← Back to Owt

Last updated 15 September 2026

Owt is an event-discovery app that shows you public events happening near you in South Africa. This page explains, in plain language, what information the app touches, who else ever sees it, why, and what your rights are. Just as importantly, it also covers what it doesn't do with your data.

The short version

1. Information we collect

Location. With your permission, your browser sends your coordinates to our server to find events within range. We use it for that single request and don't log or store it against you. It's sent as a one-off request, not attached to any saved profile.

If you don't create an account (guest mode). Your name, age, bio, saved ("Interested") events, recently viewed events, and app preferences (like map theme) are all saved with your browser's localStorage, on your device, not our servers. Clearing your browser data or switching devices erases it. Nothing about you ever reaches us this way. Owt doesn't use tracking cookies at all, in guest mode or otherwise. localStorage is a different, more limited browser mechanism that only Owt's own pages can read, and nothing else on the web can access it.

If you create an account. Signing up needs an email address and a password. We never see or store your actual password. Our authentication provider, Supabase Auth, handles that using industry-standard hashing, and our own systems only ever receive a session token proving you're logged in. Your profile (name, age, bio) is stored in our database, protected by row-level security rules that make it technically impossible for anyone (including us, querying casually) to read or write a row that isn't their own. Creating an account requires ticking a checkbox agreeing to this policy and our Terms; that's the lawful basis (consent) we rely on to process this data, and you can withdraw it at any time by deleting your account (see Your rights).

What we deliberately don't ask for. No phone number, no physical address, no government ID, no payment details, ever. If a future feature needs more than name/age/bio to work, this policy will be updated first, and you'll be asked to agree again before that feature can use anything new.

Where account data lives. Supabase's infrastructure isn't currently hosted in South Africa, so if you create an account, your email and profile data are processed outside the country. We rely on Supabase's own security and data-protection commitments as the basis for that transfer, as South Africa's POPIA requires when personal data crosses a border.

Standard server logs. Like most web services, our hosting provider, Railway, automatically logs basic technical data (IP address, request time, browser type) for security and debugging, under its own retention settings. We haven't layered any additional tracking or analytics on top of this. We don't cross-reference it with anything else, and nobody at Owt reviews it unless actively debugging a problem.

How long we keep it. Account data (email, profile) is kept for as long as your account exists, and deleted when you close it (see Your rights). Event data cached from Quicket is refreshed roughly hourly and past events are removed automatically about a day after they start. We don't currently run any process that deletes an account just for being inactive. Closing one is always something you (or we, at your request) do deliberately.

2. Who else processes your data

Owt is built on a small number of specialist providers rather than our own infrastructure for everything. Each one only ever sees the specific data it needs to do its one job.

Who	What they handle	Their policy
Quicket	Event listings you see (names, venues, prices) and ticket checkout, never your personal data	Quicket privacy policy
Mapbox	Map rendering; may collect standard usage data under its own policy while the map loads	Mapbox privacy policy
Supabase	Account authentication and, if you sign up, your profile data	Supabase privacy policy
Resend	Delivers account emails (sign-up confirmation, password reset) on Supabase's behalf, and sees your email address, not your profile or password	Resend privacy policy
Railway	Hosts the app itself; sees standard server-access logs (see above)	Railway privacy policy

We don't sell, rent, or otherwise share your data with anyone beyond this list, and none of these five exist to advertise to you or build a profile of you. Each is a working part of the app, not a data buyer.

Third-party links. "Get tickets" and "Directions" take you to Quicket's or Google Maps' own site. Once you leave Owt, that site's own privacy policy applies, not this one. It's worth a glance if you're unsure what either does with your information.

3. How we secure it

Concretely, not just as a promise:

• All traffic to and from Owt is encrypted in transit (HTTPS).
• Passwords are never handled by Owt's own code at all. See §1.
• Account data is protected by database-level row-level security, not just an app-level check. Even a bug in Owt's own code can't make one user's row readable by another.
• The app's public API is rate-limited to reduce automated abuse.
• We do not run advertising trackers, third-party analytics scripts, or any code whose purpose is to profile visitors.

No system is perfectly secure, and we don't claim this one is either. Every point above reflects an actual, verified property of how Owt is built, not aspirational language.

4. What we don't do

• We don't run advertising or ad-tracking of any kind.
• We don't sell or share personal data with anyone.
• We don't use analytics or tracking cookies to follow you across other sites.
• We never see or store your actual password, even if you have an account. Our authentication provider handles that layer entirely.
• We don't make any automated decision about you, or build a behavioural profile. Nothing in Owt personalizes content by scoring or profiling users. The event list is the same public data for everyone in an area.
• If you don't create an account, we don't store any personal data server-side at all. There's nowhere for it to leak from, because it never leaves your device.
• We never send your location to Google Maps when you tap "Directions". That link only ever carries the event venue's own public coordinates as the destination. If Google Maps needs your current position to route from, it asks you directly, through its own site, entirely outside Owt.

5. Children

Owt isn't intended for anyone under 13, and the profile page's own age field enforces that minimum. Event listings themselves may carry their own age restrictions, set by the organizer or venue, which we display where Quicket provides them. Those are separate from, and don't replace, Owt's own 13+ minimum.

6. If you're outside South Africa

Owt is built for South Africa. The event catalog is SA-only, and this policy is written against South African law (POPIA). If you use Owt from elsewhere, POPIA still governs how we handle your data on our side, but your own country's privacy law may give you additional rights we haven't specifically documented here. If that's you and something in this policy is unclear, contact us and we'll do our best to answer directly.

7. Your rights & who to ask

Under South Africa's Protection of Personal Information Act (POPIA), you have the right to know what personal data we hold about you, to have it corrected, to have it deleted, and to object to or withdraw consent for its processing.

If you've only ever used guest mode, this is simple: everything lives in your own browser, so clearing your browser's site data for Owt removes it all. There's nothing on our side to request.

If you have an account, you can delete it yourself at any time from Settings → Account → Delete account inside the app. This permanently removes your profile and saved events immediately, with no waiting period. For anything short of full deletion (a copy of your data, a correction, or withdrawing consent without closing the account), email groov.support@gmail.com from the address you signed up with and we'll action it directly.

Information Officer. Under POPIA, every organisation processing personal data needs an identifiable Information Officer responsible for compliance. For Owt, at this stage, that's the same address above, groov.support@gmail.com. Reach out with "Information Officer" in the subject line for anything specifically related to POPIA compliance rather than general support.

If you're unhappy with how we've handled a request, you also have the right to complain to South Africa's Information Regulator (inforegulator.org.za). We'd genuinely rather you raised it with us first so we can actually fix it, but that right exists regardless.

8. Changes to this policy

If how Owt handles data changes (for example, if analytics, ads, or new partnerships are introduced), this page will be updated and the "last updated" date above will change. For a change significant enough to affect what you previously agreed to, we'll look at surfacing it directly in the app rather than relying on you to re-check this page.

9. Contact

Questions about this policy, or anything covered above, can be sent to groov.support@gmail.com.

Owt, est. 2026, South Africa.