Grounders Privacy Policy
Effective date: 2026-04-27 Last updated: 2026-04-27
This Privacy Policy explains how grounders ("Grounders," "we," "us") collects, uses, shares, and protects information when you use the Grounders mobile or web application (the "Service").
If you have questions, contact us at support@grounders.app.
1. Summary
Grounders is a location-based social app where you post photos, videos, and notes anchored to where you took them. Friends nearby can see and react to your posts.
To make this work, we collect:
- Your phone number — used as your account identifier and to send you a one-time login code.
- Your display name — shown to other users.
- Your location — used to anchor posts you create and to determine which posts you can see and react to.
- The photos, videos, and audio you choose to post — stored and shown to other users according to the visibility you set.
- A list of your friends ("grounders") — so we can show you their content and they can see yours.
- A push-notification token — so we can notify you about reactions and friend activity.
- Basic technical logs — IP address, device type, app version, timestamps — for security and debugging.
We do not sell your personal information. We do not track you across other apps or websites. We do not show ads.
2. Information We Collect
2.1 Information you provide directly
- Account info: phone number, display name.
- Posts: photos, videos, audio, captions, and the GPS coordinates of where each post was created.
- Friend connections: the phone numbers or usernames you use to find and add friends; the friend requests you send and receive.
- Safe zones: the GPS coordinates and (optionally) name of any "safe zone" you create — these are areas where you've chosen not to post or be visible.
- Reactions: the emoji reactions you place on others' posts.
- Reports: if you report a post, the reason category and any details you provide.
2.2 Information we collect automatically
- Location data: while the app is open, with your permission. We use this to (a) tag posts you create, (b) determine which posts are within reaction range of you, and (c) center the map on your area. Background location is only collected if you explicitly enable a feature that requires it.
- Device + technical data: device model, operating system version, app version, IP address, language preference, push-notification token, crash and error logs, and approximate request timestamps.
- Usage data: which screens you visit, which posts you tap, friend requests sent — for product analytics and abuse detection.
2.3 Information we do NOT collect
- We do not access your contacts list.
- We do not access your calendar, microphone (except while recording a video you intend to post), or health data.
- We do not collect biometric data — Face ID / Touch ID / fingerprint authentication runs entirely on your device; we never receive the biometric template.
- We do not track you across other apps or websites and do not request the App Tracking Transparency permission for this purpose.
3. How We Use Information
We use the information described above to:
- Authenticate your account (send one-time codes, refresh access tokens).
- Display your posts at their captured location to users who are allowed to see them.
- Determine eligibility for reactions (the 500-meter proximity rule).
- Enable friend connections and the related notifications.
- Send push notifications about reactions to your posts, friend requests, and friend activity.
- Detect and prevent abuse, spam, and harmful content.
- Diagnose crashes and improve the app's reliability.
- Comply with legal obligations.
We do not use your information for advertising, profiling, or to make automated decisions that produce legal effects on you.
4. Visibility of Your Content
You control who sees each post you make:
- Public posts are visible on the map to any user.
- Friends-only posts are visible only to users you've connected with as friends.
- Posts inside a safe zone you've defined are not shown to other users at all.
Reactions to a post are visible to the post's author and to other reactors. Your display name and friend list are visible to your friends and to people you've sent or accepted requests from.
When you delete a post, we remove it and its reactions from our systems. Backups containing the deleted content are overwritten in the normal course of our backup rotation (typically within 30 days).
5. How We Share Information
We share information only with:
- Other Grounders users, according to the visibility settings described above.
- Service providers that operate parts of the Grounders infrastructure on our behalf:
- Twilio (SMS one-time-code delivery) — receives your phone number when you request a login code.
- Firebase Cloud Messaging (Google LLC) (push notifications) — receives your device push token and the title/body of notifications we send you.
- Firebase Authentication / Firebase services as configured — limited account metadata.
- Google Maps Platform (map tiles, place lookups) — receives the map viewport coordinates required to render tiles. Google Maps treats viewport requests under its own privacy policy.
- Railway (application hosting) and PostgreSQL (database) — hosts the application servers and stores account, post, and reaction data.
- Amazon S3 / equivalent object storage (media hosting) — stores the photos, videos, and audio you post.
- Law enforcement, courts, or governmental authorities, if we receive a valid legal request that compels disclosure, or if we believe in good faith that disclosure is necessary to prevent imminent harm.
- A successor entity, if Grounders is involved in a merger, acquisition, asset sale, or bankruptcy — we will notify you of any such transfer that affects how your information is handled.
We do not sell your personal information. We do not "share" your personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act.
6. Data Retention
- Account information (phone number, display name, friends): retained for as long as your account is active. Deleted within 30 days of account deletion.
- Posts and reactions: retained until you delete them. Deleting your account triggers a cascade delete of your posts, reactions, friends, devices, and refresh tokens.
- Server logs: retained for up to 90 days for security and debugging, then deleted or anonymized.
- Backups: full backups are rotated within 30 days, after which deleted content is no longer recoverable.
7. Your Rights and Choices
You can:
- Access and correct your account information by editing your profile in the app, or by contacting us.
- Delete your account at any time from inside the app (Profile → Delete account). This permanently removes your account and content as described above.
- Block another user from inside the app to prevent each of you from seeing the other's content.
- Report content that violates our community standards from inside the app.
- Disable push notifications in your device's system settings.
- Disable location access in your device's system settings — note that the app's core features will not work without location.
- Withdraw biometric unlock by disabling Face ID / Touch ID / fingerprint for Grounders in your device settings.
If you are in the European Economic Area, the United Kingdom, or California, you may also have rights to access, correct, port, or restrict processing of your personal data, and to lodge a complaint with a supervisory authority. To exercise these rights, contact us at the email above.
8. Children
Grounders is not directed to children under 13 (or under 16 in jurisdictions where that is the minimum age for online consent). We do not knowingly collect information from such users. If you believe a child under 13 has provided us with information, contact us and we will delete it.
9. Security
We use industry-standard practices to protect your information, including:
- TLS encryption in transit between the app and our servers.
- Encrypted-at-rest storage on the database and object-storage providers.
- Hardware-backed secure storage of your authentication token on your device (iOS Keychain / Android Keystore).
- Short-lived access tokens with refresh-token rotation.
- Rate limiting on authentication endpoints.
No system is perfectly secure. If we ever experience a security incident affecting your information, we will notify you and any required authorities within the time frames required by applicable law.
10. International Data Transfers
Grounders is operated from Canada. If you access the Service from outside Canada, your information will be transferred to and processed in Canada and in the countries where our service providers operate (primarily the United States and Canada). Where required, we rely on Standard Contractual Clauses or equivalent transfer mechanisms with our processors.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you in the app or by email. Your continued use of the Service after the effective date of an updated policy means you accept the updated policy.
12. Contact
Questions, requests, or complaints: