Privacy Policy

Last updated: October 2026

Entity: Hangpost, Inc., a Delaware corporation · privacy@hangpost.app

The short version (not a substitute for the full policy)

You set one home point and a radius; we use it to show you nearby people and posts. We do not track your live GPS location, and we limit how often your home base can move.
We never sell your personal data, and we never sell or share location data for advertising. Period.
Recommendations are computed from the profile fields you provide, the connections you have in common, and, where contacts were imported, whether one of you has the other saved or you both have the same person saved; we show you the reasons for every recommendation, including, by name, up to two of the connections you have in common.
You can delete your account in-app, and request a copy of your data by email; deletion is real and propagates to our processors.
18+ only. US only.

1. What we collect

Category	What	Source
Account	Name, phone number (verified via a one-time code), email, date of birth (to enforce 18+), and authentication identifiers	You; our auth provider (Clerk)
Waitlist (website)	If you join the waitlist at hangpost.app: your name, email, an optional phone number, the city you are waiting for, and referral details (a code you can share, and who referred you). We email you a confirmation link; your spot counts once you click it. If you never confirm, the signup is deleted 30 days after your last confirmation link was issued. A new link is issued only when an expired link is renewed, but submitting the form again queues another email either way, and if you are already confirmed that email tells you so. While an email waits in the queue it holds your name, your email address and the message itself, including the link. We erase that the moment the email is sent, is canceled, or finally fails, and anything still waiting after 7 days is canceled rather than sent. The queue's own record of the attempt, which holds no contact details, is deleted after 30 days. Once confirmed, we remove your name, email, and phone from the record 30 days after you create a Hangpost account, or after 12 months if you never do, keeping only an anonymous placeholder so the public queue count stays honest. Email privacy@hangpost.app to be removed sooner or entirely	You
Profile	Structured fields you fill in: interests, hobbies, hometown, college, major, job ("Role at Employer"), age, a profile photo, and, if you pick one, the accent color shown with your name and profile (a display preference only, never used by our matching system). Uploaded photos are screened automatically for explicit content before they appear (see "Safety and integrity" below)	You
Instagram handle (optional)	If you choose to add it, an Instagram username shown as plain text on your profile. It is visible to anyone nearby who can open your profile, not just your connections (the same wording you see when you type it in), so add it only if you want it visible. It is never a clickable link, never used by our matching system, and we never connect to Instagram. Remove it any time in profile edit	You
Photo verification (optional)	If you choose to verify your profile photo, a one-time selfie taken in the app. It goes to a private storage location, our processor (Amazon Rekognition) compares its facial geometry against your profile photo, and the selfie is deleted immediately after the comparison, pass or fail. We keep only the fact and time of verification, never the selfie and never a face template, and we never run face recognition against other users, other photos, or any external database. Changing your photo clears the badge. One narrow exception: if an image is flagged as apparent child sexual abuse material, US law requires us to preserve it rather than delete it. See "Safety and integrity" below	You, only when you start verification
Government-ID verification (optional)	If you choose to verify your identity, you are handed to our identity-verification provider (Persona) inside the app. Persona checks that a government-issued ID is valid and matches a selfie you take; that comparison happens on Persona's systems, not ours. We never receive or store your ID image or that selfie. Persona's answer to our server includes the details it read from your ID; we use only the date of birth, to check that you're 18 or older, and we never store it or any other detail from the document. We keep only the yes-or-no result, the time you were verified, and an opaque reference to Persona's own record. Persona retains the ID and selfie on its side, under our contract with it and its own retention schedule. While you verify, Persona's own code in the app also records, on Persona's side, an approximate location taken from your internet connection, a device identifier and account identifiers Persona assigns, and error and step logs for the check. We don't keep or use these; they sit under the same contract and schedule. The check runs only when you start it, and never against any external database. The result appears as a badge on your profile: it is never fed to our matching system, never used to rank you, and never shared or sold. We also check that your ID shows you're 18 or older, because Hangpost is only for adults: we compare the date of birth on it with today's date and keep only whether you're under 18, never the date. If we can't read the date of birth on an ID Persona approved, you don't get the badge, nothing is counted against you, and you can try again. If it shows you're under 18, you don't get the badge and we lock your account: you can't use Hangpost, your profile and posts are hidden from everyone, and the phone number and email on it can't open a new account, but nothing is removed. The app tells you why, and in case it was a mistake you can retry the ID check once, from the locked screen. If the retry shows you're 18 or older, you get the badge and the account is unlocked with everything as it was. If the retry also shows you're under 18, your posts and profile photo come down, the account stays locked, and you can appeal by emailing support@hangpost.app with your reasons within 30 days. A person reviews every appeal, and we'll never ask you to email a photo of your ID. If the account isn't unlocked within 30 days of its latest lock, we delete it the same way as when you delete it yourself, including its photos and posts, and the phone number and email on it still can't open a new account. Verifying your identity is optional, and you never need it to use Hangpost	You, only when you start verification
Guest RSVPs (legacy; collected before July 8, 2026)	Before July 8, 2026, people could RSVP to a shared hangout link without an account using a name and US phone number. That option is retired: RSVPing now requires a Hangpost account. Legacy guest records are kept only so the host can run attendance, are deleted automatically 30 days after the hangout, and are never used for marketing or any outreach. Only the host sees the name; the phone number is never shown to anyone. Email privacy@hangpost.app to have a legacy guest RSVP removed sooner	You
Derived profile	A synthesized text description generated deterministically from your structured fields (you do not write a free-text bio) and a numeric embedding of it, used for ranking	Generated by us
Location	Home base: one point plus a radius that you set by choosing a neighborhood. The app does not read your device location to do it. We store it at reduced precision (snapped to roughly a 100-meter grid). You can move your home base at most twice in any 30 days. Setting it for the first time does not count. Your radius can change only when you set or move your home base. We cap it because a home base is meant to be the place you actually live rather than a setting you flip, and keeping it steady is part of how we keep your location a small, low-profile part of the product. To enforce the cap we record when your last two moves happened, as times only. We never keep a list of the places you have been. Hangout locations: a venue or point you attach to a post. We do not collect continuous or background location	You
Attendance and profile activity	Check-ins ("I'm here"). If you tap to say you have arrived at a hangout, we record the time on your RSVP, or on the hangout itself if you are the host. It is a tap, never a location reading: the app does not read your device's location to confirm it, and the server accepts it only during that hangout's own short window, from an hour before the start to a few hours after. While the window is open, the people who joined the same hangout can see who has said they are there. Regulars, thanks, and "Up to lately." Your profile also shows the number of people who have RSVP'd "going" to two or more of your finished hangouts, the number of 👍 reactions your posts have received, and a short list of your last few finished hangouts that were open to everyone nearby. Those three are shown only to you and your accepted connections, never to a stranger who opens your profile. The list never includes an invite-only or connections-only plan, and it never shows whether a hangout repeats, so it cannot be read as a prediction of where you will be in future. All of it is worked out when the page is loaded rather than stored as its own field, and none of it is ever shown as a score or a ranking	Your use of the Service
Saved interest groups ("Circles")	A named, reusable list of your own accepted connections who are into one thing (for example, "Pickleball"), so that when you post about doing that thing the same group sees it. A Circle is a filter over people you are already connected to, never a way to reach your contact list. It is private to you: the people on it are never told they are on it, and nobody else can see it or its name. Delete it any time	You
Per-post "hide from" list	When you post, you can hide that post from specific people who would otherwise see it. The choice is saved with that one post only, is never reusable, never becomes a block, and the hidden-from person is never told. Only you can see it	You
City Expert status	Whether your local tips have been marked helpful by enough other people nearby to earn the City Expert star, or whether we granted it. The star is shown to anyone who can see your profile or a tip you posted, including people who are not your connections. It is a credential, not a score, and cannot be bought	Earned from others' reactions, or granted by us
Social graph	Friend connections made in-app; if you choose to import contacts, the imported identifiers as hashes, with a recorded consent receipt (`consent_hash`) proving you authorized the import. Connections in common are named. When we suggest you to another member and the two of you have accepted connections in common, the suggestion names up to two of them (for example, "You both know Jake Miller"). Each name shown is already one of that member's own connections, so what it tells them is that you are connected to that person too. A name stops showing as soon as either connection ends, and a banned or deleted account is never named	You, with explicit consent per import
Being found by people who know you	When you sign in, we store a one-way, keyed hash of your verified phone number and of your email. When another member chooses to import their phone contacts, we compare the hashes of their contacts with yours. If your number or email is in their contacts and Let contacts find me is on (it is on unless you turn it off): they may get a one-time notification that you joined, showing your display name, if they imported their contacts before you joined; you appear in their list of contacts who are on Hangpost; you can be shown near the top of their suggested connections; and your posts can be shown higher in their feed and included in its "My people" view. If you have both imported contacts, both have Let contacts find me on, and both have the same person saved in your phones, that shared contact counts as someone you both know in each of your suggestions, and each of you sees that person's name only as it is saved in your own phone. We never tell you who has your number or email saved. Turn it off any time in the app's Settings, under Contacts, Let contacts find me: from that moment nothing about you reaches them through their contacts (not their list, their suggestions, their feed ranking or their "My people" view), and the join notification disappears from their Alerts (a notification already delivered to their phone's lock screen can't be recalled). Each imported contact hash is deleted 180 days after the last contact sync that included it, when the member removes their imported contacts, or when they delete their account. When you delete your account, your stored hashes and every match to you are deleted	Your sign-in details; other members' contact imports, made with their consent
Your "Add me on Hangpost" link (optional)	If you ask for your add-me link, we keep a random code tied to your account. The link carries only that code, never your name, handle or photo, and the page someone sees before they join Hangpost names nobody. Only a signed-in member who opens it is taken to your profile, where they can ask to connect. You can get a new link at any time, which stops the old one working, and it is deleted with your account	You, when you ask for your link
City Guide tips sent by link	When a member sends someone a City Guide tip, the message links to a page that shows only that tip's words, to anyone who has the link. It never shows who posted the tip. Only tips already open to everyone nearby get a link, and the page stops working if the tip is taken down or its poster's account is closed	The member who sends the tip
Activity	Posts, hangouts, RSVPs, reports, and blocks; recommendation impressions (what we showed you, with an internal score and the reason breakdown) and outcomes (viewed, opened, friend request, RSVP, block)	Your use of the Service
Device and logs	IP address, device and OS identifiers, and crash and performance logs	Automatic
Exit survey (optional)	When you choose to delete your account, the app first offers one optional question: a rating from 1 to 5, a few reasons you can pick, and a box for anything you want to tell us. Your answers stay on your phone until the deletion goes through; if you cancel, nothing is sent. If you answer, we keep those answers with no name, account, phone, email, device identifier or IP address attached. They are sent after your account is already gone, record only the day they were sent, and are not stored with your account; anything you type in the box is kept as written, so leave out anything that would identify you. They are used only to improve Hangpost. Skipping it changes nothing about your deletion	You, only if you answer
Payments (if and when offered)	Handled by our payment processor; we receive transaction records, never full card numbers	Processor (Stripe)

2. How we use it

Run the product: show the nearby feed, rank recommended connections (with visible reasons), run hangouts and RSVPs, and send notifications you control.
Run the waitlist: keep your spot on the list, tell you when Hangpost opens in your city, and credit referrals. We do not sell this data or use it for advertising. To correct or delete your waitlist record, even if you never create an account, email privacy@hangpost.app.
Improve matching: train ranking models on whether the recommendations we showed led to real connections (our impression and outcome records). Our north-star metric is repeat in-person meetings, not screen time.
Safety and integrity: verification, automated content review of uploaded images for explicit material, checking uploaded images against databases of known child sexual abuse material through Project Arachnid Shield (a service of the Canadian Centre for Child Protection, which receives the image bytes for the check and is described on our Service providers page), human review of reports, moderation, enforcing blocks and bans, and meeting our legal duties, including reporting apparent child sexual abuse material to NCMEC as required under 18 U.S.C. § 2258A. When an image is flagged that way, the law requires us to preserve it rather than delete it, and to keep enough information to file a report: the image itself in a locked location no one can serve or delete, its digital fingerprint, and the uploading account's identifiers together with the IP address and device information of the upload. We hold that material for the period the law requires, disclose it only to NCMEC and law enforcement, and it survives account deletion because the law does not let us destroy it. This is the only circumstance in which we keep an image you asked us to delete. If we permanently ban an account for a serious violation, we keep a one-way hash (never the raw number) of its phone and email and use it to refuse a new signup with the same phone or email, so a banned person cannot simply make another account. That ban check is a safety use, never advertising, and we do not use face recognition for it. Your phone number and email also let people who already have them saved find you on Hangpost, as described under "Being found by people who know you" in section 1. We never use either for advertising.
Support and communications: respond to you, send service messages, and send optional product emails you can opt out of.
Legal: comply with law, enforce the Terms, and establish or defend claims.

We do not use the content of your private messages for advertising or for training models unrelated to safety.

One messaging behavior worth knowing: direct messages open only after you both accept a connection. If you later remove that connection, the conversation is not deleted. It moves to a quiet Requests area, new messages from that person stop notifying you, and reconnecting brings the thread back. Blocking someone stops their messages entirely.

3. What we never do

Sell personal data, as "sell" and "share" are defined in the CCPA/CPRA and similar state laws. No exceptions.
Sell, license, or disclose location data to data brokers or advertisers. Internally, your approximate location is used only as an in-or-out radius filter when we retrieve candidates; it is never a ranking input and never leaves that layer.
Run third-party advertising, ad-targeting, or cross-app tracking SDKs in the app. We do not currently run any third-party product-analytics SDK either. If we add first-party, privacy-respecting product analytics, we will name it on our Service providers page and update this policy before it goes live, and only if it can run without cross-app tracking.
Track your location in the background.
Confirm a check-in with your device's location, or record where you physically were. Saying "I'm here" is a tap you choose to make, and the only thing it records is the time you made it.

Sponsored content on Hangpost, when present, is labeled, is targeted only by the same city and zone scoping as everything else, and pays for verified attendance, not for your attention or your data.

4. Who we share it with

Service providers that only handle the data they need to run their part of Hangpost, never for their own advertising: hosting, database, sign-in, photo storage, identity verification, email, error monitoring, and ad measurement (a Google Ads conversion tag and a Meta Pixel on our public website pages that count whether an ad we bought led to a waitlist signup -- Google's personalization signals off, Meta's Limited Data Use on with no advanced matching, and neither ever receives your name, email, or phone), plus a large-language-model provider used only in an offline pipeline to generate match-quality training labels (never from your messages). We summarize these by category on our Service providers page, and we'll name the specific companies on request at privacy@hangpost.app.
Other users, per your visibility settings: your profile to in-radius users, your posts to the audience you pick, your RSVP to the hangout's attendees, and, while Let contacts find me is on, the fact that you are on Hangpost to members who have your number or email saved.
Legal and safety: law enforcement and others where required by law, or where necessary to address fraud, security, or threats to any person, under our Law-Enforcement Guidelines, which require legal process appropriate to the data sought and a warrant for location data.
Corporate transactions: a merger or acquisition successor, bound by this policy, with notice to you.

5. Retention and deletion

Account data is kept while your account is active.
Account deletion is available in-app and by emailing privacy@hangpost.app. On deletion we delete or de-identify your personal data within 30 days, with backups rotating out within 90 days, except that we retain moderation, safety, and legal-compliance records for up to 2 years (longer where the law requires) to protect other users, and transaction records for the period tax law requires.
If a report about you or something you posted is still open when you delete your account, we keep your photos (your profile photos and any photos on your posts) until that report is closed, so the person reviewing it can see what was reported. They are no longer shown in the app, and they are deleted once the report closes. If your account was removed for a policy violation, they stay with the moderation record for as long as it is kept.
The same goes while you keep your account: if a report about you is open when you replace or remove your profile photo, we keep the old photo in private storage, where only the person reviewing the report can see it, and delete it once the report closes. If your account is removed for a policy violation, it stays with the moderation record for as long as that is kept.
Biometric data: our retention and destruction schedule. Photo verification and ID verification each compare faces, and some state laws, including Illinois's Biometric Information Privacy Act, treat the facial geometry used in those comparisons as biometric data. We use it only to run the check you started. It is never used to rank or match you, and never compared against anyone else.
Biometric data, photo verification: your selfie is deleted right after the comparison, pass or fail. If a check is interrupted, our storage deletes any selfie left behind within two days. We never store facial geometry or a face template. We keep only whether your photo matched, and when.
Biometric data, ID verification: the comparison happens at Persona, and we never receive the ID image, the selfie or any facial geometry. Persona keeps them under its contract with us and its own retention schedule. We ask Persona to delete a check as described just below.
If you start an ID check, we keep Persona's reference number for it, never the ID or the selfie. When a check is declined, when you start over after an unfinished one, or when you delete your account, we ask Persona to delete that check and keep asking until it confirms. After that we keep only the record that we asked, for 90 days, and then delete it too.
If an ID check shows you're under 18, we keep Persona's reference number for that check and the date of the check, so the one-retry rule above can work. We delete them if your retry shows you're 18 or older, if an appeal is granted, or when the account is deleted. If your account is locked for this reason, we keep that reason with the lock until the account is unlocked, or deleted 30 days after its latest lock.
When someone reports a post, comment, or message, the report keeps a copy of what was reported so a moderator can still review it after the original is edited or deleted. That copy is removed 2 years after the report was filed, whether or not the report has been resolved; the report record itself stays for the period above.
Impression and outcome logs used for model training are de-identified on account deletion.
Imported contact data is deleted on request, when you remove your imported contacts, or on account deletion, and each imported contact hash is deleted in any case 180 days after the last contact sync that included it.
We keep at most 5,000 of your contacts' phone numbers and email addresses (as hashes), and an account can add at most 5,000 in total, including after you remove and re-import them. Anything past that isn't stored or compared. The "you both know" line names a shared contact for up to 30 people a day.
If you start signing up but never finish creating your profile, we delete the account and its data 30 days after you started.
For 30 days after you delete your account, the deleted record keeps a keyed hash of your @handle and of the phone number (or email) you signed in with, never the handle, number or address themselves. That is how nobody else can take your handle in those 30 days, and how you can take it back if you return with the same phone number or email. Both hashes are deleted after 30 days.
Answers to the optional exit survey are kept for up to 2 years. They hold no name, account or device identifier and record only the day they were sent, not the time, so deleting your account does not touch them and they are not stored with your account. Anything you type in the box is kept as written, so leave out anything that would identify you.

6. Your rights and choices

We honor these for all users, regardless of which state you are in:

Access and export: get a copy of your data by emailing privacy@hangpost.app.
Correction: edit your profile at any time.
Deletion: in-app, as above.
Opt-outs: notifications (in-app settings) and product emails (unsubscribe link).

State-law mechanics (CCPA/CPRA, Virginia CDPA, Colorado CPA, and the other state privacy acts): we do not sell or share personal data, so there is nothing to opt out of under those provisions; we treat the limited sensitive categories we handle, such as the approximate location you set, with the heightened care those laws require; we will not discriminate against you for exercising your rights; and you may use an authorized agent. If we deny a request you may appeal by replying to our decision, and we will respond within the statutory window (generally 45 days, extendable where the law allows); if it remains unresolved you may contact your state Attorney General.

We verify requests against your authenticated account or your verified phone or email.

7. Security

We use encryption in transit and at rest, least-privilege access, secrets held in managed stores, and an incident-response plan. No system is perfectly secure; we will notify you and regulators of breaches as required by law.

8. Children

Hangpost is for adults 18 and older. We ask for your date of birth when you sign up and don't let anyone under 18 create a profile. If an ID check shows a member is under 18, the one-retry rule in the Government-ID verification row of section 1 applies: we lock and hide the account at once without removing anything, the member can retry the check once, a second such result takes its posts down, and we delete the account and its data 30 days after its latest lock unless a passing retry or an appeal unlocks it. If we learn a member is under 18 some other way, for example from a report we review, we delete the account and its data. We do not knowingly collect data from children under 13 (COPPA).

9. Where data lives

We operate in the United States, and the Service is offered only to US users. Our service providers store data in the United States, with one exception: images you upload are checked against databases of known child sexual abuse material by the Canadian Centre for Child Protection, in Canada, as described in section

That check is the only routine transfer of your data outside the United

States. The kinds of providers we rely on are summarized on our Service providers page.

10. Changes

Material changes get 30 days' in-app or email notice. The change history of this policy is public.

11. Contact

Hangpost, Inc., a Delaware corporation · privacy@hangpost.app