Privacy policy

Last updated: October 19, 2026

Our philosophy. We believe in transparency, user safety and minimal data collection. We collect only what SKWAD.community needs to work, we don't sell your data, we don't spam you with marketing, and we give you control over what you share.

SKWAD.community helps adults find people nearby to do things with. It's invite-only, starting in California. To do that we need a little information about you. This page says what we collect, why, who helps us run the service, how long we keep things, and what you can ask us to do. It covers the SKWAD.community app and the skwad.community website.

The short version:

We never sell your data. Not to advertisers, not to data brokers, not to anyone.
No third-party analytics or trackers in the app. Nothing about how you use the SKWAD.community app goes to an outside analytics or advertising company.
We collect the minimum we need to run hangouts, and we delete things on a schedule.
The app doesn't store your email address or phone number. We keep only a scrambled fingerprint that can't be turned back into it. (If you join the waitlist, Squarespace keeps the email you give it until the waitlist closes.) Your real name and the details in a report are stored encrypted.
Delete your account and your personal details are erased straight away.

What we collect

Your account

Email address. You sign in with a one-time code we email you. We use your address to send that code, and then we forget it. Our database never stores your email address: it keeps only a fingerprint, a scrambled code made from your address with a secret key, which can't be turned back into the address. The fingerprint lets us recognise your account when you sign in, stop two accounts using the same email, and stop a banned person signing up again. The one exception is an account under a legal hold. Because we don't keep your address, messages about your account or a report are shown in the app, and may also be emailed to you the next time you sign in.
Username. Your public handle (@username). Anyone who can see a hangout you host sees your @username, and people at the same hangout see each other's.
Display name (optional). Your real name, if you add one. Only your friends can see it. Sending or receiving a friend request doesn't show it; the request has to be accepted first. It's stored encrypted.
Age confirmation. At signup you confirm you're 18 or older. We store the time you confirmed. We don't ask for or store your date of birth.
Terms acceptance. The time you accepted our Terms and which version.
Favourite activities. The activities you pick (and any you write in). Only you and your friends see them.
Settings, such as which push notifications you've turned off and your search radius.
Past usernames, if you change your username, so an old handle can't be taken over by someone else.

Your location

Your zip code. You can type a zip code, or tap Use my location. If you use location, the app takes one low-accuracy reading (about a kilometre), and your phone turns it into a zip code on the device, using the phone's own geocoder. Only the zip code is sent to our servers, never your coordinates.
We store your zip code and the centre point of that zip code (not where you are), and use it to show hangouts within your chosen radius. We keep it until you change it or delete your account.
The map's locate-me button on Explore takes a more precise reading so the map can show where you are. That point stays on your phone: it only moves the map, and it's never sent to us or anyone else.
The app only asks for location while you're using it, never in the background.

Hangouts and what you do in them

Hangouts you post: the activity, time, place, title, description and other details. The venue comes from Google Places, and its address is shown to anyone who can see the hangout. Hangout titles and descriptions are not private: they're shown to the people the hangout is open to.
Joins, waitlists, invites, cancellations (and the reason, if you give one), check-ins and the host's attendance confirmations. These are how SKWAD.community learns who actually shows up.
Blurbs: the short, preset chat messages ("On my way", "Here now") in a hangout's chat. There's no free-text chat; you can only pick from a fixed list.

Friends, blocks and reports

Friends and friend requests, including friends made by redeeming someone's invite code or scanning their QR code, and any friend groups you make.
Blocks. Who you've blocked, so we can keep you apart.
Reports you file or that are filed about you: the reason, the details the reporter writes (stored encrypted, and read only by our team), and which hangout or blurb it's about.

Notifications

In-app notifications (your bell inbox).
A push token for your phone, if you allow push notifications. It lets us send pushes to your device. Signing out clears it.

How the app is used (our own event log)

The app records a small set of events in our own database (not an outside service): for example, which screen you opened, that you viewed or joined a hangout, that you tapped an activity filter, or how long a search was (the length, never what you typed). Events are tied to your account. They never contain your name, email, location, or what you type.

Signup step counts (anonymous)

While someone is signing up, the app counts how many people reach and finish each step, so we can see where signup is confusing. These counts have no identifier at all: no account, no device ID, no IP address. They're daily totals, like "40 people reached the username step today", and can't be traced to anyone.

Contact forms and email

Profile › Settings › Contact us has three options: Suggest an idea, Get help and Report a bug. Each opens a Google Form. What you type in a form goes to Google, which stores it for us, and Google's own privacy policy covers it. If you write to support@skwad.community instead, Squarespace forwards your email to our Gmail inbox, and we get your email address and whatever you send. To find the account you're writing about, we may make a fingerprint of the address you wrote from and compare it with our records. That check doesn't add your address to our database.

The waitlist

The skwad.community home page has a waitlist form for the San Diego beta. It asks for one thing: your email address. Squarespace stores it for us, in its form storage, separate from the app.

What we use it for: only to invite you to SKWAD.community and to tell you about the beta.
What we don't do: we never sell it, and we don't add it to any other list or marketing tool unless you tick the build-updates box (below).
How long we keep it: until we close the waitlist, then we delete it. You can ask us to delete yours sooner by emailing support@skwad.community from the address you signed up with.
Signing up to the app later doesn't copy your waitlist entry into the app's database. The app follows the rest of this policy.

Build updates (optional newsletter)

Under the waitlist form there's a box, unticked unless you tick it, to also get our build updates: what we're making, what's next and when invites go out, roughly every couple of weeks.

Only if you opt in. Joining the waitlist never signs you up on its own.
Sent through Squarespace (its Email Campaigns tool), to the email you gave the form. Squarespace may record whether an email was opened or a link clicked, to show us totals.
Unsubscribe anytime with the link at the bottom of every update, or by emailing support@skwad.community. We remove you straight away.
Never sold or shared, and never used for anything but these updates.

The website

The skwad.community website is a few information pages and the waitlist form above. Squarespace runs the site and, like any web host, receives your IP address and browser details when you visit. It uses cookies needed to run the site and may count visits for us. We don't add advertising pixels or trackers to the website. Squarespace's own privacy policy covers what it does as the host.

Technical information

Server logs. When the app talks to our servers, Google Cloud records each request, including your IP address, the time and which part of the app was used. We use these logs to keep SKWAD.community running and secure. They're deleted after 14 days.
Error alerts. When our server hits an error, it sends our team a short alert in Slack so we can fix it: which part of the app failed and the technical error. Alerts are built to leave out your email address, phone number, account ID, IP address and anything you sent, and we strip those details before an alert leaves our server. No outside error-tracking service is used, and the app on your phone doesn't send crash reports to anyone.

What we don't collect

No contacts, photos, microphone, or background location.
The camera is used only to scan a friend's QR code, and the calendar only to add a hangout when you tap Add to calendar. Neither is sent to us.
No advertising IDs, and no third-party analytics or tracking SDKs in the app.
No payment information. SKWAD.community is free.

How we use it

To run the service: sign you in, show hangouts near you, let you join, chat, check in and make friends.
To keep people safe: enforce blocks, review reports, and suspend accounts that break the rules.
To learn what works: our own event log and the anonymous signup counts help us fix confusing parts of the app.
To talk to you: sign-in codes, push notifications you've allowed, and messages about your account or a report, in the app (and by email the next time you sign in).

SKWAD.community also uses attendance (who checks in, who cancels early or late) to build a sense of reliability over time. This is never shown to anyone as a number, and it isn't used to make decisions with legal or similarly significant effects.

We don't sell your data, and we don't "share" it (in the California sense of sharing for cross-context behavioural advertising). See Advertising for how ads would work in the future.

Advertising

Today, SKWAD.community shows no ads and uses no third-party ad trackers or ad SDKs, in the app or on the website.

In the future, we may show ads to help keep SKWAD.community free. When we do:

We may choose which ads to show using what we know about your interests on SKWAD.community, such as the activities you favourite and the kinds of hangouts you attend. Advertisers tell us the audience they want (for example, "people interested in fitness"), and we do the matching ourselves.
Advertisers never get your personal information: not your profile, hangouts, location, email or @username. They can't contact you through the app. They only see aggregate, anonymous totals, such as "1,000 people saw your ad, 50 tapped it".
We never sell your personal information.
You'll be able to turn off personalised ads in Settings and still use the app, with non-personalised ads.

Before ads start, we'll update this policy and tell you in the app or by email, as Changes to this policy says.

Who can see what

What	Who sees it
Your @username	Anyone who can see a hangout you host; people at the same hangout; people who search for you
Your display name and favourites	Only your friends (a friend request that hasn't been accepted doesn't count)
Who's going to a hangout	The host and people going see each other's @username; others see only their friends, plus a count
A hangout's details and venue	Everyone the hangout is open to (your area, your invitees, or both)
Your zip code and location point	Nobody else. It's only used to match you with hangouts nearby
Blocks and reports	Never shown to the person blocked or reported

Who helps us run SKWAD.community

We use a few service providers. They process data only to provide their service to us.

Provider	What they do	What they handle
Google Cloud (Cloud Run, Cloud Logging, Secret Manager, Cloud Storage, Cloud Scheduler)	Runs our server, keeps request logs, stores our secrets, holds nightly backups	Everything our server handles; IP addresses in logs
Supabase	Hosts our database	Everything we store about you
Resend	Sends sign-in emails	Your email address and the sign-in code
Expo	Delivers push notifications	Your push token and the notification text
Apple (Push Notification service) and Google (Firebase Cloud Messaging)	Deliver pushes to your phone	Your push token and the notification text
Google Maps Platform (Places)	Venue search when you post a hangout	What the host types in the venue search, and their zip code's centre point to rank nearby places first
Google Forms	Our Suggest an idea, Get help and Report a bug forms	Whatever you type in a form
Squarespace	Hosts the skwad.community website and its waitlist form, sends the optional build-updates newsletter, and forwards email sent to support@	Website visitors' IP addresses and browser details; the email you give the waitlist (and, if you opt in, newsletter opens and clicks); emails you send to support@
Google (Gmail)	Our support inbox	Emails you send to support@skwad.community
Slack	Alerts our team to new reports and to server errors	The report's reason, the reported @username and IDs, never the details; error alerts are scrubbed

Push notifications are written to be generic and don't include other people's names.

How long we keep things

A job runs every night and deletes old data on this schedule:

Data	Deleted
Hangout chat (blurbs)	30 days after the hangout ends
Notifications	90 days after they're sent
Sign-in codes	About a day after they're used or expire
Expired or signed-out sessions	30 days after they expire or are signed out

Separately:

Server logs (with IP addresses) are deleted after 14 days.
The waitlist (your email, held by Squarespace) is deleted when we close the waitlist, or sooner if you ask.
Nightly database backups are kept in a private Google Cloud Storage bucket, and each copy is deleted automatically after 30 days.
Our own event log is meant to be kept for 3 months. Automatic deletion of older events isn't switched on yet; until it is, events are kept until your account is deleted (which erases them straight away).

Kept while your account exists: your profile, friends, blocks, favourites and settings.

Kept for the life of the service: hangouts, joins, check-ins and attendance records, because other members' history depends on them. After your account is deleted, these records are linked only to an anonymous ID, not to your name, email or @username.

Safety records (reports, and the actions our team takes on them) are kept for the life of the service, so we can spot patterns and keep people safe. After your account is deleted they refer to it only by an account ID.

Anonymous signup counts are kept indefinitely. They aren't about anyone.

Legal holds

Sometimes we have to keep an account's data longer than usual, for example after a serious safety report (such as one involving a minor or a threat of violence), or when we receive valid legal process. We call this a legal hold. A hold is about preserving information, not a judgment that someone did anything wrong.

While a hold is in place:

Everything we hold about that account is kept, even if the account is deleted: its profile, fingerprints and encrypted details, hangouts, chat, check-ins, friends and blocks, reports, notifications and our event log about it. The scheduled deletions above are paused for it.
If the person signs in, the email address or phone number they type is sealed and kept. It's locked with a key that is never on our servers; the key is kept offline and split in two halves, and both are needed to open it. We open a sealed address only to report child sexual exploitation to NCMEC, to report an imminent threat to someone's life or safety, or when valid legal process requires it. Every opening is logged.

When the hold is lifted, any sealed address is deleted straight away, and the rest is erased or deleted on the normal schedule.

Serious harm is never erased. If an account is involved in child sexual exploitation or anything else that puts a child at risk, trafficking, prostitution or solicitation, sexual assault or rape, sexual harassment, abuse, or a threat to someone's life or safety, we keep it under a legal hold with everything preserved, and we report it to the appropriate authorities (NCMEC for anything involving a child, law enforcement otherwise) with the information the law allows us to share. We have zero tolerance for this conduct.

A hold doesn't keep our backups longer: those are always deleted after 30 days.

Deleting your account

You can delete your account any time in the app: Profile › Settings › Delete account. Or email support@skwad.community from the address you sign in with: we'll check it matches an account, and email that address to confirm before we delete anything. See Delete your account for the details.

When you delete your account:

It leaves the app straight away. Nobody can find you, invite you or see your profile, your @username is retired so nobody else can take it, and you're signed out everywhere.
Your personal data is erased straight away: the fingerprint of your email address (and of your phone number, if you used one), your display name, your location (including your zip code), your push token, your favourite activities and write-ins, our event log about you, your friend QR code, your notification inbox, your past usernames, any feedback you sent in the app, and the friend groups you made.
What stays, linked only to an anonymous ID: hangouts you hosted, attendance records, friendships and blocks. Safety records (reports and moderation actions) are kept by account ID only.
If we banned the account for breaking our rules (for example spam or fraud), we keep only the fingerprint of its email address or phone number, so the same address can't be used to sign up again. A fingerprint can't be turned back into your address.
Under a legal hold, your account still leaves the app, but your data is kept until the hold is lifted, and then erased. Accounts held for serious harm are never erased (see Legal holds).
Backups taken before you deleted your account roll off within 30 days. We never restore a backup to bring a deleted account back.

Deleting your account doesn't reach things held outside our database: answers you sent through the Google Forms, emails you sent to support@, and a waitlist entry that hasn't been deleted yet. To have those deleted too, email support@skwad.community.

Your rights

Wherever you live, you can ask us to:

See your data: tell you what we hold about you and give you a copy.
Correct it: you can change your display name, location and favourites in the app, or ask us.
Delete it: in the app or by email, as above.

Email support@skwad.community. To protect your account, write from the email address you sign in with: we'll check it matches an account, confirm the request by emailing that address, and act only after you reply from it. Because we don't store email addresses, write from the address you use to sign in, or include your @username. We'll handle requests within 30 days, and usually much sooner. We won't treat you differently for asking.

California residents

California law (the CCPA, as amended by the CPRA) gives you the rights above: to know what personal information we collect, use and disclose; to delete it; to correct it; and not to be discriminated against for using these rights. You also have the right to opt out of the sale or sharing of your personal information, but we don't sell or share it, so there's nothing to opt out of. We don't use sensitive personal information to infer things about you. You can use an authorised agent to make a request for you.

In the last 12 months, the categories of personal information we collected were: identifiers (email address, used to sign in and kept only as a fingerprint, and the email you give the waitlist, held by Squarespace; username, account ID, IP address, push token); approximate location (zip code); internet or app activity (our event log and server logs); and the content of reports and feedback. We got it from you, from your use of the app and website, and from other members (for example, when they invite you, add you as a friend, or report you). We disclose it only to the service providers listed above, for the purposes in this policy, and to authorities when the law requires it (see below).

Law enforcement and legal requests

We disclose personal information to law enforcement or other authorities when the law requires it, such as in response to a valid subpoena, court order or warrant, and only the information that the request covers. Because we don't store email addresses or phone numbers, we can't hand them over. We can say whether an address the authorities give us belongs to an account, and an account under a legal hold may have a sealed address we can open for them.

If we believe someone is in immediate danger of death or serious harm, we contact emergency services. If we learn of child sexual exploitation, we report it to the National Center for Missing & Exploited Children (NCMEC), as US law requires. Reports of trafficking, prostitution or solicitation, sexual assault or rape, sexual harassment or abuse are reported to the authorities too, with the information the law allows us to share.

Keeping your data safe

Everything between the app and our server travels over an encrypted (HTTPS) connection.
Our database and backups are encrypted on disk by our providers, and the backup bucket is private.
We never store your email address or phone number, only a fingerprint made with a secret key that isn't kept in the database.
Your real name, push token, the details written in reports and the feedback you send in the app are encrypted by our server before they reach the database, with a key the database never holds. Someone with access to the database alone sees only scrambled values.
We never store sign-in codes or session tokens in readable form, only scrambled (hashed) versions.
Only the SKWAD.community team can reach the database, and we keep an audit trail of admin actions.
Your phone stores your sign-in only in its secure storage (the iOS Keychain or Android's equivalent).

International users

SKWAD.community operates in the United States. Our servers and service providers process and store data in the US. If you use SKWAD.community from outside the US, your information is transferred to and processed in the US.

Minors

SKWAD.community is for adults. You must be 18 or older to use it, and you confirm this when you sign up. We don't knowingly collect information from anyone under 18. To report an account you think belongs to someone under 18, use Report › Involves a minor in the app, or email support@skwad.community. If we learn that an account belongs to someone under 18, we pause it straight away and then delete the account and its data. If we've got it wrong, the account holder can tell us by emailing support@skwad.community.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change is significant, we'll let you know in the app or by email before it takes effect.

Contact

Questions about privacy? Email support@skwad.community, or write to us at:

SKWAD.community, 3525 Del Mar Heights Rd Unit 235, San Diego, CA 92130