Privacy.

Tova is operated by Peers Creative, based in Aotearoa New Zealand. Reach us at hello@tova.co.nz.

Your email address. Used to sign you in (email + password, or Apple sign-in) and for transactional email — RSVP confirmations, host notifications, reflection prompts, anything you’d expect to receive about a gathering you’re part of. We do not send marketing email.

Your profile. Display name, handle, optional bio, optional avatar. You provide all of it; you can change any of it any time.

Your phone number. Optional. If you add it to an RSVP, the host of that gathering can see it so they can reach you about the night.

Your content. Gatherings you create, photos and videos you upload (mood, post-event, share-to-stories), the itinerary and run of show, reflection notes you leave on other people’s gatherings, RSVPs you submit.

Your chat messages. Tova has a group chat per gathering, including images, polls, replies and @mentions. Messages live with the gathering — only people in the gathering can read them.

Crash and performance data. When the app crashes or behaves badly, Expo (the framework Tova is built on) collects an anonymised crash report so we can fix it. We do not see your content in these reports.

How you use the app, minimally. We track save counts and view counts at the gathering level so Feed and Explore can rank useful things, and we receive push delivery receipts. We do not track which screens you visit, what you tap, or how long you stay.

No ads. Tova doesn’t run ads and we don’t share data with ad networks.

No tracking across other apps or websites. We don’t use Google Analytics, Facebook Pixel, Mixpanel, or any third-party advertising network.

No selling your data. Ever. Not aggregated, not anonymised, not in any form.

No location tracking. Tova doesn’t read your device location, GPS, or background location.

No contacts access. We don’t read your address book, social graph, or anything outside the app.

Calendar and camera, only when you ask. Tova asks for Calendar access only when you tap “Add to calendar” on a gathering, and asks for Camera or Photo Library access only when you’re uploading or capturing a photo. Both can be revoked any time in iOS Settings.

Tova runs on Supabase (managed Postgres, storage and auth) and sends email through Resend (transactional email). Push notifications are delivered by Apple Push Notification service and Firebase Cloud Messaging on Android, routed via Expo. Crash reports are processed by Expo. Each of these vendors sees your data only because they have to in order for Tova to work. None of them sell your data or use it for advertising.

Hosting is on Vercel (US). If you’re in the EU or UK, your data may transit through the US for processing — using Tova counts as consent to that transfer.

Private gatherings: only you and the people you invite.

Public gatherings: visible on Feed, Explore, and your host profile to anyone, signed in or not.

Events: visible publicly, plus anyone can request to attend. You approve or decline.

Reflection photos: guests upload, you moderate. They’re only public after you approve them.

Chat messages: only people in the gathering (the host, co-hosts and approved guests) can read them. Vendors invited to a gathering see only the chat thread for that gathering.

Your email and phone: never shown publicly. Hosts you RSVP to see your display name, plus your phone number only if you added one to the RSVP.

If someone makes Tova worse for you, block them: they won’t see your gatherings, and you won’t see theirs. Reports go to a human at Peers Creative; we review them and act.

In the app: Settings → Delete account. Removes your profile, every gathering you’ve hosted, every photo, every RSVP, and your login. Nothing about you remains. We have no recovery flow on purpose.

If you email us at hello@tova.co.nz, we’ll do the same on your behalf within 30 days.

Tova isn’t for under-13s (under-16 in the EU/UK). If you’re below that and signed up, please delete your account or tell us and we will.

Ask us what we hold, fix what’s wrong, export it, or have it deleted. Just email us. If you’re in the EU or UK, you also have the right to complain to your data protection regulator.

We’ll update the effective date at the top and, for any substantial change, tell you in the app or by email before it takes effect.