Privacy policy

1. Who we are

Good Company (“we”, “us”) is being set up as a UK company. Until the company is registered and the app opens, this website doesn’t collect sign-ups or anything else through forms. The only personal information we receive is what you choose to email us, and the basic technical details our website host needs to show you the site (see section 6). The rest of this policy describes how the app will handle your data once it opens. When the company is registered, its legal name, registered office, company number and ICO registration number will appear here, and it will be the controller of your personal data for the Good Company website and app.

Privacy questions or requests: privacy@goodcompanyapp.uk.

2. What we collect, why, and our lawful basis

This table sets out everything we collect. The Your data page shows the same information from your point of view, with the controls. If you think we’ve missed something, please tell us.

3. Identity verification and biometric data

To verify you, Stripe (Stripe Identity) checks your government ID and compares it with a live selfie. That comparison involves biometric data, which UK GDPR treats as special-category data. You’re shown Stripe’s own notice and asked for your explicit consent in its flow before anything is captured (Art. 9(2)(a)).

We don’t receive the images. We receive a pass/fail result, a reference number, the date of birth printed on your ID, and the sex shown on it. We also make the one-person-one-account code described above from the name and date of birth on the ID; we don’t keep your name from the ID as text.

Stripe’s role. Stripe runs the check on our behalf, as our processor. For some purposes, such as meeting its own legal obligations, preventing fraud and improving its services, Stripe acts as a separate controller and uses the data under its own privacy notice: stripe.com/privacy. When you delete your account, our deletion request asks Stripe to delete (redact) all of the ID-check sessions it ran for us about you.

How long Stripe keeps it. Stripe says that, as a separate controller, it keeps biometric data for up to 1 year and other ID-check data typically for up to 7 years, for its own legal and fraud-prevention reasons. See stripe.com/privacy and Stripe’s guide to managing your ID verification information.

If you can’t or don’t want to do the selfie match, email safety@goodcompanyapp.uk and we’ll arrange another way to verify you.

If you don’t want to verify at all, you can stay on the waitlist, but you won’t be able to post or join plans — verification is what the service is built on.

4. Women-only and men-only plans, and the sex on your ID

When you sign up you can tell us your gender (woman or man); it’s optional, and without it you see mixed plans only. We use it only to run women-only and men-only plans, and it isn’t shown to other members.

After a successful ID check, Stripe tells us the sex shown on your ID document, if the document shows one. We compare it with your answer:

• If they match, or the ID doesn’t show a sex, nothing more happens.
• If they differ, a member of our team reviews it, usually within a day. They bear in mind that documents can be out of date and that a person’s gender may differ from what their ID says. Until they have, women-only and men-only plans, clubs and groups are paused for you (everything mixed carries on as normal; places you already have stay until the review).
• The reviewer either keeps your answer, or updates the gender used for single-sex plans to match your ID. If they update it, we let you know by email, and any places you hold in upcoming women-only or men-only plans that no longer match are cancelled. If you think we got it wrong, email safety@goodcompanyapp.uk and a different person will look again.

How we treat this information. Sex and gender aren’t special-category data under UK GDPR on their own, but they can reveal sensitive things about a person, so we treat them with care: only the small number of staff who review differences can see them, they aren’t shown to other members, and they aren’t used for anything else. Our lawful basis is legitimate interests in safety and in making sure single-sex plans are for the people they’re meant for; we’ve weighed that against your interests, and you can object at privacy@goodcompanyapp.uk. The ID check itself involves biometric data, which is handled with your explicit consent (section 3).

5. Where your data comes from

From you; from your device (location and push token, only if you allow them); and from our verification partner (the result, the date of birth and the sex on your ID, and the name we use to make the one-person-one-account code, as described above). Other members can also give us information about you through ratings and reports, and a member who names you as their trusted contact gives us your name and number.

6. Who we share it with

Other members

Signed-in members can see your profile photo once it has passed our checks. ID-verified members who open a plan you’re in can see who’s going: your first name, photo, verified badge, rating average (once you have at least three ratings) and reliability. The host of a plan you ask to join also sees your passport: your photo, first name, city, the month you joined, bio, interests, rating and attendance record, your three fun answers and the colour you chose. If the host switched on a personality check, they also see your quiz answers and type with your request; on other plans they see your type only if you’ve put it on your passport. Quiz answers sent with a request are cleared from it once the host decides. While you’re both in a plan (as host or going), the other people in it can open your passport too, and so can your friends: they see the same as a host, except quiz answers, and your type only if you’ve put it on your passport. Same time next week groups don’t show passports. Members of a plan see your messages in its chat. Members who haven’t verified their ID yet see only the host’s first name and no photos or member lists. If you join Same time next week, the other people in your group see your first name, photo, verified badge, any conversation cards you wrote, who your arrival buddy is and who came with you as a plus-one; they don’t see your answers to the matching questions or where you live. If you join a club, its members see your name, photo and verified badge in its member list and your messages in its chat; signed-in members nearby can see a club’s name, description, general area, member count and its organiser’s first name. Friends you message see your messages and any photos you send them; nobody else does. Someone you invited is told your first name only if they open the notification we send you. Members and hosts can see your age range (for example 25–29) — not your date of birth. We don’t ask for your home address, and other members aren’t shown your own location. A plan’s exact meeting spot is shown only to its host and to members the host has accepted; everyone else sees the general area, a position rounded to about 1 km, and an approximate distance.

Companies that help us run the service

These providers act on our instructions and may only use data to provide their service to us, except where we say otherwise below.

Maps in the app are drawn by your phone’s own map service (Apple Maps on iPhone, Google Maps on Android), which loads map tiles for the area on screen. When a trusted contact opens your live location, their phone does the same for the area around your position.

Where the law requires, or to keep people safe

We may share information with the police, regulators or courts when legally required, or where it’s necessary to protect someone from serious harm. For disclosures to prevent or detect crime, to safeguard someone or in an emergency, we rely on the recognised legitimate interests in UK GDPR Article 6(1)(ea) (as amended); otherwise on a legal obligation (6(1)(c)) or, where someone’s life is at risk, vital interests (6(1)(d)). We tell you first where we lawfully can.

If we find child sexual exploitation or abuse content, we report it to the National Crime Agency, as the law requires. The report includes the content and the information about the account that the law requires us to send.

We do not sell your personal data and we do not share it with advertisers or sponsors.

7. Reports and information about possible crimes

Reports from members, and what we find when we look into them, can include information about alleged criminal behaviour, such as assault, harassment, threats or fraud. UK GDPR (Article 10) and the Data Protection Act 2018 set extra rules for this kind of information. We handle it under Schedule 1 to that Act: paragraph 10 (preventing or detecting unlawful acts) and paragraph 33 (legal claims). We keep the appropriate policy document that the Act requires for this.

In practice: only our safety team can see it; we use it to keep members safe and to decide what action to take on an account; we keep it for the period in the retention table; and we share it with the police only when the law requires us to, or when it’s needed to protect someone from serious harm. The person you report isn’t told who reported them.

8. If someone named you as their trusted contact

A member can choose up to three people to see where they are while they share their live location at a plan, and to be told if they don’t confirm they got home safely. There are two ways to be someone’s contact.

Trusted contacts with the app

• How it starts: the member sends you an invite code from their own phone. Nothing happens until you sign up (with an email; no ID check or photo) and enter it. You must be 18 or over to have an account.
• What you see: while they share, their latest position on a map, the plan’s name and general area, and when they’re home safe. You never see who they’re with, their chats, or the exact meeting spot. You get a notification when they start sharing and an update every hour, and an alert if they miss their check-in.
• What we hold about you: your account (email, name, date of birth, password hash), the link between you and the member, and whether you opened an alert.
• To stop: in the app, Profile → Settings and safety → Trusted contacts → Stop. The member is told. You can also delete your account.
• Blocking ends it: if either of you blocks the other, the trusted-contact link is removed straight away, both ways, and nobody is told.

An emergency backup number

• What we hold: your name and UK mobile number, as the member gave them to us.
• Your agreement first: when a member adds your number, we text you a 6-digit code and say who is asking. Only if you give them the code (and they enter it) is your number used. If you don’t know them or don’t want to, ignore the text: nothing else is sent unless they ask for another code (at most three a day).
• What we send after that: one text, only if the member misses a safety check-in and none of their trusted contacts opens the alert in the app within 10 minutes. Twilio delivers it for us. We don’t use your number for anything else, and we don’t send marketing.
• How long: until the member removes or changes it, or deletes their account.
• To stop: reply STOP to the text if your network allows replies, or email privacy@goodcompanyapp.uk and we’ll remove your number from the member’s account.

Our lawful basis for processing data about trusted contacts is legitimate interests in keeping members safe (6(1)(f)). You have the same rights over your data as anyone else (see your rights).

9. International transfers

Some of our providers process data outside the UK, mainly in the United States:

• Stripe — ID verification
• Expo — push notifications
• Resend — email
• Twilio — the emergency backup text
• Mapbox — map pictures in live-location notifications (if switched on)
• Google — Cloud Vision photo checks
• Cloudflare — website hosting, email forwarding and bot checks on our forms
• Supabase and Render — our data is stored in London and processed in Frankfurt, but both are US companies whose staff may access it to support us

Where a provider is certified under the UK Extension to the EU–US Data Privacy Framework, we rely on that (the UK government has found it gives adequate protection). Where it isn’t, we use the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with any extra safeguards needed. Ask us at privacy@goodcompanyapp.uk for details or a copy of the safeguards. Our database is in the UK (London) and our servers run in the EU (Frankfurt), which the UK recognises as giving adequate protection.

10. How long we keep it

11. Your rights

Under UK GDPR (and EU GDPR where it applies to you) you can:

• Access a copy of your data — in the app: Profile → Settings and safety → Your data → Download my data. Notes our safety team wrote about you aren’t in the download, because they can identify other people (for example who made a report). Ask privacy@goodcompanyapp.uk and we’ll send them, leaving out details about other people where the law allows.
• Correct anything wrong — in the app: Edit profile.
• Delete your data — in the app: Profile → Settings and safety → Your data → Delete account.
• Restrict or object to how we use it, especially where we rely on legitimate interests.
• Take it with you in a portable format (the download is JSON).
• Withdraw consent at any time, for example for the waitlist, location, notifications or analytics — withdrawing doesn’t affect what we did before.

You can also use the request form. We reply within one month. We may need to confirm it’s you, and some rights are limited where the law lets us keep data (for example to deal with a safety report). You don’t pay to use these rights.

12. Automated decisions

Some decisions are made automatically:

• The ID check result. Whether your ID check passes or fails is decided automatically by Stripe’s systems. Our own rules then apply automatically too: if the ID shows you’re under 18, the account is closed and its details deleted (and we email you to say so); if the same ID already verifies another open account, or belongs to an account we closed, the check is turned down and the app tells you why. In those two cases a person can look at it: email safety@goodcompanyapp.uk.
• Pausing an account. When 3 different verified members who have been in a plan, club or group with the same person report them, their account is paused automatically while a member of our team reviews it; a person makes the final decision. A paused member can still download their data or delete their account.
• Profile photos are checked automatically, and a photo can be refused without a person looking at it; that stops that picture being used, not you, and you can add another.

You can ask for a person to review the ID-check result, an automatic pause or a refused photo: email safety@goodcompanyapp.uk. Matching and notifications are automated too, but they don’t have a legal or similarly significant effect on you. The comparison between your gender answer and your ID doesn’t change anything by itself: a person decides.

13. Children

Good Company is only for people aged 18 or over. We check date of birth at sign-up and by ID. If we learn an account belongs to someone under 18 we close it and delete their data.

14. Security

Passwords are stored only as salted one-way hashes. Traffic is encrypted in transit; access to the database is restricted; sign-in attempts are rate-limited; our moderation console is reached only with a password plus a one-time app code, and every action in it is logged; and because ID images stay with a specialist partner, we don’t hold them. No system is completely secure; if a breach puts you at risk we’ll tell you and the regulator as the law requires.

15. Changes to this policy

If we make a material change we’ll tell members in the app and by email before it takes effect, and update the date above.

16. Contact and complaints

Questions: privacy@goodcompanyapp.uk. Post: the address will appear here once the company is registered. Until then, please use email.

If you’re unhappy with how we’ve handled your personal data, tell us (privacy@goodcompanyapp.uk, or the “Complain about how we handled your data” option on the Your data page). We’ll acknowledge your complaint within 30 days, look into it, and tell you the outcome. You can also complain to the Information Commissioner’s Office (ico.org.uk/make-a-complaint).