Plain English privacy notes.

Public pages can be read without submitting personal information. An access request includes the information shown on the form, such as your name, contact details, professional context, who invited you, the kinds of introductions you value, and any optional note.

Account and authentication information may include your email address, account identifiers, confirmation state, role, session information, and security records. Business profile information may include your name, company, role, introduction, business contact details, address, links, visibility choice, and a private profile headshot.

Event information may include RSVP status, guest count, optional guest names, member check-in time, and attendance state. A guest check-in includes full name, mobile number, email address, company, role or title, event, and arrival time.

Private relationship and communication information may include connection status, direct messages and read state, discussions, replies, moderation state, and limited audit history. Web Push information may include a device subscription, permission state, and redacted delivery evidence. Ordinary server, session, and security information may also be processed to operate and protect MIDDAY.

MIDDAY uses information to review access, create and protect approved accounts, present approved member-visible business profiles, coordinate invitations and events, process RSVP and check-in, support member connections and private communication, deliver operational email and optional notifications, prevent misuse, troubleshoot failures, and preserve limited operating or security evidence.

MIDDAY does not sell personal information, does not use personal information for advertising, and does not use it to create public profiles, public attendee lists, or public relationship maps.

Public visitors cannot see member profiles, attendee lists, RSVP records, connections, direct messages, discussions, replies, contact details, or check-in information.

Approved signed-in members can see approved member-visible business profiles and the member-safe attendance view for an event. Connected members may see business contact details that the profile owner has approved for connected-member visibility. Message participants can see only their own direct conversations.

An authorized operator can access the private operating or moderation information needed to run MIDDAY. The hidden administrator is not presented as a member identity and is excluded from member discovery, RSVP identity, discussions, connections, and direct-message eligibility.

MIDDAY uses Netlify for hosting and application runtime, Supabase for authentication, private database records, and private Storage, and Resend for application email delivery. Supabase authentication email is delivered through configured custom SMTP. Browser and operating-system services participate when a member enables Web Push or installs MIDDAY on a Home Screen.

These providers process information only as needed to operate their part of MIDDAY. MIDDAY does not authorize them to sell MIDDAY member information or use it for unrelated advertising.

Secure authentication and session cookies keep approved accounts signed in and protect private routes. MIDDAY uses a service worker and manifest to support optional Home Screen installation.

Web Push requires a member-initiated permission choice. A device subscription remains until notifications are disabled, the subscription expires, or it becomes invalid. Analytics and behavioral tracking remain disabled. MIDDAY does not use advertising pixels or third-party behavioral tracking scripts.

Unapproved or archived access requests are retained for 12 months after the final decision. Accepted request and invitation history is retained for the account lifetime plus 12 months.

Active accounts, business profiles, current headshots, and profile links are retained for the account lifetime. Approved account-deletion requests are targeted for completion within 30 days after identity and scope are verified. Superseded headshot files and asset records are deleted within 30 days after replacement when no rollback hold applies.

Connections remain for the account lifetime or until disconnected; removed relationship history is deleted within 12 months. Direct messages remain until author removal or account closure, subject to narrow security or legal holds. Discussions and replies remain until author removal or authorized moderation archive.

Moderation and security audit records are retained for 24 months. Member RSVP and check-in records are retained for 12 months after the event. Guest check-in contact details are retained for 90 days after the event; de-identified guest attendance history may be retained for up to 12 months.

Active Web Push subscriptions remain until disabled, expired, or invalid. Inactive or invalid Push endpoints are removed within 30 days. Email and Push delivery evidence is retained for 90 days, while aggregate notification diagnostics may be retained for 12 months.

Authentication sessions follow the configured expiration rules. Authentication rate-limit and related security records are retained for 30 days after the final relevant attempt. Backup remnants after an approved deletion may remain through the provider backup cycle, targeted at no more than 30 additional days.

Requests for correction, export, account closure, deletion, or retention information can be sent to: privacy@middaypc.com

MIDDAY will verify your identity before disclosing, changing, or deleting private information and will respond neutrally when identity cannot be verified.

MIDDAY targets completion of a verified request within 30 days. An export contains only information the requester is authorized to receive. Deletion may not immediately remove narrow security, fraud-prevention, legal-hold, or provider-backup remnants; MIDDAY will explain any such retained-data exception.

MIDDAY uses reasonable safeguards designed for the size and nature of the service, including private routes, server authorization, row-level database controls, private file storage, secure sessions, and limited operator access. No internet service can promise absolute security.

Material changes to this notice will be reflected by an updated date on this page. Questions about this notice or MIDDAY privacy practices can be sent to: privacy@middaypc.com