Privacy

What we keep

An account holds the name you chose and one contact — a phone number, WeChat ID or email. Your password is stored only as a salted hash; we cannot read it.

If you host or join an event we keep what you entered: the event details, how many people you are bringing, and any message to the host. Photos and comments you post stay until you or the host remove them.

We do not ask for your date of birth, your address book, or your precise location. The "Near me" button reads your position in your browser to pick a city and then discards it — the coordinates are never sent to us.

Cookies

A session cookie keeps you signed in. Small cookies also remember your language, your city and which posts you liked, so the site behaves the same on your next visit.

There is no advertising or tracking cookie, and no third-party analytics script. We do not follow you to other sites.

Who else sees it

We do not sell data, and we do not share it with advertisers. Everything below is a service that makes a specific feature work.

Cloudflare carries traffic to the site and sees the usual connection information any network provider does. It also collects its own network-error reports from your browser.

The AI features send what you gave them to OpenRouter, which passes it to a model provider. Writing help and translation send that text. The poster reader sends the photograph you uploaded — worth knowing, because a poster can carry faces, a phone number or a QR code. Voice input is transcribed first, and the words are what get sent. Your account details never are, and if you do not press those buttons nothing goes there at all.

Voice input itself does not run on our servers. Your browser sends the audio to its own maker's speech service — Google on Chrome, Apple on Safari — and hands us back the text. That happens under their privacy policy, not ours.

Venue suggestions are looked up through Photon, an OpenStreetMap search run by komoot in Germany. What you typed is sent from our server, so your IP address is not.

Event photographs published by libraries and other organisers are fetched by our server and cached, so your browser does not connect to their sites.

The map and ride buttons on an event are ordinary links. Nothing is sent until you tap one, and then it is that service — Amap, Baidu, Apple, Uber — that receives the venue address and your connection, under their terms.

We do not currently send email. If that changes, this section will say who sends it.

Other people

Hosts see the name, contact and message of anyone who joins their event, because they need to reach you. Reserve privately if you would rather your name did not appear in the public guest list — the host still sees it.

What you post publicly — events, photos, comments — is visible to anyone, including people who are not signed in.

Where it is kept, and where it goes

OneJoy runs on a server in Malaysia. If you are somewhere else, using the site means your information is handled there.

OpenRouter is in the United States, and it chooses which model provider serves a request; those providers are in several countries, and for the model we use that can include China. We cannot promise which one a given request reaches.

This matters most if you are in mainland China, the EEA, the UK or Korea, where sending personal information out of the country has its own rules. We are telling you plainly rather than burying it: if you would rather your information did not leave your country, do not create an account, and do not use the AI features.

How long we keep it

Your account and what you posted stay until you delete them.

A signed-in session expires after 90 days. Records of AI use, which exist to enforce the daily limits, are kept for 90 days. Notifications are kept for a year. Venue searches are cached for 30 days and are not linked to you.

Events stay after they have happened, because they are the record of something that took place and people who came may want to look back at it.

Your rights

You can ask us for a copy of what we hold about you, to correct it, to delete it, or to stop using it in a particular way. Email [email protected] from any address and tell us your account contact. We answer within 30 days and we do not charge.

Deleting your account does not need our involvement at all — there is a button in your profile.

If you think we have handled your information badly, tell us first and we will try to fix it. You can also complain to the data-protection authority where you live.

Deleting things

You can delete your own posts and cancel your signups at any time.

To delete your account, open your profile and use “Delete my account”. Your account, sign-ups, saves, follows and notifications are erased outright. Posts, comments, reviews and events you hosted stay up with your name and contact removed — deleting them would take other people’s replies and reservations with them.

You can also email [email protected] from any address, tell us your account contact, and ask us to delete it, send you a copy of your data, or correct something. We answer within 30 days.