Privacy
Privacy Policy
How Ranked handles your information — plainly and carefully.
What Ranked is, and what this policy covers
Luthiber Labs Inc. (Ontario Corporation No. 1001683033), operating as Ranked ("Ranked", "we", "us", "our") is committed to protecting your privacy in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. This policy explains how we collect, use, disclose and protect your personal information.
Ranked is a calendar of events in your city and a way to go to them with other members: you say you are going, you check in when you arrive, you join a group for the night, and you can host events of your own or run a page for a club or a place. This policy describes the data those features use. It does not describe features Ranked no longer offers.
1. Information we collect
We collect the following personal information when you create and use a Ranked account:
Account information:
- Phone number or email address (for sign-in and account security)
- First name and date of birth (for your profile and to confirm you are 18 or over)
- Gender (shown on your profile if you choose)
- City (the calendar you see is the one around your city)
Profile information:
- A profile photo, if you add one (shown to other members beside your name)
- Optional details you choose to add to your profile
- An invite code you redeem, and the codes you share
Events and pages you create:
- For an event you host: its title, description, category, place, date and time, cover image, who leads it, and a capacity if you set one
- For a page you run: its name, category, tagline, logo and cover, social handles, booking link and place
Activity:
- Events you say you're going to or are interested in, events you save, and pages you follow
- Check-ins: the event or place, the time, and the one location fix taken at that moment (see section 7)
- Photos from places: a photo you choose to add at a place you checked in to, its caption, the place and the day. The photo carries no location data; the moment you added it is not shown to other members.
- Groups you start or join, and the messages you send in them
- Reports you submit about content or members
Device information:
- Device type, operating system and app version
- Push notification token (to deliver notifications you have allowed)
2. Why we collect it
- Sign-in and security: to verify it is you and keep your account safe
- The calendar: to show you events and places around your city, and the events of pages you follow
- Going and checking in: to record that you're going, to confirm you were there, and to award the chips your check-ins earn
- Groups and messages: to let members going to the same event talk to each other
- Hosting: to publish the events and pages you create and let other members find them
- Safety: to detect and prevent abuse, fraud, harassment and policy violations, and to act on reports
- Notifications: to send reminders and group messages you asked for and, only with your consent, marketing
- Service improvement: to understand aggregate usage and improve features (analytics is off unless you turn it on)
- Legal compliance: to meet our obligations under Canadian law
3. Where your data is stored
Your personal information is stored and processed on servers operated by Supabase Inc., which uses Amazon Web Services (AWS) infrastructure located in US-East (United States).
Important: by using Ranked you consent to your personal data being transferred to and processed in the United States. While in the United States your data may be subject to disclosure under US laws, including to US government agencies under the USA PATRIOT Act, the CLOUD Act or other applicable US legislation.
We have contractual safeguards in place with our infrastructure providers to ensure your data receives a comparable level of protection to that required under Canadian law.
Security measures:
- Databases are encrypted at rest and in transit
- Row Level Security ensures members can only read and change what they are allowed to
- Photos are stored in cloud storage with access controls
- Sign-in uses one-time passcodes
4. Who we share your data with
We do not sell your personal data to any third party.
Other members see: your first name and photo; that you're going to an event, on that event's page, unless you choose to be listed as "Member"; the groups you are in and the messages you send there; any event or page you publish; and a photo you add at a place you checked in to, with the place's name and the day, from six hours after you add it. Your phone number, email, birthday and exact location are never shown.
We share data with the following service providers, who process it on our behalf:
- Supabase Inc. — database hosting, authentication, storage (US-East)
- Amazon Web Services — infrastructure (US-East-2)
- Amazon Rekognition — automated photo moderation before a photo is stored (nudity, violence, weapons, drugs, minors, hate symbols; US-East-1). If you choose to verify your account with a selfie, Rekognition compares that selfie one-to-one with your own profile photo; the selfie is deleted as soon as the decision is made and never later than 30 days, and no face template is stored.
- Google LLC (Google Maps Platform) — the map is drawn by Google's map SDK on your device: while it is open, your IP address and the area of the map you are looking at reach Google, and your position is used on the device itself to draw the "you are here" dot. When you search for a place while creating an event or a page, the text you type and your city are sent to Google Places. We do not send Google your profile or the location fixes we store.
- OpenAI L.L.C. — automated text moderation of group messages, event descriptions and page text (omni-moderation-latest, US). Per OpenAI's API data-use policy, text sent to the moderation endpoint is not used to train models and is retained at most 30 days for abuse monitoring.
- Apple Inc. (StoreKit) — if you buy anything in the App, Apple processes the payment; we receive only the receipt, transaction id and product id.
- Expo / EAS — push notification delivery (US)
- Twilio Inc. — SMS delivery of one-time passcodes (US)
- Resend — email delivery (US), including the application you submit before an account exists
- Ticket sellers — when you tap "Get tickets" you leave Ranked for the seller's site; what you do there is governed by their policies, and nothing is sent to them by us
We may also disclose personal information when required by law, court order or government request; to protect the safety, rights or property of our members or the public; or in connection with a merger, acquisition or sale of assets, with notice.
5. How long we keep it
- Account data: kept while your account is active; deleted when you delete your account.
- Photos: deleted when you remove them or delete your account.
- Photos from places: kept until you remove them or delete your account. Other members see a photo from six hours after you add it; you can remove it at any time, and anyone shown in a photo can ask us to remove it at [email protected]. If your check-ins are hidden in Settings, your photos are hidden with them.
- Group messages: deleted when you delete your account.
- Check-ins: each check-in records where it happened; the record stays as part of your check-in history and is deleted with your account. We keep no continuous location history.
- Events and pages you created: deleted with your account; an event other members had said they were going to is shown to them as cancelled.
- Analytics: kept while your account is active and deleted with it; analytics is off unless you turn it on.
- Backups: point-in-time recovery snapshots may hold a copy for up to 30 days after deletion before they are purged.
- Purchase receipts and audit logs: kept for 7 years to satisfy Canadian tax and dispute-resolution requirements.
- Child-safety and abuse reports: records tied to Cybertip.ca or NCMEC referrals, and related account metadata, are kept for as long as the receiving authority requires, plus our internal minimum of 7 years.
Data no longer needed for any identified purpose is destroyed or anonymised in accordance with PIPEDA.
6. Automated decisions
Some parts of Ranked are computed rather than chosen by a person. We say so here:
- Chips and tiers: a chip in a category is earned by a verified check-in; its tier (Bronze / Silver / Gold / Onyx) is derived from your verified check-in count in that category, with a city-level percentile recalculation each month.
- Host tier: derived from the number of distinct members who checked in as going to events you hosted. Each member counts once for you in total.
- "For you": when the calendar recommends events, it does so from your own check-in record by category. Nothing about other members enters it.
- Moderation: photos and text are screened automatically as described in section 4; a person reviews reports and appeals.
You can request human review of any of these by emailing our Privacy Officer (section 11). We respond within 30 days. None of these processes is used to deny you access to the service.
7. Location
Location data is sensitive personal information under PIPEDA and requires your express consent.
Ranked asks for your location only at the moment you use it: when you tap "I'm here" at a place, or check in at an event. One location fix is sent to our servers to confirm you are within 150 metres of the place, and that check-in records where it happened. The map is centred on your city, not on you; your position is drawn on your device only, and only while you have allowed it.
We do not track your location in the background and we do not keep a running history of where you have been. You can withdraw location permission at any time in your device settings; checking in then needs it again, and everything else in Ranked works without it.
Safety alert: if you use "Send alert" from the Safety centre, we take one location fix and send it, with the place you are at, to the trusted contact you saved, by SMS. That fix is not kept after the alert is sent.
8. Notifications (CASL)
Push notifications are governed by Canada's Anti-Spam Legislation (CASL).
Transactional notifications — event reminders, messages in your groups, changes to an event you said you were going to, posts from pages you follow — are part of the service you asked for and need no separate consent.
Marketing notifications are commercial electronic messages under CASL and require your express consent. They are off by default. You can change this in Settings.
Every marketing notification identifies Ranked as the sender and includes a way to unsubscribe.
9. Children
Ranked is intended solely for people aged 18 and over. We do not knowingly collect personal information from anyone under 18.
Age is checked at sign-up through your date of birth. If we become aware that a member is under 18, we suspend the account and delete its personal data.
10. Data breach notification
In the event of a data breach that poses a real risk of significant harm, we will:
- Notify the Office of the Privacy Commissioner of Canada as soon as feasible
- Notify affected members directly: what information was involved, what we are doing about it, and steps they can take
- Keep records of all breaches for a minimum of 24 months as PIPEDA requires
We maintain internal incident response procedures to detect, investigate and respond to potential breaches promptly.
11. Accountability and your rights
Under PIPEDA you have the right to access the personal data we hold about you (use "Download my data" in Settings, or write to us), to have it corrected, to delete your account and all associated data at any time from Settings, to withdraw consent for optional processing (location, analytics, marketing) in Settings, and to complain to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca. Withdrawing consent for the processing the service needs (terms, privacy) means deleting your account.
We respond to privacy requests within 30 days; if we need up to 30 more, we tell you.
Ranked has designated a Privacy Officer accountable for our compliance with PIPEDA and this policy:
Privacy Officer Luthiber Labs Inc. (Ontario Corporation No. 1001683033), operating as Ranked 27 Bathurst Street, 416w, Toronto, Ontario M5V 0R1, Canada English: [email protected] Français (Québec): [email protected]
General support: [email protected] Pour l'assistance générale (français): [email protected]
Child-safety concerns / signalements en matière de sécurité des mineurs: [email protected] / [email protected]
12. Child safety reports
If our automated systems detect content that appears to depict a minor in an explicit context, we are required by Canadian and U.S. law to report it. In Canada we report to Cybertip.ca, operated by the Canadian Centre for Child Protection under s. 2 of the mandatory reporting Act; in the United States to the National Center for Missing & Exploited Children (NCMEC) under 18 U.S.C. §2258A. Reports include the flagged content and the associated account metadata. Ranked Safety ([email protected]) is our designated point of contact.
13. Changes to this policy
We may update this Privacy Policy from time to time. Material changes are communicated in the app and may require renewed consent. The "Last updated" line at the top says when it was last revised.
Continued use of Ranked after a change means you accept it. If you do not agree, you can delete your account at any time.
Contact
Privacy requests: [email protected]
Safety concerns: [email protected]
Everything else: [email protected]
Luthiber Labs Inc. (Ontario Corporation No. 1001683033), operating as Ranked · 27 Bathurst Street, 416w, Toronto, Ontario M5V 0R1, Canada