Privacy
What we hold, and where it goes
BeYu is a membership for real nights out in New York. Everything below is the complete list of what the product holds about you and every place it is sent. There are no ads on BeYu, nothing here is sold to anyone, and nothing follows you across other apps.
Your account
You sign in with Apple, with Google, or with your email address and a six-digit code. Supabase runs that door for us. What we copy out of a sign-in and onto your profile is your name, and nothing else — there is not even a column for your email address on it.
The door itself keeps more than that, and it is fairer to say so than to let the sentence above stand alone. Supabase stores the whole answer your provider gave it, beside your account rather than on your profile. With Google that is the account id Google uses for you, whether Google says your address is verified, your name as Google spells it, and — when Google sends one — the address of your Google profile picture. With Apple it is the account id Apple mints for BeYu specifically, the address Apple asserts for you, and your name — which Apple sends once, on the very first sign-in, and never again. We read your name out of it and use none of the rest; no other member can see any of it. For security we also keep a log of sign-ins to your account, including the network address each one came from.
Sign in with Apple, and Hide My Email
Apple’s sheet offers to hide your email address. Take that offer and Apple gives BeYu a relay address ending in privaterelay.appleid.com instead of your own, and forwards to you anything we send to it. That relay address then is your address here: it is what your account is keyed to, and every message we send you passes through Apple on the way.
Which account you land in follows that address, and it is the one thing on this page worth reading twice. Sign in with Apple using your real address, having signed up with Google using the same one, and it is a single account with two doors. Hide your email and there is nothing for it to match, so it starts a second, empty account — a new profile, onboarding again, none of your friends, no membership, and nothing on it that was on the first. There is nothing in BeYu that merges two accounts, and we would rather say that than let you find it out. The choice sticks to your Apple ID until you undo it: on your iPhone, in Settings, under your name, in Sign in with Apple, find BeYu and choose Stop Using.
Two consequences follow, and both are ours to say rather than yours to discover. If you RSVP’d to a night as a guest, with your name and your real email address, joining BeYu is what claims that RSVP — and it claims it by matching the confirmed address on your account against the one you typed. So an account holding a relay address can never claim a guest RSVP made with your real address: the row stays on the host’s door list, unclaimed, still holding the name and address you gave. And signing in on this website takes Google or a six-digit code sent by email, and neither of those reaches a relay address today — so an account made that way is an app account until we can send mail through Apple’s relay.
Your profile
Your handle, display name, photo, bio and city are your public face on BeYu. Other signed-in members can see them; there is no public member directory. One edge worth saying plainly: your profile photo is served from a public address, so anyone who has that exact link can fetch the image itself.
Your date of birth is different. It lives in a separate table that only you can read — not other members, not administrators, no exceptions. The only thing anyone else can learn from it is that you passed the 18-and-over gate, which is enforced in the database rather than by a form.
Your taste
Onboarding is a conversation, and the conversation is with a model: what you write in the intake goes to Anthropic to be turned into structured answers. What we keep is those answers — the kinds of nights you want, who you want them with, your energy, your availability, what you like to spend, the things you asked us to avoid.
Those answers have one job: deciding which nights to show you, and in what order. Only you can read them; they are never shown to another member. When the app ranks events for you, your answers — scrubbed of any other person’s name before they leave — are sent to Anthropic along with the candidate events. What you tap, dismiss, RSVP to and check into teaches the ranking as well, and that signal is yours alone too.
What you post and write
Photos you post live on the event page you posted them to, for the people that page already admits. Comments and bulletins carry your name on the page where you wrote them. A direct message is between the two of you — administrators have no read access to messages, by policy.
When you give Sami feedback about a night, the words you say are saved as your feedback on that night, and the person who hosted it reads them with your name and your photo on them. That is the whole audience: the database allows exactly two readers of a note, you and the host of the night it is about, and there is no third. The app says the same thing at the moment you write; it belongs here too.
Talking to Sami
Sami is the voice in the app. When you hold to talk, your audio streams from your phone directly to AssemblyAI, who turn it into text — BeYu’s servers never receive your voice. The words you say go to Anthropic to choose among nights the app is already allowed to show you: the model picks from a numbered shortlist, every pick is bounds-checked, and the shortlist itself is fetched with your own credentials, so the model can never see an event you couldn’t.
Before any stored text of yours reaches the model, other people’s names, handles, numbers and places are scrubbed out of it. There is one exception and it is named rather than buried: if you opt in to meeting people at a night, the line you wrote for that night is read by the model inside another member’s conversation — scrubbed the same way, and with nothing attached that says it is yours. The section below is exactly how that works, and nothing else about another person is ever sent.
The words you speak or type in the moment are sent as you said them — Sami cannot answer what it never hears — so what you choose to tell it is in your hands. Spoken replies are synthesized by Cartesia, and Cartesia only ever receives sentences our server composed — the reply templates have no slot a member’s name could reach. If you type to Sami instead, your words skip the audio vendors entirely: no AssemblyAI, no Cartesia, only the model. We keep no recording and no transcript of the conversation.
Meeting people, if you ask to
Sami can introduce members at a night — but only members who asked. You opt in per night, never by default, by writing a line about yourself for that night. That line is the only thing used: never your bio, never your intake, never anything you wrote for another purpose.
Here is exactly where those words go, because this is the one place BeYu sends something you wrote into somebody else’s conversation. When another member going to that same night asks Sami to introduce them, your line is one of the lines the model reads — sent to Anthropic scrubbed of names, handles, numbers and places, given a number, and carrying nothing that says which line is yours. The model answers with numbers. Our own server, not the model, then draws the cards: your line as you wrote it, with your name, your handle and your photo, on the screen of a member going to the same night. That is what opting in means, and it is all it means.
Opting out is deleting the line. It takes effect immediately — nothing caches it — and the night ends the offer either way. If you never opt in, there is no record you were ever asked.
Your contacts
BeYu reads your address book only when you ask it to. Picking friends to invite involves no server at all — nothing leaves the phone, and BeYu never sends anything on your behalf. Finding which of your contacts are already members works like this: each contact’s email address is normalized and hashed on your phone, only those hashes are sent, they are compared once against hashes of member emails, and then they are gone — not stored, not even cached. Raw addresses never leave your phone, matches are shown only to you, and the one record kept on our side is that you asked: your member id, how many hashes, and when.
Paying for membership
Membership is billed by Stripe. We send Stripe your email address and your member id, and nothing else; your card details go into Stripe’s own checkout page and BeYu never sees card numbers. Whatever you type on that page — name on the card, billing address — is collected by Stripe under Stripe’s own policy.
Tickets for outside events are different: they are sold by their sellers. BeYu sends you to Ticketmaster or whoever holds the door, carrying nothing about you in the link, and never learns whether you bought.
Notifications
If you allow notifications, we store the delivery token Expo issues for your device — deliberately not your device’s own identifier — and Expo carries the messages. Signing out retires the token; deleting your account deletes it.
Where event data comes from
Listings can come to BeYu from Ticketmaster and from NYC Open Data. That data is about events, not about you, and nothing about you is sent to fetch it. When a host searches for a venue, the words they typed go to Google Places, biased to a fixed point in New York — the search carries neither who they are nor where they are. The app never reads your location at all; the map is never centred on you.
Deleting your account
You can delete your account in the app, under Settings. The order is worth stating exactly, because it is not the order you would guess. Your photographs and your profile picture are removed from storage first. Then your billing is cancelled at Stripe — that happens before a single row of your data is deleted, and if the cancellation cannot be confirmed the deletion stops right there rather than leave you paying for a ghost. The files are already gone by that point, and stopping does not bring them back. Then the rows go: profile, date of birth, taste answers, your posts, your RSVPs and attendance, friendships and blocks, your direct message threads, your push tokens, your feedback, your account itself.
What survives, honestly:
- Comments other people replied to stay, with your name taken off — an authorless tombstone, so nobody else’s conversation collapses.
- Nights you hosted that already happened stay up for the people who were there, without your name on them. Nights that hadn’t started yet are cancelled.
- Notifications you already caused in other members’ inboxes keep the name they were delivered with.
- Photos other members posted that include you belong to their rows, not yours — report “It’s a photo of me” on the photo and taking it down is the ordinary outcome, not a courtesy.
- If you ever RSVP’d as a guest with your name and email and then joined BeYu, that guest RSVP stays with the night it was for, still holding the name and address you typed. Deleting your account unlinks it from you but does not remove it. Write to us and we will.
- Your sign-in history stays, and this is the one survivor that is not ours to erase. The service that runs the door keeps its own log of every sign-in, sign-out and token refresh — the time, what happened, the email address the sign-in was made with, and the network address where one was recorded — in a table that has no link to your account for a deletion to follow. Only administrators can read it, through a door that returns no email and no other detail, and it is how a question about who signed in when gets answered.
- Our own audit records keep an opaque id that resolves to nothing, and aggregate counts — how many people did a thing in an hour — keep your contribution without any way back to you.
If you RSVP without an account
A guest RSVP is a name and an email address, held so the host knows who said yes. A scrambled network fingerprint rate-limits abuse; the address it came from is never stored. If you were a guest and want your name and email gone, write to support@beyu.app and we will remove them.
No ads, no sale, no tracking
There are no ads on BeYu and there never have been. We do not sell your data — not to advertisers, not to brokers, not to anyone. There is no cross-app tracking: no ad SDKs, no third-party analytics, no attribution pixels. What we count for ourselves is nine kinds of moment, and they are all of them: opening the app, signing in, opening a tab, opening an event, tapping RSVP, opening Chat, sending Sami a message, and a host starting or publishing a night. Not what you photographed, not what you wrote, not which night — the nine are built so that no free text, no handle and no message can even be passed in, and a tenth would take a change to the database.
Who we work with
- Supabase — runs our database and sign-in.
- Apple — mints your identity when you use Sign in with Apple, and, if you chose to hide your email, runs the relay every message we send you travels through.
- Stripe — bills membership; gets your email and member id.
- Anthropic — the model behind intake and Sami; gets what you say to it, your stored answers with other people’s names scrubbed out, and — only if you opt in to meeting people at a night — the line you wrote for that night, scrubbed and unattributed, inside the conversation of another member going to it.
- AssemblyAI — turns your voice into text when you hold to talk.
- Cartesia — speaks Sami’s replies; only ever hears our own sentences.
- Google Places — venue search; gets the typed query, never the person.
- Expo — carries push notifications and app updates.
- Ticketmaster and NYC Open Data — send us event listings; learn nothing about you.
Questions about any of this — or a request this page doesn’t cover — go to support@beyu.app. The terms and support pages are the other two documents we keep.