Endiavo

Endiavo — Privacy Policy

Last updated: 2026-07-29.

Endiavo ("we," "us") operates the Endiavo mobile app (com.endiavo.app) and website. Endiavo is a privacy-first, location-aware social app for discovering what's happening near you and connecting with people face-to-face. This policy explains what we collect, why, who we share it with, and your choices.

Endiavo is for adults 18 and older. We do not knowingly create accounts for anyone under 18.

The short version

We are built to hold as little identifying data as possible. Your email, phone number (if used), and any real name are encrypted so that our servers cannot read them — they can only be opened with an offline key held by the operators for legal break-glass situations.
Your direct messages are end-to-end encrypted. We store only ciphertext and cannot read them.
Your identity's private keys never leave your device.
We do not use advertising, analytics, or tracking SDKs, we do not build per-user profiles, and we do not sell your data. We do keep aggregate counts of app usage (for example, how many people a given event listing reached) — daily totals only, with nothing linking a count to a person.
The in-app map is served from our own servers. Viewing the map does not hand your location to a third-party map provider, and address searches are resolved on our own infrastructure.

What we collect and why

Data	Why we collect it	Notes
Email address	To create and recover your account and send one-time login codes	Stored encrypted (sealed) + as a one-way index; sent to our email provider only to deliver the code.
Phone number (optional; not used in the current release)	Alternative sign-up method	Same encryption as email; delivered by SMS provider if enabled.
Name (optional)	Held for our records / legal break-glass; never shown to anyone	Encrypted (sealed) to an offline key.
Pronouns (optional)	Shown on your profile to people you connect with	Self-declared.
Profile photo (optional)	Your avatar, shown to your connections	A live camera capture (uploads are blocked, to reduce impersonation). Never sent to a third party.
Event poster / flyer (optional)	Shown on your event listing; and, if you use "auto-fill from poster", read once to draft the event details for you	Sent to Anthropic for that reading — see "Who we share data with". Organizer-type accounts only.
Approximate & precise location (optional)	Center the map on you, "near me" discovery, and GPS check-ins for adventures/hunts	Foreground only. We never track your location in the background, and your location is not sent to any third-party map provider — map tiles come from our own servers.
Content you create	To display your notes, events, adventures, and hunts	Public/shared content is visible to others by design.
Messages	To deliver messages you send	End-to-end encrypted; we cannot read them.
Push notification token	To send you notifications	Shared with Google/Apple to deliver push; notifications contain no message content.
IP address	Security, rate-limiting, and abuse prevention	Processed transiently (and by our CDN); not used to profile you or for ads.
Device timezone	Send the daily event digest at the right local hour	—

Age. During sign-up we ask you to confirm you are 18+. This is a self-attestation and we do not store your birthdate or age.

Who we share data with (service providers)

We share the minimum necessary with vendors that process data on our behalf:

Google Firebase Cloud Messaging (and Apple Push Notification service on iOS) — your push token, to deliver notifications.
Resend (resend.com) — your email address, solely to send verification-code emails.
Cloudflare — network/CDN provider in front of our servers; processes request traffic (including IP) to deliver and protect the service.
Capgo (api.capgo.app) — delivers over-the-air updates to the app's code. When the app checks for or applies an update it reports an anonymous device identifier, the app and bundle version, and the platform. It receives no account data, no location, and no message content.
Anthropic (api.anthropic.com) — reads event details off a poster. Only if you are a venue, promoter, producer or employee account and you choose to use "auto-fill from poster": the image you upload is sent to Anthropic's Claude vision API, which returns the title, date, time, venue, address and links it can read, as a draft you then confirm or correct. Nothing is created from it automatically. Anthropic receives the poster image and nothing else — no account, contact, location, or message data — and we do not send it your avatar or any other photo. If you never use auto-fill, no image of yours is ever sent there.

We do not use a third-party map provider. Map tiles are rendered from our own PostGIS/Martin server, and address searches are resolved against a local U.S. Census (TIGER) dataset on our own infrastructure. Viewing the map or searching an address does not send that data to Google or anyone else.

We do not currently use an SMS provider. The phone sign-up path is not enabled in this release; if we enable it in future, we will update this policy before doing so.

We do not share data with advertising networks, data brokers, or analytics vendors, and we do not sell personal information.

How we protect your data

In transit: everything is encrypted with TLS (HTTPS).
At rest: email, phone, and name are sealed with encryption our servers cannot open; messages are end-to-end encrypted; your private keys stay on your device.
Public content, avatars, and event flyers are stored on our servers to be shown to others.

Data retention

We keep your account data while your account is active. When you delete your account (below), we remove your identity and the personal data tied to it immediately — there is no grace period and no "soft delete" of your account record.

Web-server access logs (which include IP addresses) are rotated daily and deleted after 14 days.
Application logs are size-capped and are overwritten as new entries arrive; in practice they hold no more than a few weeks of history. They are not indexed by user and are used for debugging and abuse investigation only.
We keep no banned-user list or retained identifier hashes after deletion. Deleting your account does not leave behind a record that blocks you from signing up again.
We do not currently keep database backups. Deletion is therefore not recoverable from a backup copy. If we begin taking backups, we will state the retention window here before doing so.

Your choices and rights

Access / correction: edit your profile in the app; contact us for anything else.
Location: grant or revoke location permission any time in your device settings; the app works (browse-only) without it.
Notifications: turn off push in the app's Settings or your device settings.
Account & data deletion: see the next section.

Deleting your account and data

You can request deletion of your Endiavo account and associated personal data in two ways:

1. In the app: Settings → Delete my account. This permanently deletes your account immediately. 2. On the web, without reinstalling the app: visit https://endiavo.com/delete-account from any browser, enter your account email, and confirm with the emailed code. (Optional support fallback: email [email protected].)

When you delete your account we remove your identity record and the personal data associated with it (email/phone/name seals, profile, avatar, your notes/events/adventures/hunts, RSVPs, stars, and your membership in conversations). End-to-end-encrypted message ciphertext that has already been delivered to other participants' devices is outside our control — we only ever held the ciphertext, and our copy of it is deleted with your account.

Deleted immediately: your identity record; your sealed email, phone and name; your profile and avatar; your pronouns; every note, event, adventure and hunt you created; your RSVPs, stars and check-ins; your circle memberships; your push-notification tokens; your saved recovery blob; and your membership in every conversation, along with the server-side copy of the encrypted messages you sent.

Not deleted: content other people created that merely mentions you or that you interacted with (their own notes and events remain theirs), and encrypted messages already delivered to other people's devices, which we cannot reach. Where an administrative action of ours referenced your account, the record of the action is kept but the link to you is severed.

There is no grace period — deletion is immediate and cannot be undone.

Children

Endiavo is not directed to children and is 18+. If you believe a minor has created an account, contact us and we will remove it.

Changes

We will post any changes here and update the "Last updated" date.

Contact

Endiavo — [email protected]. Write to that address for access, correction, or deletion requests, or any privacy question; a postal address for the operator is available on request to the same address.