Privacy Policy

Last updated: August 17, 2026 · Developer: Eduardo Graffe · [email protected]

1. Introduction

Now What? is a group decision-making app that helps you and your friends decide what to do — movies, restaurants, recipes, games, and more. This Privacy Policy explains what information the app collects, how it is used, and your choices regarding that information.

By using Now What?, you agree to the practices described in this policy.

2. Information We Collect

Information you provide:

Player names — names you enter for group members. Stored locally on your device only. Never transmitted to our servers.
Custom lists and saved items — options you add manually. Stored locally on your device only.
Group/squad names — names you create for recurring groups. Stored locally on your device only.

Information collected or processed when you use app features:

Location data — when you use real-place features in Dinner, Going Out, or Activities, including typed place search and Find Nearby Places, the app may request your foreground location. Location coordinates and place search text are sent through our Cloudflare Workers backend to place providers such as Apple Maps and Geoapify, depending on availability and configuration, to return relevant nearby results, place details, and place photos.
App install identifier — the app generates a random identifier for the app installation. It is stored locally and may be sent to first-party Now What? backend services for rate limiting, quota management, reliability, and abuse prevention. It is not an advertising identifier such as IDFA or GAID and is not used for advertising or cross-app tracking.
Search queries — text you type when searching for places, movies, restaurants, recipes, TV shows, anime, video games, or board games may be sent to the backend or provider needed to return results. Place searches may be sent with your location. Anime search is routed through our AniList proxy service.
Decision history — your last 100 decisions, including the winner, shortlist, players, and outcome. Stored locally on your device only. Never transmitted to our servers. For Apple Maps provider results shown in History or Replay, Now What? retains title-only place information. It does not retain Apple place IDs, Apple Maps URLs, coordinates, addresses, place types, photos, raw Apple metadata, or other Apple provider response metadata.
Usage and engagement data — XP points, Chaos Level, badges, and similar gameplay/progress data are stored locally on your device. Separately, the product analytics described below may record product-interaction information such as app launches, screens viewed, feature/category usage, interaction counts, and similar usage events.
App preferences — sound, haptics, onboarding/tutorial status, and other app settings. Stored locally on your device.
Network and service metadata — when the app communicates with our backend or third-party services, those services may necessarily process standard network metadata such as IP address, request time, app/platform information, and similar technical information needed to deliver, secure, or diagnose the service.
Local reminders — if you enable weekly reminders, they are scheduled locally on your device using local notifications. Notification permission is requested contextually when you enable reminders or use notification-related features. We do not operate a remote push notification backend at launch and do not collect push notification tokens at launch.
Crash and error diagnostics — production builds use Sentry for crash/error reporting. The app is configured to avoid sending default PII and to filter user-entered or request-related fields before reports are sent.

Product analytics: Now What? uses PostHog for product analytics to understand how the app is used and to improve features, usability, and reliability. Analytics may include events such as app launches, screen views, feature or category usage, interaction counts, app version/platform information, and similar product-interaction data. PostHog uses an analytics identifier that is not an advertising identifier or user account identifier. We do not use PostHog for advertising, cross-app tracking, or data-broker purposes, and we do not intentionally send player names, group names, custom-list contents, decision history, or precise location as PostHog event properties.

Email addresses: email addresses are not collected through the launch version of the app because the optional email signup feature is disabled. If that feature is enabled in a future version, this policy will be updated before collection begins.

Information we do NOT collect: passwords, phone numbers, contacts, photos, camera or microphone data, advertising identifiers such as IDFA or GAID, payment information, or browsing history outside the app.

3. Location Data

Location is used when you request nearby suggestions or search for real places in location-based categories such as Dinner, Going Out, and Activities. The app requests foreground location permission only — it does not access your location in the background.

Your foreground location coordinates and place search text may be sent through our Cloudflare Workers backend to place providers such as Apple Maps and Geoapify, depending on availability and configuration, to find restaurants, bars, activities, place details, and place photos. Your location is not shared with advertisers and is not used for advertising or cross-app tracking.

You can decline location permission and continue using non-location features and manually added ideas. Live place search and nearby-place suggestions may be unavailable without location access.

Apple Maps provider results are not retained in History or Replay beyond title-only place information. Geoapify or other fallback/supplemental place responses may be cached only where permitted to reduce repeated requests and improve performance.

4. How We Use Your Information

Show you nearby places and activity suggestions
Search for movies, TV shows, recipes, games, anime, and real-world places
Save your decisions, preferences, groups, and history locally
Track your XP and achievements locally
Understand product usage and improve features, usability, and reliability
Identify and fix app crashes and technical issues
Protect backend services with rate limits, quota management, and abuse prevention

We do not use your information for advertising or cross-app tracking. We share or process data with third-party service providers only as described in Section 5 and only as needed to operate, secure, analyze, or improve the app.

5. Third-Party Service Providers

Provider	Purpose	Data Sent
Cloudflare	Workers backend proxying, D1 app content, KV rate limiting, edge caching where permitted, and abuse prevention	Search requests, place-search coordinates when needed, app content requests, temporary provider-permitted cached responses, normalized request data where permitted, and rate-limit counters based on hashed IP values
Apple Maps	Primary places provider for nearby place search, place details, and place photos at launch	Approximate/foreground coordinates and place search text needed to return relevant place results
Geoapify	Fallback or supplemental places provider for nearby place and location search	Approximate/foreground coordinates and place search text needed to return relevant place results
Sentry	Crash and error reporting	Filtered crash/error diagnostic events and standard network/service metadata needed to deliver the service
PostHog	Product analytics used to understand feature usage and improve the app	Analytics identifier, product-interaction events such as app launches, screen views, feature/category usage and interaction counts, plus standard network/service metadata needed to deliver the service
IGDB / Twitch	Video game search	Game title search query
TVMaze	TV show search	TV show search query
AniList (via proxy service)	Anime search	Anime title search query
Expo / EAS	Developer build and release infrastructure	Used as part of the developer build/release process. Remote JavaScript and asset updates are disabled in the production App Store build.
YouTube	External trailer/search destination opened only when you choose to view trailer-related content	Search or destination information and normal browser/device data handled by YouTube when you open the external link
Google Maps	External map destination opened only when you choose to view a place on a map	Place/map destination information handled by Google when you open the external link
Apple / App Store	App distribution and platform services	App binary and platform/device information managed by Apple
Google Play	Android app distribution and platform services	App binary and platform/device information managed by Google

Search requests may pass through our backend before being sent to the provider needed to return results. Content and image providers may also receive standard network metadata when your device downloads externally hosted images. We do not intentionally send player names, decision history, group names, XP/badge data, or locally stored custom-list contents to search/content providers. Product analytics and diagnostics are handled separately by PostHog and Sentry as described above.

6. Data Storage and Security

Local storage: Player names, decision history, XP, badges, preferences, squads, saved items, custom ideas, lists, the app-generated install identifier, and similar app data are stored locally on your device using standard mobile storage such as AsyncStorage. Analytics or diagnostic SDKs may also maintain limited SDK-managed local state needed to provide their services. Local app data is not transmitted unless specifically described elsewhere in this policy.

Server-side processing and storage: Our backend stores app content such as recipes, movies, and board games in Cloudflare D1. Cloudflare KV may store limited-retention rate-limit or quota state derived from request information such as hashed IP values and/or the app install identifier. Cloudflare Workers may temporarily cache provider responses or normalized request data only where permitted by relevant provider terms, to improve reliability and reduce repeated provider requests. PostHog and Sentry process analytics and diagnostic information as described in this policy and according to the service configuration used by Now What?. If optional email signup is enabled in a future build, this policy will be updated before email collection begins.

Data in transit: All communication between the app and our backend uses HTTPS encryption.

7. Your Rights and Data Deletion

Since Now What? stores most user-created app data locally on your device, you have control over that data:

Delete locally stored profile and activity data — the Settings deletion action removes primary local data such as player profiles, decision history, XP/badges, squads, saved items, custom ideas/lists, onboarding/tutorial status, and app settings. Some temporary cache or prompt-state data may expire or be cleared separately.
Location data — revoke location permission at any time through your device's system settings. Non-location features continue to work without location access, but live place search and nearby-place suggestions may be unavailable.
Local notifications — weekly reminders, if enabled, can be managed in the app or through your device notification settings. We do not collect push notification tokens at launch.
Product analytics — analytics events are used to understand app usage and improve the product. They are not used for advertising or cross-app tracking.
Crash and error diagnostics — production diagnostic events are used to identify and fix technical issues and are filtered to avoid sending default PII and user-entered content.
Technical identifiers and server-side service data — the app-generated install identifier is used for first-party quota, reliability, and abuse-prevention purposes. Limited-retention rate-limit or quota state may be stored by our backend. App content stored in D1 does not contain your player profiles, decision history, or locally stored custom lists.

For privacy questions or requests, contact us at [email protected].

8. Children's Privacy

Now What? is not directed at children under the age of 13. Some app content and activity categories may be intended for older users, and age suitability may vary based on the applicable App Store or platform age rating and region. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information through the app, please contact us at [email protected].

9. Advertising

Now What? does not currently display advertisements and does not collect advertising identifiers such as IDFA or Google Advertising ID for advertising purposes. Product analytics described in this policy are used to understand and improve Now What? and are not used for cross-app advertising tracking. If advertising is added in a future version, this policy will be updated before that change is introduced.

10. In-App Purchases

Now What? does not currently offer in-app purchases or subscriptions. If purchases are added in a future version, this policy will be updated.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.

12. Contact

Eduardo Graffe
Email: [email protected]