Privacy Policy

Say Less is built around anonymity and minimal data collection. This policy explains what we collect, why, and how we protect it.

1. Information We Collect

Information you provide

• Phone number — used for account creation and authentication via one-time passcode (OTP)
• Display name — optional, shown to your contacts within the App
• Contacts — only accessed with your permission, used to find friends on Say Less and deliver plan invitations. Contact data is not stored on our servers beyond what is needed for matching.
• Plan content — the text of plans you create (e.g., "bar tonight?"). Plans are temporary and deleted after expiry.

Information collected automatically

• Device token — for delivering push notifications (APNs for iOS)
• Basic device info — device type and OS version, for compatibility and debugging
• Usage data — anonymized interaction data (e.g., plans created, votes cast) to improve the App

Information we do NOT collect

• Location data
• Photos, camera, or microphone access
• Browsing history
• Advertising identifiers

2. How We Use Your Information

3. Anonymity

Anonymity is core to Say Less. When you create a plan:

• Your identity as the plan creator is never revealed to other participants
• All participants — including you — receive the same notification
• We store creator information internally for safety and legal compliance, but it is never exposed through the App

4. Data Sharing

We do not sell your personal data. We share information only in these limited cases:

• Service providers — we use Supabase (database/auth), Apple Push Notification service (push delivery), and Twilio (SMS delivery for non-app users). These providers process data only to deliver their services to us.
• Legal requirements — we may disclose information if required by law, court order, or to protect the safety of our users

5. Data Retention

• Plans — deleted after they expire (typically within hours)
• Account data — retained while your account is active. Deleted within 30 days of account deletion request.
• Usage data — anonymized and aggregated, retained for up to 12 months

6. Data Security

We use industry-standard security measures to protect your data:

• All data transmitted between the App and our servers is encrypted via TLS
• Authentication tokens are securely managed through Supabase Auth
• Database access is restricted through row-level security policies

No system is 100% secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

7. Your Rights

You have the right to:

• Access — request a copy of the personal data we hold about you
• Delete — request deletion of your account and associated data
• Withdraw consent — revoke contacts access or disable notifications at any time via device settings
• Portability — request your data in a portable format

To exercise any of these rights, contact us at hello@sayless.app.

8. Children's Privacy

Say Less is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided personal data, we will delete it promptly.

9. International Data Transfers

Your data may be processed on servers located outside your country of residence. We ensure appropriate safeguards are in place for any international transfers of personal data.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App. Your continued use of Say Less after changes become effective constitutes acceptance of the updated policy.

11. Contact

Questions or concerns about your privacy? Reach out at hello@sayless.app.