← Back to Owt

Last updated 6 November 2026

Owt is an event-discovery app that shows you public events happening near you in South Africa. This page explains, in plain language, what information the app touches, who else ever sees it, why, and what your rights are. Just as importantly, it also covers what it doesn't do with your data.

The short version

1. Information we collect

Location. With your permission, the app sends your coordinates to our server to find events within range. We use it for that single request and don't log or store it against you. It's sent as a one-off request, not attached to any saved profile. Searching for a place by name is separate and never touches your location: your device's coordinates are only ever sent when you ask for events near you.

If you don't create an account (guest mode). Your saved events and app preferences are saved on your phone, in the Owt app's own storage, not on our servers. Deleting the app or switching phones erases them. Nothing about you reaches us this way. Owt doesn't use tracking cookies at all, in guest mode or otherwise. The Android test version also keeps a name, age, bio and recently viewed events the same way, using its built-in browser storage (localStorage), which only Owt's own pages can read.

If you create an account. Signing up needs an email address and a password. We never see or store your actual password. Our authentication provider, Supabase Auth, handles that using industry-standard hashing, and our own systems only ever receive a session token proving you're logged in. Your profile (name, age, bio) is stored in our database, protected by row-level security rules that make it technically impossible for anyone (including us, querying casually) to read or write a row that isn't their own. Creating an account requires ticking a checkbox agreeing to this policy and our Terms; that's the lawful basis (consent) we rely on to process this data, and you can withdraw it at any time by deleting your account (see Your rights).

What we deliberately don't ask for. No phone number, no physical address, no government ID, no payment details, ever. If a future feature needs more than name/age/bio to work, this policy will be updated first, and you'll be asked to agree again before that feature can use anything new.

If you help us test. If you volunteer to test Owt by filling in the sign up form on our website (a Google Form, which Google runs under its own terms), or by sending us your Google account (Gmail) address by direct message or email, we use what you give us for one thing: adding you to the Google Play testing list and writing to you about the test. We don't share it, we don't add you to any marketing list, and we don't use it for anything else. Google Play stores the address on the testing list under its own terms. Once the test is over we delete your details from our own records, and you can ask us to delete it sooner at any time by emailing us.

Events you hide (Android test version). If you tap "Not interested" on an event, its ID is saved with your browser's localStorage on your device so that event stops appearing on your map, list and Popular. It is only a list of event numbers: it is not sent to us, not linked to your account, not used to personalise anything, and it does not follow you to another device. You can bring hidden events back any time from the Menu ("Show hidden events"), and deleting your account or clearing your browser data removes the list.

Searching for events. When you type in the search box, the words you type are sent to our server, in the body of the request rather than in the web address, so it can return upcoming events whose name or venue match. They are used only to build that list of results. We do not save them, we do not keep a search history, and they are not linked to your account. Opening an Owt link that points to one event (for example a link in a post) simply asks our server for that one event.

Searching for a place. In the Owt app, typing a town or suburb (for example "Melville") also sends those words to Mapbox, so it can suggest matching places in South Africa. Only the words are sent, never your location: the app puts the nearest matches first on your phone. Tapping a place moves the map and the events to that area.

Anonymous usage counts, app only. The Owt app counts a few moments, such as opening the app or the map, scrolling a row of events, tapping a pin, opening an event, tapping Get tickets, saving an event, using search and opening a notification, so we can see where the app works well and where people get stuck. Only totals are sent to our server, for example "map opened 3 times, in 1 session", with whether the phone is an iPhone or an Android and the app version. Nothing that identifies you or your phone is sent: no device ID, no account, no location and nothing about which events you looked at, and we don't keep your IP address with the counts (beyond Railway's standard request logs, below). Our database only keeps daily totals for everyone together, so no count can be traced back to a person. You can switch this off at any time in the app under You, "Share usage counts".

App error reports (Android test version). If something in that version breaks, it sends a short technical note to our server: the error message, which file and line it came from, your device's browser or Android version, and whether you were in the app or on the website. It leaves out your email address, your account, your location and anything you typed. It is used only to find and fix the bug. It is not stored in our database, only written to our server log, which is kept under Railway's own retention settings, and at most five are sent per session.

Offline event cache. The last events list you successfully loaded is kept on your device (in the Owt app's own storage, together with the name and centre of the area it was loaded for, so the app opens there next time) so the app can still show you something if you open it with no signal. This applies whether or not you have an account, and it's the same public event data already shown on screen, nothing new is collected to make it work, and it never leaves your device.

Small on-device reminders (Android test version). Three more things are kept only in your browser's localStorage: when you last opened Owt (so a "welcome back" message can show once, if it's genuinely been a while), whether you've ever saved your first "Interested" event (so a one-time first-save message doesn't repeat), and how many times you have opened Owt on this device, a single number (so the home screen can show a simpler layout for your first few visits). None of them is sent to us, none is linked to your account, and clearing your browser data removes all three.

Notifications. If you turn on notifications in the app, we store a device token, the name of the city you last had selected or, when you use your location, the nearest city to you (the name only, never your coordinates), and, if you're signed in, your account so a reminder for an event you marked Interested in can reach the right device. This is opt-in, off by default, and turning it off in the app deletes the token from our systems immediately. We only ever send two kinds of notification: a reminder for an event you've marked Interested in, or a once-daily note around midday about what's on today near you, nothing else, no marketing.

Where account data lives. Supabase's infrastructure isn't currently hosted in South Africa, so if you create an account, your email and profile data are processed outside the country. We rely on Supabase's own security and data-protection commitments as the basis for that transfer, as South Africa's POPIA requires when personal data crosses a border.

Standard server logs. Like most web services, our hosting provider, Railway, automatically logs basic technical data (IP address, request time, browser type) for security and debugging, under its own retention settings. Apart from the anonymous usage counts described above, we haven't layered any tracking or analytics on top of this. We don't cross-reference it with anything else, and nobody at Owt reviews it unless actively debugging a problem.

How long we keep it. Account data (email, profile) is kept for as long as your account exists, and deleted when you close it (see Your rights). Event data cached from ticketing platforms is refreshed roughly hourly and past events are removed automatically about a day after they start. We don't currently run any process that deletes an account just for being inactive. Closing one is always something you (or we, at your request) do deliberately.

2. Who else processes your data

Owt is built on a small number of specialist providers rather than our own infrastructure for everything. Each one only ever sees the specific data it needs to do its one job.

Who	What they handle	Their policy
Ticketing platforms, currently Quicket	Event listings you see (names, venues, prices) and ticket checkout, never your personal data	Quicket privacy policy
Mapbox	Map rendering, including the small map picture on an event's page (which shows the venue, never your location), and place suggestions for the words typed in the app's search (never your location); may collect standard usage data under its own policy while the map loads	Mapbox privacy policy
Supabase	Account authentication and, if you sign up, your profile data	Supabase privacy policy
Resend	Delivers account emails (sign-up confirmation, password reset) on Supabase's behalf, and sees your email address, not your profile or password	Resend privacy policy
Railway	Hosts the app itself; sees standard server-access logs (see above)	Railway privacy policy
Apple Push Notification service	Delivers push notifications to iPhones, if you've turned them on; sees your device token, not your profile or password	Apple privacy policy
Firebase	Delivers push notifications, native app only, if you've turned them on; sees your device token, not your profile or password	Firebase privacy policy

We don't sell, rent, or otherwise share your data with anyone beyond this list, and none of these six exist to advertise to you or build a profile of you. Each is a working part of the app, not a data buyer.

Third-party links. "Get tickets" and "Directions" take you to the ticket seller's own site (for most events today, Quicket) or to the map app you pick (Apple Maps, Google Maps or Waze). Once you leave Owt, that site's or app's own privacy policy applies, not this one. It's worth a glance if you're unsure what either does with your information.

Sharing an event. The "Share" button hands the event's name and a link to its Owt page (which has the ticket link on it) to your device's own share menu (or your browser's, on the web) so you can send it wherever you like, WhatsApp, Instagram, anywhere else. That's handled entirely by your device's operating system or browser; Owt never sees or records who you shared with.

3. How we secure it

Concretely, not just as a promise:

• All traffic to and from Owt is encrypted in transit (HTTPS).
• Passwords are never handled by Owt's own code at all. See §1.
• Account data is protected by database-level row-level security, not just an app-level check. Even a bug in Owt's own code can't make one user's row readable by another.
• The app's public API is rate-limited to reduce automated abuse.
• We do not run advertising trackers, third-party analytics scripts, or any code whose purpose is to profile visitors.

No system is perfectly secure, and we don't claim this one is either. Every point above reflects an actual, verified property of how Owt is built, not aspirational language.

4. What we don't do

• We don't run advertising or ad-tracking of any kind.
• We don't sell or share personal data with anyone.
• We don't use analytics or tracking cookies to follow you across other sites.
• We never see or store your actual password, even if you have an account. Our authentication provider handles that layer entirely.
• We don't make any automated decision about you, or build a behavioural profile. Nothing in Owt personalizes content by scoring or profiling users. The event list is the same public data for everyone in an area.
• If you don't create an account, we don't store any personal data server-side at all. There's nowhere for it to leak from, because it never leaves your device.
• We never send your location to a map app when you tap "Directions". The link only ever carries the event venue's own public coordinates as the destination. If the map app you chose needs your current position to route from, it asks you directly, entirely outside Owt.

5. Children

Owt isn't intended for anyone under 18, and the profile page's own age field enforces that minimum. It's set at 18 rather than a lower age because of what the app itself shows: real nightlife and bar venues, and events with alcohol references, not because of how Owt collects or handles data. Event listings themselves may carry their own age restrictions, set by the organizer or venue, which we display where Quicket provides them. Those are separate from, and don't replace, Owt's own 18+ minimum.

6. If you're outside South Africa

Owt is built for South Africa. The event catalog is SA-only, and this policy is written against South African law (POPIA). If you use Owt from elsewhere, POPIA still governs how we handle your data on our side, but your own country's privacy law may give you additional rights we haven't specifically documented here. If that's you and something in this policy is unclear, contact us and we'll do our best to answer directly.

7. Your rights & who to ask

Under South Africa's Protection of Personal Information Act (POPIA), you have the right to know what personal data we hold about you, to have it corrected, to have it deleted, and to object to or withdraw consent for its processing.

If you've only ever used guest mode, this is simple: everything lives on your own phone, so deleting the Owt app removes it all. There's nothing on our side to request.

If you have an account, you can delete it yourself at any time from Menu → Account → Delete account inside the app. This permanently removes your profile and saved events immediately, with no waiting period. For anything short of full deletion (a copy of your data, a correction, or withdrawing consent without closing the account), email groov.support@gmail.com from the address you signed up with and we'll action it directly.

Information Officer. Under POPIA, every organisation processing personal data needs an identifiable Information Officer responsible for compliance. For Owt, at this stage, that's the same address above, groov.support@gmail.com. Reach out with "Information Officer" in the subject line for anything specifically related to POPIA compliance rather than general support.

If you're unhappy with how we've handled a request, you also have the right to complain to South Africa's Information Regulator (inforegulator.org.za). We'd genuinely rather you raised it with us first so we can actually fix it, but that right exists regardless.

8. Changes to this policy

If how Owt handles data changes (for example, if analytics, ads, or new partnerships are introduced), this page will be updated and the "last updated" date above will change. For a change significant enough to affect what you previously agreed to, we'll look at surfacing it directly in the app rather than relying on you to re-check this page.

9. Contact

Questions about this policy, or anything covered above, can be sent to groov.support@gmail.com.

Owt, est. 2026, South Africa.