Skip to main content
Link copied!
Legal

Privacy Policy

How Midpoint collects, uses, and shares information. Last updated: August 3, 2026.

This Privacy Policy explains how midpoint (“Company,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with the Midpoint service at midpoint.to (the “Service”). It should be read together with our Terms of Service.

This Policy describes practices based on the Service’s current functionality. Placeholders mark facts that must be completed by the operator (for example legal entity and retention for contact messages).

1. Who we are / Contact

Controller / operator: midpoint, organized under the laws of [STATE], [COUNTRY].

Privacy contact: support@midpoint.to or Contact.

2. Scope

This Policy applies to visitors, private-poll participants, public-event hosts and viewers, and individuals who contact us. It does not apply to third-party websites linked from the Service (including ticket sellers or map providers), which have their own policies.

3. Information we collect

3.1 Information you provide

  • Private polls: poll name/description, date/time windows, timezone, participant names, availability selections, optional attendance flags, optional location notes or coordinates you choose to share, chat messages, and meetup/spot votes where enabled.
  • Public events: title, description, schedule, venue/address, zip code, coordinates (if derived or provided), ticket URL, category/details fields, and related listing content.
  • Contact form: name, email address, subject, and message.
  • Admin operators: username, password hash, and email associated with administrative accounts (not consumer end-user accounts).

3.2 Information collected automatically

  • Technical / log data: IP address, approximate request timing, browser/user-agent signals as provided by your client, and security-related telemetry needed to operate rate limiting, abuse prevention, and human verification.
  • Device / usage data: pages and APIs requested, referring URLs where provided by the browser, and feature-usage signals inherent to HTTP requests.
  • Cookies / session: a first-party session cookie (typically PHPSESSID) when needed for CSRF protection, forms, human-verification challenges, flash messages, or admin authentication. Cookie flags may include HttpOnly, Secure (on HTTPS), and SameSite=Lax.

3.3 Location data

  • Zip codes you enter for listing or discovering public events.
  • Optional browser geolocation if you choose features such as “Near me” or share location in a private poll. We use coordinates to estimate a nearby search center, reverse-lookup a zip where supported, or store participant location you elect to share. You may decline browser permission and use zip entry instead.
  • We may cache zip-to-coordinate and points-of-interest lookup results to operate maps and discovery features.

3.4 Local storage (browser)

We may use browser localStorage (not cookies) to remember:

  • cookie-consent acknowledgment;
  • theme preference (light/dark);
  • on private poll pages, temporary client-side state such as your display name, response identifiers, selected slots, and related UI state for that poll.

We do not currently use sessionStorage.

3.5 Payments

We do not currently collect or process payment card data through the Service. If paid features are added, payment data would typically be handled by a third-party processor and this Policy would be updated.

3.6 Communications

If you email us or use the contact form, we process the content of that communication to respond and for related operational records. We do not operate a marketing newsletter at this time.

3.7 AI processing

We do not currently send your content to generative AI / LLM providers as part of product features. Public pages may be crawled by third-party AI bots subject to our robots policy; that crawling is outside our product processing pipeline.

4. Cookies and similar technologies

We use:

  • Essential / security cookies: session cookies required for CSRF tokens, form flows, human verification, and admin login where applicable.
  • Preference storage: localStorage for consent and theme as described above.

We currently do not use third-party advertising cookies, analytics pixels, or marketing trackers on Midpoint. CDN-hosted libraries (for example Bootstrap, icons, fonts, or mapping scripts) may be loaded from third-party CDNs and may receive standard technical request data (such as IP address) as part of delivering those assets.

Our cookie banner lets you Accept all, Reject non-essential, or Customize preferences. Essential session functionality may operate regardless of optional consent because it is required to run secure forms. See the full Cookie Policy on this site for names, durations, and storage details.

Do Not Track: The Service does not currently respond to browser Do Not Track signals because there is no industry-uniform standard for DNT interpretation and we do not deploy advertising trackers.

5. Analytics

We do not currently use Google Analytics, Mixpanel, Hotjar, or similar product analytics suites. Server and application logs used for security and abuse prevention are described above.

6. How we use information

  • Provide, operate, maintain, and improve private polls and public event listings.
  • Enable discovery, maps, geocoding, and related features you request.
  • Respond to support and contact requests.
  • Authenticate administrators and protect accounts.
  • Secure the Service: rate limiting, IP blocking, honeypots, human verification, fraud and abuse prevention, debugging, and integrity monitoring.
  • Comply with law, enforce Terms, and protect rights, safety, and property.
  • Create backups and perform routine operations.

We do not sell personal information.

7. Legal bases (where applicable)

If GDPR/UK GDPR or similar frameworks apply to a processing activity, we rely on one or more of: performance of a contract (providing the Service you request); legitimate interests (security, abuse prevention, service improvement, limited public discovery of content you chose to publish); consent (for optional geolocation and similar optional features); and legal obligation. Replace this section with counsel-approved bases once [COUNTRY]/entity details and data flows are finalized.

8. How we share information

  • Other users / public: Private poll participants with the link can see content the product displays. Public event information you publish is visible to visitors and may be indexed by search engines.
  • Service providers: hosting, database storage, email delivery (contact messages may be sent via server mail facilities), CDN providers, and mapping/geocoding providers (for example Nominatim / OpenStreetMap-related services) that process data to provide the Service.
  • Legal / safety: when required by law, legal process, or to protect rights, users, or the Service.
  • Business transfers: in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction subject to appropriate confidentiality and this Policy’s principles.

We do not sell personal information for monetary consideration. We do not share personal information for cross-context behavioral advertising.

9. File uploads and media

Administrators may upload images/media to the Service for site content. Uploaded files are stored on our hosting environment and associated metadata (filename, type, alt text) may be retained in our database. Do not upload unlawful or infringing media.

10. Security

We use reasonable administrative and technical measures appropriate to the nature of the Service, which may include HTTPS, password hashing for admin credentials, HttpOnly session cookies, CSRF protections, rate limits, and abuse controls. No method of transmission or storage is 100% secure. You use the Service at your own risk regarding residual security risk.

11. Data retention

  • Events (private polls / public events): Active listings remain until deleted. Soft-deleted events are retained for a recovery window of approximately 30 days, then permanently purged (including related responses/chat where cascading deletion applies), subject to backups and legal holds.
  • Rate-limit records: typically purged on the order of about 24 hours as part of abuse-prevention housekeeping.
  • Abuse / blocked IP records: retained as needed for security.
  • Contact submissions: retained until deleted by an administrator or earlier if we set a schedule; target retention: [DATA RETENTION PERIOD — CONTACT].
  • Admin accounts: for as long as the account is active and as needed thereafter for security/audit.
  • Caches (zip/POI): retained as needed for performance, then refreshed or removed.

We may retain information longer when required by law, to resolve disputes, enforce agreements, or maintain security.

12. International transfers

The Service may be hosted and processed in the United States and/or other locations where our providers operate. If you access the Service from outside those locations, you understand information may be processed in countries that may have different data-protection laws. Where required, we will use appropriate transfer mechanisms as determined with counsel for [COMPANY LEGAL NAME].

13. Your choices and rights

  • Do not submit information you do not want shared via a private-poll link or public listing.
  • Decline geolocation and use zip search instead.
  • Clear localStorage/cookies via your browser settings (may affect forms/login).
  • Request access, correction, or deletion of personal data we hold by emailing support@midpoint.to. We may need to verify the request and may retain certain data as permitted or required by law (for example security logs).

13.1 GDPR / UK GDPR rights (if applicable)

If these laws apply to you, you may have rights to access, rectification, erasure, restriction, portability, and objection, and to withdraw consent where processing is consent-based, and to lodge a complaint with a supervisory authority. Contact us to exercise rights. We will respond within applicable statutory timelines where those laws apply.

13.2 California privacy rights (if applicable)

If you are a California resident and CPRA/CCPA applies, you may have rights to know/access, delete, correct, and opt out of “sale” or “sharing” of personal information as those terms are defined by California law. We do not sell personal information and do not share it for cross-context behavioral advertising as those terms are commonly understood for advertising networks. To submit a request, email support@midpoint.to. We will not discriminate against you for exercising rights. Authorized-agent requests may require verification.

Note: Whether Midpoint is a “business” subject to CPRA depends on thresholds and facts for [COMPANY LEGAL NAME]; this section is provided for transparency and readiness, not as an assertion that CPRA currently applies.

14. Children’s privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 provided personal information, contact us and we will take appropriate steps to delete it.

15. Third-party technologies used to deliver the Service

Depending on the page, the Service may load or call:

  • CDN-hosted UI libraries (for example Bootstrap and icons via jsDelivr);
  • Google Fonts;
  • Leaflet mapping libraries and OpenStreetMap tiles;
  • Nominatim / OpenStreetMap-related geocoding and places lookups;
  • Outbound Google Maps search links (not an embedded Maps SDK).

Those providers may process technical data (such as IP address) under their own policies when your browser or our servers request their resources.

16. Authentication summary

Consumer end users typically use the Service without accounts. Administrators authenticate with username/password; passwords are stored as one-way hashes; sessions are maintained via first-party cookies; CSRF tokens protect state-changing requests. Human verification challenges may be required for certain sensitive actions (for example admin login and creating a public event).

17. Changes to this Policy

We may update this Privacy Policy from time to time. The effective / last-updated date on this page will change when we do. Continued use after an update means you acknowledge the revised Policy. Material changes may also be highlighted via the Service or cookie notice where appropriate.

18. Contact

Privacy questions and data requests: