Privacy Policy
Last updated: May 26, 2026
This Privacy Policy explains what data we collect, how we use it, and your rights.
What we collect
- Account info — email, password (hashed), display name.
- Profile data — optional avatar photo, Interac email/phone/name if you choose to add them.
- Event content — events you create, RSVPs, chat messages, photos, expense entries.
- Friend connections — accepted friend lists.
- Usage data — IP address, browser type, pages visited (server logs only; we don't use third-party analytics).
- Device push tokens — only if you enable notifications.
How we use it
- To operate the service (your events, friends, balances need to be persisted).
- To send transactional emails (invites, updates, bill reminders).
- To enforce security and detect abuse.
We do not sell or share your personal information for cross-context behavioral advertising.We do not show ads. California residents have the right under the CCPA to opt out of the sale or sharing of personal information; since we don't engage in either, no opt-out is needed — but you can still email us with any privacy request.
Who can see your data
- Other members of your events / groups see what you post there (messages, photos, RSVPs, expenses).
- Friends you've added can see your display name and avatar.
- Your Interac info is only shown to people who share a group or event with you, so they can pay you.
- Grouplit staff may access data when required to operate or troubleshoot the service.
Third-party services we rely on
- Supabase — hosting, database, authentication, storage. Data resides in their managed infrastructure.
- Resend — email delivery.
- Vercel — web hosting.
- OpenStreetMap (Nominatim) — location autocomplete (we don't share your account data).
- Tenor — GIF search (search queries only, no personal info).
Your rights
- Access / export — request a copy of your data by emailing support@grouplit.app.
- Correct — edit your profile and content directly in-app.
- Delete — request account deletion (we'll remove your personal data within 30 days; content you posted in shared groups may remain visible to other members as part of the group's history).
- Unsubscribe from email — every email has a one-click link.
Children
Grouplit is not for children under 13. We don't knowingly collect data from anyone under 13. If you believe a child has signed up, email us and we'll delete the account.
Security
We use industry-standard practices (HTTPS, encrypted databases, scoped access policies). No system is 100% secure — if we discover a breach affecting your data, we'll notify you and any required regulators.
Changes
Material changes will be announced 14 days in advance via email and in-app.
Contact
Privacy questions: support@grouplit.app.