Privacy Policy

Last Updated: September 9, 2026

This Privacy Policy describes how SlothMania, LLC ("SlothMania," "we," "us," or "our") collects, uses, and shares information when you use the Unplanned mobile application (published in app stores as "Unplanned: Vibes"), our website at unplanned.slothmania.com, and related coordination services (collectively, the "Service").

The mobile app provides full plan coordination features. The website provides marketing information, legal policies, customer support, read-only access to some account and plan details, and landing pages for plan and friend invite links.

1. Information we collect

We collect information you provide directly, information generated through your use of the Service, and information from authorized third-party services:

  • Account and Authentication Information: When you register or sign in, we receive information from our authentication provider (Clerk), including your user identifier, email address, optional phone number, display name, and authentication tokens.
  • Profile Information: You may provide a display name, an optional birthdate, a base or home location, and interest or vibe preferences (at least three vibe interests are selected during onboarding). You may also configure a discoverability toggle for contact-based friend matching. Your birthdate is used solely to gate age-restricted venue categories (such as bars, breweries, and nightlife) to users 18 or older.
  • Phone Verification Data: If you choose to verify your phone number, we send one-time verification passcodes via SMS (using SMS service providers such as Twilio, Bandwidth, or ClickSend) and store challenge metadata (such as attempt counts, verification status, and timestamp expiration). We do not store the plaintext content of SMS messages beyond what is necessary to complete verification.
  • Friends and Social Graph: We collect information about friend requests, accepted connections, friend groups, blocked users, referral invite codes, and app invite redemptions.
  • Plan, Voting, and Coordination Data: Information about vibes and plans you create or join, including participant roles, RSVP statuses, suggested place and time options, custom location labels (such as "My House"), votes submitted during the 15-minute voting window (up, down, or neutral), and finalized hangout outcomes. Unplanned is designed for spontaneous coordination among friends — not professional event hosting or public ticketing.
  • Location Information (When in Use Only): If you grant location permission or manually enter a search area during plan creation, we use your location solely while the app is in use to calculate midpoint areas and suggest nearby venues. We do not track your location continuously in the background and we do not maintain a persistent GPS location history.
  • Contact Book Discovery (Optional & On-Device Hashed): If you opt in to friend discovery, phone numbers and email addresses in your device address book are cryptographically hashed on your device using SHA-256 before transmission to our API, where a server-side HMAC pepper is applied to match other discoverable users. We do not upload, collect, or store your unhashed address book, full contact names, or raw contact lists.
  • AI Place Recommendations & Cached Venue Data: When generating hangout recommendations, we send anonymized search parameters (such as vibe tags, group size, general location label, and time context) to AI services (such as OpenAI). We never send your email address, phone number, or raw contact information to AI recommendation providers. We cache third-party venue details (such as venue names, addresses, coordinates, photos, and ratings sourced from Google Places) to power recommendations and voting.
  • Push Notifications & Device Tokens: If you enable push notifications, we store an Expo push token, device platform, and your in-app notification preferences (such as alerts for active voting windows, RSVP deadlines, and friend requests). Push tokens are automatically deduplicated and evicted from other user accounts on shared devices.
  • Real-Time Synchronization: We use realtime infrastructure (Ably) with scoped channel access tokens (canViewPlan) to provide live voting tallies and plan status updates.
  • Analytics & Usage Data: In production mobile app builds, we use product analytics (PostHog) to understand feature engagement (such as plans created, votes submitted, and invite links redeemed). On our website, PostHog analytics cookies are set only if you provide explicit opt-in consent through our cookie banner.
  • Device Attestation and Diagnostic Information: We collect device type, operating system version, app version, IP address, diagnostic logs, and platform integrity signals (such as Apple App Attest or Google Play Integrity) to protect the Service against fraud, bot abuse, and unauthorized scraping.
  • Web Companion Data: On unplanned.slothmania.com, we use cookies and local storage for essential session authentication (Clerk), cookie consent preferences, and temporary pending invite tokens. See our Cookie Policy for details.

2. How we use information

We use the information we collect to:

  • Provide, operate, and maintain the Unplanned service, including account authentication, friend discovery, vibe selection, AI-assisted venue suggestions, 15-minute voting windows, and realtime coordination.
  • Deliver transactional service communications, including push notifications and SMS verification codes.
  • Personalize venue suggestions based on vibe selections and enforce age restrictions (18+) for alcohol and nightlife venues.
  • Protect the security, integrity, and safety of our users, preventing fraud, spam, automated bot activity, and violations of our Acceptable Use Policy.
  • Understand user trends and optimize product performance through aggregate and product analytics.
  • Provide customer support and respond to user inquiries.

We do not use your personal information to operate a commercial event-hosting platform or public ticketing directory.

3. How we share information

We share information only in the ways described below:

  • With Other Users: When you participate in a plan, your display name, profile avatar/vibe interests, RSVP status, and votes are visible to other participants in that plan according to the design of the Service. Accepted friends can view your profile name, vibes, and base location.
  • With Service Providers (Subprocessors): We share data with trusted third-party service providers who process data on our behalf under strict data protection terms:
    • Authentication: Clerk (user identity, credentials, sessions).
    • Cloud Infrastructure & Database: PostgreSQL hosting and cloud server providers.
    • Venue Data: Google Places API (place search and venue details).
    • AI Recommendations: OpenAI (anonymized recommendation prompts without direct user contact PII).
    • Realtime Messaging: Ably (ephemeral plan coordination and voting sync).
    • Push Notifications: Expo / Apple Push Notification service / Firebase Cloud Messaging.
    • SMS Verification: Twilio, Bandwidth, or ClickSend (phone OTP delivery).
    • Product Analytics: PostHog (in-app feature usage; web opt-in only).
    • Rate Limiting & Caching: Upstash Redis (temporary rate limiting and anti-abuse counters).
  • No Sale of Personal Information: We do not sell, rent, or trade your personal information to third parties, and we do not share your data for cross-context behavioral advertising.
  • Legal and Safety Requirements: We may disclose information if required by law, subpoena, or legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of SlothMania, our users, or the public.
  • Business Transfers: If SlothMania is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction under standard confidentiality protections.

4. Data retention and account deletion

We retain your personal information for as long as your account remains active or as necessary to provide the Service, resolve disputes, maintain safety, and comply with legal obligations.

You can permanently delete your account at any time directly within the mobile app by navigating to Profile → Delete account. When you delete your account:

  • Your user profile, friend connections, contact hashes, and push tokens are immediately and permanently removed from our active database.
  • Your authentication record is deleted from Clerk.
  • Any past plans you created or participated in are anonymized or cleaned up according to our database cascade policies.
  • Residual backup copies are purged in the normal course of backup lifecycle retention (typically within 30 days).

5. Your choices and privacy rights

You have extensive control over your data:

  • Profile and Settings: You can edit your display name, birthdate, base location, and vibe preferences in the app profile settings.
  • Discoverability: You can turn off contact-based discoverability at any time in your profile settings.
  • Device Permissions: You can grant or revoke location, push notifications, and contact access in your mobile device operating system settings at any time.
  • Web Cookies: You can manage or reject non-essential cookies via our website cookie banner or your web browser settings.
  • State Privacy Rights (DSAR): Depending on your state of residence (such as California under the CCPA/CPRA, Virginia, Colorado, Connecticut, Utah, or other applicable jurisdictions), you may have the right to:
    • Request access to and a portable copy of the personal information we have collected about you.
    • Request correction of inaccurate personal information.
    • Request deletion of your personal information.
    • Opt out of the sale or sharing of personal data (we do not sell your data).
    • Not receive discriminatory treatment for exercising your privacy rights.

To submit a Data Subject Access Request (DSAR) or exercise your privacy rights, email us at support@slothmania.com with the subject line DSAR — <Request Type> (e.g., DSAR — Access, DSAR — Deletion). We will verify your identity using your account email address and respond within forty-five (45) days as required by law.

6. Security

We implement technical and organizational security measures designed to protect your information against unauthorized access, loss, misuse, or alteration:

  • Encryption in Transit: All network communication between our client apps, web companion, and API is encrypted using TLS 1.2+ (HTTPS). Production mobile builds include SSL public-key pinning.
  • Secure Local Storage: Authentication session tokens, identity credentials, and temporary invite tokens on mobile devices are stored in OS-level hardware-backed secure storage (iOS Keychain and Android Keystore via expo-secure-store).
  • Contact Cryptography: Friend matching uses client-side SHA-256 hashing and server-side HMAC peppering; raw address books are never uploaded or stored.
  • Server Authorization: All plan access and recommendation requests are strictly authorized on the server (canViewPlan, canRecommendPlaces).

While we take rigorous precautions, no method of electronic transmission or storage is 100% secure. We encourage you to keep your account credentials protected.

7. Children's privacy

The Service is rated 12+ and is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take prompt steps to delete that account and all associated data. If you believe a child under 13 has registered, please contact us at support@slothmania.com.

8. International data transfers

Unplanned is operated and hosted in the United States and is intended for users located in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

9. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technologies, or legal requirements. When we make changes, we will update the "Last updated" date at the top of this policy and provide prominent notice within the app or website where appropriate. Your continued use of the Service after any update constitutes your acceptance of the revised Privacy Policy.

10. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

SlothMania, LLC
Product: Unplanned
Website: https://unplanned.slothmania.com
Email: support@slothmania.com

Questions?

If you have any questions, please reach out to support@slothmania.com