Privacy Policy
Last updated: October 5, 2026
This Privacy Policy explains what information Kespas collects, why, and how it's used.
Information We Collect
- Account information: your name, phone number, and (optionally) email address, collected when you register.
- Location: with your permission, your device location, used to show you nearby events and let friends see relevant map activity. You can deny or revoke this permission at any time in your device settings.
- Contacts: with your permission, we access your contacts to help you find friends who are already on Kespas. We store a hashed version of their phone numbers — never their names, and never a number in plain text — so we can keep matching them going forward, for example to let you know if one of them joins Kespas later. This hashed list is fully replaced each time you sync your contacts.
- Photos and camera: used for profile pictures, QR code scanning (for example, to add a friend), and sharing photos and videos in event chats. Profile pictures, event photos, and photos shared in chat are re-encoded to strip location/EXIF metadata before storage; videos shared in chat are stored as uploaded.
- Messages and event content: the events you create, the chats you participate in, and the messages you send. Chat messages are encrypted at rest.
- Device push token: used to deliver push notifications through Expo's push notification service, if you enable them.
How We Use Your Information
We use the information above to operate the Service: showing you nearby events, connecting you with friends, delivering chat messages and notifications, and verifying your account via SMS. Authorized Kespas staff may also access account and activity information through internal administrative tools, for moderation, customer support, and fraud prevention.
Third-Party Services
Kespas relies on the following third-party services to operate:
- Twilio — sends SMS verification codes and invite texts.
- Amazon Web Services (S3) — stores uploaded photos and event images.
- Centrifugo — our self-hosted real-time messaging server, used to deliver chat messages instantly.
- Mapbox — renders the map and provides location search.
- Google Places — powers address autocomplete when setting your location or an event's location.
- Google (Gemini) — helps discover and generate public event listings shown on the map; processes only public location and category details, not your personal messages or content.
- Sentry — helps us detect and fix crashes and errors; it does not receive your messages or personal content beyond what's needed to diagnose a technical issue.
Each of these providers processes data only as needed to provide their specific service to Kespas, under their own privacy and security practices.
We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.
Data Retention
We retain your account information for as long as your account is active. If you delete your account, we delete your personal information within a reasonable period, except where we're required to retain it for legal or security purposes. Messages and events you've shared with others may remain visible to the people you shared them with after your account is deleted, with your identifying information replaced by a generic label (e.g. "Deleted User") — removing shared content outright would also remove it from the conversations of the people you shared it with.
Your Rights
You can review and update your profile information from Settings at any time, and delete your account at any time. If you have questions about your data or want to request its deletion outside the app, contact support@kespas.com.
Children's Privacy
Kespas is not intended for children under 13, and we don't knowingly collect information from anyone under 13.
Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we'll notify you through the app before they take effect.
Contact
Questions about this policy? Reach us at support@kespas.com.