Privacy notice
Last updated: 9 November 2026.
Who is responsible
UK Tonight is operated by MARVELLA GROUP LIMITED, the controller of the personal data described in this notice. Contact info@marvellagroup.co.uk for privacy requests or support.
Your account
Depending on how you sign in, UK Tonight uses an email, password hash or sign-in provider identifier, together with your date of birth, to provide an account, check the 18+ requirement and protect sign-in. WeChat-only accounts do not need an email. Your date of birth and email are not displayed on your public profile.
WeChat sign-in
When you choose WeChat and consent, the WeChat SDK opens its authorisation screen. UK Tonight uses an application-specific WeChat identifier to create or link your account. We do not fetch contacts, chat history, your phone number, email or profile photo. You still confirm your age and community agreement. A WeChat-only account can be deleted after reauthorising the linked WeChat account.
Google sign-in
If you choose Google, UK Tonight receives a verified email and Google account identifier to sign you in. We do not receive your Google password or access your Gmail, contacts or Drive. Your age and community agreement are still required. To delete a Google-only account, confirm with a code sent to your verified email; no new password is required.
Sign in with Apple
Apple provides an account identifier and a verified email, which may be a private relay address. We verify your identity on our server and store an encrypted Apple refresh token solely to manage sign-in and revoke authorisation when you delete your account. Your Apple password is never shared with UK Tonight.
Why we process data
We use account, age, plan and message data to provide the service you request under our terms. Our legitimate interests in preventing fraud, protecting users and maintaining a reliable service support security checks, moderation and technical diagnostics. Optional phone sharing is based on your consent, which you can withdraw. Where the law requires us to keep or disclose information, we rely on that legal obligation.
What other people see
Your chosen name and optional profile information can be seen by other signed-in users. Public plans show their host, venue, time, availability and approved cover image. Each approved guest has a separate conversation with the host; other guests cannot read or send messages in that conversation. Authorised moderators may review reported messages for safety. Avoid posting private or sensitive information.
Activity photos
Hosts can choose a supplied activity illustration or upload a photo they have permission to use. Uploaded activity photos are reviewed before publication; until approved, the existing image or an illustration remains visible. Uploaded photo metadata is removed. Supplied illustrations do not show actual participants or prove that an event has taken place.
Attendance and Social Passport
When you enter a host check-in code, or a host marks you as arrived, we link an attendance time to your account and the named venue. This records reported attendance, not GPS verification. We do not request device location or track your movements. Confirmed participants can see arrivals. Your Social Passport shows attendance totals and area/month summaries; your own view also shows venue and date details.
Optional contact sharing
A phone number is shared only after the guest and host both consent. Withdrawing consent stops future display in UK Tonight; it cannot erase copies already received by another person. WhatsApp is a separate service with its own privacy terms.
Hosting and account emails
Supabase hosts our dedicated database in London. Netlify provides the website and backend, and Zoho CPaaS (formerly ZeptoMail) sends verification and recovery emails through its EU service. Support, security and other service processing may take place outside the UK. Provider contracts include safeguards for international transfers, including standard contractual clauses and UK-specific protections where applicable. Contact us for information about the safeguards relevant to your data. No advertising or cross-app tracking SDK is included in this version.
Service security
We process IP addresses and account identifiers to limit abuse and sign-in attempts. Our backend records technical error information to diagnose failures. These records may contain account-related identifiers and are not used for advertising.
Attendance reports and appeals
We keep private attendance reports, your explanations or appeals, and moderator decisions to investigate cancellations or missed plans and apply fair, temporary limits. Relevant users and authorised moderators can access case information; it is not published on your profile. A report alone does not trigger a penalty. You can explain safety concerns or emergencies without supplying medical documents. Resolved cases follow the safety-report retention period below.
How long we keep data
Account and plan data remain until you delete your account or the relevant content, subject to safety moderation and applicable law. Expired verification codes, sign-in requests, sessions and rate-limit records are periodically removed. Resolved safety reports and closed support correspondence are kept for no more than 12 months after closure, unless the law requires longer retention. Local recovery backups containing user data are retained for up to 30 days; source code and app installers without user data may be kept longer. Deletion removes live data first. Restricted recovery copies and service-provider delivery or security logs may remain until their own retention periods expire. Supabase Pro standard daily backups are retained for seven days; Zoho account-email delivery logs normally for 60 days. Provider service-termination cleanup can take longer: our Zoho DPA allows up to six months for primary storage and up to a further three months for backups. These supplier periods are separate from our local 30-day backup limit. No backup may be restored into active use without reconciling account deletions.
Your privacy rights
You can ask for access, correction, erasure, restriction or portability of your personal data, or object to processing based on legitimate interests, where these rights apply. You can withdraw consent without affecting earlier lawful processing. We may need to verify your identity before responding. Contact info@marvellagroup.co.uk; you can also complain to the UK Information Commissioner’s Office at ico.org.uk. We do not use automated decisions that have legal or similarly significant effects on you.
Control and deletion
You can edit optional profile information, revoke contact sharing, withdraw from plans, block people and delete your account in Me. Account deletion removes your live profile, photos, messages, applications and hosted plans, and signs out all devices. Contact us for access, correction or other privacy requests.
Contact
For privacy enquiries, email info@marvellagroup.co.uk. UK users may also contact the Information Commissioner’s Office at ico.org.uk.