Privacy Policy

What Umber Uses

Umber is made by 71 Labs and lives at umber.71labs.com.

Umber uses the details you choose to provide, such as a first name, age range, planning style, saved plans, favorites, notification choices, and preferred language. The app keeps profile preferences and local saved plans on your device. A 71 Labs account is optional; when you create one, we process the account information supplied by the sign-in service so we can provide account-only features such as shared plans.

When you request nearby recommendations or weather-aware plans, Umber sends your precise device location to Umber's service. For nearby recommendations, it may also send a small pseudonymous personalization signal based on explicit planning choices and a bounded set of place IDs you explicitly marked as visited, plus whether that bounded list represents your full explicit-visit history. It does not include provider-sourced venue names, addresses, ratings, prices, photos, or categories. Umber uses that signal only to order otherwise eligible venue candidates; it is not a permanent “do not show” list. The service sends the coordinate and limited query data to its maps, places, and weather providers only to return the requested results; it does not send that raw visit-history signal to those providers. If an AI recommendation feature is used, selected planning preferences and weather context may be sent to its recommendation provider; provider-sourced candidate venue details, shared-plan titles, and messages are not sent to that provider. The venue shortlist is generated deterministically by Umber's service. The optional Home insight runs only after you enable optional planning insights; it uses a supported city rather than a raw reverse-geocoded locality and a limited preference summary. You can decline or later change location permission in device settings.

Google Maps Platform

Umber uses Google Maps Platform services, including Places and Weather APIs, to provide requested location-aware results. Google processes information needed to provide those services under the Google Privacy Policy. The related Google Maps/Google Earth Additional Terms of Service also apply to your use of those features.

Service Protection and Optional Insights

Umber creates a random pseudonymous installation identifier on your device. We send it to Umber's service with protected live-service requests to prevent abuse, apply request limits, and bind app-integrity verification. It is not your name or an advertising identifier, and it is used even when optional planning insights are off. Clearing local data or completing account deletion resets this identifier; where supported, protected requests then establish a fresh local app-integrity registration.

Optional planning insights are off by default. When you enable them, Umber may send a pseudonymous identifier, planning choices, destination, result count, ranking version, irreversible server-side hashes of up to six displayed Place IDs, weather fit, and a coarse 0.1-degree location area to help improve result quality. Raw displayed Place IDs are not retained in analytics. These events do not include saved-plan content, venue names, addresses, ratings, prices, photos, your name, profile age range, or profile audience setting.

How Long We Keep Data

Optional planning-insight events and limited AI service telemetry are retained for up to 180 days, then routinely deleted. AI service telemetry may be created when you use an AI feature even if optional planning insights are off; it records operational details such as endpoint, model, latency, outcome, cache or fallback status, and, where available, a hashed installation identifier. It does not include raw plan content or shared-plan messages.

Service-protection records have shorter, defined windows: request-limit counters are deleted after 35 days; inactive app-integrity registrations and inactive push-device records after 180 days; push-delivery diagnostics after 90 days; and expired sign-in sessions, sign-in states, and one-time exchange codes are routinely deleted. Administrative security audit records are retained for up to 365 days. If account deletion requires Apple credential revocation, the encrypted revocation credential is kept until Apple confirms revocation (or reports it invalid), but never longer than seven days after deletion. At that deadline the secret is irreversibly cleared even if Apple has not confirmed revocation; a non-secret terminal record is retained for up to 90 days for operational follow-up.

Saved plans, favorites, cached weather, and profile preferences are stored locally on your device unless you choose an account or shared-plan feature. Active account, shared-plan, and entitlement records remain while needed to provide those features or until deletion, subject to any legal retention obligation.

Shared Plans, Notifications, and Providers

When you create or join a shared plan, we store the user-written title and invitation message, plan summary, membership, RSVPs, proposed ideas and times, votes, and discussion messages. Members can see these contributions. Anyone with an active invitation link can preview the invitation title, message, host name and selected plan details, so share links only with people you trust. Hosts can revoke or replace links, remove members and moderate their plans. If you enable notifications, we process a device push token and your notification choices so we can deliver the reminders you request.

When you report content, we retain the reported content, report reason and account identifiers in a private moderation queue. The person reported cannot see your report. We clear the content snapshot when a report is resolved. Blocking records are used to hide contributions between the affected accounts. Account deletion removes your social contributions, reports associated with you and blocking records.

Umber may use trusted providers for maps, places, weather, notifications, and recommendation support. Those providers process information only as needed to deliver the requested feature and under their own privacy terms. When personal data is shared with a provider, Umber remains responsible for ensuring that provider gives it the same or equivalent protection described in this policy.

Your Choices

You can change location access, notification access, and optional planning insights from your device settings or inside Umber. You can clear local data in Umber to remove locally stored saved plans, favorites, and cached weather and reset the local service-protection identifier. Clearing local data does not delete your account or shared plans.

If you have an account, you can request account deletion in Umber. This revokes active sessions, removes associated push devices, removes your memberships and plans you own, and anonymizes the account profile. After a successful deletion, the app also clears its local saved plans, favorites, cached weather, and service-protection identifier. Shared plans owned by other people remain, but your membership, messages, suggestions and votes are removed. Some limited security, audit, entitlement, or operational records may be retained as described above.

Contact

Questions about privacy can be sent to info@71labs.com.