Privacy Policy
Squad helps a friend group plan trips, split expenses and keep photos in one place. This page explains, in plain language, what we collect to make that work, who can see it, and how to delete it.
The short version. We collect what you type and upload into Squad, and nothing else. We don't sell your data, show ads, or track you across other apps. The app never asks for your device's location. You can delete your account and data from inside the app at any time.
1. Who we are
Squad is run by Omar Almahayni ("we", "us"). For anything in this policy, contact us at support@steel-gate.com.
2. What we collect
What you give us
- Your account: your email address, a password (stored only as a one-way hash, so we can't read it), and the display name you choose. A profile photo is optional. If you choose to sign in with Apple or Google, we receive the email address and name they share with us.
- Payment details (optional): the PayPal, Venmo or Revolut username, and the bank account name and IBAN, you choose to add so friends can pay you back. Squad only shows them to the person paying you, or puts them in a payment request you send. We never ask for card details or your bank login.
- Your squads: squad names, invite codes, the nickname, role label and short note you set for yourself in a squad, and the names of people you add as placeholders before they've joined.
- Trips and plans: trip names, dates, destinations (picked from a search), budgets, itinerary items, notes, links you paste, and who's going.
- Ideas: the ideas you post, their images, links, places and prices, and your votes.
- Expenses: what was bought, the amount and currency, who paid, how it was split, and repayments you record, plus a photo of the receipt if you add one. Squad only keeps track of who owes whom. No money moves through Squad, and we never ask for card details or your bank login. Each item shows who added it and who last edited it. A trip can also keep a pot (who holds the cash, in what currency, and what each person was asked to put in).
- Pay links for friends who aren't on Squad: if you add a friend as a placeholder, any member of the squad can share a secret link with them. Anyone who has the link can see what that placeholder owes and the payment details (PayPal, Venmo or Revolut name, or bank name and IBAN) of the people they owe, and nothing else about the squad. The link stops working once a real person takes the placeholder's place.
- Photos and videos: anything you add to a squad's shared gallery, with any caption, plus cover photos you choose for a squad or trip.
- Your location, only if you share it: on a trip you can choose to share your live location with your squad for a set time (2, 6 or 12 hours, or the rest of the trip). While it's on, Squad sends your current position, including while the app is in the background, so your squad can see you on the trip map. Only your latest position is kept, never a history of where you've been. Stopping sharing deletes it; when the time you picked runs out, it stops updating and isn't shown any more.
- Safety messages: if you send an SOS or "I'm back safe" message to your squad, it includes your position at that moment, when you've allowed location access.
What we collect automatically
- A sign-in session, so you stay signed in on your device.
- If you turn on notifications, a token that identifies your device to the notification service.
- Standard server logs (such as IP address and time of request) kept by the services that run Squad, for security and reliability.
- Crash reports: if the app crashes or hits an error, a report of what went wrong: the technical error, the screen you were on, your device model, system and app version, and your account ID. Never your name, email, amounts or anything you typed.
- Usage data: counts of what's used, such as "trip created", "expense added" or "invite shared", with your account ID, your squad's ID and your device model, system and app version. Never your name, email, amounts, anything you typed, or your location. You can turn this off in Settings → Usage data.
What we don't collect
- Your location, unless you share it as described above. The trip map can show where you are, but that stays on your phone. A trip's destination is just a place you pick from a search.
- Your contacts, or an advertising identifier.
- Advertising or tracking data. Squad has no advertising software and doesn't follow you across other apps or websites.
Camera, photos, microphone and location
The app asks for these only when you use a feature that needs them, such as adding a photo or video to your squad's gallery. Nothing leaves your device until you choose to add it.
Location is asked for when you use the trip map, start sharing your location, or send a safety message. Background location ("Always") is only needed for live sharing, and only used while a share is on. You can stop sharing in the app, or turn location off for Squad in your phone's settings, at any time.
3. How we use it
- To run Squad: show your squad its trips, ideas, expenses and photos, and work out who owes whom.
- To keep your account secure, and to send the emails needed to sign in or reset a password.
- To send notifications, only if you've turned them on.
- To fix problems and keep the service reliable, using crash reports.
- To learn which parts of Squad are used and which aren't, using usage data (unless you turn it off).
- To follow the law when we have to.
We don't sell your personal data, use it for advertising, or build profiles of you.
4. Who can see it
Your squad
Squad is built for sharing with a group. Everything you put into a squad (expenses, trips, ideas, photos) can be seen by that squad's members, and members can see your display name, profile photo and any payment details you add (including a bank account name and IBAN). People in one of your squads can also see that you're in it. Your content is not visible to people outside your squads.
Anyone who has a squad's invite link or code can see the squad's name and how many people are in it, so they know what they're joining. They can't see anything else until they join.
Services that help us run Squad
We use these providers to operate the app. Each only receives what it needs for the job described here.
| Service | What it does | What it receives |
|---|---|---|
| Supabase | Hosts our database, sign-in and file storage. | Everything described in section 2. |
| Cloudflare | Serves this website and invite pages. | Standard web request data (such as IP address). |
| Resend | Sends sign-in and password-reset emails. | Your email address and the message. |
| Expo | Delivers push notifications, if you turn them on. | Your device's notification token and the notification text. |
| Unsplash | Finds destination photos you can use as a trip cover. | The destination you searched for (sent by our server, not linked to your account). |
| Open-Meteo | Destination search and weather. | The place you typed or picked. Their servers see your device's IP address. |
| Frankfurter | Currency exchange rates. | Currency codes only. Their servers see your device's IP address. |
| OpenRouter | Reads a receipt when you tap "Scan receipt", so its items can be split, and looks places up when you tap "Find places" (a web search by an AI model). | The receipt photo, or the destination plus what you picked or typed for Find places, sent by our server. OpenRouter passes it to the AI model that reads it. Not your name or account. Turn both off in Settings → AI features. |
| Google (Places) | Fills in the name and photo when you paste a Google Maps link. | The place name from the link you pasted. |
| Sites you link to | When you paste a link, our server fetches that page to show a title and picture. | The link you pasted. |
| Apple Maps / Google Maps | Draw the trip map (Apple Maps on iPhone, Google Maps on Android). | Map requests for the area on screen. Their servers see your device's IP address. |
| Sentry | Collects crash reports so we can find and fix bugs. | The crash reports described in section 2. |
| PostHog (EU) | Counts how the app's features are used. | The usage data described in section 2, unless you turn it off. |
| Apple / Google sign-in | Only if you choose to sign in that way. | Their standard sign-in exchange. |
We may also disclose information if the law requires it, or to protect people's safety or our rights. If our business is ever sold or merged, your information may move to the new owner under this same policy.
5. Where it's kept, and for how long
Your data is stored with Supabase in the European Union (Frankfurt, Germany). We keep it for as long as your account exists. When you delete your account we remove your personal data as described in the next section. Copies in the provider's backups disappear on its normal backup schedule.
Crash reports and usage data are kept by Sentry and PostHog for their standard retention periods, then deleted automatically. They carry your account ID, never your name or email.
Some of the providers above are based in other countries, so your information may be processed outside the country where you live. Where the law requires it, we rely on recognised safeguards for those transfers.
6. Deleting your account and data
Open Settings → Delete account in the app. There's more detail, and a way to ask us to do it if you can't use the app, on our account deletion page. In short:
- Deleted: your profile, name and photo, payment details, your sign-in, your votes and RSVPs, your notification settings, your shared location and your safety messages.
- Squads where you're the only person are deleted, including their trips, expenses and photos.
- Things you added to squads that other people are still in (ideas, trips, photos) stay, with your name removed, because they're part of the group's shared record.
- Expenses stay and show your part as "Former member". Other people's balances depend on them, and changing them would make everyone else's numbers wrong. Nothing in them identifies you.
7. Your rights
Depending on where you live (for example the EU, the UK or California), you may have the right to see the personal data we hold about you, correct it, get a copy, delete it, or object to how we use it. You can correct your name and photo in Settings and delete your account there too. For anything else, email support@steel-gate.com from the address on your account and we'll reply within 30 days. You can also complain to your local data protection authority.
We don't sell or share personal information for advertising.
8. Children
Squad isn't meant for children under 13 (or under the minimum age for online services in your country if that's higher). We don't knowingly collect their data. If you think a child has an account, tell us and we'll delete it.
9. Security
Data is encrypted in transit, and each squad's data can only be read by that squad's members. No system is perfectly secure, so please use a strong, unique password.
10. Changes
If we change this policy in a way that matters, we'll update the date above and tell you in the app or by email before it takes effect.
11. Contact
Omar Almahayni · support@steel-gate.com