Privacy

Draft for legal review. Last updated 11 October 2026.

This is what Lastnyt collects, why, who helps us handle it, and the choices you have. It covers the Lastnyt app and this website.

Who we are

Lastnyt is made by FSM Developments Ltd (“we”), a company in Auckland, New Zealand. We’re responsible for the personal information in this policy under the Privacy Act 2020. Questions, requests and complaints go to support@lastnyt.com.

The short version

• We use your information to run Lastnyt: to make and share your Nights’ recaps.
• We never sell it or show ads, and we don’t track you across other companies’ apps or websites.
• Photo locations are rounded to about 11 metres.
• You can hide your photos, or delete your account, whenever you like.

What we collect, and why

• If you join in a browser: the name you give, which the people in the Night see, and if you choose, a phone number or email so we can send you the recap. A cookie keeps you in that Night on that browser for up to 90 days. We don’t use cookies for analytics or ads.
• If you use the app: your email address, or your Apple or Google sign-in (they share your name and email with us; Apple lets you hide your email). We use it to sign you in, and show your name to the people in your Nights. We also record that you confirmed you’re 18 or over.
• Photos and videos you choose to add, with the time each was taken and where, rounded to 4 decimal places (about 11 metres). They make the map, the timeline and the reel. We only get the location saved in the photos and videos you add: the app never tracks where your phone is.
• Your profile photo, if you add one (or the picture from your Google account). It shows next to your name.
• Captions and reactions you add to photos. Everyone who can see the photo sees them, and other people’s reactions help pick what goes in the reel.
• A push token from Apple or Google, so we can send notifications to your phone, like when the recap is ready.
• Purchases: what you bought, the store’s transaction id and the Night it unlocked, through RevenueCat. Apple and Google take the payment: we never see your card.
• Analytics: a short list of events, like a Night started, photos added or a reel shared, so we can see what’s working. In the app they carry your account id (a random id, not your name or email). On this website they’re kept in memory, without cookies. Nothing is recorded automatically: no screen recordings, no taps or page views.
• Crash reports: when something breaks, the error and details about the app and device, so we can fix it. In the app they carry your account id; on this website, nothing that identifies you. Never cookies or what you sent.
• Reports: if you report a photo, which one, why, and who reported it, so we can review it.
• Messages you send us, so we can help.
• Server logs, such as IP addresses, which our hosting providers keep to run the service and keep it secure.

Photos are re-encoded on your phone or in your browser before they upload, which removes the camera details and exact location saved in the file. Reels are made fresh, with none. Shortly after a video is added, we remove the details the phone saved in its file, such as where it was filmed, before anyone outside the Night can see it. To pick the best moments we score each photo, spot near-duplicates and find where faces are in the frame. We don’t recognise who anyone is.

Who can see what

• People in the same Night see each other’s names and profile photos, and the photos, videos, captions and reactions they add.
• Anyone with a published recap’s link sees the map with its stops, the reel, the photos and videos, and the names and profile photos of the people who added them. Anyone with the invite link sees the Night’s name, the host’s name and who’s adding photos.
• Hidden photos are seen only by the host, and by you if you hid it. They never appear in a reel or on a shared page.
• Your phone number and email are never shown to anyone else.
• Hosts can take people off their Night, and what those people added goes too.

Who helps us run it

These providers handle information for us, only to provide their service:

• Supabase (Sydney, Australia): the database, sign-in and file storage.
• Railway (Singapore): the service that makes reels and sends notifications.
• Vercel (United States, with servers worldwide): this website.
• Expo, Apple and Google (United States): push notifications.
• Resend (United States): sign-in emails, and guests’ recap emails.
• Twilio (United States): guests’ recap texts.
• Mapbox (United States): maps and street names, from the rounded locations of the places in a Night. Your phone or browser loads maps from Mapbox directly.
• Google Places (United States): names of places, from the rounded locations of the places in a Night.
• RevenueCat (United States): purchases.
• PostHog (United States): analytics.
• Sentry (United States): crash reports.
• Apple and Google: sign-in if you use them, and payments.

Sending information overseas

Our providers are in Australia, Singapore and the United States, and some work worldwide. They handle your information on our behalf, under terms that require them to protect it and use it only to provide their service to us. We stay responsible for it under the Privacy Act, including its rules on sending personal information overseas (information privacy principle 12).

How long we keep it

• Full-size originals of photos and videos: 30 days on free Nights, 12 months on paid ones. After that we keep the thumbnails and the reel.
• Thumbnails, reels and the rest of a Night, including guests’ names and contact details: until the host deletes their account, or you ask us to remove them.
• Your account: until you delete it (see deleting your account). Purchase records stay without your account on them, so a Night Pass keeps working for its Night.
• Analytics and crash reports: for as long as our providers keep them, linked only to a random id.
• Copies in our database backups: overwritten within 30 days.

Keeping it safe

• Everything travels encrypted, and our providers encrypt it where it’s stored.
• Photos and reels sit in private storage. The app and website only get links to them that expire within 60 minutes.
• Access rules in the database mean people see only what they’re allowed to. Guests’ access keys are stored only as hashes.
• Only the people who run Lastnyt can reach our systems, and only to run them.
• If a privacy breach is likely to cause serious harm, we’ll tell you and the Privacy Commissioner.

18 and over

Lastnyt is for people aged 18 and over: everyone confirms their age before they join or host a Night. If we learn someone younger is using it, we’ll remove their account.

Your choices and rights

• Hide any photo you added, ask for one you’re in to come down, or report anything that shouldn’t be there.
• Remove your profile photo, or delete your account, from Profile in the app.
• As a guest, leave out your phone or email. Turn notifications off in your settings.
• Ask to see the personal information we hold about you, or to correct it. Email support@lastnyt.com, and we’ll respond within 20 working days.
• Not happy with how we’ve handled your information? Tell us first. You can also complain to the Office of the Privacy Commissioner (privacy.org.nz).

Changes to this policy

If we change this policy, we’ll update this page and the date at the top. If a change matters, we’ll tell you in the app or by email before it takes effect.