Privacy Policy

nSpace is a consumer app made by NextTry, a small Hong Kong based team. nSpace is where you open and join small-group Spaces to do real things with a few people. You can reach us anytime at hakest@nexttryhk.com. This Privacy Policy applies to the nSpace mobile app and our website at hknexttry.com.

• Account: your email, name, optional avatar (from your sign in provider or your own upload), a securely hashed password (your real password never reaches our database), the sign in method you used, and your sign up date.
• Profile: the things you choose to put on your profile — your mission text, topics you think about, what you are open to — and your share code.
• Activity: Spaces you create or join, reviews you leave after a Space, friend connections (pending and accepted), meetups (proposed and confirmed), 1 on 1 messages, and group chat messages (including photo and file attachments).
• Student verification (optional): if you choose to verify your student status, the school email address you provide and the fact that it was verified. The one time code we email you is stored only as a hash and deleted once used or expired.
• Push notifications: if you allow notifications, a device push token so we can deliver them. It is deleted when it stops working or when you delete your account.
• Usage data: a log of meaningful actions in the app (signing up, creating a Space, accepting a connection, sending a message, and so on) together with an anonymised form of your IP address. We never store your actual IP address.

For most of what we collect, the lawful basis is contract — we need this data to provide the service you signed up for. For usage data, the basis is our legitimate interest in understanding how the product is used, and we keep it in a de-identified form. For optional things — a custom avatar, student verification, push notifications — the basis is your consent, which you can withdraw at any time.

Public Spaces you host or join are visible to other users browsing the feed; private Spaces surface only to your accepted connections; meetings added inside a group are visible only to that group. Direct messages and group chats are visible only to the people in them. Your name, share code, and avatar are visible to anyone who has the code. You choose who to give it to. There is no public search by name. Connections happen by sharing your code in person, by message, or however else you choose.

Your data is stored and processed by a small number of trusted service providers acting on our behalf: a managed database and file storage service (hosted in Singapore), a transactional email delivery service, Apple’s and our notification provider’s push services (which carry the device token and notification content in transit, not your account data), and our web hosting provider. We share with each provider only what it needs to do its job, and none of them may use your data for their own purposes.

Two things worth knowing about photos: avatars sit at unguessable URLs, while chat photos and files live in private storage and are served through short lived signed links that only conversation participants receive.

Sign in sessions use encrypted, HttpOnly cookies. Google and Apple sign in are optional and use their official sign in flows. Our providers may store or process data outside Hong Kong (typically Singapore, the EU, or the US), each under its own privacy policy and data protection terms.

We send email only when it serves you. Transactional email (sign in, password reset, email verification, a welcome note when your account is confirmed, student verification codes and their confirmation, account events) goes out the moment it is needed. We also send a friendly meetup reminder if you and a connected friend have chatted but have not met up in a while, with a link to propose something. You can opt out at any time by emailing us. We never sell your email or send marketing on behalf of a third party.

• Account data: kept while your account exists. When you delete your account, your data — including uploaded photos — is removed from our systems.
• Usage data: kept for up to 24 months, then deleted. It is also removed when your account is deleted.
• Backups: our database provider keeps automated backups on a rolling schedule. Your deletion request will be honored, but backups may take longer to age out.

• We do not sell, rent, or share your data with advertisers.
• We do not use third party tracking cookies that follow you across the web.
• We do not read or analyze your messages for ad targeting or profiling.
• We do not train AI models on your content.

On our website we use only first party cookies that keep you signed in and protect your session. No third party trackers, no advertising cookies. For details see our Cookie Policy.

• Passwords are stored only as salted hashes using an industry standard algorithm — never in plain text.
• All traffic is encrypted in transit (HTTPS), and data is encrypted at rest.
• Access rules are enforced on the server for every request — who can see a Space, a chat, or a profile is decided by our systems, not just hidden in the app.
• Rate limits protect against abuse (messages, Spaces, friend requests, uploads).
• All input is validated on the server before it touches the database.

You can do these from Settings in the app at any time:

• Access: download a copy of everything we have about you.
• Correct: edit your profile, your mission, your topics, your avatar.
• Delete: delete a Space you host at any time, or delete your entire account — which permanently removes your data from our systems, including uploaded photos.
• Withdraw consent: sign out, or delete your account.

If you are in the EU or UK, GDPR rights apply (access, rectification, erasure, restriction, portability, objection). If you are in California, CCPA rights apply (know, delete, opt out, non discrimination). If you are in Hong Kong, your rights under the Personal Data (Privacy) Ordinance (PDPO) apply, including the right to access and correct your data, and the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD).

We will let you know about meaningful changes through an in app notice and an email at least 30 days before they take effect. Minor edits (typos, clarifications) may go live without notice. The “Last updated” date at the top will always reflect the current version.

You must be at least 16 years old to use nSpace. If you are between 16 and 18, you may use it only with the permission of a parent or guardian. We do not knowingly collect personal information from anyone under 16. If we learn that we have, we delete it. If you are a parent or guardian and believe your child has given us information, contact us at hakest@nexttryhk.com.

Questions about your data? Email us at hakest@nexttryhk.com. We read everything.