Privacy Policy
SoCal is a social calendar for you and your friends, operated from the United States (“SoCal”, “we”). This policy explains what we collect, how we use it, and the choices you have. Questions or requests anytime: stan@sedberry.co.
The short version: SoCal has no ads, no third-party analytics, and no tracking. We never sell your data or share it with anyone to market to you. We collect only what the product needs to work, and you can delete all of it, in the app, at any time.
What we collect
- Phone number: your account identifier. We send a one-time code to verify it when you sign in. It is never shown to other users.
- Profile: your name, and optionally a photo, a short bio, and your birthday. Your full birth date is stored privately; other users can see at most the month and day, and only if you turn on “show my birthday.”
- Content you create: events (title, description, time, location text you type, an optional photo and link), shared calendars, RSVPs, and invites. SoCal does not collect your device location; an event’s “location” is just text you write.
- Contacts, hashed on your device (optional): if you allow contact access to find friends, phone numbers from your address book are cryptographically hashed (SHA-256) on your phone before anything is sent to us. We never receive names, emails, or raw numbers, and hashes are used only to show you which contacts are on SoCal and to deliver invites you personally choose to send. Hashing is a strong privacy measure, not perfect anonymization. Note that when other users match their contacts, we may receive the hash of your number the same way.
- Push token: if you enable notifications, the device token Apple assigns for delivering them. Notifications are optional and configurable in the app.
- Support email: whatever you send us when you write in.
Some features run entirely on your device: scanning a flyer to pre-fill an event uses on-device text recognition and on-device Apple Intelligence models. Photos you scan are not uploaded for processing.
How we use it
We use the data above only to: operate your account and verify sign-in; show your profile and content to the people described below; match contacts you choose to match; deliver invites and notifications; keep the service secure and prevent abuse; and respond when you contact us. That is the complete list. We don’t repurpose your data for anything else, and we don’t use it to train AI models or share it with third-party AI services.
What other users can see
- Your phone number is never displayed to other users.
- Your profile (name, photo, bio, and opt-in birthday month/day) is visible to other signed-in SoCal users; that’s how attendee lists and member rosters work.
- Events are visible to the members of the calendars they’re on and to people the host invites. RSVPs are visible to whoever can see the event.
- A public eventcan be opened by anyone with its link, and its preview (title, time, host name, photo) appears wherever the link is shared, including in message previews and on the web. A calendar invite link similarly shows the calendar’s name, image, owner, and member count to anyone holding the link.
- Photos are stored on our servers and delivered by link; treat anything you post as visible to the audience you share it with, and remember we can’t control what people you share with do with it outside SoCal.
Service providers
We share data only with the infrastructure that runs SoCal: Supabase (database, storage, and authentication, hosted in the United States), Apple (push notification delivery), and an SMS delivery provider (sends your sign-in code; receives your phone number for that purpose). These providers process data only to provide their service to us, under their data processing agreements, and are required to protect it to at least the standard described in this policy. We do not sell or share personal information with data brokers, advertisers, or analytics companies; there are none in the app.
We may disclose information if required by law, or as needed to protect the safety and integrity of SoCal and its users.
Retention and deletion
We keep your data while your account is active. Read notifications are automatically deleted after 90 days. When you delete your account (Settings → Delete Account, in the app), your profile, events, calendars, photos, RSVPs, invites, contact hashes, and push tokens are removed immediately, and photo links stop working right away; residual copies in encrypted backups age out shortly after. You can also revoke individual permissions anytime: contact access and notifications in iOS Settings, and your birthday, photo, or bio in your profile. For anything else, email us and we’ll handle it.
Your rights
You can view and edit your information directly in the app, and delete it entirely as described above. You can also email stan@sedberry.co to request a copy of your data, corrections, or deletion. We honor these requests for everyone, wherever you live.
If you use SoCal in the EEA or UK: we process data to perform our contract with you (running the service), with your consent (optional profile fields, contact matching, and notifications, all withdrawable anytime), and for our legitimate interests in keeping the service secure. You additionally have the rights of access, rectification, erasure, restriction, portability, and objection, and may lodge a complaint with your local supervisory authority. Data is processed in the United States; our providers rely on Standard Contractual Clauses and EU-U.S. Data Privacy Framework certifications for transfers.
Children
SoCal is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have, we will delete the account and its data. If you believe a child has created an account, contact us.
California & Do Not Track
We do not track you across other apps or websites, no third parties collect personal information across sites through SoCal, and we therefore do not respond to browser “Do Not Track” signals; there is nothing to turn off. We do not sell or share personal information as those terms are defined in California law.
Security
All traffic is encrypted in transit, access to data is enforced row-by-row in our database, sensitive fields like contact hashes and full birth dates are isolated from the general API surface, and raw phone numbers from your address book never leave your device. No service can promise perfect security, but SoCal is built to hold as little as possible in the first place.
Changes
If we make material changes to this policy, we’ll notify you in the app or by prominent notice on this site before they take effect, and update the date at the top.