Privacy policy

1. Who we are

SayWhen is a social planning app that helps friend groups keep shared lists of the things they want to do together and find dates that work. SayWhen Tech Ltd (“SayWhen”, “we”, “us”, or “our”) is the company behind the app and the data controller responsible for the personal information described in this policy. SayWhen Tech Ltd is a company registered in England and Wales (company number 17293699), with its registered office at 66 Paul Street, London, EC2A 4NA, United Kingdom.

For any privacy question, or to exercise your rights, contact us at info@joinsaywhen.com.

2. Information we collect

We collect information you give us, a limited amount of information created when you use the Services, and information from services you choose to connect. This includes the product-usage information described below.

Information you provide

• Account details such as your first name, last name, display name or username, email address, date of birth, and profile photo. We ask for your date of birth to confirm you meet our minimum age requirement (see section 13).
• Content you create or upload such as activity ideas, activity locations, photos and shared lists, the friend groups you create or join, invitations you send, suggested dates, your availability responses and any notes you add, and the plans you lock in.
• Enquiries you send us by email, including anything you choose to include in your message, such as your name and the details of your request.
• Marketing email and waitlist details if you choose to receive emails from us, such as your email address and marketing email preference.

Location information you add to an activity is used to support planning features. We may derive a broad geographic category, such as city, region or country, from an activity location for analytics and service improvement. We may provide that broad category to an analytics provider, but not the activity address or precise location. We do not collect your device’s GPS location for analytics.

Information created when you use the Services

• Technical and log data such as your IP address, device and operating system type, app version, and request timestamps, which our hosting and backend providers process automatically to keep the Services secure, reliable, and working.
• Product-usage data such as screens and features used, actions completed, timestamps, and a pseudonymous account or device identifier, which we use as described in section 5.
• Notification tokens such as the push notification token for your device, if you turn on notifications, so we can send you invitations and plan updates.
• Scheduling preferences such as the “usual busy times” you optionally set to improve date suggestions.

Information from services you connect

• Calendar and availability data if you choose to connect Apple Calendar or Google Calendar, as described in sections 3 and 4.
• Sign-in data such as the basic profile information shared by Apple or Google when you use their sign-in options.

3. Calendar and availability

Connecting a calendar is optional. Signing in with Google does not connect your Google Calendar. Calendar access requires separate permission. Connecting a calendar helps SayWhen suggest dates that are more likely to work for you.

• We use calendar information only to work out when you are likely to be free or busy, so we can suggest and rank candidate dates for a plan.
• SayWhen does not display the titles, guests, locations, notes, or other private details of your calendar events to your friends or other group members. Your friends only see the availability signals and responses you choose to share.
• Apple Calendar availability is read on your device. If you connect Google Calendar, we securely store an encrypted Google authorisation token so our backend can refresh your free or busy availability on a schedule; you can revoke this at any time, as described in section 4.
• We access the minimum information needed for this feature, and only for the calendars and time ranges relevant to planning.
• You can disconnect a calendar at any time in the app or via your calendar provider’s settings. When you disconnect, we stop accessing new calendar data and delete or de-identify the availability information derived from it within a reasonable period, unless we are required to keep it.
• We do not use calendar data for advertising, and we do not sell it.

When “Add locked-in plans” is enabled, SayWhen sends the plan title, date, time and location to your connected calendar. For Google Calendar, SayWhen creates, updates and removes only calendar events created by SayWhen. It does not edit or delete your other Google Calendar events.

4. Google user data

If you connect a Google account or Google Calendar, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We only request the Google permissions needed to provide the calendar features you choose to use. We access free and busy time ranges to suggest suitable dates. If calendar writing is enabled, we use the locked-in plan’s title, date, time and location to create, update or remove the corresponding SayWhen-created Google Calendar event.
• SayWhen does not access or display the titles, descriptions, attendees, locations or other contents of your existing Google Calendar events. Group members see only derived availability signals, such as whether a proposed time appears free or busy, and not your underlying Google Calendar data.
• We use Google user data only to provide or improve those user-facing features, and we do not use it for serving advertisements.
• We do not sell Google user data or transfer it to advertisers, data brokers or other information resellers. We disclose Google user data only as necessary to provide the user-facing calendar features you have chosen, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets after obtaining your explicit prior consent.
• We do not allow humans to read Google user data unless we have your affirmative agreement for specific data, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data is aggregated and de-identified.
• You can revoke SayWhen’s access to your Google data at any time via your Google account permissions.

5. How we use information

• Create and manage your account and friend groups.
• Provide the core Services: shared lists, date suggestions, responses, and turning ideas into confirmed plans.
• Suggest dates using availability signals, while keeping the final decision with your group.
• Send transactional and service messages, such as invitations, plan updates, and security notices.
• Respond to your enquiries and provide support.
• Send you launch news, product updates and other SayWhen news where you have chosen to receive them. You can unsubscribe at any time using the link in an email.
• Confirm you meet our minimum age requirement, using the date of birth you provide.
• Keep the Services safe, prevent fraud and abuse, and enforce our terms.
• Monitor, troubleshoot, and improve the reliability and performance of the Services.
• Comply with legal obligations and protect our legal rights.

Analytics and service improvement

We use limited product-usage and technical information to understand how people use the Services, measure feature engagement and drop-off, identify reliability issues, and improve the product. This may include screen and feature interactions, actions completed, timestamps, app and device information, a pseudonymous identifier, broad age ranges, and coarse geographic categories.

We may use product analytics providers to process this information on our behalf. We do not provide them with direct identifiers such as your name or email address, or with the contents of your plans, calendar data, contacts or precise locations. We do not use product analytics for advertising or automated decisions about you.

We do not sell your personal information, and we do not use your content or calendar data to serve third-party advertising.

6. Legal bases

If you are in the UK or European Economic Area, we rely on the following legal bases under the UK GDPR and EU GDPR:

• Contract: to provide the Services you request, such as running your account and shared plans.
• Consent: for optional features such as connecting a calendar, for sending you marketing emails you have opted in to, and where consent is otherwise required. You can withdraw consent at any time.
• Legitimate interests: to secure, maintain, and improve the Services, understand feature engagement and product journeys, prevent abuse, and communicate with you about the Services, balanced against your rights.
• Legal obligation: to comply with laws that apply to us.

7. How we share information

• With your group: content you add to a shared list or plan, and the responses and availability signals you choose to share, are visible to the members of that group.
• Service providers: trusted companies that process data on our behalf under contract, as listed in section 8.
• Legal and safety: where we reasonably believe it is necessary to comply with the law, respond to lawful requests, or protect the rights, property, or safety of users, the public, or SayWhen.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, with notice consistent with this policy.

We do not sell your personal information or share it for cross-context behavioural advertising.

8. Service providers

We use a small number of reputable providers to run the Services. Each processes data only as needed to provide their service to us:

• Cloud infrastructure providers: providers that support our database, authentication, file storage, backend infrastructure, and website or app hosting.
• Email delivery providers: providers that send account, service, and waitlist emails on our behalf.
• Apple: app distribution, Sign in with Apple, and push notifications through the Apple Push Notification service, and, where you connect it, Apple Calendar availability read on your device.
• Google: Google sign-in and, where you connect Google Calendar, free/busy availability and the optional creation, updating and removal of SayWhen-created calendar events.
• Product analytics providers: providers that process pseudonymous usage events and limited technical information on our behalf so we can measure feature use, journeys, funnels, drop-off, retention and service performance.

These providers have their own privacy practices, and we keep this list current as the Services develop.

9. International transfers

Some of our providers may process data outside the UK or your home country. Where we transfer personal data internationally, we rely on appropriate safeguards such as UK and EU adequacy decisions or Standard Contractual Clauses, so your information continues to receive an appropriate level of protection.

10. How long we keep data

We keep personal information only for as long as needed for the purposes described in this policy:

• Account and content data is kept while your account is active. If you delete your account, we delete or de-identify it within a reasonable period, unless we must keep some records to meet legal obligations or resolve disputes.
• When Google Calendar disconnection completes, SayWhen deletes the stored Google authorisation credential and cached Google free/busy intervals and stops accessing new Google Calendar data.
• Google Calendar events already created by SayWhen remain in your Google Calendar after disconnection, but SayWhen can no longer update or remove them unless you reconnect. You can delete those events directly in Google Calendar.
• Push notification tokens are kept while notifications are enabled, and are removed when you turn notifications off or delete your account.
• Pseudonymous analytics events are kept only for as long as reasonably necessary to compare product trends and evaluate improvements, using documented retention settings with our analytics providers. We may keep statistics that have been aggregated and anonymised so they no longer identify an individual.
• Enquiry emails are kept only for as long as needed to handle your request and maintain appropriate records.
• Marketing email details are kept while you are subscribed. If you unsubscribe, we stop sending marketing emails and may retain a limited record of your preference so we can respect your choice. Other waitlist information is kept only for as long as reasonably necessary for the waitlist and related record-keeping.

11. How we protect data

We use technical and organisational measures designed to protect personal information, including encryption in transit, encryption of sensitive tokens such as Google authorisation tokens at rest, database access controls that restrict each person to their own and their groups’ data, and limiting who can access data to those who need it. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any issue we identify.

12. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. You can:

• Update much of your information directly in the app.
• Disconnect a connected calendar, or turn off notifications access, at any time.
• Delete your account, and the personal information associated with it, directly in the app.
• Stop receiving marketing emails at any time by using the unsubscribe option in an email.
• Ask us to access, correct, or delete your information by emailing info@joinsaywhen.com.

Your right to object

Where we rely on legitimate interests, you may object to our use of your personal information. You can use our privacy preferences page to stop future product-analytics events from being associated with your account and exclude your account from future analytics processing, or email info@joinsaywhen.com about another objection. We will consider your request in accordance with applicable data-protection law and stop the relevant processing unless we have compelling legitimate grounds to continue.

We will respond in line with applicable law and will not discriminate against you for exercising these rights. If you are in the UK or EEA and are unhappy with how we handle your data, you can complain to your local data protection authority; in the UK this is the Information Commissioner’s Office (ICO).

13. Children

SayWhen is intended for people aged 16 and over, and is not directed to children under 16. We ask for your date of birth when you create an account to help confirm you meet this minimum age. We do not knowingly collect personal information from children under 16, and if we learn that someone under 16 has created an account, we will close it and delete their information. If you believe a child under 16 has provided us with personal information, please contact us at info@joinsaywhen.com and we will take appropriate steps to delete it.

14. Changes to this policy

We may update this policy as the Services develop or as legal requirements change. When we make material changes, we will update the date below and, where appropriate, provide additional notice.

15. Contact us

If you have any questions about this policy or how we handle your information, email us at info@joinsaywhen.com.