Privacy policy

1. Who we are

SayWhen is a social planning app that helps friend groups keep shared lists of the things they want to do together and find dates that work. SayWhen Tech Ltd (“SayWhen”, “we”, “us”, or “our”) is the company behind the app and the data controller responsible for the personal information described in this policy. SayWhen Tech Ltd is a company registered in England and Wales (company number 17293699), with its registered office at 66 Paul Street, London, EC2A 4NA, United Kingdom.

For any privacy question, or to exercise your rights, contact us at info@joinsaywhen.com.

2. Information we collect

We collect information you give us, a limited amount of information created when you use the Services, and information from services you choose to connect. We do not use any third-party advertising or analytics tracking in the app.

Information you provide

• Account details such as your first name, last name, display name or username, email address, date of birth, and profile photo. We ask for your date of birth to confirm you meet our minimum age requirement (see section 13).
• Content you create such as activity ideas and shared lists, the friend groups you create or join, invitations you send, suggested dates, your availability responses and any notes you add, and the plans you lock in.
• Enquiries you send us by email, including anything you choose to include in your message, such as your name and the details of your request.
• Waitlist details if you join the launch waitlist on our website: your email address, the time you gave consent, and basic technical details captured with your submission (such as the page you signed up from, your IP address, and browser type) which we use to confirm consent and prevent abuse of the form.

Information created when you use the Services

• Technical and log data such as your IP address, device and operating system type, app version, and request timestamps, which our hosting and backend providers process automatically to keep the Services secure, reliable, and working.
• Notification tokens such as the push notification token for your device, if you turn on notifications, so we can send you invitations and plan updates.
• Scheduling preferences such as the “usual busy times” you optionally set to improve date suggestions.

Information from services you connect

• Calendar and availability data if you choose to connect Apple Calendar or Google Calendar, as described in sections 3 and 4.
• Sign-in data such as the basic profile information shared by Apple or Google when you use their sign-in options.

3. Calendar and availability

Connecting a calendar is optional. It helps SayWhen suggest dates that are more likely to work for you.

• We use calendar information only to work out when you are likely to be free or busy, so we can suggest and rank candidate dates for a plan.
• SayWhen does not display the titles, guests, locations, notes, or other private details of your calendar events to your friends or other group members. Your friends only see the availability signals and responses you choose to share.
• Apple Calendar availability is read on your device. If you connect Google Calendar, we securely store an encrypted Google authorisation token so our backend can refresh your free or busy availability on a schedule; you can revoke this at any time, as described in section 4.
• We access the minimum information needed for this feature, and only for the calendars and time ranges relevant to planning.
• You can disconnect a calendar at any time in the app or via your calendar provider’s settings. When you disconnect, we stop accessing new calendar data and delete or de-identify the availability information derived from it within a reasonable period, unless we are required to keep it.
• We do not use calendar data for advertising, and we do not sell it.

If you turn on “Add locked-in plans”, SayWhen sends the plan title, date, time and location to your connected calendar. For Google Calendar, SayWhen creates, updates and removes only calendar events created by SayWhen. It does not edit or delete your other Google Calendar events.

4. Google user data

If you connect a Google account or Google Calendar, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We only request the Google permissions needed to provide the calendar features you choose to use. We access free and busy time ranges to suggest suitable dates. If calendar writing is enabled, we use the locked-in plan’s title, date, time and location to create, update or remove the corresponding SayWhen-created Google Calendar event.
• SayWhen does not access or display the titles, descriptions, attendees, locations or other contents of your existing Google Calendar events. Group members see only derived availability signals, such as whether a proposed time appears free or busy, and not your underlying Google Calendar data.
• We use Google user data only to provide or improve those user-facing features, and we do not use it for serving advertisements.
• We do not sell Google user data or transfer it to advertisers, data brokers or other information resellers. We disclose Google user data only as necessary to provide the user-facing calendar features you have chosen, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets after obtaining your explicit prior consent.
• We do not allow humans to read Google user data unless we have your affirmative agreement for specific data, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data is aggregated and de-identified.
• You can revoke SayWhen’s access to your Google data at any time via your Google account permissions.

5. How we use information

• Create and manage your account and friend groups.
• Provide the core Services: shared lists, date suggestions, responses, and turning ideas into confirmed plans.
• Suggest dates using availability signals, while keeping the final decision with your group.
• Send transactional and service messages, such as invitations, plan updates, and security notices.
• Respond to your enquiries and provide support.
• Run the waitlist: send you a confirmation email when you join, and email you launch news and updates about SayWhen, including after the app launches, that you have opted in to. Every waitlist email includes a way to unsubscribe, and you can also opt out at any time by emailing info@joinsaywhen.com.
• Confirm you meet our minimum age requirement, using the date of birth you provide.
• Keep the Services safe, prevent fraud and abuse, and enforce our terms.
• Monitor, troubleshoot, and improve the reliability and performance of the Services.
• Comply with legal obligations and protect our legal rights.

We do not sell your personal information, and we do not use your content or calendar data to serve third-party advertising.

6. Legal bases

If you are in the UK or European Economic Area, we rely on the following legal bases under the UK GDPR and EU GDPR:

• Contract: to provide the Services you request, such as running your account and shared plans.
• Consent: for optional features such as connecting a calendar, for sending you waitlist, launch, and ongoing SayWhen update emails you have opted in to, and where consent is otherwise required. You can withdraw consent at any time.
• Legitimate interests: to secure, maintain, and improve the Services, prevent abuse, and communicate with you about the Services, balanced against your rights.
• Legal obligation: to comply with laws that apply to us.

7. How we share information

• With your group: content you add to a shared list or plan, and the responses and availability signals you choose to share, are visible to the members of that group.
• Service providers: trusted companies that process data on our behalf under contract, as listed in section 8.
• Legal and safety: where we reasonably believe it is necessary to comply with the law, respond to lawful requests, or protect the rights, property, or safety of users, the public, or SayWhen.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, with notice consistent with this policy.

We do not sell your personal information or share it for cross-context behavioural advertising.

8. Service providers

We use a small number of reputable providers to run the Services. Each processes data only as needed to provide their service to us:

• Supabase: database, authentication, file storage, and backend hosting.
• Resend: sending account, service, and waitlist emails.
• Apple: app distribution, Sign in with Apple, and push notifications through the Apple Push Notification service, and, where you connect it, Apple Calendar availability read on your device.
• Google: Google sign-in and, where you connect Google Calendar, free/busy availability and the optional creation, updating and removal of SayWhen-created calendar events.
• Hosting and infrastructure providers: serving the website and app infrastructure.

These providers have their own privacy practices, and we keep this list current as the Services develop.

9. International transfers

Some of our providers may process data outside the UK or your home country. Where we transfer personal data internationally, we rely on appropriate safeguards such as UK and EU adequacy decisions or Standard Contractual Clauses, so your information continues to receive an appropriate level of protection.

10. How long we keep data

We keep personal information only for as long as needed for the purposes described in this policy:

• Account and content data is kept while your account is active. If you delete your account, we delete or de-identify it within a reasonable period, unless we must keep some records to meet legal obligations or resolve disputes.
• When Google Calendar disconnection completes, SayWhen deletes the stored Google authorisation credential and cached Google free/busy intervals and stops accessing new Google Calendar data.
• Google Calendar events already created by SayWhen remain in your Google Calendar after disconnection, but SayWhen can no longer update or remove them unless you reconnect. You can delete those events directly in Google Calendar.
• Push notification tokens are kept while notifications are enabled, and are removed when you turn notifications off or delete your account.
• Enquiry emails are kept only for as long as needed to handle your request and maintain appropriate records.
• Waitlist details are kept for as long as we continue sending you SayWhen updates, including after launch, until you unsubscribe or ask us to remove you. If you unsubscribe, we stop sending you waitlist emails and permanently delete your waitlist record within 30 days. We keep hashed rate-limit records used to prevent abuse for no more than 24 hours. If you have not engaged with our emails for a long period, we may ask you to confirm you still want to hear from us, or remove your details from the waitlist.

11. How we protect data

We use technical and organisational measures designed to protect personal information, including encryption in transit, encryption of sensitive tokens such as Google authorisation tokens at rest, database access controls that restrict each person to their own and their groups’ data, and limiting who can access data to those who need it. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any issue we identify.

12. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. You can:

• Update much of your information directly in the app.
• Disconnect a connected calendar, or turn off notifications access, at any time.
• Delete your account, and the personal information associated with it, directly in the app.
• Leave the launch waitlist at any time by using the unsubscribe option in any waitlist email or by emailing info@joinsaywhen.com.
• Ask us to access, correct, or delete your information by emailing info@joinsaywhen.com.

We will respond in line with applicable law and will not discriminate against you for exercising these rights. If you are in the UK or EEA and are unhappy with how we handle your data, you can complain to your local data protection authority; in the UK this is the Information Commissioner’s Office (ICO).

13. Children

SayWhen is intended for people aged 16 and over, and is not directed to children under 16. We ask for your date of birth when you create an account to help confirm you meet this minimum age. We do not knowingly collect personal information from children under 16, and if we learn that someone under 16 has created an account, we will close it and delete their information. If you believe a child under 16 has provided us with personal information, please contact us at info@joinsaywhen.com and we will take appropriate steps to delete it.

14. Changes to this policy

We may update this policy as the Services develop or as legal requirements change. When we make material changes, we will update the date below and, where appropriate, provide additional notice. Your continued use of the Services after an update means you accept the revised policy.

15. Contact us

If you have any questions about this policy or how we handle your information, email us at info@joinsaywhen.com.