third is a local social discovery app. It helps you find and meet people who are physically nearby and open to connecting. This policy explains what information we collect, why we collect it, and how it is used.
When you create a profile, we collect:
This information is used to build your profile card, which is shown to nearby users when you are open to chat.
When you toggle "open," third accesses your device's GPS coordinates. Your location is used to:
Your precise coordinates are never shown to other users — only a venue name and approximate distance. When you go offline, your location data is deleted from our servers immediately.
When you send a wave to another user, a record is created linking your account to theirs. Waves are used to deliver push notifications and to display your wave history within the app. Waves older than three days are automatically deleted, except for connections where both people have met in person.
If you grant notification permission, we store a push token associated with your account. The token is used to deliver app notifications: when someone waves at you, when someone reveals their identity in response to your wave, and when another user becomes visible nearby. We do not use the token for marketing.
When you report or block another user, a record is created for safety and moderation purposes. Reports may be reviewed by the third team to enforce community guidelines.
third uses Supabase to store and manage your data. Profile photos are stored in Supabase's secure object storage. Data is stored in the United States. We use Supabase's built-in row-level security to ensure users can only access data they are permitted to see.
When you upload a profile photo, it is automatically scanned via Google Cloud Vision (face detection + safety filter) to confirm a face is present and that the image is not explicit. Photos that fail the check are deleted from storage immediately and never associated with your account. We do not retain any of the analysis output beyond the pass/fail result.
third uses the following third-party services:
Each of these services has its own privacy policy. We share only the minimum data necessary for each service to function.
third is intended for users who are 18 years of age or older. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, please contact us and we will remove it promptly.
You may at any time:
Location data is deleted when you go offline, or after 30 minutes of inactivity, whichever comes first.
Wave records persist while they are active in your inbox or outbox. When you unwave a wave you sent, it is deleted three days later. When you dismiss a wave you received, it is deleted three days later. Waves where both people have met in person are preserved indefinitely.
Profile data is retained until you delete your account. When you delete your account, your profile, photo, sent and received waves, and blocks are deleted immediately. Reports linked to your account (filed by you or against you) are anonymized rather than deleted: your account ID is removed from each report, but the report content (reason text, timestamp) is preserved for moderation purposes under our legitimate interest in preventing abuse.
If your account is suspended for violating these terms or our community guidelines, an irreversible cryptographic hash of your email address may be retained to prevent the same address from being used to re-register. The hash cannot be reversed to recover the original email, and the underlying email is not stored.
If you are located in the European Economic Area (EEA), the United Kingdom, or California, you have additional rights regarding your personal information under applicable law (the General Data Protection Regulation, the UK GDPR, and the California Consumer Privacy Act respectively).
These rights include:
We do not sell or share your personal information for cross-context behavioral advertising. We do not knowingly process the personal information of minors under 18.
To exercise any of these rights, contact us at . We will respond within 30 days for GDPR / UK GDPR requests and within 45 days for CCPA requests, as required by applicable law.
The legal basis on which we process your data under the GDPR is:
If we make material changes to this policy, we will update the date at the top of this page. Continued use of the app after changes constitutes acceptance of the revised policy.