Last updated: October 12, 2026

    What We Collect

    Account Information

    • Name and email address (via Sign in with Apple, Google sign-in, or email signup)
    • Display name: the name friends see on your plans, crews and chats. It comes from your sign-in provider or from what you enter, and you can change it in Profile > display name. Your email address is never shown as your name: when your account has no name, your chat messages and your place on plans you create appear to others as "Someone". When a host invites you by name, their label for you stays on that plan or crew
    • Phone number, if you add one to your profile
    • Profile photo (optional), taken with your camera or chosen from your photo library with your permission

    Location Data

    • Your precise location (GPS coordinates), collected only with your permission, to find events and activities near you and to power features you request (such as weather-aware plan suggestions)
    • A home city and zip code you set during onboarding
    • Your location is never shown to or shared with other users
    • You can decline or disable location access in iOS Settings and pick a city manually instead

    Contacts

    • When you pick a friend to invite, the app opens the system contact picker. Only the one contact you choose is handed to the app, as the details on that contact card, and the app keeps just their name and one phone number for the invite; nothing else from the card is stored or sent. The app never reads your address book, and on iOS it asks for no contacts permission
    • Picking from contacts is optional; every core feature works without it
    • The numbers of the contacts you select are processed and stored on our servers so we can match them against existing accounts (a match gets the invite in the app instead of a text) and manage the invite afterwards
    • An unmatched number invited to an event is stored on that invite and goes away when the event is deleted. A number you add to a crew is also saved to your own contacts list, which stays with your account until you delete your account: taking someone out of a crew ends their crew membership, it does not erase the saved contact

    Calendar

    • If you grant calendar access, we read the busy windows (start and end times only) of events in the next two weeks and store them so your crew can see when you are free
    • Event titles, details, locations, and attendees from your calendar never leave your device
    • Turning calendar access off in iOS Settings removes the stored busy windows the next time the app syncs your calendar (when you visit your events), and every stored window is deleted automatically within two days of the event ending

    Usage and Analytics Data

    • Events you view, save, and RSVP to, and your swipe history, to personalize recommendations
    • Messages sent in event group chats (visible only to that event's members)
    • Product analytics (screens viewed, features used) collected via PostHog and linked to your user ID, account email, and sign-in method so we can understand and improve the product. You can turn these off with the share usage analytics switch in Profile. The app never puts your location in an analytics event: when you set your location, the event records how you chose it (your device's location, a search, or a city from our list) and the radius you picked, never the city, the address, the text you searched for, or coordinates. PostHog itself derives an approximate location from the IP address an event arrives from; that is described under Third-party services below
    • Crash reports, errors, and performance timings collected via Sentry. Your screen is never recorded: the app has no screen recording or session replay of any kind

    Device Information

    • Push notification token (for event reminders and updates). Turning off the push notifications switch in Profile deletes the stored token, and no new token is stored while it is off
    • Device type and OS version (for crash reporting and diagnostics)

    How We Use It

    • Show you relevant local events based on your interests and location
    • Enable event planning, crew management, and group chat
    • Personalize your event feed with our recommendation engine
    • Send push notifications for RSVPs, messages, invites, crews and event reminders, which you can turn off with the push notifications switch in Profile
    • Improve the app experience

    What We Don't Do

    • We never sell your data to third parties
    • We never share your location with other users (it is used to find nearby events and to power features you request, such as weather-aware plan suggestions)
    • We never use your data for advertising or cross-app tracking
    • Chat is between you and your crew; we only access message content when required to review a report of abuse

    Third-Party Services

    • Supabase (database and authentication): supabase.com/privacy
    • Google (optional Google sign-in; venue details and photos via Google Places): some venue information and photos in the app come from Google Maps. Google's handling of data is described in the Google Privacy Policy, and use of that content is subject to the Google Maps/Google Earth Additional Terms of Service. Venue lookups run on our servers using venue names from our event catalog, never your identity, account details, or search history. When the app shows a photo hosted by Google, your device loads it from Google's servers directly, which shares your device's IP address with Google the same way any web image load does
    • PostHog (product analytics): usage events and an anonymous or account-linked id (posthog.com/privacy). Once you are signed in, your analytics profile also includes your account email and your sign-in method (Apple, Google, or email), which we use to tell internal and duplicate accounts apart from real ones. PostHog does not record your screen. PostHog derives an approximate location (country, region, city, postal code and approximate coordinates) from the IP address each event arrives from and keeps the first and the latest on your analytics profile; the app itself sends it no location. Turn this off with the share usage analytics switch in Profile. That switch controls product analytics only: crash reports, errors, and performance timings (Sentry, below) are not affected by it, because a crash report is how we find out the app broke for you. One exception, recorded rather than hidden: the switch is remembered per device and survives signing out, but the account-created event is sent by our server the moment a new account accepts the terms, before that account has reached any switch. So a device that opted out and then creates a NEW account still emits one server-side event for it, carrying the new user id, the signup timestamp, the authentication provider, a signup date, and a fixed source label (auth_users_trigger) marking it as sent by our database, and nothing else. Every in-app event for that account stays suppressed by the device opt-out. When you delete your account, your analytics profile is deleted with it. The app stops recording analytics, sends the events still waiting on the device so they are deleted with your profile, and discards any it could not send within a couple of seconds, so nothing left on the device can recreate the profile later. PostHog deletes your profile in the background, usually within a few minutes, and its events in a later deletion run. PostHog deletes the events it received before our request, so when that request goes through we ask again a day later to catch any that were already on their way. If the first request does not go through, we retry it automatically
    • Sentry (crash reporting): errors, device type, and OS version (sentry.io/privacy). Sentry receives crash reports, errors and performance timings. Your screen is never recorded
    • Anthropic (Claude AI): powers event curation and the AI planner. Server-side event curation writes and scores catalog content, and no personal data is involved in that path. Two features send data of your own, and each asks you to agree in the app first, naming Anthropic and listing exactly what is sent: when you set a profile picture, the photo is sent to Anthropic's API for an automated safety check before it is published, and it is only published if it passes; when you use the planner, your note, your picks (when, vibe, budget), and details of nearby places are sent to Anthropic's API so it can write your plan. Declining sends nothing and leaves the feature unused, and you can withdraw either agreement at any time in Profile > ai features. Anthropic does not use this data, including your photos, to train models
    • Photon (komoot) and Nominatim / OpenStreetMap (location search): the place text you type in the location picker goes to Photon, and when you pick a country or region, its map bounds go to Nominatim to list the cities inside it. Both requests are made by our servers, so the app never contacts either service directly, and neither receives your account details or your device location
    • Open-Meteo (weather): weather lookups for plan suggestions, using approximate coordinates and no account identifiers
    • Ticketmaster (event data): no personal data shared
    • Expo (push notifications): device tokens for notification delivery

    Invite texts are sent from your own phone through the Messages app; we never send SMS on your behalf. On a device that cannot send texts (an iPad, for example) the same link opens in the system share sheet instead, and you choose how to send it.

    Data Retention

    • Account data is kept while your account is active
    • You can delete your account at any time from Profile > Delete Account, or by following our account deletion instructions
    • Account deletion removes your profile, crews, and the events you created within 30 days, and the messages you sent go with it, including the ones in other people's event chats. Other members keep their own messages; yours are gone
    • Revoking your Sign in with Apple grant, deleting your uploaded photo and deleting your analytics profile (PostHog) happen as part of the same deletion. If Apple, our storage provider or PostHog is briefly unavailable at that moment, those steps may finish shortly afterwards: we retry them automatically, up to ten times over about a day, with the wait between attempts growing each time. If they still have not succeeded after that, we stop retrying and a member of our team is alerted to finish them by hand. Your account itself is already gone at that point; only these external steps can be outstanding
    • Safety reports are kept when an account is deleted: reports your account filed, and reports other people filed about your account, stay on record for safety for up to 24 months. At deletion we remove the account ids from them and erase their free-text details. What remains is the kind of report, the reason category, and the action taken on it. After 24 months the report is deleted
    • A report about an invited guest who has no account keeps the name shown for that guest and the event it was filed from, for up to 24 months, even after the guest is removed or the event is deleted, because no account ties that report to a deletion. After 24 months the report is deleted

    Your Rights

    • Access: View your data in your Profile
    • Delete: Delete your account anytime; your personal data, the chats of events you created, and the messages you sent in other people's chats are all removed
    • Portability: Contact us to request a copy of your data
    • Opt-out: Disable location in iOS Settings, notifications with the push notifications switch in Profile, analytics with the share usage analytics switch in Profile, withdraw AI processing consent, or delete your account

    Children's Privacy

    Squishmish is not intended for users under 17. We do not knowingly collect data from minors.

    Contact Us

    For privacy questions: privacy@squishmish.ai

    Changes

    We may update this policy. Changes will be posted here with the updated date.