Privacy Policy
Effective Date: September 27, 2026
1. Introduction
Midnight ("Midnight," "we," "us," or "our") is operated by Cloak Communications LLC, a company based in Colorado, USA. Midnight is a social app for spontaneous, low-pressure sharing, where posts automatically disappear at midnight in the poster's local time zone.
This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using Midnight, you agree to the practices described here. If you don't agree, please don't use the app.
2. Information We Collect
2.1 Information You Provide
We collect the email address you use to create your account and sign in via a one-time passcode; we do not use passwords. We collect the display name you choose, which is shown publicly alongside your posts and comments. If you choose to upload a profile photo, it is shown publicly on your profile. We also collect the content you post, including posts, comments, and votes you submit.
2.2 Information Collected Automatically
We collect session and device information, including your IP address and user agent (browser or device type), when you sign in, for security and fraud prevention purposes. If you enable push notifications, we collect a device specific push notification token used to deliver them, along with your notification preferences describing which notification types you want to receive.
2.3 Information We Do Not Collect
We do not collect your birthdate, precise location, payment information, or contacts. We do not use third party advertising trackers.
3. How We Use Your Information
We use your information to create and secure your account and sign you in; to operate the core features of the app, including posting, commenting, voting, blocking, and reporting; to send push notifications you've opted into; to enforce our Terms of Service and Community Guidelines, including reviewing reports and taking action against accounts that violate them; and to comply with legal obligations.
4. How Content Expiration Works
Midnight's core feature is that posts disappear. Every post has an expiration time, set automatically to midnight in the poster's local time zone at the time of posting. Once a post expires, it immediately becomes invisible to everyone. It no longer appears in the feed, and can't be viewed, voted on, or commented on. Expired posts, together with their comments, are then permanently deleted from our database on a recurring automated cleanup cycle that runs every few minutes. Comments are deleted together with the post they belong to; they do not expire on their own separate timer. Because deletion happens on a short recurring cycle rather than at the exact instant of expiration, there may be a brief delay, typically a few minutes, between a post becoming invisible and being permanently removed from our database. During that window, the content is not accessible to any user.
5. How Report Retention Works
Reports and blocks are handled differently from ordinary posts and comments, because they are safety and moderation records rather than content you're sharing with the community. When you submit a report, we save a copy of the reported content's text and the identity of the user you reported, at the moment you file it. This saved report is kept independently of the original post, comment, or account. It is not deleted if the reported post or comment expires, and it is not deleted if either you or the reported user deletes your account. We retain a report for fourteen (14) days from the date it was filed, after which it is automatically and permanently deleted from our database on a recurring cleanup cycle, the same way expired posts are. Blocks are retained for as long as either account involved remains active, so that a block relationship stays in effect. A block is removed if you choose to unblock the user, or if both accounts involved are deleted. We use retained reports to review conduct, identify repeat violations, and decide on enforcement action such as warnings, suspensions, or bans, and we may also disclose a retained report as described in Section 7.3 below.
6. Image Storage
Midnight posts and comments are text only. We do not support image attachments on posts. The only images we store are optional profile photos, hosted with Cloudflare. Uploading a new profile photo replaces your previous one; we do not retain old versions.
7. How We Share Information
7.1 Service Providers
We share limited information with trusted service providers who help us operate Midnight, solely for that purpose. Railway hosts our database and server infrastructure. Cloudflare (R2) stores profile photos. Resend delivers sign-in emails. Firebase (Google) delivers push notifications. These providers are only permitted to use your information as needed to provide their services to us.
7.2 No Sale of Data
We do not sell your personal information to third parties, and we do not use it for third party advertising.
7.3 Legal Disclosure
We may disclose information, including retained reports described in Section 5 above, if required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Midnight, our users, or the public.
7.4 Business Transfers
If Cloak Communications LLC is involved in a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of its assets, your information may be transferred to the successor entity as part of that transaction. That entity will be required to honor the commitments described in this Privacy Policy with respect to information collected before the transfer, unless you are separately notified of and agree to a different policy. This kind of transfer is not a sale of your personal information for purposes of Section 7.2 above.
8. Data Retention
Account information, including your email, display name, and profile photo, is retained for as long as your account is active. Post and comment content is retained only until it expires, as described in Section 4 above. Reports are retained for fourteen (14) days from filing, independently of the underlying content or accounts, as described in Section 5 above, and blocks are retained as also described in Section 5 above. If you delete your account, your account data is deleted from our active database; residual copies may briefly persist in system logs or backups before being fully cleared, or as part of a still active report record as described in Section 5.
9. Your Rights and Choices
You can update your display name and profile photo at any time within the app, and you can permanently delete your account at any time from within the app. You can turn notification types on or off individually in the app's settings. You may contact us at the email below to ask what information we hold about you or to request its deletion. If you are a Colorado resident, you may have additional rights under the Colorado Privacy Act, including the right to access, correct, delete, and obtain a copy of your personal data, and to opt out of certain processing. You can exercise these rights using the contact information below. If we deny a request, you may appeal that decision by replying to our response, and, if the appeal is denied, you may contact the Colorado Attorney General.
10. Children's Privacy
Midnight is intended for users age 16 and older and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account or provided us information, please contact us at the email below so we can investigate and delete it.
11. Data Security
We use reasonable technical and organizational measures to protect your information. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
12. Data Breach Notification
If we become aware of a security breach that compromises your personal information in a way that triggers notification obligations under applicable law, we will notify affected users and any required regulators or authorities without unreasonable delay and in accordance with applicable law, including the Colorado Consumer Protection Act's data breach notification requirements.
13. International Users
Midnight is operated from the United States, and any information you provide is processed and stored in the United States.
14. Changes to This Policy
We may update this Privacy Policy from time to time. If we make a material change, we will update the effective date above, post an in-app notice, and send a notice to the email address associated with your account before, or as soon as reasonably practicable after, the change takes effect. Non-material changes, such as clarifications or corrections that do not affect your rights, may be made without individual notice, though the effective date above will still be updated.
15. Severability
If any provision of this Privacy Policy is found by a court of competent jurisdiction to be invalid or unenforceable, that provision will be limited or eliminated to the minimum extent necessary, and the remaining provisions will remain in full force and effect.
16. Contact Us
Questions about this Privacy Policy? Contact us at [email protected].