Together
Privacy Policy
Effective date: 5 September 2026
Together is a private location-sharing and chat app for small circles of friends, published by Ming Zhu (individual developer, “we”, “us”). This policy explains what data the app handles, why, and the controls you have. The short version: your location and messages are only ever visible to the members of your invite-only circle, we run no ads and no third-party analytics, and we never sell your data.
1. Data we collect
| Data | What and why |
|---|---|
| Account | Your email address and a password (stored only as a secure hash), used to create and sign in to your account. |
| Profile | A nickname and, if you choose to add one, a profile photo. Both are visible to members of your circle. |
| Approximate or precise location | Only when you choose to share it. You can use approximate location or precise location, depending on your device permission and the in-app precision setting. For live sharing, your position is streamed to your circle members and a snapshot (latitude, longitude, accuracy, and heading when available) is kept on the server so friends who open the app shortly afterwards can see where you were. While sharing is on, updates continue when the app is in the background so your circle keeps seeing your current position — always with a visible indicator: a persistent notification on Android, the system location indicator on iOS. Live snapshots expire after 15 minutes. Turning live sharing off stops all collection and deletes the snapshot immediately. Live sharing is off by default and never starts without your action. |
| Messages and dropped pins | Chat messages you send to your circle are stored so your circle can read them. If you choose to drop a pin, that message also stores its approximate or precise latitude and longitude and, if you add one, its name. Unlike a live-location snapshot, a dropped pin remains in chat history until you delete it, delete your account, or it is removed by the chat-retention limit described below. You can delete your own text and pin messages at any time. |
| Subscription status | If Together Plus purchasing is available and you subscribe, the purchase itself is handled entirely by Apple's App Store or Google Play — we never receive your payment card or billing details. We keep only your subscription's tier, status (active, grace, expired), store platform, a store transaction reference, and its renewal date, so the app can unlock Plus features for your circles. |
| Safety records | If you block someone or file a report, we store the block, the report reason, and — for message reports — a copy of the reported message so we can review it even if it is later deleted. |
| Notification device ID and preferences | If you enable notifications in the Global app, we associate a random push-registration token with your account, device platform, language, and your message/circle notification choices. The token is used only to deliver notifications you requested; it is not used for analytics, advertising, or tracking across apps. |
| Technical logs | Our infrastructure provider keeps short-lived request logs (such as IP address and timestamps) for security and reliability, as any web service does. We do not use them to profile you. |
2. Who can see your data
Circles are invite-only. Free circles hold up to three people; circles owned by a Together Plus subscriber hold up to eight. Your live location, dropped pins, messages, nickname, and photo are visible only to members of the relevant circle. There is no public profile, no discovery, and no way for strangers to find or follow you. You can see who is in your circle at any time, remove yourself, and (if you created the circle) remove others.
3. What we don't do
- We do not sell or rent your data, and never will.
- We show no ads and use no advertising SDKs.
- We use no third-party analytics and do not track you across apps.
- We do not collect your contacts. Location is collected only during a share you started — that includes while the app is in the background, shown by a persistent notification (Android) or the system location indicator (iOS) — and collection stops the moment you turn sharing off.
4. Service providers
We use the following service providers, acting on our instructions:
- Supabase — hosts our database, authentication, file storage, and realtime messaging. All the data in section 1 is processed and stored on Supabase's cloud infrastructure, which may be located outside your country. Supabase's own commitments are described in its privacy policy and data processing addendum.
- OpenFreeMap — serves the map imagery in the app. When the map loads, your device requests map tiles directly from OpenFreeMap's servers; like any web request, this exposes your IP address and the map area you are viewing to that server. No account data is sent with these requests.
- RevenueCat — if Together Plus purchasing is enabled, processes app-store purchase receipts and tells our server whether your subscription is active. It receives your account's random identifier and store purchase tokens — never your name, email, or payment details. RevenueCat's commitments are described in its privacy policy. Nothing is sent to RevenueCat unless purchasing is enabled and you open the Together Plus screen, buy a subscription, or restore purchases.
- Google Firebase Cloud Messaging and Apple Push Notification service — if you enable notifications in the Global app, route notification text and a random device registration token to your phone. Payloads may identify the relevant circle/message/request so a tap opens the right screen, but they never contain location coordinates or invite codes. Google and Apple process this delivery under their respective privacy terms.
5. How long we keep data
- Location snapshots: at most 15 minutes; deleted immediately when you stop sharing.
- Messages and dropped pins: each circle keeps its most recent 1,000 messages. Dropped-pin coordinates and names are part of those messages and follow the same retention period. Older messages are deleted automatically; your messages are also deleted when you delete them individually or delete your account.
- Profile and account: until you delete your account.
- Safety reports: as long as needed to review and act on them.
- Subscription records: while your subscription is active and afterwards as long as required for accounting; deleted with your account.
- Notification tokens: while notifications are enabled. Turning notifications off or signing out asks our service to unregister the token and invalidates it on the device. Failed or stale tokens are disabled; any retained record is removed when the account is deleted.
- Backups: residual copies in encrypted service backups expire automatically within 30 days.
6. Your controls and rights
- Sharing controls: choose approximate or precise location, start and stop live sharing at any time, and decide each time whether to send a dropped pin; leave a circle at any time; block and report members; delete your own text and pin messages.
- Notification controls: turn push off for the device, separately disable messages or circle activity, and choose whether message text may appear in lock-screen previews.
- Delete your account: in the app (Circle tab → Delete account) or via our deletion page. Deletion is immediate and permanent.
- Export your data: email us and we will provide a copy of your data in a portable format within 30 days.
If you are in the European Economic Area or the United Kingdom, you also have the rights of access, rectification, erasure, restriction, portability, and objection under the GDPR, and the right to complain to your supervisory authority. Our legal bases are performance of a contract (providing the service you signed up for) and legitimate interests (keeping the service safe and secure). If you are a California resident, the CCPA gives you rights to know, delete, and correct; we do not sell or share personal information as the CCPA defines those terms.
To exercise any of these rights, email us at the address below.
7. Children
Together is not directed at children under 13 (or the higher minimum age your country requires), and we do not knowingly collect data from them. If you believe a child is using Together, contact us and we will delete the account.
8. Security
All traffic between the app and our servers is encrypted in transit (TLS). Access to data on the server is enforced per-row by database security policies, so even a signed-in user can only ever read the circles they belong to. Passwords are stored as salted hashes and are never visible to us.
9. Changes to this policy
If we make material changes, we will update this page and note the new effective date above, and — for significant changes — tell you in the app.
10. Contact
Ming Zhu (developer of Together)
Email: ming.life@foxmail.com