Privacy notice | Friendo

Who we are

Friendo (friendo.uk) is owned and run from the UK by Steven Smith, who is the data controller for the personal data described here. Contact: hello@friendo.uk.

The short version

Your location is never shared unless you switch it on and choose friends. We keep only your latest position, for a few hours at most, and no history.
Photos are only for the friends you choose; we strip hidden data (like GPS) from them and delete them when they expire or have been opened.
The app has no ads, no analytics and no tracking. We don’t sell data.

What we store and why

Data	Why	Lawful basis	How long
Your e-mail address — stored encrypted, plus a scrambled (keyed-hash) copy for look-ups. Never shown to other users; our admin sees only a masked hint like “s•••@e•••.com”.	To sign you in with a code and send important account messages.	Contract	Until you delete your account.
Name, username, date of birth, profile picture, status	To run your account; to check you’re 18 or over. Friends see your name, username, picture and status — never your date of birth.	Contract; legitimate interests (keeping under-18s off the service)	Until you delete your account. A status disappears after 24 hours.
How you joined (which member invited you, or which beta code)	To run the invite-only beta and limit invites.	Legitimate interests	Until you delete your account.
Snaps: the photo (all hidden data such as GPS removed), caption, who it went to, and when each friend opened it	To deliver your snaps to the friends you chose.	Contract	Until it expires (1 hour to 7 days, as chosen), or a few minutes after every friend has opened a view-once snap, or until you delete it. A reported snap is kept until it has been reviewed.
Your location — only if you switch sharing on: your latest position, snapped to the centre of a ~1 km square, and your precise position (stored encrypted) only if you’ve chosen at least one friend to see it	To show you on the map to the friends you chose, at the level you chose.	Consent (you switch it on and can switch it off at any time)	No history: each update overwrites the last. Deleted after the time you choose (at most 8 hours), or straight away when you switch sharing off, go ghost or delete your account.
Friends, requests, blocks, who you share your location with, pokes	To run the friends features.	Contract	Until removed or you delete your account. Pokes: 7 days. Declined requests: 30 days.
Sign-in sessions: a hashed session code, device type (e.g. “Safari on iPhone”), when you signed in and last used it	To keep you signed in and let you see and sign out your devices.	Contract; legitimate interests (security)	Until you sign out, or 90 days after you last used that device.
Sign-in codes (stored hashed) and requests for them, with a hashed IP address	To check codes and stop abuse (rate limits).	Legitimate interests (security, preventing fraud)	Codes: deleted within 24 hours. Rate-limit records: 3 days.
Reports, warnings and moderation records	To keep the service safe and meet our Online Safety Act duties.	Legal obligation; legitimate interests	Up to 3 years. Warnings: 12 months after you’ve read them.
Removed content	Normally deleted at once. Kept in a restricted area only when needed for an appeal (up to 28 days) or because the law requires it, for example child sexual abuse material reported to the National Crime Agency (1 year).	Legal obligation; legitimate interests	As stated.
Bans and age blocks: a hashed copy of the e-mail address only	To stop banned people and under-18s joining again.	Legitimate interests	Bans: until lifted. Under-18 blocks: 12 months.

We don’t ask for special category data (such as health or religion), but photos can reveal it — please think about what you share. We don’t use automated decision-making about you.

Who can see your data

Your friends see your name, username, picture and status; snaps you send them; pokes; and your location only if you chose them, at the level you chose.
People who type your exact username or use your invite link see your name, username and picture.
Our admin (the owner) sees account basics (username, name, masked e-mail, join date and counts), reported content and reports. The admin can’t browse private snaps that haven’t been reported, and can’t see anyone’s location.
Service providers: our web hosting provider, which also runs the mail server that sends sign-in e-mails, and your own e-mail provider, which receives them.
The police, the National Crime Agency or other authorities where the law requires it (for example, reports of child sexual abuse).

Ads on our information pages

The app never shows ads. Some information pages (the home page, how it works, the safety centre, FAQ, about and the blog) can show a banner ad from 5od (5od.co.uk), a small ad service run by the owner of this site. The ads are contextual: chosen to suit the page, not you. 5od sets no cookies and builds no profile of you; your browser sends it the site, the ad position and size, and the page address. The banners are for shops and brands in the Awin affiliate network, whose banner images and links can set Awin’s own cookies when a banner is shown or clicked. That’s why nothing loads until you choose:

Accept ads cookies: banners load, and Awin is told you agreed.
Reject: no banners load at all, and your browser doesn’t contact 5od or Awin.
JavaScript off: no ads load and you won’t be asked.

Your choice is kept in your browser for 6 months; change it with “Cookie settings” in the footer of those pages.

Security

Everything is sent over an encrypted connection. E-mail addresses and precise positions are encrypted at rest; IP addresses are never stored in readable form; photos are stored outside the public web folder and only sent after a permission check. Our web server also keeps basic technical logs (such as IP address, page requested and browser type) for security and troubleshooting.

Your rights

Access and portability: download everything we hold about you from Me → Download my data.
Correction: change your name, username and picture in the app; e-mail us for anything else.
Erasure: Me → Delete my account removes your account straight away.
Withdrawing consent for location: switch sharing off or go ghost — your position is deleted at once.
Objection and restriction: e-mail us.

E-mail hello@friendo.uk to use any right. We’ll reply within one month. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO).

Children

Friendo is for adults (18+). If we learn that a user is under 18, we close the account.

Changes

We’ll update this notice if what we do changes, and tell you in the app if it’s significant.