Skip to content
Live now on the App StoreAlso on Google PlayLondonClock inOracle picks the nightCross pathsClimb the ranksFree, Explorer, Icon30% off yearlyNo card to startThe Owl RemembersLondon nightlife, levelled upLive now on the App StoreAlso on Google PlayLondonClock inOracle picks the nightCross pathsClimb the ranksFree, Explorer, Icon30% off yearlyNo card to startThe Owl RemembersLondon nightlife, levelled up
MYSOVA
Privacy

Privacy Policy

Last updated: 14 October 2026 (Version 1.2)

Effective from 30 October 2026 (Version 1.2). Until then, Version 1.1 applies.

Introduction

MYSOVA LTD ("MYSOVA", "we", "us", "our") operates the MYSOVA mobile application, a London nightlife social platform for discovering venues, clocking in, earning XP, and forming social connections with other users, and the website at mysova.co.uk.

This Privacy Policy explains what personal data we collect, how we use it, with whom we share it, and what rights you have under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

The full and authoritative version of this policy is published at https://mysova.co.uk/privacy. The same policy is shown in the app and is updated alongside this page.

By creating an account and using MYSOVA, you confirm you have read and understood this policy. If you do not agree, please do not use the app.

Data controller: MYSOVA LTD (company number 17154283), London, United Kingdom
Designated data protection contact: Pavel Vassiltsenko (Director)
Contact: privacy@mysova.co.uk

Data We Collect

We collect the following categories of personal data:

Account Data

  • Email address (used for login and communications)
  • If you sign in with Apple or Google, the name and email address they share with us (Apple may give us a private relay address instead of your real one)
  • Date of birth (used to confirm you are 18 or over)
  • Username and display name
  • Profile photo(s), a short bio and interests you choose to add
  • Gender, only if you choose to add it to your profile (it is optional and can be removed at any time)
  • Phone number, only if you verify one (it is required to use Paths; we send it a one-time code by SMS)
  • Subscription tier and payment status, and the receipts Apple or Google send us to confirm a purchase
  • The version of this policy you accepted and when you accepted it, as a record of consent

Location Data

  • When you clock in or out of a venue or landmark, your device sends its current coordinates so we can check you are within 75 metres. We store the venue and the time, not the coordinates. If the check suggests location spoofing (for example, an impossible journey between two venues), we keep the coordinates of that attempt as a fraud-prevention record
  • While the app is open, your location is used on your device to show the map, sort nearby venues, and work out walking distances. To answer a SOVA question, our servers use your location to find nearby venues; your coordinates are not sent to the AI provider
  • If you ask for walking or public transport directions, your starting point and the venue are sent to Mapbox (walking) or Transport for London (public transport) to plan the route
  • Live location, only if you turn on "Share live location" inside a squad. While that squad screen is open, your exact coordinates are sent about once a minute, stored against your squad membership on our servers, and shown to the other members of that squad. Sending stops when you turn the toggle off or leave the screen. Each update overwrites the last, so we hold only your most recent position
  • We do not track your location in the background or when the app is closed

Usage Data

  • Venues and landmarks you have visited and clock-in and clock-out times
  • XP earned, streaks, badges unlocked, and rank history
  • Challenges completed and leaderboard position
  • Venue ratings, event RSVPs and venues you save
  • SOVA questions you ask and the answers SOVA gives

Social Data

  • Crossed Paths: when you and another user clock in to the same venue on the same night, we record that encounter so we can suggest you to each other, and we store the choices you each make (cross back or let it pass)
  • Friends, and messages sent within the app (one-to-one and party chats)
  • Photos you attach in chats. Media is stored until the message is deleted or expires. (Voice notes are not available yet; if they launch, this policy will be updated first.)
  • Party membership and Mega Clock-In participation
  • Reports you make, people you block, and social features you enable or disable in settings

Support Data

  • Messages you send us through Help > Send Feedback, with any attachment you add and basic device details (app version, operating system), and our replies

Device Data

  • Operating system, device model and app version
  • Crash reports and performance diagnostics (via Sentry)
  • With your consent, in-app usage analytics, including how long clocking in and out takes on your device (via PostHog — see Third-Party Services)
  • Push notification device token (via Expo)

We do not ask for special category data (such as health, religion or sexual orientation). Some venues you clock in to could suggest something sensitive about you to other people. We do not use clock-ins to infer sensitive characteristics, and you control who sees your clock-ins in your privacy settings.

How We Use Your Data

We use your personal data for the following purposes:

Service Delivery
To create and maintain your account, enable clock-ins, calculate XP and streaks, award badges, process subscriptions, and provide all core app features.

Personalisation
SOVA uses your interests, clock-in history, level, tier, and the current time to generate personalised venue recommendations and nightlife insights.

Social Features
To power the Paths matching system, facilitate messaging, support party creation, and show you activity from people you are connected with.

Safety and Moderation
Photos you upload to your profile or to a chat are checked automatically for adult or violent content. A photo the check flags, or that cannot be checked, is hidden and held for review by a member of our team. We also review reports you and others make, and act on them.

Fraud Prevention
To detect location spoofing and other attempts to earn XP or prizes unfairly. A flagged clock-in can be refused or have its XP withheld; you can ask us to review any such decision by emailing privacy@mysova.co.uk.

Notifications and Emails
To send you alerts and emails about your account, subscriptions, friend clock-ins, new Crossed Paths connections, event reminders, level-ups and milestones, and (with your consent) marketing messages. You can turn each type off in Settings > Notifications or unsubscribe from any email.

Service Improvement
To analyse how the app is used, fix bugs via crash reports, and improve features over time.

Age Verification
To make sure that all users are aged 18 or over at the point of registration.

Legal Basis for Processing

Under the UK GDPR, we process your personal data on the following legal bases:

Contract (Article 6(1)(b))
Processing necessary to deliver the MYSOVA service you have signed up for: your account, clock-ins, XP, SOVA, social features, messaging, squad live location when you turn it on, subscriptions, and the service emails and notifications that go with them.

Consent (Article 6(1)(a))
In-app analytics (PostHog), marketing communications (email and push), and optional analytics cookies on our website. You may withdraw consent at any time in Settings > Data Preferences, in your notification settings, through the unsubscribe link in any email, or through the cookie banner on our website.

Legitimate Interests (Article 6(1)(f))
Keeping MYSOVA adults-only, security monitoring, fraud prevention, photo moderation and handling reports, crash reporting via Sentry, measuring whether our emails are delivered, answering support messages, and improving app performance, where our interests are balanced against your rights.

Legal Obligation (Article 6(1)(c))
Keeping records we are required to keep by law, such as tax and accounting records, and responding to lawful requests from authorities.

Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Third-Party Services

We share limited data with trusted third-party processors to deliver our service. All processors are contractually bound to handle your data securely and only for specified purposes. Where a processor is outside the UK, see International Transfers below.

Supabase (database, authentication, file storage and server functions)
Your account data, clock-in records, social data, photos and messages are stored in Supabase's cloud database. Data is hosted within the European Union.
Privacy policy: supabase.com/privacy

Anthropic (SOVA recommendations)
When you ask SOVA a question, the text of your recent SOVA conversation is sent to Anthropic's API to generate a reply, together with your level, rank, tier, interests, number of clock-ins, the current London time, and a list of nearby venues and events with walking distances. We do not send your name, email address, phone number, exact coordinates, or your friends' activity. Anthropic deletes these inputs and outputs within 30 days, except where it must keep them longer to enforce its usage policies or comply with law.
Privacy policy: anthropic.com/legal/privacy

Twilio (phone verification)
If you verify a phone number, it is sent to Twilio to deliver a one-time code by SMS.
Privacy policy: twilio.com/legal/privacy

Resend (email delivery)
Your email address and the content of each email we send you pass through Resend, which delivers them and tells us whether each was delivered.
Privacy policy: resend.com/legal/privacy-policy

Google Cloud Vision (photo moderation)
Photos you upload to your profile or a chat are sent to Google Cloud Vision's SafeSearch check, using a link that expires after 60 seconds, to screen for adult or violent content.
Privacy policy: cloud.google.com/terms/cloud-privacy-notice

Sentry (crash reporting and performance monitoring)
Crash reports may include device information, app version, and stack traces. A crash may also attach a picture of the screen you were on, but only from a short list of screens that hold no personal content — pricing, the shop, challenges, your interests, and the legal pages. Everywhere else, no picture is taken. Sentry does not receive your personal profile data.
Privacy policy: sentry.io/privacy

PostHog (product analytics — only with your consent)
If you opt in to analytics in Data Preferences, PostHog receives usage events (screens viewed, taps, and how long clocking in and out takes) linked to your account, together with your username, subscription tier and XP. Taps are recorded as the identifier of the control you touched, never its contents — the contents of messages, profiles and search boxes are not collected. Session replay is not enabled. Data is processed in PostHog's EU region. You can withdraw consent at any time in Settings > Data Preferences.
Privacy policy: posthog.com/privacy

Mapbox (venue map and walking directions)
The city map is rendered by Mapbox, which receives your device's IP address and the map tile requests needed to display the map. If you ask for walking directions, Mapbox also receives your starting point and the venue's location.
Privacy policy: mapbox.com/legal/privacy

Transport for London (public transport directions)
If you ask for public transport directions, your starting point and the venue's location are sent to TfL's journey planner. TfL handles that request as an independent organisation under its own privacy notice.
Privacy notice: tfl.gov.uk/corporate/privacy-and-cookies

Upstash (rate limiting)
To stop abuse of some features (SOVA, photo upload checks and account deletion), our servers keep short-lived counters in Upstash, keyed by your account ID.
Privacy policy: upstash.com/trust/privacy.pdf

Expo (push notifications)
Push notification tokens are managed via Expo's notification infrastructure, which passes notifications to Apple or Google for delivery. Notification payloads contain only the data needed to deliver the alert.
Privacy policy: expo.dev/privacy

Apple / Google (sign-in, subscription payments and app distribution)
If you use Sign in with Apple or Google sign-in, they confirm your identity to us. Payment transactions are processed directly by Apple (App Store) and Google (Play Store); we send them your purchase receipt to confirm it and they tell us when a subscription renews, lapses or is refunded. MYSOVA does not store your payment card details. You can manage subscriptions through your device settings. Your use of the app is also subject to the privacy policies of Apple and Google, which govern their own data collection.

Vercel (website hosting)
Our website is hosted by Vercel, which processes your IP address and browser details to serve the pages.
Privacy policy: vercel.com/legal/privacy-notice

We do not sell your personal data to third parties, and we do not share it with advertisers.

International Transfers

Our main database is in the European Union, which the UK recognises as providing adequate protection. Some of the processors above (including Anthropic, Twilio, Resend, Google, Sentry, Mapbox, Expo, Upstash and Vercel) are based in, or may process data in, the United States or other countries outside the UK.

Where personal data leaves the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, for companies certified under it) or on the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner, together with the processor's security commitments. You can ask us for more detail on the safeguard used for any processor at privacy@mysova.co.uk.

Data Retention

We retain your personal data only for as long as necessary for the purposes described in this policy:

  • Account data (profile, settings, preferences): kept until you delete your account
  • Clock-in history, XP, badges and ranks: kept while your account exists, because they make up your passport and rank
  • Messages and chat photos: kept until the message is deleted or expires, or until the account that sent it is deleted
  • Squad live location: only your most recent position is held, and it is overwritten with each update
  • SOVA answers: kept while your account exists, so we can count your daily SOVA allowance and show you your last recommended route
  • Support messages: kept while your account exists, so we can follow up
  • Crash reports and device diagnostics: kept by Sentry for up to 90 days
  • Analytics events: kept while your account exists, and deleted within 30 days of your account being deleted
  • Security and fraud-prevention records (for example a flagged clock-in, or a log that an account was deleted): kept only as long as needed to investigate and prevent abuse
  • Anonymised, aggregated figures (totals and trends with no account attached): kept indefinitely

You can delete your account at any time in Settings > Delete Account, or at mysova.co.uk/delete-account. Deleting in the app removes your profile, clock-ins, messages, photos and other personal data from our live systems straight away. Copies in our encrypted database backups are overwritten as the backups roll over, and the whole process is complete within 30 days. We keep only what we must: limited security and fraud-prevention records, records we are required to keep by law, and purchase records held by Apple or Google under their own policies. If you joined the MYSOVA waitlist before launch, that record is kept separately under the consent you gave then; email us to have it removed.

Your Rights Under GDPR

You have the following rights in respect of your personal data:

Right of Access
You may request a copy of the personal data we hold about you (Subject Access Request). You can also download a copy of your data yourself in Settings > Data & Account > Export My Data.

Right to Rectification
You may request correction of inaccurate or incomplete personal data. Most profile details can be edited in the app.

Right to Erasure ("Right to Be Forgotten")
You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, or where you have withdrawn consent. You can delete your whole account in the app at any time.

Right to Data Portability
You may request your data in a structured, machine-readable format to transfer to another service.

Right to Restrict Processing
You may ask us to pause processing of your data in certain circumstances (e.g. while you contest its accuracy).

Right to Object
You may object to processing based on legitimate interests, and to direct marketing at any time.

Right to Withdraw Consent
Where processing is based on consent, you may withdraw it at any time in Settings > Data Preferences or by contacting us.

Rights about automated decisions
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Automated checks (photo moderation and location-spoofing checks) can hold back a photo or withhold XP, and you can ask for a person to review any such outcome.

To exercise any of these rights, contact us at:
privacy@mysova.co.uk

We will respond within one month (UK GDPR Article 12(3)). You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/.

Cookies & Tracking

In the app

The MYSOVA app does not use browser cookies. It uses:

  • Essential: Supabase session tokens to keep you logged in, and device push notification tokens. These cannot be disabled without stopping core functionality.
  • Optional: PostHog analytics, off until you opt in. You can opt in or out at any time in Settings > Data Preferences.

On our website

  • Essential cookies: mysova_age_ok remembers that you confirmed you are 18 or over, and mysova-consent remembers your cookie choice. Both last one year.
  • Optional analytics, only if you accept them in the cookie banner: Vercel Web Analytics, Vercel Speed Insights and Plausible, which measure page visits and page speed. If your browser sends a Do Not Track signal, we treat it as a refusal. You can change your choice by clearing the mysova-consent cookie.

We do not use cross-site tracking, fingerprinting, or advertising networks.

Children

MYSOVA is strictly for users aged 18 and over.

We require all users to provide their date of birth at registration. Users who do not meet the 18+ age requirement are prevented from creating an account.

If we become aware that a user under 18 has created an account, we will immediately suspend the account and delete all associated personal data.

If you believe a minor is using MYSOVA, please contact us at privacy@mysova.co.uk.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements.

When we make material changes, we will tell you in the app or by email before the changes take effect. Where required by law, we will seek your consent.

We record in your account which version of this policy you accepted and when. You can review the current version at any time in the app under Settings > Privacy Policy, or at mysova.co.uk/privacy.

Contact Us

For all privacy-related enquiries, requests, or complaints:

Email: privacy@mysova.co.uk
Company: MYSOVA LTD
Company number: 17154283
Registered in: England and Wales
Location: London, United Kingdom

We aim to respond to all privacy requests within one month. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):
Make a complaint: https://ico.org.uk/make-a-complaint/
Website: ico.org.uk
Telephone: 0303 123 1113

Trademarks

MYSOVA and the owl device are trademarks of MYSOVA LTD, registered with the UK Intellectual Property Office (UK00004373417 / UK00004373474).