer, not a private investigator, not somebody claiming to be police on the phone. A legal request, in writing, or nothing.
• We give what is asked for and nothing more. A request about one meetup does not get somebody’s year.
• We will tell you it happened — unless we are legally prevented from telling you, which does happen with police matters.
• A preservation request stops the clock. If we are told to preserve something, it is held past the retention in section 12 until the matter ends.

The honest summary: the safest message is one nobody is holding. Everything in your group’s chat is being held by us, and could one day be read by somebody neither of us chose. That is a reason to keep the chat for arranging the meetup, and to say the rest of it in person.

Your information sits in a managed database exposed through Supabase’s internet-facing API. Authorization rules, server-side checks and row-level security restrict what a member can read or write. The website is served over HTTPS. We do not store card numbers at all — Apple, Google Play or Stripe handles the payment.

Supabase runs our account sign-in. If you set a password, it is hashed and held by Supabase; there is no screen in SanSpace that can show it back to you. Email code sign-in and social sign-in do not require a SanSpace password. We never ask you to send a password to support.

The sign-in screen offers the methods available for your platform: email code, password or a supported social account. If a social account uses a different email address, it may open a separate account; we do not merge accounts based on a matching name.

Google and Facebook are supported social providers where enabled, and the iOS app also supports Sign in with Apple. The provider learns that you signed in to SanSpace; we receive its account identifier and the name and email it shares. Apple may share a private relay email instead of your usual address. The iOS app keeps Facebook automatic app-event logging and advertising-ID collection disabled, and does not request tracking permission in the public release.

Until August 2026 the link we emailed you opened your booking with no sign-in at all, and anyone who was forwarded that email could see the meeting point, your group and the first names of the five people you were meeting. We removed it. Every page about a meetup now asks you to sign in, old links included — they take you to the sign-in page and then on to the right one. It is a step we did not use to ask for, and we think it is the right one: the people in your group agreed to meet you, not to be visible to whoever your inbox reaches.

Your group’s chat is stored as ordinary text, not encrypted end-to-end. It is protected by Supabase authorization and row-level security, and by server-side access controls — and no more than that. Anybody who got that key would be able to read it. We would rather say so than let the word “secure” do work it has not earned.

No small company can promise perfect security and we are not going to. If we ever discover a breach that affects you, we will email you and say plainly what happened and what it means for you.

SanSpace is for adults 40 and over. We do not knowingly collect information from anyone under 18, and the site has nothing to offer them.

If somebody under 40 completes the quiz, we tell them they are not eligible and we do not take their money. We keep the record of their answers only briefly.

We will update this page when what we do changes. The date at the top changes when the words change.

If a change is significant, we will email members at the address on their account before it takes effect where practical, and we will keep the previous version available on request. We also show the effective date and explain the material change on this page.

Questions about this policy, or about anything we hold: support@sanspaceapp.com. A person reads that address, and you will get a person’s answer.