Privacy Policy
Mixer is a consent-first networking service for events and person-to-person introductions. It helps people create an approved profile, selectively share a networking card, see possible common ground, mutually connect, and coordinate an optional conversation or meetup.
Information Mixer processes
- An opaque Mixer account identifier derived from the Apple or Google sign-in method you choose. Mixer does not receive your Apple or Google password.
- The events you join, membership and availability settings, and event profile fields you approve.
- A private modular peer profile you create, including questions and answers you choose to add and an optional profile photo. Professional, Fitness, and Life & Interests organize that profile in the installed app. A Mixer Card selects the questions, answers, contact methods, and links you want to share. This selected content is returned through the card's active public link but is not encoded directly in the QR code. Everything not selected stays private. If you upload a peer profile photo, Mixer includes it with your Mixer Cards and serves it from a direct public image URL until you remove the photo or delete your account.
- On the peer web page, your browser may keep your display-name convenience value for up to 30 days and a random guest credential used to restore your backend profile. It does not keep a second local copy of your question answers or Mixer Card.
- For a no-sign-in App Clip or web guest, a random device credential generated on your device and the derived opaque Mixer identity used to restore that temporary profile. Mixer does not require an Apple or Google identity for this guest flow.
- Person-to-person comparison results generated from the participants' answers to questions present in both selected Mixer Cards, including a bounded commonality summary, shared topics, reasons, and a suggested conversation opener. Each participant receives a scan-time snapshot containing only the answers and contact fields that the other person explicitly shared for that card.
- Match results, connection requests, text messages, read and mute state, meetup plans, and private post-event feedback.
- Event questions you submit and votes you cast. Questions are shown to the room without displaying the author's identity; Mixer keeps the submitting identity privately to enforce event access, one vote per attendee, abuse controls, and deletion.
- An event directory entry is created only after you approve an event profile. It contains your display name and only the specific organizer-question answers the organizer explicitly marked public for the Room card, full Room profile, or event filter. Profile photos, general profile fields, private organizer-question answers, boundaries, and separately saved contact cards are not included.
- Contact methods and external links you choose to save. Event contact details are revealed only after both attendees approve an exchange. For person-to-person sharing, only the individual contact methods or links you explicitly enable in a Mixer Card are shown to someone who has its active link.
- If you choose to connect LinkedIn, the limited account claims LinkedIn provides and any public LinkedIn profile URL you add. Mixer does not receive your LinkedIn password, connections, posts, or messages.
- Safety reports and only the specific messages a reporter chooses to attach as evidence.
- In-app notification records and, when notifications are enabled, an Apple device token, app identifier, and delivery environment.
- If you choose “Allow analytics” on the website, mobile web experience, or Android app, privacy-safe product events such as visits, demo progress, invitation opens, sign-in completion, event joins, profile approval, match views, connection outcomes, and organizer actions. Random browser and session identifiers are hashed before storage. These records may include the Mixer surface, platform, app version, event identifier, campaign label, and a synthetic-test marker.
- When you use the App Clip, Mixer records first-party flow diagnostics needed to understand whether the lightweight experience works: screens reached, button choices, question and field positions, step timing, API success or failure, and bounded error codes. Random App Clip visitor and session identifiers and any Mixer account identifier are hashed before analytics storage. These records include the event identifier and app version/build, but never the text you type, your AI prompt or conversation, messages, passwords, contact details, or authentication tokens.
- Short-lived authentication, rate-limit, and operational records needed to secure and run the service.
Mixer does not request your Apple, Google, LinkedIn, ChatGPT, or Claude password; provider access token; contact list; precise location; hidden model reasoning; or general chat history from another service. A personal-AI drafting button sends or copies a bounded prompt to the assistant you choose. Mixer receives only the profile fields you bring back, review, and submit.
How information is used
Mixer uses this information to operate event and peer profiles, produce comparisons from selected questions, shortlist potential event matches, present introductions, run audience questions and voting, provide the event directory, enable mutually approved communication, deliver notifications, prevent abuse, investigate reports, understand product funnels, diagnose App Clip drop-off and failures, and maintain the service. Product analytics do not use screen recording, session replay, keystroke capture, or third-party analytics SDKs and never include profile answers or descriptions, messages, AI prompts or conversations, match explanations, contact information, feedback text, authentication tokens, full invitation URLs, or precise location. Mixer does not retain raw IP addresses in its product-analytics records. When model-assisted matching is enabled, approved event fields or the participants' approved event-profile answers—other than private boundary instructions—may be sent to OpenAI to shortlist candidates and generate a bounded, redacted match result. Private Mixer messages, answers outside the event profile, and contact details are not sent to the matching model. In the installed app, you can separately opt in to include bounded text from profiles you previously approved when drafting a future profile; this setting is off by default and does not include messages or contact details.
Who can see what
- Attendees see only the profile information and match explanation intended for their event experience.
- Event attendees can see the room's anonymous questions and vote totals. The organizer can privately mark a question as handled for the on-stage workflow or hide it from the room for moderation; neither action publishes an answer or reveals the author.
- Event attendees can open the Room before approving a profile, but only attendees with an approved profile are listed. Listed attendees expose their display name and the exact organizer-question answers configured as public. Every other answer, profile field, boundary, photo, and saved contact-card value is excluded.
- An organizer can create an unlisted post-event directory link, revoke it at any time, and share it with attendees. Anyone who receives the opaque link can view the same bounded directory until the link expires after no more than 30 days.
- Anyone who has an active opaque person-to-person link can view its current selected question-and-answer pairs, bounded Mixer Card labels, profile photo if one is set, and only the contact methods or links enabled for that card until the owner revokes it or it expires. Changes to that active Mixer Card are reflected through the same active link. The link does not expose any unselected answer or the underlying private master profile. A direct profile-photo image URL remains retrievable until the owner removes the photo or deletes the account.
- A completed peer comparison is stored for both participants so each can revisit the same result and the card-selected answers and contact fields that were shared at scan time. Changing a current Mixer Card does not rewrite an already completed comparison.
- Chat opens only after mutual connection. Contact details open only after a separate mutual exchange.
- Event owners can view the answers you approve to their event’s configured questions in their authenticated dashboard and CSV export, including answers not marked public in the Room. This does not expose your private general matching fields, boundaries, conversations, or separately exchanged contact cards. Event organizers also receive attendance and aggregate workflow information plus limited report summaries needed for event safety. Conversation ratings may appear as attendee averages only after an attendee has received at least two ratings; organizers do not receive who rated whom, individual ratings, private messages, exchanged contact details, or private feedback text.
- Authorized Mixer service operators can review pseudonymous App Clip journeys across events—including actions, timing, and bounded errors—to diagnose failures and improve completion. The analytics view does not contain the attendee's typed answers, AI content, messages, contact details, or passwords.
- Push alerts use generic wording and do not contain private message text or contact details.
Service providers and disclosure
Mixer uses Amazon Web Services for hosting, storage, operational monitoring, and the first-party product analytics described above; Apple and Google for identity; Apple for notification delivery; LinkedIn only when you choose to connect it; OpenAI for the ChatGPT integration and optional bounded matching; and Anthropic when you choose Claude. Mixer does not sell personal information or use it for advertising.
Retention and deletion
Event membership, event-history pointers, approved event profiles, private peer profiles, reusable networking cards, event questions, and votes are retained while needed to provide the event features you use. A post-event directory link expires after no more than 30 days and can be revoked earlier by the organizer. The peer web page stops reusing its locally cached display name after no more than 30 days; clearing that browser's site data removes it earlier. A peer share expires at the lifetime selected by its owner, from 8 to 24 hours; revoking it ends public access immediately even if physical database cleanup occurs later. Peer comparison records expire after no more than 90 days. Leaving an event ends active participation and matching eligibility. Deleting an event profile removes that profile from future profile-history and matching use, while limited event or safety records may remain. Social records such as messages, connection state, meetup plans, contact exchanges, notifications, and private feedback expire no later than 90 days after creation or earlier when the event has an earlier expiry. Product analytics records expire after no more than 400 days. Device registrations expire after 30 days unless refreshed. Safety records may be retained for a limited period where needed to investigate abuse, prevent fraud, or meet legal obligations.
You can pause discovery, leave an event, delete its profile, remove a peer profile photo, revoke a peer share, revoke contact sharing, or request account deletion. Removing a peer profile photo deletes its stored image and ends access through its direct Mixer image URL. A no-sign-in guest can use Delete my temporary Mixer profile on the peer page; this deletes that Mixer identity’s peer profile, cards, comparisons, and active shares and clears its local device credential. After identity verification, Mixer will delete or irreversibly anonymize other account-linked personal information unless limited retention is required for security or law.
Security and changes
Mixer uses encrypted AWS services, audience-bound access tokens, PKCE, server-side authorization checks, bounded data access, and rate limits. No system is perfectly secure. Material policy changes will be posted here with a new effective date.
Contact
Questions or privacy requests can be sent to events@thinklavender.com.