Together Privacy Policy

1. Who operates Together

Together is currently operated by a private individual and is not yet incorporated as a company. For privacy questions or requests, contact us at support@join-together.com.

2. Information Together handles

The information Together handles depends on the features you use and the choices you make.

Account information

When you sign in, Together receives account details made available by the authentication provider, such as your name, email address, profile image, and provider account identifier. Together uses this information to create and secure your Together account.

Together content

Together may handle information that you choose to create or share, including your profile, moods, events, Loops, relationships, invitations, availability settings, and messages or conversation metadata when you use messaging features.

External calendars

You can choose to connect an external calendar from Settings. Together requests read-only access and uses the connection to show availability alongside Together events.

• Google Calendar uses the calendar.readonly permission and limited account identity information to show the connected account label.
• Microsoft / Outlook uses delegated Calendars.Read and User.Read permissions.
• iCloud uses the Apple ID email and app-specific password that you enter for the iCloud connection.

Imported calendar entries are read-only availability blocks. Together does not create, edit, delete, or write events back to Google, Microsoft, iCloud, or device calendars.

Contacts

If you grant contact permission and choose a person for a Together conversation, the app uses the selected contact information on your device. Together does not upload your entire address book. You can separately opt into contact matching; that feature sends only bounded, versioned cryptographic fingerprints of normalized phone numbers, never contact names, raw numbers, or the address book. Matching can be disabled and its server-side matching state cleared from Settings.

Account identity and messaging providers

Together keeps a provider-neutral account identity separate from messaging providers. A successfully confirmed WhatsApp link may attest a phone identity on the service boundary, but WhatsApp identifiers, Matrix identifiers, provider conversation identifiers, and bridge credentials are not sent to the mobile app. Disconnecting WhatsApp revokes that provider connection without deleting the Together identity.

Location

Together uses location only when you enable a location feature, such as tapping the location button or opting into proximity suggestions. Together does not silently track your location in the background.

Technical information

Together and its hosting, authentication, and security providers may process technical information needed to operate and protect the service, such as IP address, device or browser information, request timestamps, error details, and security logs.

3. How Together uses information

• To provide Together accounts, profiles, events, maps, and calendars.
• To show read-only availability from calendars you connect.
• To provide conversations, Loops, invitations, and notifications you request.
• To authenticate accounts, prevent abuse, troubleshoot failures, and protect the service.
• To respond to support, privacy, and account-deletion requests.
• To comply with applicable law and enforce the service’s safety requirements.

4. Third-party services

Together uses third-party services to provide selected features. These services receive only the information needed for the feature you use and operate under their own privacy policies.

• Clerk provides Together account authentication.
• Google Calendar and Microsoft Graph provide calendar data when you authorize those connections.
• Apple iCloud CalDAV provides iCloud calendar discovery and entries when you connect iCloud.
• Google Maps Platform provides map and place features when you use them.
• Hosting, infrastructure, and messaging providers support the Together service and conversations you initiate.

Together does not sell personal information and does not use connected calendar content for advertising.

5. Credentials and security

Google and Microsoft passwords are entered only on the provider’s hosted sign-in page. Together does not ask for, receive, or store those passwords.

Google and Microsoft authorization uses authorization code flow with PKCE. Access and refresh credentials for connected calendars are stored only in the device’s secure storage and are scoped to the signed-in Together account. iCloud calendar credentials are also stored in secure device storage. Provider credentials, authorization codes, and client secrets are not intentionally written to ordinary app storage or application logs.

No method of transmission or storage is completely secure. Together uses reasonable technical and organizational measures for the service’s current stage, but cannot guarantee absolute security.

6. Retention and deletion

Together retains account and content information for as long as needed to provide the service, maintain security, resolve disputes, and meet legal obligations. Retention can vary by feature and third-party provider.

• Disconnecting a calendar removes its stored provider credentials from the device and stops Together from loading that source.
• Disabling a calendar source hides it from availability views without deleting Together events.
• Disabling contact matching revokes the active phone claims used for matching and clears provider attestations tied to those claims. The canonical Together account identity is retained.
• Disconnecting WhatsApp removes its provider access and mappings. It does not delete a canonical Together identity or native messaging relationships.
• Revoking access at Google or Microsoft prevents future access; Together may need to clear the local connection when the next calendar request detects the revocation.
• You can request deletion of your Together account and associated data by contacting support@join-together.com.

7. Your choices and privacy rights

You can choose whether to connect calendars, grant contacts or location permissions, enable proximity suggestions, opt into hashed contact matching, and show each connected calendar in availability views. You can also revoke Google, Microsoft, Apple, or WhatsApp access from the relevant provider’s account settings.

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal information, and to receive a portable copy of information you provided. Contact us at support@join-together.com to make a request. We may need to verify the request before acting.

8. International processing

Together and its service providers may process information in countries other than the country where you live. Where required, applicable providers use legally recognized safeguards for international transfers.

9. Changes to this policy

We may update this policy when Together’s features, providers, or legal obligations change. The effective date at the top of this page will show when the current version took effect. If a change is material, Together will provide additional notice where appropriate.