Privacy notice

Who operates the service

What a Night is currently a validation-stage service. Before public launch, replace this paragraph with the controller's full legal name, postal address and privacy contact email. The controller may be a natural person, but the published identity and contact details must still accurately identify that person.

Data we process

We process account and authentication data when you register or sign in. If you use Google sign-in, this includes the email address, name and authentication identifiers supplied through Google and Supabase. We also process saved-night and access data when you use account features; survey answers and the destination from which the survey was opened; an estimated country code used to display relevant pricing; and, only with product-research consent, an anonymous browser identifier and an anonymised daily participation count. The server stores a one-way hash rather than the browser identifier in the daily reach table. We do not intentionally store your raw IP address in the survey or daily reach tables.

At registration we also record the version and time of your Terms acceptance and Privacy Notice acknowledgement. If you separately opt in to news emails, we record your email address, subscription status, consent version, source and consent or withdrawal time.

Why we use it

Data is used to provide the requested service, secure accounts, remember saved journeys, enforce access limits, answer support or legal requests, and evaluate whether people are interested in the product, its possible pricing models, and the anonymous daily growth trend shown on the performance page.

News emails about What a Night and newly added destinations are sent only on the basis of your optional consent. Newsletter consent is not required to create or use an account.

Service providers

The service currently relies on Vercel for hosting, Supabase for authentication and database services, Google for optional account sign-in, and YouTube/Google for external video playback when you allow external media. These providers may process technical and account data under their own terms and privacy notices.

Add the selected email-delivery provider to this section before the first newsletter is sent, and update the international-transfer information where applicable.

Retention and rights

Define and publish concrete retention periods before public launch. Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw optional cookie or product-research consent at any time through Privacy choices. Newsletter consent can be changed in My account and must also be withdrawable from every marketing email. Withdrawal does not affect processing performed before withdrawal. Add the controller's contact email here before launch.