Who we are
Joolo is an iOS app and website operated by its founding team, who are based in California, under the name Joolo (“Joolo,” “we,” “us”). Joolo is not yet incorporated. When it is, this page will name the company.
Until then, for the purposes of the GDPR, the members of Joolo’s founding team who decide what the app collects are joint data controllers for the information described here. If you want to know exactly who we are, email us and we will tell you. We are named people, not a faceless company, and we are not hiding from anyone who asks.
You can reach us at joolo.app@gmail.com. Joolo runs entirely online, so email is how you reach a person about anything on this page, including a request to see or delete your data.
This policy covers the Joolo iOS app and the joolo.app website, including the waitlist form and invite links.
The short version
- We collect what the app needs to work: your account, your profile, your groups, and the plans you make in them.
- We do not sell your data. We do not share it for advertising. There are no third-party trackers, analytics SDKs, or ad networks in the app.
- Anything you put into a group is visible to everyone in that group. That is the point of a group, and it is not reversible by us.
- Your saved places (like your home address) are private to you and are never shown to your group.
- Your calendar is read on your phone. Raw events never leave it.
- You can delete your account yourself, from inside the app, at any time.
- You can ask for a copy of your data by emailing joolo.app@gmail.com.
What we collect
Almost everything below is information you type into the app yourself. We do not buy data about you, and we do not build a profile of you from anywhere outside Joolo.
| Category | What that means | Source |
|---|---|---|
| Account | Your email address, and a password stored only as a salted hash. If you use Sign in with Apple or Sign in with Google, we get an account identifier and the email address that provider gives us instead of a password. | You, or Apple / Google |
| Profile | Display name, and optionally an avatar photo, avatar colour, bio, pronouns, cover banner, and the four places you pin to your profile. | You |
| Groups | Group name, group type (couple, friends, family, solo), who is in it, each member’s role, and when they joined. Group banner photos. | You and your group |
| Invites | Invite codes and invite links you generate, who created them, who used them, and when they expired. We also log failed join attempts so that codes cannot be brute-forced. | You |
| Plans | Plan title, date, start time, time zone, status, and the trip settings you set for splitting fuel cost (vehicle efficiency, fuel price, number of people). | You and your group |
| Stops | For each stop on a plan: title, type, place name, address, latitude and longitude, how long you are staying, your notes, your ordering, pinned times, travel mode, and the driving time to the next stop. | You and your group |
| Running a plan | Which stops you marked done or skipped and when, which drive you are currently on, and, per person, when you arrived at a leg and how late that was. | You and your group, as you use the app |
| Live Activities | If you start a plan with Live Activities on, a token per running plan and a per-device token, so the Lock Screen card can be updated and started remotely. They carry no content of their own. | Your device |
| Memories | Journal entries you write about a plan and any rating you give it. Photos you upload, their captions, and the date each photo was taken. | You |
| Saved places | Places you save for yourself, such as Home: a label, a name, an address, and coordinates. See the callout below. | You |
| Vehicles & fuel | Vehicles you save (a name and a miles-per-gallon figure) and the fuel price you set, used to estimate the cost of a trip. | You |
| Picking a day | Date boards: the days someone proposes, and each member’s vote on whether a morning, afternoon, or evening works. Separately, the days your phone judged open, which only you can read. See the callout below. | You and your group; your calendar, if you allow it |
| Place interactions | When a place is picked, skipped, swapped, backed out of, or rated, we record the place name, category, coordinates, and which of those happened, against your group. This is what lets the app learn that your group likes sushi. | Your group, as you use the app |
| Usage events | A small set of named events about the core loop, such as a plan being created or a day being started, tied to your account and group. We use these to work out which features people actually use. | Automatic, as you use the app |
| Notifications | Your notification preferences, and an Apple Push Notification token for each device you are signed in on, so that we can send the notifications you have not turned off. | You and your device |
Saved places are private
Your saved places, including your home address and its coordinates, are readable and writable only by you. This is enforced in the database itself, not just in the app: no other account, including other members of your groups, has any permission to read those rows. When Joolo shows you a “leave by” time based on where you live, your group sees their own version of that row, never yours.
Your calendar stays on your phone
If you let Joolo read your calendar, the scan happens entirely on your device. The app reads your events, works out whether each morning, afternoon, and evening in the date window is free or busy, and sends only that free-or-busy answer to our server. Event titles, attendees, locations, notes, and times never leave your phone and are never stored by us. Joolo only ever reads your calendar; it never writes an event to it.
Even that free-or-busy answer is private to you. Your group cannot read it. On the group’s free-days strip they see only how many people are open on a given day, as a count, never who. Those answers also go stale on purpose: anything your phone last reported more than seven days ago stops counting toward that total.
Recent places stay on your phone
The “Recent” places that resurface when you search for a stop are kept in your phone’s own storage. They are not sent to our servers and nobody else can see them. They go away when you delete the app.
The website
If you join the waitlist at joolo.app, we store the email address and name you enter and whether you confirmed it. If you fill in the survey, we store your answers. Our host, Cloudflare, keeps standard request logs, which include IP addresses, for its own security and abuse-prevention purposes. The site does not set advertising cookies and does not run a third-party analytics script.
Phone permissions
iOS asks before Joolo can use any of these, and you can withdraw any of them at any time in Settings › Joolo. The app still works without them; you just lose the feature attached to each one.
| Permission | What Joolo does with it |
|---|---|
| Calendar | Reads your events on-device to suggest which days are open for a plan. Only free-or-busy results leave the phone, as described above. Joolo never adds, edits, or deletes anything in your calendar. |
| Location (while using) | Suggests a starting point for a plan and sorts nearby results when you search for a place. We do not track you in the background and we do not store a history of where you have been. |
| Camera | Takes a photo to use as a group banner. |
| Photos (add only) | Saves photos from a plan into your own camera roll. This is add-only access: Joolo cannot read your photo library through it. |
| Notifications | Sends plan reminders, changes from your group, and the notifications you have left switched on. |
Why we use it
If you are in the UK or the European Economic Area, the GDPR requires us to name a legal basis for each use. Here they are.
| What we do | Legal basis |
|---|---|
| Run your account, your groups, and your plans | Performance of a contract: this is the service you signed up for. |
| Send notifications about your plans, and show a Live Activity while a plan is running | Performance of a contract, and your consent through the iOS notification prompt. You can switch each type off in the app. |
| Read your calendar, use your location, use your camera | Your consent, given through the iOS permission prompt and withdrawable at any time. |
| Suggest places based on what your group has liked before | Our legitimate interest in making the app useful. You can ask us to stop. |
| Count feature usage to decide what to build | Our legitimate interest in improving a product we are still building. |
| Rate-limit invite codes and keep accounts secure | Our legitimate interest in preventing abuse of the service. |
| Answer a legal request or defend a legal claim | Compliance with a legal obligation, or our legitimate interest in defending ourselves. |
We do not make any decision about you by purely automated means that has a legal or similarly significant effect.
Who can see what
Joolo is built around groups, so the honest answer is: your group sees a lot, and that is deliberate. Specifically:
- Everyone in a group can see that group’s plans, every stop on them including addresses and coordinates, the notes on those stops, the journal entries and photos attached to them, and each member’s profile.
- Everyone in a group can edit that group’s plans and stops. Joolo is a shared planner, not a set of private documents.
- Only you can see your saved places, your vehicles and fuel price, your notification preferences, and the open days your phone worked out from your calendar.
- Nobody outside your groups can see any of it. Access is enforced by row-level security rules in the database, so it holds even if the app has a bug.
When you leave a group, you stop being able to see it. Content you contributed (a stop you added, a photo you uploaded) stays with the group, because the rest of the group’s record of that day would otherwise fall apart. If you want that content removed too, email us. When the last member leaves a group, the group and everything in it is deleted automatically.
How long we keep it
- Account, profile, plans, and memories: until you delete your account, or until the group they live in is deleted.
- Groups: deleted automatically, along with all of their plans, stops, entries, and photos, as soon as the last member leaves.
- Invite codes: typed codes expire one hour after they are created. Invite links last until someone resets them. Failed join attempts are kept briefly for rate limiting.
- Push tokens: kept while a device is signed in, and deleted when Apple tells us the token is dead. A Live Activity’s own token is deleted when that plan’s card ends.
- Open days from your calendar: overwritten each time your phone rescans, and ignored by the group’s free-days count once they are more than seven days old.
- Photos: when a photo is deleted from a plan, the underlying file is removed from storage by an automatic cleanup job.
- Usage and place-interaction events: kept while the group exists, and deleted with it.
- Waitlist emails: until we launch and email you, or until you ask us to remove you.
Deleted rows may sit in encrypted database backups for up to 30 days before those backups roll over.
Your rights
Wherever you live, you can ask us to:
- Give you a copy of the data we hold about you, in a portable format.
- Correct anything that is wrong.
- Delete your account and the data attached to it.
- Restrict or object to a particular use, including the personalisation and usage counting described above.
- Withdraw consent for calendar, location, camera, or notifications, at any time, in iOS Settings.
Email joolo.app@gmail.com and we will act on it. We aim to respond within 30 days, which is the window the GDPR gives us; California requests get the 45 days the CCPA allows. We will not charge you, and we will not treat you differently for asking.
What deleting your account does
You can delete your account yourself, in the app, under Profile › Settings › Delete account. It asks you to confirm, and then it happens straight away. You do not need to email anyone to do it.
Deleting your account removes your profile, your saved places, your vehicles and settings, your journal entries, your notification preferences and push tokens, and your membership of every group. Groups you were the last member of are deleted entirely, along with their plans, stops, entries, and photos.
Content you added to a group that other people are still in (a stop on a shared plan, a photo in a shared memory) stays with that group by default, because removing it would tear a hole in someone else’s record of the day. Your name comes off it. Email us if you want that content removed as well, and we will do it.
One thing survives in de-identified form: the usage events described in section 3. When your account goes, the link between those events and you is severed, so what remains is a record that something happened in a group, with nothing pointing back to you. Those rows are deleted when the group is. If you would rather they went immediately, say so and we will delete them.
If you are in the UK or the EEA and you think we have handled your data badly, you have the right to complain to your national data protection authority. We would rather you told us first, but that right stands either way.
California residents
The California Consumer Privacy Act, as amended by the CPRA, gives you some specific rights. In the last twelve months, Joolo has collected the categories of personal information described in section 3 above, which map to the CCPA’s categories of identifiers, personal information under Cal. Civ. Code § 1798.80, commercial information, geolocation data, internet activity, sensory data (photos), and inferences drawn from your group’s place preferences. We collect them from you, from your group, and from your device, for the purposes in section 5.
We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the last twelve months. We do not do either of those things at all. Because we never sell or share in that sense, there is no “Do Not Sell or Share My Personal Information” link to give you. We do not knowingly sell or share the personal information of anyone under 16.
You may request to know, delete, or correct your personal information, and to receive it in a portable form, by emailing joolo.app@gmail.com, or by deleting your account in the app. We will verify an emailed request by confirming you control the email address on the account. An authorised agent may make a request on your behalf with written permission from you.
Home addresses and precise coordinates count as sensitive personal information under the CPRA. We use them only to provide the features you asked for: working out when you need to leave, and where a plan starts. We do not use or disclose sensitive personal information for any purpose that would trigger a right to limit that use.
Security
Traffic between the app and our servers is encrypted with TLS. Data at rest is encrypted by our host. Passwords are stored as salted hashes, and we never see your plaintext password, not even when you set it.
Access to your data is controlled by row-level security policies in the database, which means the rules about who can read what are enforced by Postgres itself rather than by app code that could have a bug in it. Private data such as saved places and calendar open-days has no group-read policy at all, by design.
No system is perfectly secure. If we ever discover a breach that puts you at risk, we will tell you and the relevant regulator, without undue delay.
Children
Joolo is for people aged 13 and over. We do not knowingly collect information from anyone under 13. If you are a parent or guardian and you believe your child has made an account, email joolo.app@gmail.com and we will delete it.
Some countries in the EEA set the age of consent for online services higher than 13, at up to 16. If you live in one of those countries and you are under the local age, please use Joolo only with your parent’s or guardian’s permission.
Where your data lives
Our database and file storage are hosted by Supabase in Northern California, in the United States. Our website is served by Cloudflare’s global network. If you use Joolo from outside the United States, your information is transferred there and processed there.
For transfers out of the UK or the EEA, we rely on the European Commission’s Standard Contractual Clauses, and the UK Addendum where it applies, which our hosting providers enter into with us. United States privacy law does not give you all the protections that UK and EU law does; the clauses exist to close that gap contractually.
Changes
We will update this page when the app changes. The “last updated” date at the top always reflects the current version. If a change materially affects how we use your information, we will tell you in the app or by email before it takes effect, rather than quietly editing this page.
Contact
Questions, requests, or complaints: joolo.app@gmail.com.
A real person reads that address. If you are asking us to export or delete your data, say so in the subject line and send it from the address on your account, so we can act on it faster.