Privacy policy

Privacy · Draft 8 · 15 October 2026 · Australian law, Victoria

What we collect

Your account: an email address, and whatever name your sign-in provider gives us. You choose the name and handle your mates actually see.

Your calendars: the start and end times of your events, from calendars already on your phone or from an iCal link you paste in. Event names are stored only if you leave "Keep event names" switched on when you connect a calendar. Turn it off and we store blocks of busy time with no titles at all.

Your location, only if you choose to share it. Opening the Map asks your phone for your position so it can show you your own dot, and that position stays on your phone until you tap Share. Once you are sharing, the app sends a fresh position while it is open: when you open it, when you come back to it, and every few minutes while it stays on screen. One coordinate, overwritten each time. Never while the app is in the background or closed. Going ghost pauses it, and turning location off in Settings → Your privacy stops it and deletes what we hold.

Your date of birth, asked once while you set up. It is used to check you are old enough to hold an account and for nothing else. Nobody else can read it: it is kept apart from the profile your circles can see, in a table whose only rule is that you are the one asking.

Your circles: who is in them, the invite links you make, and the sharing level you set for each person.

If you turn notifications on, a token that lets a message reach your device. It identifies the installation rather than you. The app refreshes it each time it opens, and it is deleted when the app is removed from that device, when the app has not been opened there for 90 days, or when your account goes.

The notifications we send you, so they can be shown in the app: what they said, and whether you have read them.

A record of the permissions you have granted or refused, with timestamps, so we can evidence consent.

Your plans: the time, the place if one was chosen (its name and, if it came from the places search, where it is), who was invited and who accepted. This is how an invitation reaches everyone and stays up to date when someone pulls out.

If you answer a plan from its link, on the web or from outside its circle: the first name you give and your answer, which the people in that plan see. Your browser keeps a random key so you can change your answer later. Nothing else about you is collected, and you see nothing of the circle beyond that one plan.

When you search for somewhere to meet: the point you are searching around, and what kinds of place you asked for. In every Australian capital, the Gold Coast and Newcastle that goes only to our server, which answers from our own copy of the map and does not keep the search.

Who you have blocked, if anyone. The person you block is not told.

Reports you make: who or which circle you reported, why, any note you wrote, and what their name, photo and circle name looked like at that moment, so the report can still be checked if they change them. The person reported is never told who reported them.

If you subscribe: which plan, whether it is in its free month, renewing, cancelled or ended, when it renews or ends, and the App Store’s reference number for it. Apple takes the payment. We never see or store card details.

If you turn on App lock: nothing. Face ID or Touch ID is checked by your phone, which tells the app only whether it worked. Your face or fingerprint never reaches the app or us, and the setting itself stays on your phone.

Your device’s time zone, so an evening notification arrives in your evening rather than ours.

Your IP address, briefly, when you write something. It is used only to stop one connection flooding the service, is never linked to what you did, and is deleted within a day.

If the app crashes, and only if you leave crash reports switched on: the technical details of the crash, the app and operating system version, and the device model. These reports carry no account details, no calendar, and no location, and are not linked to you. You can switch them off in Settings → Your privacy.

If you leave usage analytics switched on: a count of a short, fixed list of actions. A circle made, a plan proposed, a search for somewhere to meet. We record that the action happened and nothing else: not which circle, not which friend, not where. These are not tied to your account, and you can switch them off in the same place.

What we do with it

Work out when you are free, and when everyone in a circle is free at the same time.

Show mates in your circles where you are, at the precision you granted them: your exact position, a rough area of about a kilometre, or nothing.

Suggest a halfway point and places near it. The midpoint is worked out on your phone, from positions you were already allowed to see.

Send you the notifications you switched on, and the ones about money, which are not optional.

Keep people safe: enforce blocks, and read and act on reports. A person reads every report.

Nothing else. There is no advertising, no profiling, and no analytics that read your calendar or your location.

What we never do

We never sell your information. Not to advertisers, not to data brokers, not to "trusted partners".

We never send an event name to someone you have not granted detail sharing to. Those viewers read a separate table that has no title column in it, so there is nothing to leak even if we made a mistake.

We never send a precise coordinate to someone on area-level sharing. The coordinate is rounded to a grid cell inside the database, before it leaves.

We never track you in the background. Your location is read only while the app is open, and only shared with friends if you have chosen to share it.

We never show pubs, bars, clubs or casinos to anyone under 18. That is decided on our server, not in the app.

Who else touches it

Supabase hosts our database and handles sign-in. Our project is in their Sydney region, so your data is stored in Australia.

Apple and Google handle sign-in if you use those buttons. They tell us your email and name; we tell them nothing about your calendar or location.

Places come from OpenStreetMap (© OpenStreetMap contributors, under the Open Database Licence). For every Australian capital, the Gold Coast and Newcastle we keep our own copy, refreshed each week, so a search there goes only to our server. Anywhere else, the app asks one of the public Overpass services that serve OpenStreetMap data directly; that request contains the point being searched around and nothing about you: no name, no account, no device identifier.

The map itself is drawn from OpenFreeMap's map tiles. Loading a map necessarily tells them which part of the world you are looking at, in the same way loading any map does.

Expo builds and delivers the app, and delivers push notifications: when we send you one, its title and text and your device’s push token pass through Expo’s push service and on to Apple’s (APNs), which puts it on your screen. Neither receives your calendar or your location.

Apple takes subscription payments, and tells our server when a subscription starts, renews, is cancelled or refunded, so your plan stays right. We receive the plan, its dates and a reference number, never payment details.

Cloudflare runs a check that you are a person, not a script, if sign-up or sign-in shows one (Turnstile). It looks at your device and connection to decide, and tells us only whether you passed.

Sentry receives crash reports, if you leave them switched on. We use their European region, so those reports are stored in Germany rather than the United States. They receive no account identifier, no calendar and no location. Only the crash itself, and what device it happened on.

PostHog receives usage analytics, if you leave them switched on, also in their European region. We turn off their location lookup, so they do not estimate where you are from your connection.

How long we keep it

Location: deleted after 24 hours by a scheduled job on the server. Not hidden after 24 hours. Deleted.

Events: removed 30 days after they finish.

Your date of birth: kept while the account exists, because the age rule applies for as long as the account does. Deleted with everything else.

IP addresses recorded for rate limiting: deleted within a day, by a scheduled job.

Notifications: deleted after 90 days, read or not.

Answers given from a plan's link: deleted 30 days after the plan.

Push tokens: deleted when the app is gone from that device, or after 90 days without the app being opened there.

Reports: kept until someone has dealt with them, then for two years, to spot the same account coming back, then deleted.

Blocks: until you lift them, or delete your account.

Plans are kept after they happen, including the place and how many people came. We use that to argue for discounts with venues on behalf of our users. It is never sold, and a venue is never told who you are, only that a number of people turned up.

Everything else: until you delete your account, which happens immediately and cannot be undone. Any circle you started is deleted with it, for everyone who was in it; those members are notified that it has gone.

Your subscription record: while your account exists. Apple takes the payments and keeps the billing records, as Australian tax law requires.

Your rights

You can export everything we hold about you at any time, from Settings → Data & deletion. It arrives as JSON and contains what you share with others, never what they share with you.

You can correct your name and handle in Settings → Your profile, and change what each person sees whenever you like. Nobody is told when you change it.

You can delete your account outright, in the same place.

If you think we have handled your information badly, tell us at rufreeapp@gmail.com and we will answer. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Kids

This app is for people aged 16 and over. We ask for your date of birth while you are setting up, and an account that is too young cannot finish setting up or join a circle. The check is made on our server, not in the app, so it is not something a modified copy of the app can talk its way past.

We cannot prove an age from a typed date, and we do not pretend to. What we can say is that we ask everybody, we record the answer, and we act on it. If you believe a younger person has an account, tell us and we will remove it.

Between 16 and 18, the app works the same, except that pubs, bars, clubs and casinos are never suggested, and neither are drinks offers. That is decided on our server.

Changes and contact

If we change how any of this works, we will change this page and say so in the app before the change takes effect.

This app is operated by Ahmed ElZarw (ABN 20 830 837 543). Contact us at rufreeapp@gmail.com.