Odyzi, Inc. · odyzi.app
Effective Date: October 5, 2026 (the “Effective Date”)
This Privacy Policy (this “Policy”) describes how Odyzi, Inc. (“Odyzi,” “we,” “us,” or “our”) collects, uses, discloses, and retains personal information in connection with the Odyzi platform, including odyzi.app, our mobile applications, our odz.bz short-link services, and related services (collectively, the “Service”). It applies to users located in the United States, the only market in which the Service is currently offered. It does not apply to information practices of event organizers (“Organizers”), venues, ticketing providers, or other third parties, even where you reach them through the Service.
The Service is intended only for individuals 18 years of age or older. Your access to and use of the Service is also governed by Odyzi’s terms of service, available at odyzi.app/terms (the “Terms of Service”).
Account data. Email address, password (stored only as a salted hash produced by an industry-standard one-way key-derivation function, and never in plaintext), display name, handle, bio, profile and header images, and optional profile location and website. Your account log-in credentials in combination with your password constitute “sensitive personal information” under California law; Odyzi uses those credentials solely to authenticate you and to secure your account.
Phone number. Collected only where you provide it for a specific purpose (e.g., event updates or, in the future, ticketing). We use a phone number only for the purpose for which it was provided; marketing text messages require your separate, express, unbundled opt-in consent, which is off by default (see Section 7.3).
Content you post. Event listings, descriptions, hashtags, images, video, comments, and other content you submit, including drafts generated with our AI-assisted tools that you review and publish. Public content is visible to anyone, including guests and search engines.
Communications. Messages you send us (support, content reports, privacy requests) and, if in-app messaging is later offered, the content of those messages. In-app messages, if offered, are encrypted in transit and at rest but are not end-to-end encrypted, meaning Odyzi can access them where necessary for safety, moderation, and legal compliance. The contents of in-app messages between users, where Odyzi is not the intended recipient, will constitute “sensitive personal information” under California law; Odyzi accesses those contents only for the purposes stated in this bullet.
Transaction data. When payment features are active: purchase history, ticket and registration details, amounts, and refund history. Payment card numbers are collected directly by our payment processor, Stripe, and are not stored on Odyzi systems. For Organizers receiving payouts, Stripe collects identity-verification and tax information (e.g., SSN/EIN, date of birth, bank account) directly.
Age confirmation. When you confirm that you are 18 or older and accept our Terms of Service and this Policy, we keep a record of that confirmation, including the time, your IP address, and your browser type.
Beta invitations. While the Service is in private beta, you need a single-use invite code to create an account. We record which code you used, the invitation group it belongs to, and how it was distributed. If we email you an invitation, we store the email address it was sent to. If you sign up with Google, a short-lived cookie that expires within 15 minutes carries your invite code through Google’s sign-in.
Waitlist. If you join our waitlist, we collect your name, email address, ZIP code, how you heard about Odyzi, and your answer to a short question about what you are looking for. We use this to decide whom to invite and to contact you about access.
Geolocation. Precise device location only if you grant OS-level permission, or a location you enter manually, used to center your feed, power radius filtering and the map view, and support “near you” features. You can revoke precise-location permission at any time in device settings and use the Service by entering a location manually. Location text you enter (city, ZIP, address), and device coordinates you choose to share, are sent to our geocoding providers (Section 4) to be converted to coordinates or a place name. When you share device location, the resulting city is kept in your browser rather than on our servers. Odyzi does not infer your location from your IP address. Odyzi does not use your location to infer, and does not infer, any health condition, treatment, diagnosis, or attempt to obtain health services or supplies; does not draw a geofence around, and does not target content, notifications, or advertising by proximity to, any facility that provides health care services; and does not disclose location data for either purpose. Precise geolocation constitutes “sensitive personal information” under California law, and Odyzi uses it solely to provide the location features you request.
Usage and behavioral data. Events you view, like, save, share, and follow; searches and filters; feed impressions and taps; media playback; session data; and referral sources, including clicks on odz.bz short links (which record the link, where it was shared from, and the time). For links you tap that leave the Service, we record only the destination website’s domain. If you use the Service without an account, we record this activity using a random identifier stored in your browser that is not linked to your name or email; if you later create an account from that browser, that earlier activity may be linked to your account. We use this to operate the feed, personalize recommendations, measure performance, and — with your consent choices honored — power lifecycle communications.
Searches. We store the words you type into search to improve results and learn what people are looking for. Before storing a search, we automatically replace anything that looks like an email address or phone number. Search words are erased 90 days after the search.
Device and log data. IP address, device type and model, operating system, browser type, app version, language, device identifiers (e.g., mobile advertising identifier only if and when advertising features described in Section 5 launch), crash logs, diagnostic logs, and timestamps.
Cookies and similar technologies. See Section 6.
Aggregated event data. We compile event listings from public and third-party sources (e.g., government open-data feeds and publicly available event pages). These listings describe events and may incidentally include personal information that the source made public, such as an organizer’s name and business contact details.
Google sign-in. If you sign up or log in with Google, we receive your Google account ID, name, email address, and profile photo, and we store the sign-in tokens Google issues for your account.
We use personal information to:
provide, operate, and maintain the Service, including the feeds, search, map view, saves, follows, profiles, and short links;
personalize your experience, including ranking your feed and generating recommendations from your activity (initially rule-based, and over time using machine-learning models trained on Service usage and on User Content (as defined in our Terms of Service) under the license in Section 5.3 of the Terms of Service, excluding any inference of health status or of proximity to a health care facility);
process transactions, ticketing, payouts, and refunds when payment features are active, and detect and prevent fraud, abuse, and chargebacks;
communicate with you: service and transactional messages (receipts, security alerts, changes to events you saved or bought into), onboarding messages, and — subject to Section 7 — marketing communications;
moderate content and enforce our Terms of Service, using automated systems and human review, including duplicate detection and safety screening;
secure the Service, debug, and develop and improve features;
measure and analyze Service performance and, if advertising features launch, measure ad delivery as described in Section 5;
comply with law, respond to lawful requests, and protect the rights, safety, and property of Odyzi, our users, and others; and
for any other purpose disclosed to you at collection or with your consent.
Where we aggregate or de-identify information, we maintain and use it only in aggregated or de-identified form and do not attempt to re-identify it, except to test the effectiveness of de-identification.
We disclose personal information to vendors that process it on our behalf under contractual confidentiality and use restrictions, including cloud hosting and database infrastructure, content delivery, payment processing (Stripe), email delivery, geocoding, customer support, and, post-launch, a marketing-automation provider for lifecycle messaging. Odyzi measures usage with first-party instrumentation and does not engage a third-party analytics provider; if Odyzi engages one, Odyzi will identify it in Section 4 before doing so. Our material service providers as of the Effective Date are listed in Section 4.
If you register for, purchase a ticket to, or RSVP to an event when those features are active, we share with that event’s Organizer the information needed to fulfill your registration (e.g., name, email, ticket type). Organizers’ use of that information is governed by their own privacy practices; our Terms of Service prohibit Organizers from using attendee phone numbers for marketing without separate express consent.
Your display name, handle, profile and header photos, follower and event counts, published event listings, and public activity are visible to other users, guests, and the public, and may be indexed by search engines and shared via odz.bz links. Unless you set your profile to private, your bio, location, website, saved and liked events, and follower and following lists are visible too.
As of the Effective Date, sponsored placements on the Service are sold directly by Odyzi and served using only first-party data; Odyzi does not sell personal information and does not share it with third-party ad networks for cross-context behavioral advertising, in each case as those terms are defined in the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the “CCPA”). If we later introduce third-party programmatic advertising (e.g., on event detail pages), certain identifiers and activity data may be shared with advertising partners in ways that constitute a “sale” or “sharing” under California law; before doing so we will update this Policy and provide the required “opt-out of sale/sharing” mechanisms, including honoring the Global Privacy Control (the “GPC”).
We may disclose information to comply with law or legal process; to respond to lawful requests from public authorities; to enforce our Terms of Service; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of Odyzi, our users, event attendees, or the public.
If Odyzi is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be disclosed and transferred as part of that transaction, subject to this Policy or successor commitments no less protective in material respects.
We disclose information when you direct us to (e.g., sharing an event via your device’s share sheet, exporting a calendar file) or otherwise consent.
As of the Effective Date, our material service providers are:
Github — web-based hosting services for version control;
Supabase — database and storage of photos and videos you upload (hosted on major U.S. cloud infrastructure);
Vercel — application hosting and content delivery;
Stripe — payment processing, payouts, identity verification, and tax reporting (when payment features are active);
Resend — transactional and onboarding email delivery;
Google — sign-in with Google (Section 1.3); fonts in our emails are loaded from Google, so Google may receive your IP address when your email app displays them;
Komoot Photon — location suggestions as you type an event address; your browser contacts Photon directly, so it receives the text you type and your IP address (no account identifiers are sent);
OpenStreetMap Nominatim — converts location text you enter, or device coordinates you share, into coordinates or place names; our servers send only the location text or coordinates, with no account identifiers;
OpenStreetMap and Protomaps — map images and map fonts for the map view, loaded directly by your browser, which shares your IP address and the map area you are viewing;
OpenAI (AI processing providers) — large-language-model APIs used to draft event summaries from links or text you submit for that purpose. We do not submit your account credentials to these providers, and our agreements restrict use of submitted content to providing the service to us. Odyzi’s agreements with these providers prohibit the use of submitted content to train the providers’ models.
We will update this list for material changes. A current list is available on request at privacy@odyzi.app.
Sponsored and promoted event placements are labeled as such in the feed. As of the Effective Date, these placements are contextual and first-party: Organizers pay Odyzi for placement, and no personal information is disclosed to the advertiser beyond aggregate performance metrics (e.g., impressions and taps on their own placement). We do not display third-party ad-network advertising. If that changes, Section 3.4 governs and this Policy will be updated first, including addition of interest-based-advertising disclosures and opt-outs.
We use cookies, local storage, SDKs, and similar technologies to keep you signed in, remember preferences (such as location and radius), secure the Service, measure usage, and attribute odz.bz link activity. Categories:
Strictly necessary — authentication, security, fraud prevention, and core functionality; these cannot be disabled;
Functional — preferences and settings;
Analytics — first-party usage measurement.
As of the Effective Date, we do not use third-party advertising cookies. You can control cookies through your browser settings; disabling non-essential cookies may impair some features. Odyzi honors opt-out preference signals, including the GPC, as a valid request to opt out of any sale or sharing of personal information, and of any processing of personal information for targeted advertising, associated with your browser. Because browsers vary in how they express “Do Not Track” (“DNT”), we do not respond to DNT signals other than the GPC.
You can edit your profile and set it to private from your profile’s edit screen (Section 3.3 describes what a private profile hides). You can ask us to delete your account at any time by contacting privacy@odyzi.app.
Marketing emails contain an unsubscribe link; opting out does not affect service and transactional messages.
We send marketing texts only with your prior express written consent, collected separately from account signup and from any other consent, and defaulted off. Reply STOP at any time to revoke; revocation by any reasonable means is honored.
Control push notifications in your device and app settings.
Grant or revoke precise-location permission in device settings at any time; you can always set location manually.
Your feed and recommendations are personalized from your recent likes, saves, and comments. You can change what is used by removing those likes, saves, or comments.
The CCPA and comparable comprehensive privacy laws in effect in other states, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Maryland, Minnesota, New Jersey, and any other state whose comprehensive privacy law is in effect from time to time, apply to businesses meeting statutory thresholds. Odyzi extends the rights below to all U.S. users as a matter of policy, regardless of whether a given statute currently applies to Odyzi or to you.
Subject to legal limits and verification, you may: (a) request access to / knowledge of the personal information we have collected about you, including categories, sources, purposes, and disclosures; (b) request a portable copy; (c) request correction of inaccurate personal information; (d) request deletion; (e) opt out of any sale or sharing of personal information for cross-context behavioral advertising (as of the Effective Date, we do not sell or share personal information as those terms are defined in the CCPA); (f) limit use of sensitive personal information, of which Odyzi collects two categories as of the Effective Date: your account log-in credentials in combination with your password, which Odyzi uses solely to authenticate you and secure your account, and your precise geolocation where you grant permission, which Odyzi uses solely to provide the location features you request; in each case a purpose for which the right to limit use does not apply. If in-app messaging is later offered, the contents of messages between users, where Odyzi is not the intended recipient, will constitute a third category of sensitive personal information, as described in Section 1.1; and (g) not receive discriminatory treatment for exercising your rights.
Submit requests by email to privacy@odyzi.app. We will verify your request using your account email (and, where necessary, additional information), confirm receipt of your request within 10 business days, respond within the time required by applicable law (under the CCPA, within 45 days of receipt, extendable once by an additional 45 days where reasonably necessary and with notice to you within the first 45-day period), and honor requests from an authorized agent upon proof of authorization and identity verification. If we deny a request, you may appeal by replying to our decision; where state law provides, we will explain how to contact your state Attorney General if the appeal is denied.
In the preceding 12 months, we have collected the following categories of personal information as described in Section 1: identifiers (e.g., name, handle, email, IP address); internet or other electronic network activity information (usage and behavioral data, log data); geolocation data (approximate; precise with permission); audio/visual information (media you upload); commercial information (transaction history, when payment features are active); inferences drawn for personalization; and sensitive personal information (account log-in credentials in combination with your password, and precise geolocation where you grant permission), as described in Section 8.2. Sources, purposes, and disclosure recipients are described in Sections 1 through 4, and the period for which Odyzi retains each category, or the criteria Odyzi applies, is described in Section 9. We have not sold or shared personal information in the preceding 12 months and have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age.
Odyzi does not sell sensitive personal data, including precise geolocation, and does not process sensitive personal data of a Maryland resident except as strictly necessary to provide or maintain a product or service that the resident has requested. Odyzi limits its collection of personal data to what is reasonably necessary and proportionate to provide or maintain the specific product or service you request.
We retain personal information only as long as reasonably necessary for the purposes described in this Policy, and then delete or de-identify it. Our baseline schedules, which we may adjust for legal holds, disputes, fraud prevention, and legal obligations:
Account and profile data — life of the account, then deleted within 30 days of verified account deletion (public event listings you published may be retained in de-identified form to preserve feed integrity);
Behavioral and usage event data — deleted automatically 13 months after it is recorded; search words are erased sooner, 90 days after the search;
Invite-code records — life of the account;
Waitlist information — until you receive access, ask us to remove it, or we close the waitlist;
Server and diagnostic logs — 13 months; short-lived diagnostic instrumentation is removed when no longer needed;
Transaction and payout records — seven years, consistent with tax and financial-record requirements;
Communications with support and privacy requests — 24 months after resolution (privacy-request records: 24 months as required by the CCPA);
Backups — encrypted backups roll off on a fixed cycle of no more than 35 days; deleted data may persist in backups until that cycle completes.
We use administrative, technical, and physical safeguards appropriate to the nature of the data, including encryption in transit (TLS) and at rest, hashed passwords, database row-level security, role-based access controls, and least-privilege access for personnel. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affecting your personal information requires notice under applicable law, Odyzi will notify you and the applicable regulators as and when required. Please report suspected vulnerabilities to security@odyzi.app.
The Service is not directed to children and is available only to individuals 18 or older. We do not knowingly collect personal information from anyone under 18, and in particular do not knowingly collect personal information from children under 13 within the meaning of the Children’s Online Privacy Protection Act. If Odyzi learns that it has collected personal information from a person under 18, Odyzi will delete that information and terminate the associated account. Odyzi escalates and acts on any report or indication that an account is held by a person under 18, whether received through support, a user report, or account content. Parents or guardians who believe a minor has provided us personal information may contact privacy@odyzi.app.
The Service is operated from the United States for U.S. users, and information is processed and stored in the United States. This Policy does not cover the practices of Organizers, venues, ticketing providers, social platforms you share to, or other third parties; review their policies before providing them information.
Odyzi may update this Policy from time to time. Odyzi will post the updated Policy with a new Effective Date, will retain and make available the prior version, and, for material changes, will provide prominent notice by in-app notice and by email to your registered address not less than 30 days before the changes take effect. Where required by law, we will obtain consent. Material changes will not be applied retroactively to previously collected information without a lawful basis.
Odyzi, Inc. — Privacy
911 Washington Ave., Suite 501, St. Louis, MO 63101
Telephone: 314.718.7889 · Privacy requests: privacy@odyzi.app · Security: security@odyzi.app · General: live@odyzi.app