What we know,
and what we do with it.

1. Who is responsible

The data controller (the “business” in California terms) is THIS WK NYC, New York, New York, United States. Contact for all privacy matters: [email protected]. We have not appointed a data protection officer or an EU/UK representative: the Service is designed for and directed at New York City and we do not target people in the EEA or UK, but we honour the rights described in Section 9 for anyone who uses it from there.

2. What we collect, where it comes from, why, and how long we keep it

What we do not collect: your contacts, precise or GPS location, payment card or bank details, government identifiers, photos of you, biometric or health data, or social-media logins. We do not buy data about you, and we do not use advertising identifiers or tracking pixels. Public event and venue listings are about events, not about our members; where a public dataset could name a private individual (for example a sole-proprietor licence holder), our pipeline discards that record rather than publishing the name.

3. How we use information

• To provide the Service you asked for: accounts, discovery, lists, gangs, chat, invitations, the guest list, export and deletion.
• To personalize discovery using your stated preferences and save/pass history. Recommendations are automated but have no legal or similarly significant effect on you; you can change or clear preferences in your taste settings at any time. Optional gang suggestions use only what the gang's members already see (proposals, votes, the locked plan) and never your private saves or taste.
• To secure the Service: rate limiting, CSRF protection, session management, abuse investigation, and enforcing blocks, exclusions and our Terms.
• To send transactional email: verification, password reset, and — only when needed — notices about your account, the Terms or this policy. We do not send marketing email and do not use open- or click-tracking in account mail.
• To measure use of public pages, only with your consent (Section 2, “Analytics”).
• To comply with law and respond to lawful requests, and to establish, exercise or defend legal claims.

We do not use your personal information to train AI or machine-learning models. Automated and AI-assisted tools are used on event source material (public listings, newsletters, flyers) to build the guide; your account data, lists, notes, chat and profile are never sent to an AI provider.

3a. Optional planning controls and event classification

Clarification added September 22, 2026. A preferred borough is where you want to go, not a request for your home address. A ticket budget is an outing preference, not your income. We do not ask for your birth date, gender, ethnicity, religion, health, sexual orientation or other demographic traits to rank events, and we do not infer those traits from your choices.

You can change or clear these choices, or switch off personal ranking, in your taste settings. Switching it off stops preference and history-derived ranking adjustments; your explicit pass and category-mute controls still apply. It does not delete your saved events or plans. Clearing choices removes those preference values. Account export includes them, and deleting your account removes them.

We use TypeSafe's JEV model through OpenRouter to classify public event descriptions into activity signals such as learning by doing, outdoor nature, art and discussion, and adventurous live music. This server-side work sends bounded public listing text, not your account, preferences, saves, private gatherings, lists, messages or browsing identifiers. It adds no browser cookies. Requests ask for provider routing that disallows data collection for training; this is not a claim of zero provider retention.

The application combines cached event signals with the choices you make locally. These signals are estimates, not verified facts. They do not determine ticket prices, admission, age eligibility, membership, or permissions. Missing or outdated classifications fall back to the existing ranking; an unavailable model does not prevent browsing. Our ranking combines editorial quality, supported preference matches, activity history when personalization is on, and variety across categories and venues. Contact us if a recommendation seems inaccurate or you want help exercising your rights.

4. Who can see or receive your information

1. Other members. Your handle is the only identity other members see; your email and greeting name are private. Members of a gang see the shared lists, notes, proposals, votes, roster and the chat they are entitled to read. Hosts see the handle, request and note of people who ask to join their gathering; approved guests see the host's arrival details. Anyone holding a read-only list link sees that list's title, description and events. Gang link previews show the name, introduction and headcount. Anything you share can be copied by the people you share it with.
2. Service providers (processors) that act on our instructions under contracts restricting their use of your data:
   • Our own server in the United States, which stores the database and runs the application.
   • Cloudflare, Inc., whose network carries all traffic between your browser and our server, provides TLS and denial-of-service protection, and keeps its own short-term connection logs. Cloudflare may set strictly necessary security cookies (see the Cookie Policy).
   • Resend, Inc., our transactional email provider, which receives the recipient address and the content of verification and reset messages.
   • Google LLC (Google Analytics 4), only when you have accepted analytics cookies, as described in Section 2 and the Cookie Policy. Google acts as our processor for measurement; we have not enabled Google Signals, advertising features or data sharing with Google's advertising products.
3. Websites that host event images and listings. Event artwork is displayed directly from its original host, so that host's server receives an ordinary image request from your browser, including your IP address and browser details, exactly as if you had visited it. When you follow a ticket or listing link you leave the Service; we send no referrer, and the destination's own privacy policy applies.
4. Legal, safety and successors. We may disclose information if required by law, subpoena or court order; to protect the rights, property or safety of members, the public or us; to investigate fraud or abuse; and to a successor if the Service is transferred (we would post notice before your data became subject to a different privacy policy).
5. At your direction, for example when you export your data.

We do not sell personal information, do not share it for cross-context behavioral advertising, and have not done so in the preceding 12 months. We do not disclose personal information to third parties for their own direct marketing.

4a. Introductions to gatherings

Added October 3, 2026. A host may let each guest they approve directly introduce a small number of friends with a single-use link. Here is exactly who sees what.

• The host sees who introduced whom: an introduced request is shown with the introducing guest's handle (“via @handle”), and if that guest later withdraws, is declined or revoked, or deletes their account, the host sees that the introducer left. The host decides on every introduction by hand; a link never admits anyone.
• The introducing guest sees only the state of each link they issued — unused, used, expired or revoked — and how many introductions they have left. They are never told who used a link, what the friend wrote, or what the host decided.
• Whoever opens a link sees the gathering's title, approximate area, date, the host's handle and the introducer's handle. Opening a link discloses that the introducer is an approved guest of that gathering, so give links only to people you would tell that yourself. Nothing is created until the person signs in and chooses to ask; viewing a link never consumes it.
• Links are bearer capabilities until used. Anyone holding the link can present it, so treat it like a key: send it privately, and revoke it from the gathering page if it goes astray. We store only a hash of the link, never the link itself; a used, expired or revoked link shows a generic unavailable page that reveals nothing about the gathering. Link pages are never included in analytics and are served with no-store and no-referrer headers.
• Blocks apply. A link cannot be used between members who have blocked each other, in either direction, and the same check applies to direct requests and to the host's approval.
• Deletion and export. Deleting your account revokes your unused links; people you introduced who were already approved keep their place and are shown to the host as introduced by a former guest, and the fact that your own request came through an introduction is kept so that nobody is promoted to a direct guest by a deletion. Your export lists the links you issued (state and dates only, no link or hash, no redeemer) and whether each of your own requests was introduced.

4b. Hosting the gang: private gatherings

Added October 3, 2026. A gang's owner may host a private gathering around the gang's settled plan — a meet-up before, a supper after. It is never listed, nobody can ask for a place, and no link grants access: when the host first sends it, every current member of the gang (other than the host, and skipping anyone blocked by or blocking the host) receives an individual invitation that holds one guest place until a fixed deadline. Each member accepts or declines for themselves; silence, a vote, or joining the gang never counts as acceptance. Here is who sees what.

• The host sees which members were invited, who accepted, who said no thanks, whose invitation expired or was withdrawn, and the handles of accepted members. The host never sees a note (there is none) and never sees anything about members of other gangs.
• An invited member sees the gathering's title, description, approximate area, date, host and their own invitation state. Only after accepting do they see the private arrival details and calendar file. They never see who else was invited or how anyone else answered; the gang's existing roster, votes and chat are unchanged and no attendance roster is added.
• Everyone else — other gang members who were not invited, members who joined after the send, and anyone guessing a URL — gets the same generic unavailable page as for a record that does not exist. The public guest list, read-only plan links, gang previews and event pages never mention these gatherings.
• Blocks apply. No invitation is sent between members who have blocked each other, and an unanswered invitation cannot be viewed or accepted while a block stands in either direction. A block does not by itself take back a place already accepted; the host can withdraw it explicitly, and leaving or being removed from the gang does release it.
• Leaving and deletion. Invitations are tied to your current membership: leaving or being removed from the gang deletes your unanswered invitation and releases any place you accepted; rejoining later starts fresh with no old invitation. If the host leaves the gang or deletes their account, the gathering is cancelled — hosting never passes to another member. Deleting the gang cancels every gathering hosted for it. Deleting your own account removes invitations addressed to you and your places; gatherings you host are deleted as today.
• Export. Your export lists invitations addressed to your current memberships (state, dates and your own answer) and, for gatherings you host, the state and dates of each invitation you sent — never recipients' identities. The gang and plan a hosted gathering was made from are included only while you are still a member of that gang.
• What a place is. A held or accepted guest place is a seat at the host's own gathering. It is not a ticket, a reservation or entry to any event in the plan. Downloaded calendar files and screenshots cannot be recalled if a place is later given up or withdrawn. These pages are never included in analytics and are served with no-store, no-referrer and noindex headers.

5. Cookies and similar technologies

The Service uses two strictly necessary cookies (session and CSRF protection), one cookie recording your analytics choice, and — only if you accept — Google Analytics cookies on public pages. There is no local-storage tracking, no fingerprinting, and no third-party advertising technology. Details, durations and controls are in the Cookie Policy. We honour the Global Privacy Control and Do Not Track browser signals as a refusal of analytics.

6. International transfers

The Service is operated from the United States and your information is stored there. If you use it from the European Economic Area, the United Kingdom, Switzerland or elsewhere, your information is transferred to the US. For your own account data the transfer is necessary to perform the contract you asked for (GDPR Art. 49(1)(b)). Cloudflare and Google are certified under the EU–US Data Privacy Framework and its UK and Swiss extensions; our other providers offer standard contractual clauses. You can ask us at [email protected] for more information about the safeguards.

7. Security

We protect your information with HTTPS everywhere, HTTP Strict Transport Security, Secure/HttpOnly cookies, a strict Content Security Policy, signed CSRF tokens, origin checks, request-size limits, rate limiting on every credential path, scrypt password hashing, hashed session and one-time tokens, per-request access checks on every private page, and restricted server access. Password changes invalidate other sessions and outstanding reset links. Routine URL access logging is disabled so that private links do not sit in logs. No system is perfectly secure; if we discover a breach affecting your data we will notify you and any regulator as the law requires. Please use a unique password, keep invitation and reset links private, and revoke other sessions if something looks wrong.

8. Retention and deletion

We keep your information for as long as your account exists, then delete it as follows. Deleting your account (from your account, with password confirmation) immediately and permanently removes your login, email, greeting name, handle, preferences, saves and passes, sessions, tokens, follows and blocks, private lists, join requests, invitations, and the gatherings you host. Click records lose their link to you and remain as anonymous counts. Shared gangs pass to their longest-standing remaining member, and the shared lists, votes, proposals and chat in them remain visible to those members with your account detached; a gang with nobody else in it is deleted. Chat text you removed is erased at removal, leaving a dated tombstone so open rooms update. Rate-limit records are discarded after 24 hours regardless. Backups are overwritten on a rotating schedule and are not searched or restored except to recover from a failure. Copies other members made of what you shared are outside our control.

9. Your rights (everyone, including EEA, UK and Swiss residents)

You can do most of this yourself, right now, in your account: see and change your greeting name and handle, adjust preferences, download a JSON export of your data, change your password, revoke other sessions, and delete your account. For everything else — including changing the email on your account — write to [email protected] from the address on the account (or tell us how to verify you). We answer within one month (30 days), extendable by two months for complex requests, and never charge for a first request.

Where the GDPR or UK GDPR applies, you have the right to: access your personal data and information about how we use it; rectify inaccurate data; erase your data; restrict processing; data portability (the export is machine-readable JSON); object to processing based on legitimate interests, including personalization; withdraw consent at any time (for analytics, on the cookie page) without affecting earlier processing; not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we make none); and to lodge a complaint with a supervisory authority, in particular in the EU/EEA member state of your habitual residence, place of work or alleged infringement, with the UK Information Commissioner's Office (ico.org.uk), or with the Swiss FDPIC. We would appreciate the chance to address your concern first.

We will not treat you differently for exercising any right. We may decline requests that are manifestly unfounded, excessive, would adversely affect the rights of others (for example, revealing another member's private data), or that we cannot verify.

10. California residents (CCPA/CPRA)

The Service may not meet the revenue or volume thresholds that make the California Consumer Privacy Act apply, but we honour its rights for every California resident regardless. This Section, with Section 2, is our notice at collection.

Categories collected in the last 12 months (statutory categories in Cal. Civ. Code §1798.140): Identifiers (email, handle, IP address, cookie identifiers); customer records (§1798.80(e): name, if you give a greeting name); internet or other electronic network activity (pages viewed, saves, passes, click-throughs, analytics data if consented); inferences (recommendations drawn from preferences and saves); sensitive personal information limited to your account log-in credentials, which we use only to provide the Service and secure your account, purposes for which the CPRA does not grant a right to limit. We do not collect precise geolocation, financial, government-ID, biometric, health, racial or ethnic, religious, union, sexual-orientation or communications-content data other than the messages you send through the Service to people you chose.

Sources: you, your device and browser, and other members when they address an invitation or request to you. Purposes: Section 3. Disclosed for a business purpose to the service providers in Section 4 (categories: identifiers, internet activity; and to Google, only with consent, identifiers and internet activity). Sold or shared: none. We have no actual knowledge that we sell or share the personal information of anyone under 16.

Your rights: to know and access the specific pieces and categories of personal information we hold and how we use and disclose it; to delete; to correct inaccurate information; to data portability; to opt out of sale or sharing (we do none, and we treat a Global Privacy Control signal as an opt-out anyway); to limit the use of sensitive personal information (not applicable, as explained above); and to non-discrimination for exercising them. Exercise them in your account or by emailing [email protected] with the subject “California privacy request”. We verify requests by matching the email address on the account and, where needed, a signed-in confirmation. An authorized agent may submit a request with your written permission; we may still ask you to confirm it directly. We respond within 45 days, extendable once by 45 days with notice. If we deny a request you may ask us to reconsider by replying to our response. We offer no financial incentives for personal information. Shine the Light (Cal. Civ. Code §1798.83): we do not disclose personal information to third parties for their direct marketing.

11. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other US states with privacy laws

Where those laws apply, you have rights to confirm whether we process your personal data and access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do none of the latter three. Exercise your rights in your account or by email to [email protected]; we respond within 45 days, extendable by 45 days with notice. If we decline a request, you may appeal by replying with “Appeal” in the subject within 45 days; we will answer in writing within 45 days with our reasons, and if the appeal is denied you may contact your state Attorney General. Nevada residents: we do not sell covered information as defined in NRS 603A.

12. Children

The Service is for adults. We do not knowingly collect personal information from anyone under 18, and never from children under 13 (or under 16 where the GDPR sets that age). If you believe a minor has an account, email [email protected] and we will delete it promptly.

13. Changes to this policy

We will post any change here with a new effective date. For material changes we will give at least 14 days' notice in the Service or by email to account holders before the change applies, and where a change would rely on your consent we will ask for it. Earlier versions are available on request.

14. Contact

THIS WK NYC · New York, New York, United States · [email protected]. Version 2026-09-21, effective September 21, 2026.