Privacy policy

Who we are

Thirdspace (“Thirdspace”, “we”, “us”) runs the Thirdspace iPhone app and the website thirdspace.my. For anything about your personal data, write to support@thirdspace.my. We handle personal data in line with Malaysia's Personal Data Protection Act 2010 (PDPA).

What we collect

When you sign in

You sign in with Apple or Google. We receive your name and email address from them. If you use Sign in with Apple and choose to hide your email, we receive Apple's private relay address instead. You can browse Thirdspace without signing in.

Your WhatsApp number, only when it's needed

• Organisers give a WhatsApp number when they request a café slot, so the café can contact them about that request.
• Café owners give the café's WhatsApp number when they set up a listing, so organisers they approve can contact them.
• Visitors are never asked for a phone number.

What you add

Your profile photo if you add one; café details, address, map pin, photos, open slots, pricing and house terms; event pages and cover photos; the notes you send with a venue request; and reports you make.

What you do in the app

Events you save or join, venue requests and their status, check-ins at events, and people you block.

From your device

• A push notification token, if you allow notifications, so we can tell you about requests, events and reminders.
• Your location, only while you use the app and only if you allow it, to show events and cafés near you and to place your café on the map. We don't keep a history of where you have been.
• Photos you choose from your library or take with the camera, only when you add them to a café, an event or your profile.

On this website

This website has no sign-up form and does not use cookies or analytics.

What we don't collect

Thirdspace takes no payments, so we never collect card or bank details. Event prices are paid to the host at the door, and venue charges at the café.

Why we use it

• To run Thirdspace: your account, listings, requests, event pages, guest lists and check-in.
• To send the notifications you asked for, such as a new request, an approval, someone joining, or a reminder the day before an event.
• To keep people safe: to review reports, enforce blocks, filter objectionable words, and suspend accounts or content that break our terms.
• To answer you when you contact support.

We don't sell personal data, and we don't use it for advertising.

Who can see what

• Published café listings and public event pages can be seen by anyone, with or without an account.
• An event page shows the host's first name (“Hosted by Nadia”).
• An event's host, and the café it is held at, see the first names and photos of the people going. Never their phone numbers or emails.
• A café sees the name, note and WhatsApp number on each venue request it receives.
• An organiser sees a café's WhatsApp number only after that café approves their request.
• Events set to “Only people with the link” are visible only to people who have the link.

Messages you send on WhatsApp are between you and the other person, and are covered by WhatsApp's own privacy policy. Thirdspace does not see them.

Where it is stored

Thirdspace's database, sign-in and file storage run on Supabase, in its Singapore region. By using Thirdspace you agree to your personal data being transferred to and stored in Singapore, which we do under section 129 of the PDPA with a provider bound to protect it.

We also rely on these services to run the app:

• Apple and Google, to sign you in.
• Expo's push service and Apple Push Notification service, to deliver notifications.
• Apple Maps, to show maps and directions.
• Our website host, to serve thirdspace.my.

How long we keep it

We keep your data for as long as you have an account. When you delete your account we delete it, except where the law requires us to keep something for longer. Backups are overwritten within 30 days. Waitlist emails are kept until Thirdspace opens, or until you ask us to remove yours.

Your rights

Under the PDPA you can:

• ask for a copy of the personal data we hold about you;
• ask us to correct it;
• withdraw your consent, or ask us to limit how we use it;
• delete your account and its data.

Most of this you can do in the app: edit your name and WhatsApp number in Profile, and delete your account in Profile > Delete account. For anything else, write to support@thirdspace.my from the email you sign in with. We reply to access and correction requests within 21 days.

Deleting your account

Open Thirdspace, go to Profile and tap Delete account. It happens straight away. See Delete your account for what is removed, or how to ask by email.

Children

Thirdspace is not meant for children under 13. If you are under 18, please use Thirdspace with a parent's or guardian's permission. If you believe a child has given us personal data, contact us and we will delete it.

Security

Data is encrypted in transit. Access is limited by rules in the database itself: for example, one person can never read another person's requests or another event's guest list. No system is perfectly secure; if we learn of a breach that affects you, we will tell you.

Changes

If we change this policy in a way that matters, we will tell you in the app before the change applies. The date at the top shows the latest version.