Privacy policy

Tabi ("we", "us") is an app for meeting people nearby through short, time-boxed activities. This policy explains what we collect when you use the Tabi app and this website, why, who we share it with, and the choices you have. Tabi is run by Kimani McLeish in Kingston, Jamaica. Questions go to kimanimac2005@gmail.com.

The short version

• We collect what the app needs to work: your account, your profile, the quests you post and join, and where you are (coarsely, or exactly only when it matters).
• Your exact live location is shared only with the people on a quest with you, only while that quest is on, and is never saved.
• We don't sell your data, show ads, record audio, or keep photos of ID documents.
• You can delete your account in the app at any time.

What we collect

• Account. Your email address and sign-in details, handled by our sign-in provider. If you sign in with Apple or Google, we receive the email and name they share. We never see or store your password in plain text.
• Profile. Your date of birth (to confirm you're 18 or older; it isn't shown to anyone), your @handle, an optional first name or nickname, your interests, and how your mascot looks.
• Quests and activity. Quests you post (kind, title, description, time, length and meeting point), quests you join or ask to join, check-ins that prove a meeting happened, completions, XP, achievements, ratings and shout-outs you give, friends, parties, guilds and polaroids you agree to keep.
• Messages. Text messages in quest, friend and party chats, kept so the people in a chat can read its history and so reports can be reviewed.
• Location. The app uses your location only while it's open. To show quests near you and to post one, it sends your position as the centre of a search. For things about your area (the sky, your area's name, its boss), it sends only a coarse cell about a kilometre across. If you go "available", only a cell about 460 metres across is stored, and it expires. During an active quest, your exact position is broadcast to the other people on it so you can find each other; this is never written to our database.
• Safety. Trusted contacts you add (name, phone number and optional email), safety timer and SOS events for your quests, and reports and blocks you make.
• Device. A push notification token so we can send you quest and safety alerts, and basic technical logs (like errors and request times) that our servers keep for a short time.

How we use it

• To run the app: show quests near you, match you with people, check you in, keep score, and send notifications you've allowed.
• To keep people safe: run safety timers, alert your trusted contacts when you press SOS or don't check in, enforce the 18+ rule, review reports and moderate content.
• To fix problems and keep the service secure.

We don't use your data for advertising and we don't sell it.

Who can see what

• Anyone in the app can see quests on the map at their meeting points, and a profile card's top: your mascot, first name, @handle and level.
• People on a quest with you see more of your card, your messages in that quest's chat, and your live location while the quest is active.
• Your trusted contacts are only ever contacted when a safety alert is sent. An SOS text names you, the kind of quest, where and when it started, and who you were with.
• Available people are shown only as coarse areas, never exact positions.

Services we rely on

We share data with these providers only so they can run parts of Tabi for us:

• Clerk for accounts and sign-in.
• Supabase for our database and realtime messaging.
• Railway for hosting our servers.
• Mapbox for maps and place search. Your device sends map views and searches to Mapbox directly.
• Expo for app updates and push notifications.
• Open-Meteo for weather, looked up by coarse area only.
• Vercel for hosting this website.
• An email provider for safety alerts sent to trusted contacts.

We may also disclose information if the law requires it, or to protect someone from serious harm.

How long we keep it

• Your data is kept while your account exists.
• When you delete your account, your profile, quests, messages and everything else personal is deleted. A minimal safety record (safety timer and SOS times, and the reason and status of reports, with no messages, phone numbers, emails or locations) is kept for 90 days so that safety reports can still be acted on, then erased.
• Live location during a quest is never stored. Availability cells expire on their own.

Your choices

• Delete your account in the app: Profile, then Delete account. If you can't, email us and we'll do it.
• Turn location or notifications off in your phone's settings at any time (the map needs location to show quests near you).
• Ask us for a copy of your data, or to correct it, by emailing kimanimac2005@gmail.com.
• Depending on where you live, you may have more rights under local law, such as Jamaica's Data Protection Act. Contact us to use them.

Age

Tabi is only for people 18 and older. We confirm your date of birth before you can use it, and remove accounts that turn out to belong to anyone younger.

Security

Data is encrypted in transit, access is limited by row-level rules in our database, and only the people who need to see something can. No system is perfectly secure, so please tell us at once if you think your account has been misused.

Changes

If we change this policy in a meaningful way, we'll tell you in the app before it takes effect. The date at the top shows when it last changed.