SUNDOWN

Bali Nightlife

Privacy Policy

Last updated: July 11, 2026

SunDown ("we", "our", or "us") operates the SunDown mobile application available on Google Play and the Apple App Store, and the website at sundown.id. This Privacy Policy explains what data we collect, how we use it, who we share it with, and what rights you have over your information.

By using SunDown you agree to this policy. If you do not agree, please do not use the app.

Contents

Data We Collect
Photo & Image Access
How We Use Your Data
Data Sharing with Third Parties
Data Shared with Partner Venues
Data Storage & Security
Data Retention
Your Rights
Children's Privacy
Changes to This Policy
Contact Us

1. Data We Collect

We collect the following categories of personal data:

Category	Data	Required?
Account info	Full name, email address, optional phone number, date joined	Required
Profile photo	Photo you choose to upload as your avatar	Optional
Booking data	Table reservations, venue names, booking dates and times, group size, special requests	Required
Moments / media	Photos and images you choose to share in the Moments feed	Optional
Venue Lens images	Photos you submit for venue recognition via the Lens feature	Optional
App activity	Venues viewed, searches made, events browsed, favourites list, reviews written	Required
Device data	Device type, operating system version — used only for app compatibility	Required
Nightlife Passport	XP points, tier status (Bronze/Silver/Gold/Platinum), badges and achievements	Required

We do not collect your precise GPS location, financial information, or payment card details.

2. Photo & Image Access

Before accessing your photos or camera, the app displays a prominent in-app disclosure explaining exactly what images are accessed, why, and how they are used. You must explicitly tap "I Understand & Allow" before any photo access occurs. This consent is stored on your device and you will not be asked again on subsequent uses.

SunDown accesses your photos and camera for three specific purposes:

Profile Photo

You may choose a photo from your device's gallery to use as your profile picture. This image is uploaded to and stored on our secure servers (Supabase). It is visible to other SunDown users as part of your public profile. It is not shared with venues or any other third party.

Moments

You may select photos from your gallery to share in the Moments community feed. Images you post are visible to other SunDown users. They are stored on our secure servers and not shared with third parties beyond being displayed to app users.

Venue Lens

You may take a photo using your camera or select one from your gallery to identify a venue. The image is processed on our servers solely to return a venue match result. Lens images are not stored permanently and are not shared with any third party, including the venue being identified.

You may remove your profile photo or delete your Moments at any time from your profile settings. Deleted images are removed from our servers within 30 days.

3. How We Use Your Data

To create and manage your SunDown account
To process and confirm table reservations at venues
To display personalised venue and event recommendations via Sandy AI
To operate the Nightlife Passport (XP, tiers, badges)
To display your profile photo and Moments to other users
To identify venues via the Lens feature
To send push notifications about bookings and events you have opted into
To improve app performance and fix bugs

We do not use your data for advertising profiling, sell it to data brokers, or use your images to train AI models.

We do not sell your personal data. We share data only in the following circumstances:

Third Party	Data Shared	Purpose
Partner Venues	Name, booking details (date, time, group size, special requests)	Fulfilling your reservation
Supabase supabase.com	All account data, photos, booking data, Moments	Secure cloud storage & database
Google OAuth	Email address & display name (if you sign in with Google)	Authentication only
Apple Sign In	Email address (if you sign in with Apple)	Authentication only

Supabase is bound by a Data Processing Agreement and stores all data with encryption in transit (TLS) and at rest (AES-256). See supabase.com/privacy for their privacy policy.

5. Data Shared with Partner Venues

SunDown connects users with Bali's nightlife venues. When you make a booking, the following data is transmitted to the relevant venue to fulfil your reservation:

Your name (as entered in your profile)
Booking details: date, time, number of guests, table preference, special requests
Contact details only if you have chosen to include a phone number in your profile and the venue requests it for confirmation purposes

Venues do not receive your email address, profile photo, Moments images, Lens images, browsing history, or Nightlife Passport data. Only the minimum information needed to fulfil your booking is shared.

Partner venues are independent third-party businesses. Their use of your booking data is governed by their own privacy practices. SunDown is not responsible for how venues store or use booking information once it has been transmitted to them.

If you cancel a booking, we request that the venue delete the associated booking data, but we cannot guarantee this.

6. Data Storage & Security

All data is stored on Supabase infrastructure with AES-256 encryption at rest and TLS encryption in transit.
Passwords are never stored in plain text. Google and Apple authentication tokens are handled securely and never stored on our servers.
Photos and images are stored in Supabase secure storage buckets with access controls.
We apply row-level security (RLS) policies so users can only access their own data.
Access to the database is restricted to authorised SunDown staff only.

7. Data Retention

Account data: retained while your account is active. Deleted within 30 days of account deletion.
Photos & Moments: retained until you delete them manually, or until account deletion (30 days).
Venue Lens images: not stored permanently — processed and discarded immediately after a result is returned.
Booking records: retained for up to 12 months for dispute resolution and service improvement, then deleted.
Device data: not stored — used only during active sessions.

8. Your Rights

You have the following rights over your personal data:

Access — request a copy of the personal data we hold about you
Correction — update inaccurate data via your in-app profile settings
Deletion — delete your account and all associated data. Use the account deletion page or contact us directly
Withdraw consent — revoke photo access at any time in your device's app permissions settings
Data portability — request an export of your data by contacting us
Object to processing — contact us to object to any specific use of your data

To exercise any of these rights, email us at donleosh21@gmail.com or use the in-app contact options. We will respond within 30 days.

9. Children's Privacy

SunDown is a nightlife application intended exclusively for users aged 18 and older. We do not knowingly collect personal information from anyone under 18. If we become aware that a minor has created an account, we will delete it immediately. If you believe a minor is using SunDown, please contact us at donleosh21@gmail.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via the app or email. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the app after changes are posted constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: