Privacy Policy

Last updated: 2026-04-26

Eventfull Ltd. ("we", "our", or "us") operates the EventFull mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the App.

We respect your privacy and are committed to protecting your personal data in line with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (PDPO) and the Personal Data Protection Act 2012 of Singapore (PDPA), the two regimes that primarily govern our launch markets. Where applicable, we also strive to align with the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA); see Section 6 for jurisdiction-specific rights.

By using the App, you agree to the collection and use of information in accordance with this Policy.

1. What Information We Collect

We collect information you give us directly, information generated by your use of the App, and information from third-party services you choose to link.

1.1 Information you provide

Account profile — display name, email address, profile photo (stored in Firebase Storage), city, age range, dietary preferences, allergies, and interest tags.
Event content — events you create or join, RSVPs, vote selections, task assignments, chat messages, expense records, and uploaded cover images.
Payment metadata — local transfer reference notes (e.g. PayMe / FPS in Hong Kong, PayNow in Singapore). Eventfull Ltd. does not custody funds and does not collect bank account or card numbers.

1.2 Information generated automatically

Anonymous user identifier — when you first open the App as a guest, we provision a temporary Firebase">https://firebase.google.com/docs/auth/flutter/anonymous-auth">Firebase Anonymous Authentication UID so you can browse public Community events without registering. This anonymous UID is not linked to a real-world identity and is automatically cleared after 30 days of inactivity, or immediately upon successful account registration (the anonymous UID is upgraded to your registered account via Firebase's account-linking flow, preserving any data you created as a guest).
Device & diagnostics data — Firebase Cloud Messaging (FCM) push token (used to deliver event reminders and chat notifications), device model, operating system version, app version, and crash reports collected by Firebase Crashlytics. Crash reports include stack traces and the path of the screen where the crash occurred, but no personal content from the affected screen.
Approximate location (city level only) — when you opt in to filter Community events by city. We do not collect precise GPS coordinates unless you explicitly attach a location to an event you are creating.

1.3 Information from third parties

Apple Sign In / Google Sign In — when you choose to authenticate with these providers we receive your verified email address and (where permitted by the provider) your display name. We do not receive passwords. Apple Sign In may return a relay email instead of your real email; we treat the relay address the same way as a real email.

2. How We Use Your Information

To create and maintain your account and authenticate you on every launch.
To render the App's features: Discovery feed, event detail pages, RSVP, voting, chat, expense splitting, and AI-assisted planning helpers.
To deliver push notifications for events you participate in (RSVP reminders, chat messages, host announcements).
To detect, investigate, and prevent fraud, abuse, harassment, or other violations of our Terms of Service.
To improve App stability and performance based on aggregated crash and performance data.
To respond to your support requests and to communicate material changes to this Policy or to our Terms of Service.

We do not sell your personal information to third parties, nor do we use it for cross-context behavioural advertising.

3. Third-Party Services

Eventfull Ltd. is built on top of several third-party services. Each sub-processor below has its own privacy policy that governs its handling of data we share with them.

Service	Purpose	Privacy policy
Firebase Authentication (Google)	Anonymous + email + Apple/Google sign-in	https://firebase.google.com/support/privacy
Cloud Firestore	Storing your account profile, events, RSVPs, chats	https://firebase.google.com/support/privacy
Firebase Storage	Hosting your profile photo and event cover images	https://firebase.google.com/support/privacy
Firebase Cloud Messaging	Delivering push notifications	https://firebase.google.com/support/privacy
Firebase Crashlytics	Crash and stability diagnostics	https://firebase.google.com/support/privacy
Apple Sign In	Optional sign-in provider	https://www.apple.com/legal/privacy/
Google Sign In	Optional sign-in provider	https://policies.google.com/privacy
Unsplash	Stock photography for event covers	https://unsplash.com/privacy

We do not currently use Firebase Analytics or any third-party analytics SDK. We do not embed advertising SDKs.

Future payment providers: If we later enable a third-party payment processor (such as Stripe, PayMe, or PayNow), your payment information will be handled in accordance with that provider's privacy policy. We will notify you at least 30 days in advance through an in-app notice before any such service is enabled.

4. Data Sharing

We share your data only in the following circumstances:

With other event participants — your display name, profile photo, RSVP status, dietary preferences, and any chat messages you post are visible to other members of the same event. The host of an event you RSVP to can see your dietary preferences and any custom answers you submit.
With sub-processors — the services listed in Section 3 process data on our behalf and are bound by their own data-protection commitments.
For legal reasons — we may disclose information when required by law, subpoena, or other legal process, or to protect the safety of users, the public, or our service.
In a corporate transaction — if Eventfull Ltd. is acquired or merged with another entity, your data may be transferred. We will provide notice and an opportunity to delete your account before any transfer takes effect.

We do not share your data with advertisers or data brokers.

5. Data Retention

Active accounts — we retain your data for as long as your account is active and the data is necessary to provide the service.
Account deletion — when you delete your account through the App, we remove your personal profile data within 30 days. Some content you contributed to events with other participants (e.g. chat messages) may be retained in those events to preserve other users' context, but it will be anonymised — your name will be replaced with a placeholder.
Anonymous users — temporary Firebase Anonymous Authentication UIDs used for guest browsing are automatically cleared after 30 days of inactivity. Anonymous users hold no Firestore data of their own.
Backups & legal holds — encrypted backups may persist for an additional 30 days, after which they are overwritten. Where we are legally required to retain records (e.g. for tax or fraud investigation), we keep only the minimum required data for the applicable retention period.
Crash logs — Firebase Crashlytics retains diagnostic data for up to 90 days under Google's default retention policy.

6. Your Rights

6.1 Hong Kong residents (PDPO)

Under the Personal Data (Privacy) Ordinance (Cap. 486) you have the right to:

Request access to the personal data we hold about you.
Request correction of inaccurate personal data.
Object to certain processing.
Withdraw your consent at any time.

Submit data-access or data-correction requests to info@eventfull.me. We will respond within 40 days, as required by the PDPO.

6.2 Singapore residents (PDPA)

Under the Personal Data Protection Act 2012 you have the right to:

Request access to your personal data and information about how it has been used.
Request correction of personal data that is inaccurate or incomplete.
Withdraw consent for further use or disclosure of your personal data.
Where applicable, request data portability for personal data we hold about you in a structured, machine-readable format.

Submit requests to info@eventfull.me. We will respond within 30 days, as required by the PDPA.

6.3 EU / UK residents (GDPR placeholder)

If you are located in the European Union or the United Kingdom, you may also have the rights to data portability, restriction of processing, and erasure ("right to be forgotten"). Please contact info@eventfull.me to exercise these rights. We will treat your request in line with the principles of the GDPR / UK GDPR pending a full review of EU-specific obligations before formal launch in those markets.

6.4 California residents (CCPA placeholder)

We do not sell your personal information. If you are a California resident, you may request the categories of personal information we collect about you and request deletion. Please contact info@eventfull.me.

7. Children's Privacy

Eventfull Ltd. is not directed to children under the age of 13, and we do not knowingly collect personal data from children under 13. If you become aware that a child has provided us with personal data, please contact us at info@eventfull.me and we will delete the information promptly. We may require additional age verification before allowing account creation in certain regions where local law mandates a higher minimum age.

8. Data Security

Eventfull Ltd. implements industry-standard security measures to protect user data; however, no method of transmission or storage is completely secure. We cannot guarantee the absolute security of your information and disclaims all liability for unauthorised access, disclosure, or loss of data. By using the app, you acknowledge and accept these risks and agree to take appropriate steps to protect your personal information.

9. Cookies & Analytics

The App is a native mobile application and does not use browser cookies. We do not currently use Firebase Analytics, Google Analytics, or any third-party analytics SDK. The only diagnostic data we collect is crash and performance data via Firebase Crashlytics (Section 1.2). If we introduce analytics in the future, we will update this Policy and notify you in-app at least 30 days before activation.

The App's privacy-policy and terms-of-service web pages (https://eventfull-f8060.web.app/privacy and /terms) are static documents and do not set tracking cookies.

10. Changes to This Policy

We may update this Policy from time to time to reflect changes to our practices, services, or applicable law. When we make material changes we will:

Update the "Last updated" date at the top of this document.
Notify you in-app at least 30 days before any material change takes effect, so you have time to review and decide whether to continue using the App.
For non-material changes (typo fixes, clearer wording, additional contact methods) we may publish the update without an in-app notice.

Continued use of the App after the effective date of an updated Policy constitutes acceptance of the changes.

11. Contact Us

For privacy-related questions, data-subject access or correction requests, or anything else covered by this Policy:

Email: info@eventfull.me
Mailing address (operations team):

*To be provided once Eventfull Ltd. registration details are finalised.*