Your data,
explained clearly.

When you create an account

Google Firebase handles your email address, password authentication, email verification and optional authenticator registration. WithFolk uses account identifiers, your adult-use confirmation, device/session records and security-confirmation records to provide sign-in, device removal, recovery, export and deletion.

We use Google Cloud to host these account services and their database in the United States. The account service does not store your password, authenticator setup key or local health entries. Service providers process authentication and connection information to operate and secure their services.

When you invite or join your Circle

WithFolk stores the recipient email, the names supplied by the inviter, offered categories, invitation status and account relationship on its Google Cloud service. Only the intended signed-in email can review a pending invitation. Acceptance binds the connection to that account. Joining does not activate health or location sharing.

The app keeps pending invitation links and retries in protected storage. The server stores a digest of the private link code, not the code itself. Sign-out or account deletion clears the account's saved private links on that device. Old local practice contacts are not automatically uploaded.

Invitation links expire after 24 hours. Pending invitations are scheduled for removal seven days after expiry; declined or revoked invitations seven days after they end. Accepted connections remain until ended or an account is deleted. Expiry and removal block access immediately even though database cleanup is asynchronous. Account deletion removes counterpart relationships too.

You choose how to send the private invitation link; WithFolk does not send it by email. On this website, its code stays in the URL fragment, which is not sent to the hosting server. The page removes it from the address bar and holds it in page memory until you leave. Copying it requires your action and does not accept the invitation.

When you share your location

The location beta requires an accepted Circle connection, your choice of approximate or precise location, and the recipient’s acceptance. Choose 1, 8 or 24 hours, or Until I revoke it. You then choose Start updates and grant the phone’s location permission. Installing an update or joining a Circle does not start collection.

While updates run, your phone sends its latest permitted location, accuracy and time to WithFolk’s Google Cloud service. Approximate sharing is reduced to an area before storage and delivery. We keep one latest reading per connection, not a route history. Your chosen signed-in recipient can see it while the connection, permission and subscription access remain valid. Readings become unavailable after 15 minutes and are scheduled for automatic database removal.

Pause or Stop sharing stops collection on this phone immediately and asks the server to remove access and the latest reading. If you are offline, the app keeps an encrypted retry instruction and shows that confirmation is pending. Until confirmed, the last reading can remain available within its existing permission and 15-minute limit. Retries survive sign-out; return to the same account to finish them. Circle removal, recipient withdrawal and account deletion also end access.

Until I revoke it has no automatic permission expiry. It does not promise continuous tracking: the phone can pause updates, and reopening a stopped app requires Start updates again. The recipient sees the time of the last reading. If they choose Load Google map, Google Maps receives the permitted map area or point and connection information under its privacy policy.

Check the tester guide for builds with this feature. Private recipient web views remain unfinished. Optional mood alerts and health connections are described below; availability depends on your installed build.

Optional mood alerts

Alerts are off until you choose mood colors for an accepted Circle member and that person accepts the exact alert choices. A new matching check-in sends its color and time to WithFolk’s Google Cloud service. We keep one latest snapshot per connection, available for up to 24 hours and scheduled for automatic removal. Acknowledgement and notification status are also stored. Quiet hours and a chosen limit between alerts can suppress alerts.

Firebase Cloud Messaging and Apple’s notification service receive device registration tokens and a generic Circle-update message. Notifications do not contain mood, names, health readings or location. Registration is tied to your signed-in device session and expires after 30 days unless renewed. A provider accepting a notification does not prove delivery or that someone read it.

Pause, withdrawal, Circle removal and account deletion end snapshot access. If stopping is offline, the app saves a retry instruction and tells you confirmation is pending. Corrections retract the earlier current snapshot; they cannot recall a notification or a copy already received. Snapshot and submission records expire after 24 hours; existing database recovery copies follow the seven-day recovery retention described above. Account export includes alert choices and your latest sent snapshot, never device tokens.

Optional health connections

You choose read-only access to sleep, resting heart rate and HRV separately in Apple Health or Android Health Connect. WithFolk imports up to the last 30 days at a time and stores the copy privately on this phone, including source, timestamps, measurement method and whether the source marks an entry as manual. These readings are not uploaded, sent to your Circle or used for advertising.

Imports refresh while the app is open or when you choose Sync now. A complete refresh replaces the saved window and reconciles changed and deleted source readings. Saved copies remain until refreshed or removed. Disconnect stops imports and removes the saved WithFolk copy; it does not change the original health records. Revoke permission in Apple Health or Health Connect to stop platform access. Device export and removal include health imports.

Trends keep competing sources and HRV methods separate. Missing readings do not become zero. Comparisons describe your recorded days; they do not diagnose, establish causes or trigger automatic health alerts. Fitbit availability depends on which readings it supplies to Health Connect.

When you use a store subscription

When you make a test purchase, Apple or Google processes the store transaction. RevenueCat connects the subscription to your WithFolk account. WithFolk checks the store and RevenueCat records to verify ownership, renewal, expiry and account access across iOS and Android. WithFolk does not receive your payment-card details.

We store your subscription product, store, provider subscription identifier, status, expiry and verification time. We also keep one-way ownership identifiers to prevent purchases from moving to a different WithFolk account. Your check-ins, medication entries and location are not sent to the billing providers by this flow.

Account deletion removes your account's subscription-status records. One-way purchase-ownership records remain without an automatic expiry so deletion cannot be used to reassign the same purchase. These records contain no email address, raw store receipt, health entry or location. Deleting WithFolk or its account does not cancel a store subscription. See the beta terms and purchase-testing information.

This website and support

This information website has no advertising, analytics scripts, sign-in forms or location requests. Firebase Hosting processes the network information needed to serve it, such as your IP address and request details. Apple TestFlight and Google Play handle their own installation and testing information.

If you email support, we receive your address and whatever you include. Please do not send passwords, authenticator codes, private links or health/location details. We use support messages to answer your request and investigate the reported problem.

Export, deletion and retention

Account records remain while your account is active. You can request a protected account export or deletion in Settings → Privacy, export and deletion. Local records have separate export/removal controls on that screen.

After a confirmed account-deletion request, access is blocked while the service removes the active account and Firebase identity. A limited deletion-status receipt and security record are scheduled for expiry after 30 days. Database recovery history can retain earlier account data for up to seven days; expiry cleanup is asynchronous. Operational service logs and copies you already exported are separate from the active account database.

See account deletion for the request path, scope and support option, including when you cannot open the app.

Questions about your data

Contact ryanfcooper@gmail.com to ask about access, correction, deletion or this notice. The beta is intended for invited adults aged 18 or older.