Privacy Policy

Information we collect

• Account information: your name, email address, and mobile phone number.
• Face template: a string of numbers that describes your face. We never keep a photograph.
• Passphrase and hint: if you set a passphrase as a proof at the find-my-people door, we keep only a scrambled form of it that we cannot read back. To warn you if a passphrase is already known from a data breach, our servers send a short fragment of a scrambled form of it to the Have I Been Pwned service when you set it, and again later if that check could not be completed. The fragment is too short to identify your passphrase or you. If you also write a hint, we keep the hint in your own words and show it to anyone who enters your phone number or email at that door. Both are replaced each time you set your passphrase again, and deleted when you delete your passphrase or your account.
• Your contacts: the names and phone numbers of the people you designate.
• Conversations when you reach out: when you reach a contact, your note, the last location you chose to share, and what your contact writes back are kept together while that conversation is open, seen only by you and that contact. A conversation stays open for 24 hours from your first text or email. After that no one can open it, and we delete all of it within two days. Writing back creates no account.
• Verification data: one-time codes we send by text message or email to confirm ownership of your phone number or email address when you sign in.
• Usage data: application logs, device information, and privacy-friendly analytics used to operate and improve the service.
• Device identifier: when you use the find-my-people door we set a random identifier on your device so that repeated face-check attempts can be limited per device. It is not linked to any account, phone number or email, and it expires after one day.

How we use information

We use your information to operate the service: sign you in, verify ownership of your phone number or email address, enable face-based identification, deliver messages you initiate to your contacts, and maintain the security and reliability of the platform. We do not sell your personal information.

Face data and identification

To let a face be recognized on a smart device, we create a numeric face template from a live face scan using Amazon Rekognition, a face-analysis service operated by Amazon Web Services. We never keep a photograph: only the face template is stored, for as long as your account is active, because it is needed for identification to work. When you delete your face or your account, we destroy the face template.

When you use a device to identify yourself, we also use Amazon Rekognition Face Liveness, a service operated by Amazon Web Services (AWS), to confirm a live person is present at the moment of the scan. The images captured for that check are used only to complete the scan and are not stored by Herd.

SMS program

Herd uses SMS only for the following:

• Sign-in codes. A one-time verification code, sent to confirm you own a mobile number when you sign up or sign in.
• An introduction to the people you add. When you add someone as one of your people, Herd sends them one text that names you, explains what Herd is and why they are receiving it, tells them how to opt out, and, only if you ask it to when you sign up, says which elephant you made them.
• Messages you start. When you ask Herd to reach one of your people, Herd texts them on your behalf. The text carries a link to a page where they can write back to you and find your location if you choose to share it. A call from Herd may follow.
• Account security notices. An occasional text to your own number when something about the security of your account needs your attention.
• Notices about your access. An occasional text to your own number about your access to Herd, sent only when your account has no email address: when Herd's yearly price begins, shortly before your access ends, when it has ended, and before an account with no access is deleted.

You may reply STOP at any time to opt out of further texts and calls, and HELP for assistance. Message and data rates may apply. Message frequency varies. Most texts are driven by your actions in the app; Herd also sends a few notices about your own account's access, and only when your account has no email address.

SMS opt-in data and consent are not shared with any third parties or affiliates for marketing or promotional purposes. We share phone numbers only with our SMS delivery provider (Twilio) for the sole purpose of delivering the messages described above.

Payments

If you subscribe, you pay on a page run by Stripe, our payment provider. Stripe keeps your card and billing details; Herd never sees or keeps your card number.

Herd keeps this about your payments:

• Stripe's reference numbers for you, your purchase and your subscription.
• Whether your subscription is active, the date it renews or ends, and why it ended.
• The date and amount of your latest payment, and for a payment we couldn't take, the amount due, how many times we have tried and the next try.
• The state of your billing address, recorded with each purchase, because sales tax and some state laws depend on it.
• Your time zone, so that the dates in our messages are your dates.
• When a payment was refunded, or a purchase was refused for a billing address outside the United States, so that the limits on subscribing again in our Terms can apply.
• The email address your notices go to.
• A receipt that you agreed to the renewal terms.

Herd's messages about your subscription and your access go to the email address you entered on Stripe's payment page at your first purchase. A later purchase, or a change made at Stripe, doesn't change that address. If you have never subscribed, they go to the email you confirmed when signing in, or, if your account has no email, by text to your phone.

When you subscribe, Herd keeps a receipt of your agreement to the renewal terms: the version of our Terms and of our billing settings at the time, when you agreed, and Stripe's reference numbers for the purchase. The receipt doesn't name your Herd account. We keep each receipt for 3 years from the day you agreed, or for 1 year after your subscription ends or your account is deleted, whichever is later. A receipt is kept after your account is deleted, as the record of your agreement.

How we share information

We share your information only with the service providers we use to operate Herd, and only to the extent necessary for them to perform their function: Supabase (database, authentication, and file storage), Twilio (text-message delivery), Amazon Web Services (face identification via Amazon Rekognition), Resend (email delivery), Stripe (payments and sales tax), and Vercel (application hosting and performance analytics). When you choose to share your location while reaching a contact, they can see it as a map link for as long as that conversation stays open, as described above. We may disclose information if required by law or to protect the rights, safety, or property of users or others.

Data retention and security

We retain your information for as long as your account is active or as needed to provide the service. If your account has no access to Herd for 90 days, we delete it, as our Terms describe, and we warn you 14 days before. You may delete your account at any time, after which we destroy your face template and delete or anonymize your other personal information.

When an account is deleted, by you or by Herd, Herd keeps only two things:

• A fingerprint of the number. When anyone replies STOP to a Herd text, we delete their contact entries from every herd and keep only a fingerprint of their number, so that Herd never texts or calls it again.
• Payment receipts, for the time stated under Payments.
• Texts sent to Herd's number, with the number they came from, until that number texts STOP or the member whose contact it is deletes their account.

Stripe keeps its own record of your payments, under Stripe's privacy policy.

We use industry-standard safeguards to protect your information. The device identifier used to limit repeated face-check attempts expires after one day.

Your choices

• You can update or delete your profile from your account settings.
• You can opt out of texts and calls at any time by replying STOP.
• You can request access to or deletion of your data by contacting us at the address below.

Children

Herd is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Changes

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the “Last updated” date above.

Contact

Questions or requests regarding this policy can be sent to privacy@goherd.app.