UpToPrivacy policy
UpTo helps friends who already know each other make plans. There's no public feed, no people map, no stranger discovery and no ads. This policy explains what data the app and the website process, why, and what you can do about it.
1. Who is responsible
Controller under the GDPR: Maximilian Händle, Madrid, Spain. Email: uptosupport@icloud.com. Postal address available on request at uptosupport@icloud.com.
2. Data the app processes
| Data | Why | Legal basis |
|---|---|---|
| Apple account ID and the email Apple shares with us (often a private relay address) | Sign in with Apple, keeping your account | Art. 6(1)(b) GDPR (providing the service) |
| Display name, username, optional short phrase, optional profile photo | Your profile | Art. 6(1)(b) |
| Your previous username, for 30 days after you change it | Keeping it reserved so nobody else can take it and pretend to be you. You can change your username at most once every 30 days | Art. 6(1)(f) legitimate interest (preventing impersonation) |
| Friendships, friend requests, circles, blocks and reports | Connecting friends, safety controls | Art. 6(1)(b); safety: Art. 6(1)(f) |
| "I'm free" posts, plans, invitations, Going/Pass answers, waitlists | Showing overlaps and coordinating plans with the audience you choose | Art. 6(1)(b) |
| Event chat messages | Chat between confirmed participants of a plan | Art. 6(1)(b) |
| Shared bills ("Split the bill"): amounts, items, members, who has paid, an optional receipt photo, and the payment details the host enters (PayPal name, Revolut, Bizum number or IBAN) | Splitting the costs of a plan. Visible only to the host and the confirmed participants the host adds to that bill. UpTo never handles money; PayPal and Revolut links open those services | Art. 6(1)(b) |
| Exact location, only when you turn it on for a live post or plan | Meeting points and showing participants where you are, for that plan only | Art. 6(1)(a) consent (iOS permission and in-app switch) |
| Push token, notification settings, time zone and delivery logs per device | Sending notifications about plans, friends and chats at the right local time | Art. 6(1)(a) (iOS permission) |
| Usage data, only if you allow it (see below) | Improving the app | Art. 6(1)(a) consent |
Usage data (with your permission). If you tap "Allow" on "Help improve UpTo?", the app sends which screens you open, steps in creating a plan, load times and short error codes, linked to your account. Never messages, names, places or location. You can withdraw your consent any time in Profile; your stored usage events are then deleted. Raw events are deleted after 90 days; after that we keep only daily totals that no longer identify anyone.
Statistics from app data. We count, in totals only, how many people use features such as plans, answers, chat and split bills, from the data the app stores anyway. Only the founder sees these figures. Legal basis: legitimate interest in improving UpTo (Art. 6(1)(f)).
People you may know. We may suggest you to people who share accepted friends or a confirmed plan with you. They see your name, photo and how many friends you have in common, nothing else. We do this because suggestions help friends find each other (legitimate interest, Art. 6(1)(f)). You can object at any time: turn off "Suggest me to friends of friends" in Privacy › Your choices. Any signed-in user who searches for your @username (or its first letters) sees your name, username and photo. Suggestions never use your location, messages or invitation text. UpTo does not access your contacts.
Server logs. Our host Supabase records IP addresses and request times for security and troubleshooting, kept for a short period set by Supabase. Legal basis: legitimate interest in a secure service (Art. 6(1)(f)).
What stays on your iPhone
If you connect Apple Calendar, UpTo only creates, updates and removes the entries for your UpTo plans. It does not read or upload your other events. If you host a shared bill, the app remembers your payment details on your iPhone for the next bill; you can change or delete them there. Photo library and camera are used only when you pick a profile photo or a receipt photo.
3. Who can see what
Profile (name, username, photo, short phrase): visible to accepted friends, to people you share a plan with, and to people you have a pending friend request with. Any signed-in user who searches for your @username (or its first letters) sees your name, username and photo. People who share friends or plans with you may see your name and photo as a suggestion (see above).
Posts and plans: visible only to the friends or circles you select.
Event chat and participant map: visible to the people who said Going to that plan. They all know the host, but they don't have to be friends with each other.
Shared bills: visible only to the host and the people on that bill.
Exact location, only when you turn it on:
- For a live post ("I'm out, join me"), everyone you invited can see your live location, also before they join.
- For a planned event, only confirmed participants can see it, starting at the earliest 15 minutes before the event, and it stops when the event ends.
The app shows who sees it and when it ends, and you can stop it any time. We store only your latest position for that plan, not the route you travelled, plus a record of who it was shared with and when sharing started and ended.
Notifications can show names, plan details and chat text on your lock screen, depending on your iOS settings ("Show Previews").
4. Service providers and transfers outside the EU
We use these providers as processors, only for what they need to run their part of the service:
- Supabase (database, login, file storage, server functions, server logs), servers in the EU (Ireland).
- Apple (Sign in with Apple, Apple Push Notification service, TestFlight and App Store distribution).
- Expo / 650 Industries, USA (forwarding push notifications to Apple). Notification content passes through Expo and Apple: names and usernames, plan title, time and place, for chat notifications up to 180 characters of the message text, and for notifications that show the sender's face a link to their profile photo that expires after one hour.
- Anthropic, USA (reading receipts). Only when the host of a bill asks UpTo to fill in the amounts, the receipt photo is sent to Anthropic's AI service, which returns the line items and total. A receipt can contain names or the last digits of a payment card. Anthropic processes the photo only to provide this result. You can always type the amounts instead.
- Cloudflare, USA (hosting and delivering this website). Cloudflare processes the technical access data described in section 7.
Transfers to the USA are based on the EU-US Data Privacy Framework or the EU standard contractual clauses. We do not sell your data and do not use it for advertising.
5. How long we keep data
- Chat messages: deleted 30 days after the plan ends.
- Exact location: deleted when the plan ends. The meeting point a host sets stays with the plan.
- Notification logs: deleted after 30 days.
- Usage events: deleted after 90 days (only daily totals remain).
- Previous usernames: released after 30 days.
- Dismissed friend suggestions: hidden for 90 days.
- Everything else: until you delete the plan or your account.
Deleting your account
Deleting your account in Privacy Center permanently removes your login, profile and profile photo, friendships, circles, your posts and plans, your answers, the chat messages you sent (they also disappear for other participants), location and sharing records, shared bills and receipt photos you uploaded, device tokens, notification settings and logs, reserved previous usernames and your usage events. Plans you hosted are deleted for everyone, including other people's answers and chat in them. Blocks you set and reports you made are deleted too, and so are blocks and reports by other people concerning you. We also revoke UpTo's Sign in with Apple connection with Apple.
6. Your rights
You can access, correct, export or delete your data, restrict or object to processing, and withdraw consent at any time (Art. 15 to 21 GDPR), in the app or at uptosupport@icloud.com. In Privacy Center you can download a complete copy of your data and delete your account. Withdrawing consent, for example by turning off location, notifications or usage data, does not affect processing before that.
You can complain to the Spanish data protection authority (AEPD, www.aepd.es) or the authority where you live.
7. The website
The website uses no cookies, no tracking and no analytics, and loads no fonts or scripts from other servers. Our host Cloudflare processes technical access data (IP address, time, requested page) to deliver the site and keep it secure (Art. 6(1)(f)). If you email us, we use your message only to answer it.
8. Minimum age
UpTo is for people 16 and older.
9. Changes
UpTo is in beta and will change. When this policy changes in a meaningful way, we update the version and date above and let you know in the app.