Privacy Policy

1. Who We Are

JoinMeIn is a social platform that helps people discover and join real-time experiences and activities happening around them. We connect members with shared interests, enable spontaneous meet-ups, and foster genuine in-person connections. In addition to core app features, we provide push and SMS-based notifications and alerts to support account security, service continuity, transactional confirmations, and other non-marketing purposes described in this Privacy Policy and our Terms of Service.

Joinmenow Inc ( DBA joinmein ) is headquartered at 32 Gramercy Park S 2F, New York, NY 10003, USA, and is the data controller for the personal information described in this policy. When we say "JoinMeIn," "we," "us," or "our," we mean Joinmenow Inc ( DBA joinmein ) and any affiliates operating under the JoinMeIn brand.

2. Where This Policy Applies

This Privacy Policy applies in every country where JoinMeIn is offered. There is no separate India-only or US-only privacy URL, Apple, Google Play, and this website all point here. It covers all websites, mobile applications (including the JoinMeIn apps distributed through the Apple App Store and Google Play), experiences, and other services we operate under the JoinMeIn brand. It also covers push notifications and SMS communications sent as part of these services. Whether you're discovering a nearby experience, joining our community, or contacting our support team, this policy has you covered. For simplicity, we refer to all of these as our "service" throughout this document. Extra rights that depend on where you live are listed in Section 15.

By accessing or using JoinMeIn, you agree to the collection, use, and processing of your information as described in this Privacy Policy. Where the law requires your consent (for example, for device permissions, SMS marketing, or certain cookies), we ask for it separately and you can withdraw it at any time.

3. Information We Collect

To help you find experiences and connect with people around you, we need some information about you. Here's a complete breakdown of what we collect and why.

a) Information You Give Us

b) Data Generated or Automatically Collected

c) Data Collected Only With Your Permission

Everything in this group requires you to grant an operating-system permission first. You can decline any of them, and you can change your mind at any time in your device settings, see Section 4 for the full list, what happens if you decline, and how to revoke access.

4. Device Permissions & What We Do With Them

JoinMeIn asks for a permission only at the moment a feature needs it, and never as a condition of creating an account. Here is every permission the app requests on iOS and Android.

5. Location, What We Collect, and For How Long

Location is the most sensitive thing JoinMeIn handles, so it gets its own section. There are four separate uses, they are switched on independently, and none of them runs when the app is closed, except an SOS you have raised yourself.

a) Nearby discovery, maps and venues

While the app is open, we use your precise location to show experiences, venues and members near you, to place you and them on the map, to sort results by distance, and to power proximity-based features such as check-in. This is the baseline use of the Location permission and stops the moment you leave the app.

b) The radar, going live

The radar is off by default. When you choose to go live, you become visible on the map to members inside your chosen radius for a window you set, and it switches itself off when that window expires. While you are live, those members receive your position so the map can draw your marker.

c) Crossed paths, opt-in, and self-erasing

Crossed paths shows you people you happened to be near recently. It is switched off until you turn it on. While it is on, and only then, the app sends occasional location pings that we store as:

• approximate coordinates, rounded to about five decimal places, plus the accuracy your device reported;
• a geohash (a short code for the cell you were in) and a 15-minute time bucket, which are what the matching actually compares;
• a note of whether the ping came from the foreground app or from a location the app already had.

Each ping is stamped with an expiry of roughly 72 hours and is deleted after that. A crossing is only recorded when both people have the feature switched on and both were inside the same cell in the same time window, the default proximity is about 120 metres, and you set it. Turning the feature off stops new pings immediately; deleting your account removes the history. Neither party sees the other's coordinates: you see an approximate area and a rough time ("around your area, yesterday").

d) SOS

If you have enabled live location sharing and you raise an SOS, your location is sent roughly every 20 seconds to the trusted friends you selected, for a 30-minute window, and continues while your phone is in your pocket, that is the point of a safety alarm. Your device shows the system location indicator throughout. It stops when the window ends or when you cancel. Nobody else receives it, and no location is shared unless you trigger the alarm yourself.

e) What we never do with location

We do not request always-on background location, we do not build a movement history or a location profile, we do not sell location data, and we do not share it with advertisers or data brokers. Outside the four uses above, your location is not collected.

6. Contact Discovery (Find Friends)

Contact discovery is entirely optional and switched off until you turn it on and grant the Contacts permission. Because address books contain other people's information, we designed this feature to reveal as little as possible. Here is exactly what happens:

• The app reads phone numbers and display names from your device address book and sends them to our servers over an encrypted (TLS) connection.
• On arrival, each phone number is immediately converted into a one-way, keyed hash (HMAC-SHA256) and the original number is discarded. We do not store the raw phone numbers from your address book.
• We compare those hashes against hashes of numbers registered on JoinMeIn so we can show you which of your contacts are already here, and notify you when one of them joins later.
• The display name you saved for a contact is stored alongside the hash so the app can label the match with the name you recognise. It is visible only to you.
• We never message your contacts on your behalf. Invites are only sent when you tap to send one, and they are sent from your own device using your phone's messaging app.
• Your contacts are never sold, never shared with advertisers, and never used to build advertising profiles.

7. Identity Verification (Optional)

JoinMeIn offers optional identity verification, run for us by Didit. You start it yourself from Profile → Verification → Verify identity; nothing happens until you do.

a) What Didit collects, and what we receive

• Didit's flow may ask you for a government-issued ID document and a selfie or liveness check, and may collect related verification signals such as your device platform, IP address and user agent for fraud prevention.
• That document and selfie are captured by Didit, not by us, and the images are not stored on JoinMeIn's servers. Didit processes them as an independent controller under its own privacy policy, and its retention rules govern how long it keeps them.
• What we store against your account is the outcome (approved, declined, still in progress), a session identifier, and the decision details Didit sends back, which can include limited fields read off your document, such as the name, date of birth, document type and issuing country, where Didit's check returns them. We keep this so we can show your status, resolve disputes about a decision, and meet our safety and record-keeping obligations.
• Identity verification is separate from payments. Didit does not process your card details, and we do not receive them through it.

b) What verifying does for you, and what it is not required for

A completed check adds a verified badge to your profile, and members who have set their radar audience to "verified only" will be able to see you. Verifying while a free trial is running also extends that trial.

Verification is optional and no feature is locked behind it. You can create an account, go live, host, book, and message without ever verifying. You can decline it, abandon it part-way, and carry on using JoinMeIn.

c) Verification codes

Didit is also the provider that delivers our one-time verification codes to your phone number or email address when you sign in or confirm a new contact detail. For that purpose it receives the phone number or email address the code is being sent to.

To remove a verification record, or to ask Didit to delete what it holds, contact us at support@joinmenow.io, see Section 14 and Section 16.

8. Data Summary, App Store & Google Play Disclosures

This table is the plain-English version of the disclosures we file in Apple's App Privacy questionnaire and Google Play's Data safety form. "Linked to you" means the data is associated with your account. "Used to track you" means data shared with a third party to target advertising or measure it across other companies' apps and websites, which we do not do.

9. How We Use Your Information

The primary reason we process your data is to provide, maintain, and improve our service, connecting you with experiences and people nearby, personalising your experience, and keeping the platform safe for everyone. We also process your data to deliver transactional communications such as SMS verification codes and account alerts, consistent with your consent and applicable law.

10. How We Share Your Information

We do not sell your personal data. Some information is visible to other members as part of the core service. We also share data with service providers who help us operate the platform, including strictly limited sharing with SMS and push delivery providers for transactional communications only.

11. What We Never Do

We think a privacy policy should be as clear about what we don't do as what we do:

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA) and similar US state laws.
• We do not track you across other companies' apps or websites. JoinMeIn contains no third-party advertising SDKs, does not use the Apple Advertising Identifier (IDFA) or Google Advertising ID for tracking, and therefore does not present the App Tracking Transparency prompt.
• We do not serve third-party behavioural advertising inside the app.
• We do not read your private one-to-one messages: they are end-to-end encrypted and we do not hold the keys. (Group and event chats work differently; see Section 19.)
• We do not send marketing to your contacts, and we do not sell or rent address book data.
• We do not store biometric templates. Face ID, Touch ID, and fingerprint checks are performed by your device; we only ever learn whether the check passed. If you choose to verify your identity, the liveness check is performed by Didit and its images are not stored on our servers.
• We do not track your location when you are not using the app. We never request always-on background location, and we do not build a movement history. The only time location is sent while the app is not in front of you is during an SOS you have raised yourself, for that 30-minute window, to the trusted friends you chose.
• We do not knowingly collect data from anyone under 18.

12. Third-Party Services We Use

These are the third parties that process personal data on our behalf, or alongside us, so that JoinMeIn can work. Each handles data under its own privacy policy in addition to our agreement with them.

We review our providers before onboarding them and require appropriate contractual protections (including data processing agreements). We do not permit them to use your data for their own advertising purposes.

13. Cross-Border Data Transfers

Our data is primarily stored in the United States. That is true for members in India, the EEA, the UK, and every other country. For certain functions (such as SMS routing, identity verification, analytics, media delivery, or cloud hosting), data may be processed outside the U.S. by vetted service providers. Where such cross-border transfers occur, we implement appropriate safeguards, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and data processing agreements, to protect your personal data consistent with applicable law, including the GDPR, the UK GDPR, and India's Digital Personal Data Protection Act, 2023 (DPDP) where they apply.

14. Your Rights & Choices

We want you to be in control of your data. The rights below are available to every member, in every country. Your local law may add more, those extras are in Section 15. To exercise any of them, use the in-app controls below or contact us at support@joinmenow.io. We respond within 30 days (or sooner where your country's law requires it) and never charge a fee or degrade your service for making a request. Please say which country you are in so we can apply the right rules.

15. Regional Rights (All Countries)

This section is for every country. The same Privacy Policy applies worldwide. Where a law names extra rights or a local complaint path, we honour them when they apply to you. Start with Section 14 and email support@joinmenow.io with your country in the subject line (for example, "Privacy request, India").

India (DPDP Act, 2023)

If you are in India, you are a Data Principal under the Digital Personal Data Protection Act, 2023 (DPDP). Joinmenow Inc (DBA joinmein) is the Data Fiduciary for the processing described in this policy. What we collect, why, and how long we keep it is set out in Section 3, Section 9, and Section 16. Your personal data is primarily stored in the United States and may be processed there and in other countries by our service providers, as described in Section 13.

You may request access to your personal data, a copy of it, correction of inaccurate data, erasure, withdrawal of consent, and a grievance about how we handle your data. Use the in-app controls in Section 14 or email support@joinmenow.io. We aim to respond within 30 days, or sooner where Indian law requires it. JoinMeIn is for users 18 or over; we do not knowingly process personal data of children. You may also approach the Data Protection Board of India where that route is available to you.

European Economic Area & United Kingdom

If you are in the EEA or the UK, you have the rights described in Section 14 under the GDPR and UK GDPR, including the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office). The legal bases we rely on are set out in Section 9. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing, an identity check you start is reviewed against Didit's result and can be re-run or escalated to a human. For privacy questions, contact support@joinmenow.io.

California

Under the CCPA/CPRA, California residents have the right to know what personal information we collect (see Section 3 and Section 8), the right to delete it, the right to correct it, the right to opt out of sale or sharing, and the right to limit the use of sensitive personal information, plus the right not to be discriminated against for exercising any of them. We do not sell personal information and we do not share it for cross-context behavioural advertising, including for consumers we know to be under 16. Because we don't sell or share, there is no "Do Not Sell or Share My Personal Information" opt-out to submit, but you may still exercise your other rights, or use an authorised agent, by contacting support@joinmenow.io. We use sensitive personal information, including precise location and government ID data where you provide it, only to provide the features you request and to keep the platform safe, and never to infer characteristics about you.

Other US States

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have similar rights to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising, sale, and certain profiling, none of which we engage in. Where the law provides an appeal process, you may appeal a decision by replying to our response or writing to support@joinmenow.io with "Privacy Appeal" in the subject line.

Canada, Brazil, Australia, and other countries

If you are in Canada, PIPEDA and applicable provincial laws may give you rights to access and correct your personal information. If you are in Brazil, the LGPD may give you rights to confirm processing, access, correct, anonymise, delete, and port your data, and to withdraw consent. If you are in Australia, the Privacy Act 1988 (including the Australian Privacy Principles) may give you rights to access and correct your personal information and to complain to the OAIC. Similar rights exist under other national laws (for example Japan's APPI, South Korea's PIPA, Singapore's PDPA, South Africa's POPIA, and the laws of the UAE, Saudi Arabia, and other countries where we offer the service).

Everywhere else: this same policy still applies. You can use every control in Section 14, access, correction, deletion, withdrawing consent, and visibility settings, regardless of whether your country has a named privacy statute in this section. Email support@joinmenow.io and tell us your country. You may also complain to your local data protection or consumer authority where one exists.

16. Data Retention

We retain your personal data only as long as necessary for legitimate business purposes and as permitted by applicable law. If you close your account, your profile will no longer be visible to other members. Accounts inactive for two years will be closed automatically. Following account closure:

• Safety window: We retain data for three months (or one year following an account ban) to investigate unlawful or harmful conduct and protect the safety of our community.
• Legal obligations: Transaction data is kept for ten years for tax and accounting compliance. SMS opt-in/opt-out records and consent logs are retained for a minimum of four years (or longer as required under TCPA/CTIA). Traffic and log data is kept for one year.
• Legitimate interest: Customer support records are kept for six years. Profile data may be retained for one year in anticipation of potential litigation. The minimum data necessary to prevent banned users from re-registering is kept as long as necessary to protect community safety.
• Location pings (Crossed paths): Each ping carries its own expiry of roughly 72 hours and is deleted after that, whether or not your account stays open.
• Identity verification records: The result, session id and decision details are kept while your account is open and through the safety window above, so we can evidence a decision and handle disputes or regulatory enquiries. The ID and selfie images are held by Didit under its own retention policy, not by us.
• Contact hashes: Deleted immediately when you wipe your synced contacts or your account. They are not part of the safety-window retention.
• Venue and business documents: Retained for as long as the listing is active and afterwards where needed for tax, fraud or dispute purposes.
• Deletion request records: See Section 23. We keep a record of the request itself.
• Legal proceedings: If we receive a valid legal subpoena or are involved in ongoing proceedings, we may retain relevant data until the matter is resolved.

17. Cookies & Tracking Technologies

Our website uses cookies and similar technologies to keep the site working, remember your preferences, and understand aggregate usage. Some cookies are strictly necessary; others require your consent, which you can give or withdraw through our cookie banner or your browser settings. Our mobile apps do not use advertising cookies or third-party ad trackers; they use local device storage to keep you signed in and to cache content for performance. Full details are in our Cookie Policy.

18. Age Restrictions & Child Safety

JoinMeIn is strictly for users who are 18 years of age or older. When you register you must tick a box confirming that you are 18 or over and that you accept our Terms and this Privacy Policy, and we keep a record of that confirmation. We do not ask for your date of birth at sign-up: it is an optional profile field you can add later, so please do not read the 18+ rule as a document check on every member. Optional identity verification (Section 7) does include a document check that confirms age, but because it is optional it is not how the rule is enforced across the platform.

We do not knowingly collect personal information, including phone numbers or SMS consent records, from anyone under 18. The app is not directed to children, is rated for adults on both app stores, and contains no features designed for children. We act on reports: if we learn that a member is under 18 we remove the account and delete the data.

We maintain a zero-tolerance policy toward child sexual abuse and exploitation (CSAE). If you believe a member is under 18, or you encounter content that endangers a minor, report it immediately using the in-app reporting tool or email support@joinmenow.io. We remove the account, delete the data, and report to the appropriate authorities, including NCMEC, where required. Our full approach is set out in our Child Safety Standards.

19. Data Security

We implement appropriate technical and organisational safeguards to protect your personal data:

• End-to-end encryption for one-to-one chats. Messages in one-to-one conversations are sealed to the recipient's public key using NaCl box (Curve25519 key exchange with XSalsa20-Poly1305). Your private key is generated on your device, stored in the device keychain/keystore, and never sent to us. Our servers store only ciphertext and cannot read those messages. One consequence worth knowing: because the key lives on your device, message history does not survive reinstalling the app on a device that has lost its key.
• Event and group chats are encrypted, but not end-to-end. They use a shared key that is distributed to participants and that our systems also hold, so, unlike a one-to-one chat. We are technically able to read them, and we may do so where a report or a legal obligation requires it. Please treat group and event chats as private from other members, not as private from us.
• Encryption in transit and at rest. All traffic between the app and our servers uses TLS, and stored data is encrypted at rest.
• One-way hashing. Passwords and synced contact phone numbers are stored only as one-way hashes. Emergency contact and trusted-friend numbers are the deliberate exception. They are stored in plain text because an SOS must be able to dial them.
• Access controls. Employee access to personal data is limited to those who need it, logged, and reviewed.
• Rate limiting and abuse protection on sensitive endpoints, including contact discovery, verification, and login.

No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. If you suspect unauthorised access to your account, contact us immediately at support@joinmenow.io. Where required by law, we will notify you and the relevant regulator of a data breach without undue delay.

20. Changes to This Policy

We may update this Privacy Policy from time to time as we add new features or as laws change. We will update the "Last Updated" date above and, for material changes, including any change to the data we collect, how we use it, or our SMS and consent terms. We will notify you in the app or by email before the change takes effect, giving you time to review it. Where the change requires your consent, we will ask for it. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

21. Legal Compliance

We may disclose your information where required by law or where we reasonably believe such action is necessary to: comply with a legal obligation or process (e.g., court order, subpoena); protect and defend the rights or property of JoinMeIn; prevent or investigate possible wrongdoing; or protect the personal safety of users or the public. In rare cases, SMS delivery logs or identity verification records may be disclosed where legally mandated. We cannot disclose the contents of end-to-end encrypted one-to-one messages because we do not hold the keys required to read them.

22. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, from any country, please reach out. We respond to privacy requests within 30 days, or sooner where your local law requires it. For India (DPDP) grievances use the same address and put "India" in the subject.

Joinmenow Inc ( DBA joinmein )
32 Gramercy Park S 2F, New York, NY 10003, USA
Email: support@joinmenow.io
For SMS-related consent or opt-out inquiries, you may also reply STOP to any SMS message you receive from us.

23. Account Deletion

You can delete your JoinMeIn account and the data associated with it at any time:

• In the app: open Profile → Settings → Delete account, then confirm. No email or phone call is required.
• On the web: use our Account Deletion page. You don't need to have the app installed.
• By email: write to support@joinmenow.io from the address on your account.

What happens next. Your account is deactivated and your profile stops being visible to other members straight away. The request is then scheduled for processing in about 14 days. Deletion is completed by our team rather than by an instant automatic purge, so the exact moment your records are erased may fall shortly after that date. Completing it removes your profile, photos and videos, interests and preferences, message content, synced contact hashes, saved locations, location pings, and push tokens.

The request itself is recorded. When you ask us to delete your account we save a record of the request, your account details as they stood at that moment, the reason if you gave one, and the IP address and browser or device user agent the request came from. We keep it as proof that the request was made and honoured, and to protect against fraudulent deletion requests made against someone else's account.

What else we keep, and why. A limited record may be retained where the law requires it or to protect the community, transaction and tax records, SMS consent logs, identity verification decisions, safety records relating to bans or open investigations, and anything subject to an active legal hold. These retention periods are set out in Section 16. Retained data is never used for marketing.

Subscriptions. Deleting your account does not cancel an active subscription purchased through the App Store or Google Play. Those are billed by Apple or Google (managed for us by RevenueCat) and will keep renewing until you cancel them in your Apple or Google account settings, please do that before deleting. See our Subscription Terms for the steps.