Privacy Policy

Last updated: October 6, 2026

Raundup ("we", "us", or "our") operates the Raundup mobile application. This policy explains what information we collect, how we use it, and your rights.

Information We Collect

• Account information — email address, display name, and profile photo when you sign up.
• Phone number — optional, if you choose to add and verify one from your profile settings. Used to send you a one-time verification code via SMS, and to let other Raundup users who already have your number saved in their contacts discover you as a friend suggestion.
• Contacts — optional, only if you choose to grant contacts access to find friends already on Raundup. Your device hashes each contact's phone number and email address before anything is sent — we never receive or store the raw phone numbers or emails of your contacts, including people who aren't Raundup users.
• Invite links — if you invite someone, we create an invite link tied to your account. We store the link's secret code, a random placeholder label (for example “Invitee 4821”), its expiry, the circles or events you chose to queue for the person you invite, and, once someone opens the link while logged in to Raundup, which account opened it. We do not store the name, phone number, or other contact details of the person you invite: any name you type, or pick with your device's built-in contact picker, stays on your device only. If you open an invite link yourself, the app keeps it on your device until you sign in, so it can connect you with the person who invited you. If you install Raundup from Google Play through an invite link, Google Play passes the invite code to the app the first time you open it. When you open the “Have an invite link?” box, the app checks your clipboard for an invite link and fills it in; it does not keep or send anything else from your clipboard.
• Profile data — any information you choose to add to your profile.
• Location data — approximate location attached to events you create. We do not track your location in the background.
• Social data — friends you add, circles you create, events you attend or create.
• Device token — a push notification token to deliver notifications to your device.
• Usage data — how you interact with the app (screens visited, features used, session length). Collected automatically by Firebase Analytics to help us understand how the app is used and improve it. This data is linked to your account.

How We Use It

• To operate the app and provide its features.
• To send you push notifications about activity relevant to you.
• To show your events and profile to friends you have added.
• To let you invite people with a link, and to connect you with the person who invited you when you join. We also keep anonymous, aggregate counts of how many invites are created, opened, and accepted to understand whether invites work; these counts contain no personal data.
• To understand how the app is used and improve it (analytics).

Third-Party Services

• Supabase — database and authentication hosting.
• Resend — delivers transactional emails (such as password reset and sign-in links). Resend only receives your email address and the message content for this purpose.
• Twilio — delivers the SMS verification code if you add a phone number. Twilio only receives your phone number for this purpose.
• Google Firebase (FCM) — push notification delivery.
• Google Firebase Analytics — app usage analytics. Collects device identifiers, app interaction events, and session data to help us understand product usage and retention. Data is processed by Google. Google Privacy Policy.
• Google Sign-In — optional login method.
• Mapbox — place name search when creating events. The text you type is sent to Mapbox through our own server, so Mapbox does not receive your IP address or account details.
• Cloudflare — hosts our website and invite link pages, and serves map tiles and place search for the app. When you open an invite link, Cloudflare processes the request (including your IP address and browser details) and our invite page loads limited information from our database to show you who invited you. On that page, tapping the App Store button may copy the invite link to your clipboard so the app can find it after you install it.

Invite links are visible to anyone who has them. Anyone holding an invite link you share can see, without logging in, your display name and profile photo and, if you queued the invite for an event, that event's title, date, and place. They cannot see the event's description, its other guests, or your circles. Only share invite links with people you want to see this, and cancel the invite from People → Invite friends if you change your mind.

Each service has its own privacy policy. We do not sell your data to any third party.

International Data Transfers

Some of our providers are based in the United States. Where data is transferred outside the EU/EEA, we rely on the providers' EU-US Data Privacy Framework certification or Standard Contractual Clauses.

Data Retention

Your data is retained for as long as your account exists. You can delete your account and all associated data at any time from the app: go to Your Profile → Settings → Delete Account. Deletion is permanent and immediate, and includes any invite links you created. Invite links that nobody opens expire and are deleted after 7 days. When someone opens an invite link, it is deleted as soon as the resulting friend request is accepted, declined, or cancelled.

Legal Basis for Processing (GDPR)

Where EU/EEA data protection law applies, we process your personal data on the following bases:

• Contract — processing necessary to provide the app and its features (account data, events, friendships).
• Legitimate interests — usage analytics (Firebase Analytics) to understand how the app is used and improve it. This does not involve advertising or sharing data with third parties for their own purposes.
• Consent — optional features you explicitly opt into, such as adding a phone number or granting contacts access.

Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights regarding your personal data:

• Right to erasure — delete your account and all data directly in the app via Your Profile → Settings → Delete Account.
• Right to data portability — export a copy of your data at any time from Your Profile → Settings → Export My Data. The export is delivered as a JSON file containing your profile, events, friendships, circles you own (including their members), and the invite links you created (without their secret codes).
• Right to access or rectification — contact us at [email protected] for any other data requests.

Age Requirement

Raundup is intended for users aged 18 and over. By using the app, you confirm that you are at least 18 years old. We do not knowingly collect data from anyone under 18. If we become aware that a user is under 18, we will delete their account and data.

Contact

Questions? Email us at [email protected]