OutPal Privacy Policy

Effective date: 15 October 2026

OutPal is operated by OutPal technologies L.L.C S.O.C in the United Arab Emirates ("we", "us"). This policy explains what data OutPal collects, why, who can see it, and how you can control or delete it. OutPal is a group outing planning app: the data model is built around sharing selected information with your friends and the members of outings you join, and nobody else.

Contact for anything in this policy: legal@outpal.ae.

Legal basis and UAE law

OutPal is operated with the intention of complying with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDPL) and other applicable data protection law. Where this policy and that law differ, the law prevails.

Your consent, and exactly what you give us access to

By creating an account you consent to OutPal processing the following data, each for the purpose stated and nothing wider:

• Your email address and password (or Apple/Google sign-in identity): to operate your account.
• Your date of birth: solely to verify that you meet the minimum age. It is never shown to any other user.
• Your display name, username and avatar: shown to other users so they can recognise you.
• The outings you create or join, and their contents (RSVPs, messages, photos, polls, packing lists, expense records you enter): shared with that outing's members.
• Write access to your photo library, only when you tap Save on a photo: used in that moment to store the one image you chose. We never read your library.
• Your location, only while you have switched sharing on: shared with the audience you chose (an outing's members, or friends for a broadcast), and expiring automatically.
• Saved places you add: private to you unless you share one.
• The categories you pick under "What you're into": used only to shape the places we suggest to you. They are never shown to any other user, and you can change or clear them at any time in Settings.
• Phone numbers from your address book, only if you switch contact matching on: sent to us in the moment, solely to tell you which of your contacts already have an OutPal account. They are never stored on our servers, and we never message your contacts.
• A push notification token, if you enable notifications.

You can withdraw consent at any time by turning a feature off (location, notifications), or entirely by asking us to delete your account (see section 4), which removes your personal data as described below.

1. Data we collect

Account and profile

• Email address and password (password handled by our authentication provider; we never see it in plain text). Optional two-factor authentication (TOTP) secrets are stored by our authentication provider.
• Profile details you provide: display name, first and last name, username, avatar photo, and optionally your phone number.
• Interest categories you pick ("What you're into"), if you choose to pick any. Picking none is a valid answer and nothing in the app requires them.
• Your email address, phone number, date of birth and interest categories are locked down at the database level: other users can never read them. Friends see only a limited set of safe display fields (such as your name, username, and avatar).

Location

Location is used only for features you actively invoke:

• While using the app: to show you on the map, fetch weather forecasts for your outings, and suggest nearby places.
• Live location sharing (background): only when you explicitly turn on the sharing toggle during an active outing, after an in-app consent dialog. Your position is then shared with the members of that outing only, and sharing stops as soon as you turn it off or leave the outing. On iOS the system background-location indicator is shown while sharing; on Android a persistent notification is shown.
• Availability status ("I'm free"): if you choose to broadcast that you are free, you can optionally include your approximate location so friends can see roughly where you are while the status is active. This is off the moment the status expires or you clear it.

There is no passive or always-on location tracking.

Contacts (optional friend matching)

If you use contact matching to find friends, phone numbers from your address book are normalised on your device and sent to our server only to check, in real time, which of them belong to existing OutPal users. Your contact list is not stored on our servers; the numbers are used transiently to answer the match request, and the response contains only the matched users' public display profiles. We never message your contacts.

Content you create

• Outings: titles, descriptions, dates, places, RSVPs, packing lists, polls.
• Chat: messages and photos you post in an outing's group chat.
• Expenses: amounts, descriptions, splits, and settlements you record with outing members.

Device and technical data

• Push notification token, stored on your profile so we can deliver notifications.
• Crash reports: when the app crashes or errors, technical diagnostics (device model, OS version, stack traces) are sent to our crash reporting provider and are associated with your user ID and email so we can follow up on bug reports you file. Crash reports may include a masked screen recording of the moments before an error, with text and images hidden.
• Product analytics: feature-usage events (for example "outing created", "friend added", "message sent", "expense added" including the expense amount) and screen views, associated with your user ID and, once you sign in, your email and name. We use this solely to understand which features are used and to improve the app. Analytics is disabled in development builds.

2. How we use your data

• To provide the service: plan outings, connect friends, share locations you choose to share, track shared expenses, deliver chat and notifications.
• To fix problems: crash reports and the bug reports you submit.
• To improve the product: aggregated feature-usage analytics.

We do not sell your data. We do not show ads. We do not use your data to track you across other companies' apps or websites.

3. Who can see your data

• Friends: your limited display profile and, if you broadcast availability, your status (and approximate location if you enabled it).
• Members of an outing you join: the outing content you contribute (messages, photos, expenses, RSVP, packing items) and your live location only while you have sharing turned on for that outing.
• Nobody else. There are no public profiles and no public outings.

Service providers (processors)

We use trusted service providers to run OutPal on our behalf, under contracts that limit them to processing your data on our instructions and keeping it secure. They fall into these categories: cloud hosting, database and authentication; content delivery and security; maps and weather; push notifications and email delivery; and crash reporting and product analytics. Your account data is currently stored with our cloud hosting provider in Singapore, which means it is transferred outside the United Arab Emirates. We protect these transfers with data processing agreements that require protection consistent with UAE Federal Decree-Law No. 45 of 2021, and, where it applies, Standard Contractual Clauses. We plan to move storage to the UAE when that becomes available to us. You can ask for the current list of our providers, or for details of these safeguards, by writing to legal@outpal.ae.

4. Retention and deletion

• Your data is retained while your account is active.
• Live location points are used to power the shared outing map; sharing stops when you stop it.
• You can request deletion of your account by email to legal@outpal.ae (see outpal.ae/delete-account for what to include). Requests are handled by hand: we first confirm that the request comes from the account holder, then complete the deletion within 30 days. Deletion permanently deletes your sign-in account and profile, your personal files in storage (profile photos and expense receipts you uploaded), and every record tied only to your account, such as friendships, RSVPs, and push-notification registrations. Content that is inherently shared stays for the other members in attributed-to-deleted-user form: messages and photos already posted to an outing's chat, and expenses recorded with other members (so their record of who paid what stays intact). Outings you created remain for their members, without your name attached. Deletion cannot be undone; signing up again starts an empty account.
• Crash and analytics data are retained according to our providers' retention settings, then deleted.

5. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can exercise most of these directly in the app (edit your profile, revoke OS permissions at any time in system settings). For anything else, including account deletion, contact legal@outpal.ae. You can also revoke any permission (location, contacts, camera, photos, notifications) in your device settings at any time; the related features simply stop working.

6. Children

OutPal is only for people aged 18 or over. OutPal is not directed at children, and the minimum age is enforced at account creation by a date-of-birth check. We do not knowingly collect data from anyone below that minimum age; if you believe a child is using OutPal, contact support@outpal.ae and we will delete the account.

7. Security

Data is encrypted in transit. Access to shared data is enforced at the database level with row-level security: outing content is readable only by that outing's members, and profile contact details (email, phone) are readable only by you. Authentication supports optional two-factor authentication (TOTP).

8. Changes to this policy

We will post any changes here and update the effective date. For material changes we will notify you in the app before they take effect.

9. Contact

OutPal technologies L.L.C S.O.C legal@outpal.ae

For support enquiries: support@outpal.ae

This policy is governed by the laws of the United Arab Emirates; disputes are subject to the courts of the Emirate of Dubai, United Arab Emirates.