Beta preview. Demesne is in private beta. This page is the working draft of the final policy; controller details and the effective date will be completed before public launch.

Privacy at Demesne

Effective date: (to be completed at public launch)

Demesne is the verified presence layer for private members' clubs. Privacy is not a setting here. It is the architecture. This page says exactly what we collect, what we never collect, and what your club can and cannot see. The app's Privacy Centre mirrors this page, and automated tests keep the two honest.

The short version

Ghost mode is the default. You appear only when you choose. You can vanish in two taps.
The radar is off by default. On, it lets nearby members of your clubs notice you — and you them, never one-way. It broadcasts a rotating identifier, never your location, and remembers nothing.
Your location is never tracked, stored or shared. We hold one ephemeral fact — "inside your club: yes or no" — and it is erased within minutes of your leaving.
Your club sees anonymous counts, never named movements. Small counts are hidden entirely.
A declined introduction is never revealed. Only acceptance is.
No advertising. No tracking. No sale of data. Ever.

Who we are

Demesne Club Ltd. (to be completed at public launch), the data controller for the Demesne app and demesne.club. Contact: privacy@demesne.club. Data protection lead: dpo@demesne.club. (to be completed at public launch)

What we collect, and why

Data	Why	Lawful basis
Email, name, profile photo, role line, up to three interest tags, self-declared social links	Your member card and account	Contract
Club membership and its validation by your club	Verifying you belong to the room	Contract
Presence — "inside your club", derived from the club's Bluetooth beacons or a coarse geofence	So you can choose to appear in tonight's member list	Your explicit consent, off by default
Radar — a rotating Bluetooth identifier your phone broadcasts while your radar is on	So nearby members of your clubs, radar on too, can notice you — and you them	Your explicit consent, off by default
Introduction requests and messages	Introductions and conversation	Contract
Device and security records (push token, app version, sign-in devices, security logs)	Keeping accounts safe	Legitimate interest / legal obligation
Product analytics	Improving the app	Consent, default off; the app works fully without it

Precise GPS coordinates never leave your phone. Beacon sightings and geofence checks are reduced, on our servers, to a single fact per club: present or not. Profile photos are stripped of hidden location metadata on upload.

How presence works — and how it is erased

Live presence is held only in an ephemeral store with a rolling expiry of at most 12 minutes, refreshed while you are in the house. Leave, and it disappears. Turn presence off, or go Ghost, and it is erased immediately. No individual presence or location record is ever written to our permanent database. What persists are hourly counts per club — never names — and any count below three is recorded only as "fewer than three".

How the radar works — and what it never knows

With your radar on, your phone broadcasts a fixed app identifier and a rotating token that only our server can resolve — it changes at least every 15 minutes and identifies you to no one else. Nearby members of your clubs whose radar is also on see your name; you see theirs; there is no one-way watching. We never read signal strength, never derive distance or location from the radar, and never keep a history of who crossed whom: an encounter lives in ephemeral memory for about two minutes after your phones last noticed each other, then vanishes. Your radar stays on with the app closed, until you turn it off — and turning it off, or going quiet, erases every current encounter on both sides at once.

What your club sees, and never sees

Your club sees anonymous occupancy counts. It never sees named arrivals, departures or movements. It cannot look up whether you, personally, are or were in the house. Membership staff can validate or revoke memberships; revocation removes you from the directory within a minute.

Declines are silent

If you decline an introduction, the requester is never told. There is no read receipt, no rejection notice, no status change they can observe. Requests simply lapse.

Sharing

We sell nothing and share nothing for others' purposes. We use a small number of processors under contract, with data held in the EU: Google Cloud (EU, Belgium region — hosting), our transactional email provider (EU) (to be completed at public launch), Sentry (EU — crash reporting), PostHog (EU — analytics, only if you opt in). There is no third-party advertising or tracking software in the app. We disclose data only where the law compels us.

Retention

Data	Kept for
Live presence	At most 12 minutes, rolling
Radar encounters	About 2 minutes after your phones last noticed each other, rolling
Radar broadcast identifiers	Rotate at least every 15 minutes; resolvable for at most an hour
Hourly occupancy counts (anonymous)	24 months
Messages	Until either party deletes the conversation, or account deletion
Introduction requests	12 months
Sign-in codes	10 minutes
Security audit records	24 months
Deleted accounts	Hard-deleted within 7 days after the grace period; backup copies expire within 35 days

Your rights

You can act on your rights from inside the app — no letters, no waiting on hold.

Export. You → Privacy Centre → Export my data. A complete copy, delivered by secure link.
Delete. You → Privacy Centre → Delete account. Three taps. A 7-day grace period, then everything goes: profile, photos, messages, tokens. Details at demesne.club/delete-account.
Access, rectification, restriction, objection and withdrawal of consent work the same way, or by writing to privacy@demesne.club.

You may complain to the Information Commissioner's Office (ico.org.uk). We would rather you told us first.

Age

Demesne is for adults. You must be 18 or over.

Changes

If this policy changes materially, we will tell you in the app before the change takes effect, and this page will show the revision history.

Questions: privacy@demesne.club. We reply within 48 hours.