Privacy Policy

Last updated: September 30, 2026

Brightnight ("we", "us", "the app") is a social app that helps people who are sober, sober-curious, or just exploring find each other, discover alcohol-free-friendly venues, and share moments from nights out without the drinks. This policy explains what personal data we collect, why, how it's protected, and the rights you have over it.

1. Who we are

Brightnight is operated by Diserve Ventures Oy, registered in Espoo, Finland, business ID (Y-tunnus) 2378021-4. For the purposes of GDPR, we are the data controller for the personal data described in this policy.

Contact for privacy questions: max@diserve.com

2. What data we collect

We collect only what the app actually needs to function. Specifically:

Category	What's included
Account data	Email address, password (stored as a secure hash — we never see or store your actual password), account creation date.
Profile data	Name, age, profile photo, bio, sober-since date (optional), interests, self-identification (sober / sober-curious / exploring), and whether your Moments are public or connections-only.
Location data	Your device's location, used to show nearby people and venues. Before it leaves your device it is rounded to an approximate location (about 1 km). We store only this approximate location on your profile and on Moments you post, and a Moment may also show a general area label like "Helsinki, Finland" if you don't tag a specific venue. Other users can see roughly how far away you are, never your exact location.
Photos	Your profile photo and photos you post as "Moments" (a paired photo of where you are and a selfie), uploaded to our storage provider.
Social/relationship data	Connections between you and other users, events you host or mark interest in, drinks you favorite, venues you save, and community tags you or others apply to venues.
Content	Captions, tags, and comments-equivalent content you post.
Safety data	Accounts you block, and reports you file about other users' content — used only for moderation.
Device/technical data	Basic device information needed to run the app and deliver local notifications (we do not currently use any analytics or crash-reporting SDK — see Section 5).

3. Why we collect it, and our legal basis

To provide the app's core functionality (contractual necessity) — your profile, location, and content are the app; without them Discover, Venues, Moments, and Connections don't work.
To keep the community safe (legitimate interest) — blocking and reporting data is used solely for moderation.
Where you've given consent — e.g. granting location permission, or opting into specific notification types, which you can withdraw at any time in Settings or your device's permission settings.

We do not use your data for advertising, and we do not sell your data to anyone.

4. How your data is stored and secured

Data is stored with Supabase, a managed Postgres database provider. Data is encrypted in transit (TLS) and at rest.
Access to your data within our database is enforced with row-level security rules — for example, your private Moments are only readable by you and your accepted connections, never by other users or, in ordinary operation, by us directly querying around those rules.
Passwords are never stored in plain text; authentication is handled by Supabase Auth using industry-standard hashing.
Our database is hosted by Supabase in the EU (Ireland). Some of the providers listed in Section 5 (for example Google and Apple) may process data outside the EU/EEA; where they do, the transfer is protected by safeguards such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

5. Third parties we share data with

We work with a small number of service providers ("processors") who handle data strictly on our behalf:

Provider	What they receive	Purpose
Supabase	All account, profile, and content data described above	Database, authentication, and file storage hosting
Google (Places API)	Approximate location (about 1 km) and any search text when you browse or search Venues	Finding real nearby bars, cafes, and restaurants
Open Food Facts	Drink search text and your country name — no account details or personal identifiers	Looking up non-alcoholic drink products and photos sold in your country
UI Avatars (ui-avatars.com)	Your display name, only if you haven't uploaded a profile photo	Generating a default initials avatar image
Apple	Standard data collected by any iOS app distribution (device identifiers, crash logs at the OS level), and approximate location when converting it into a place name or country	Required for App Store distribution, and Apple's built-in location services — governed by Apple's own privacy policy

We do not currently use any advertising network, analytics SDK, or marketing/tracking tool (no Google Analytics, Meta/Facebook SDK, Mixpanel, etc. are integrated into the app as of this writing).

6. Data retention

We retain your data for as long as your account is active. You can permanently delete your account and all associated data at any time from Profile → Settings → Delete account in the app. This removes your profile, Moments, connections, favorites, and photos immediately, except where we're required to retain something longer for legal reasons (e.g. active safety reports under investigation).

7. Your rights under GDPR

As an EU/EEA resident (or resident of a jurisdiction with similar protections), you have the right to:

Access the personal data we hold about you
Rectify inaccurate data (most of this you can already edit directly in your Profile)
Erase your data ("right to be forgotten")
Restrict or object to certain processing
Data portability — receive your data in a structured, machine-readable format
Withdraw consent at any time, where processing is based on consent
Lodge a complaint with your national data protection authority — in Finland, this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)

To exercise any of these rights, contact us at max@diserve.com.

8. Children's privacy

Brightnight is not intended for anyone under 18 years old. We do not knowingly collect data from children under this age. If you believe a child has created an account, contact us and we will remove it.

9. Changes to this policy

If we make material changes to this policy, we'll notify you in the app before the changes take effect. Continued use of the app after that point means you accept the updated policy.

10. Contact us

Questions about this policy or your data: max@diserve.com
Postal address: Diserve Ventures Oy, Westendinkuja 5b, Espoo, Finland