Data controller: CORDAGE & CO LTD, a company registered in England and Wales
Contact: privacy@amongfolk.com
We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use AmongFolk.
We process your personal data under the following legal bases as defined by the UK General Data Protection Regulation (UK GDPR):
Account information: Your name, email address, date of birth (to verify you are at least 13 years old), country (two-letter code), timezone, and language preference.
Authentication data: Password (stored hashed), passkey credentials, or Sign in with Apple/Google identifiers.
Content you create: Photos, video clips, voice notes, text posts, replies, reactions, events, albums, film, series, book, record or place recommendations, and an optional named place on a moment.
Group data: Group memberships, roles (owner, member), optional birthday sharing (month and day only, never year), aliases other members give you, and blocks you set.
Device and usage data: Device tokens for push notifications (if enabled), app version, platform (iOS/Android), IP addresses for security-relevant actions (sign-ins, password changes, account deletion), and last-active timestamps.
Subscription data: Plan type, payment provider references (not card details), renewal dates, and transaction history.
Support and feedback: Messages you send through Help & support, error reports, and crash logs (sent to Sentry).
Optional device location: When you try to add a place to a moment, get-together or recommendation, we ask to use your current location to put nearby search matches first. In the iPhone and Android apps we ask only for your approximate location, and only while you are using the app. If you allow it, your search text and coordinates pass through our API to Google Places. Location is used only while you use the place picker, never tracked in the background. You can decline and still search or write a place name. You can withdraw access in your device or browser settings.
What we don't collect: We do not collect browsing history outside AmongFolk, contacts, or any data from other apps on your device.
Photos: When you upload a photo, GPS EXIF metadata is automatically removed from all versions shown in the app. The original photo with metadata is stored in private, encrypted object storage (Cloudflare R2) and never served to anyone. Only versions with location data removed are accessible to your group.
Videos and voice notes: These are stored as uploaded and played back from your original file. Any metadata in the file travels with it to your group members. We do not remove metadata from videos or voice notes.
Voice note transcription: By default, voice notes are transcribed to text so your group can read them. When transcription is enabled, that specific recording is sent to Groq, Inc. (our speech-to-text provider, based in the United States) under a data processing agreement with standard contractual clauses. The resulting text is stored with the voice note and shown only to your group. Groq's terms state they do not use recordings to train models. However, we cannot yet confirm in writing that they delete recordings immediately after transcription. If you prefer no recording ever leaves our storage, turn transcription off. That is what the setting is for.
Access restrictions: Your media is never publicly accessible. Only current members of your group can view or listen via short-lived, signed private URLs that expire after a limited time.
We use your personal data to:
We do not use your data for advertising, sell it to third parties, or share it for marketing purposes.
Transactional emails: We send essential emails including sign-in links, notification summaries, weekly digests, and (if you enable it) birthday reminders when a group member's birthday arrives. These cannot be unsubscribed from as they are necessary for the service.
What's new (optional): An occasional note about features we've added to AmongFolk. This is opt-in only. You get it only if you ticked "Email me tips and updates" when signing up or turned it on in Settings → Notifications. We record when you opted in and the wording you agreed to. Every email has an unsubscribe link. To send these, we share your email address and first name with Resend. If you haven't opted in, we share neither.
Getting-started tips (optional): If you separately opt in, we can email help with getting started and occasional reminders when you've been away. This is off by default and separate from group notifications. We use your account milestones (first join, first post view) and app usage to choose helpful next steps, without keeping a detailed viewing history. Each email has an unsubscribe link.
We do not use email tracking pixels.
In the iPhone and Android apps, you can sign in with Apple or Google instead of choosing a password. If you do:
Apple's Sign in with Apple can hide your real address behind Apple's private relay. That works here, and the relay address is the one we hold. Apple and Google are told you signed in to AmongFolk because they verify it's you, but they do not see your usage or content.
Neither shares your date of birth or country, so the app asks you for those itself (which is also how the age check happens). If you'd rather not involve either company, email/password, passkeys, and sign-in links all still work.
Group members: Only active members of your group can see content you post in that group. When you share a moment or event with multiple groups, it is visible to current and future active members of each chosen group. Groups are not told about each other, and replies in one group are invisible in another.
Shared events: For events shared across groups, each accepted group sees the event details and cover you choose to share. Replies, photos, notes, lists, and RSVP messages remain in their own group. When you confirm a shared RSVP, your status and guest count are shared across your participating groups. Other groups do not receive your name or personal message.
Removed from a group: If you are removed, your access ends immediately. Content may persist in encrypted backups for up to 30 days.
Subscriptions are purchased through Apple's App Store, Google Play, or Stripe for web payments. We never see your card details. They go directly to the payment processor.
What we store: plan type, active status, renewal date, who is paying, and the provider's customer and transaction identifiers. RevenueCat, Inc. validates receipts and tells us subscription status. We send them your account identifier to match purchases to groups. RevenueCat, Apple, Google, and Stripe act as our data processors under data processing agreements; Apple and Google sell subscriptions under their own terms.
Active accounts: We retain your data as long as your account is active and for as long as necessary to provide the service.
After account deletion: Your profile is anonymised, personal data is deleted, and you are removed from groups. Posts you shared remain unless you deleted them first. Database backups may retain deleted data for up to 30 days in encrypted form.
After subscription ends: Media (photos, videos, voice notes) remains stored for 12 months after a paid subscription or trial ends, then may be permanently deleted. Text posts, replies, and events are not deleted. See our Terms of Service for details.
Security logs: IP addresses for security-relevant actions (sign-ins, password changes) are retained in audit logs for security and fraud prevention purposes.
Legal holds: We may retain data longer when required by law or for legal proceedings.
We do not sell your data or share it for advertising. A small number of companies process data on our behalf under data processing agreements, permitted to use it only as we instruct:
Your data is primarily stored in the UK and EU (Laravel Cloud, Cloudflare R2). Some processors are based in the United States (Groq, Resend/Amazon SES, Sentry, RevenueCat, Capgo, KLIPY). Transfers to the US are protected by:
We ensure appropriate safeguards are in place before transferring data outside the UK or EEA.
Age requirements: You may create an account from age 13. Only adults (18+) can create groups and manage billing.
Children in photos: Children may appear in photos shared by group members. The group owner is responsible for ensuring all members consent to photos of children being shared within the group.
Child safety: We employ PhotoDNA and hash-matching to detect CSAM and report violations to NCMEC, the National Crime Agency (NCA), and law enforcement as legally required.
Under UK data protection law, you have the following rights:
To exercise these rights, email privacy@amongfolk.com. We will respond within one month.
Database backups are retained for up to 30 days. Deleted data may remain in encrypted backups during this window before permanent removal. Backups are encrypted and stored securely.
We implement appropriate technical and organisational measures to protect your data, including:
However, no internet transmission is completely secure. You are responsible for keeping your account credentials confidential.
We collect minimal, first-party analytics to understand product usage (e.g., how many groups were created or active this week, feature usage patterns). We track last-active times and aggregate usage statistics.
We do not use:
Web application: We use essential cookies for authentication (Laravel Sanctum session cookies) and CSRF protection. These are necessary for the service to function.
Marketing site: The marketing site uses minimal cookies. We do not use tracking or advertising cookies.
Native apps: The iOS and Android apps store authentication tokens and preferences locally using Capacitor Preferences (equivalent to local storage), not browser cookies.
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the app. The "Last updated" date at the top shows when this policy was last revised. Continued use after changes constitutes acceptance.
If you have concerns about how we handle your data, please contact us first at privacy@amongfolk.com. We will work to resolve the issue.
You also have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk/make-a-complaint
If you separately enter our giveaway by email, CORDAGE & CO LTD uses your email address, Instagram username, country, age confirmation, and verification correspondence to administer the competition, check eligibility, and deliver prizes. Competition emails do not subscribe you to a newsletter. Entry and prize records are kept for three years after the competition ends, or longer where legally required or needed for an unresolved dispute, then deleted or anonymised. See the giveaway terms for verification, winner disclosures, and how to exercise your rights.
If you apply for a year of Plus for a qualifying social group at /for-groups, CORDAGE & CO LTD uses your name, email address, the details you provide about the group, the public link you share, and review correspondence to administer the application, check eligibility, contact you, and deliver the free year when approved. Application emails do not subscribe you to a newsletter. Records are kept while the programme runs and for three years after a decision, or longer where legally required or needed for an unresolved dispute, then deleted or anonymised.
Data controller: CORDAGE & CO LTD, registered in England and Wales
Privacy enquiries: privacy@amongfolk.com
General enquiries: hello@amongfolk.com
Support: Support centre