Privacy Policy

Last updated 28 October 2026

Thrive is a social app for playing games with people you know and meeting people nearby. Doing that means holding some genuinely personal things about you: where you are, photos you take, recordings of your voice, and what you say to other people.

This policy says exactly what we hold, who can see it, what leaves our systems, and how to get rid of it. It describes the app as it is built, not as a general statement of intent.

What we collect, and why

Your account. An email address and password, handled by our hosting provider (Supabase) — we never see your password. A display name, and optionally a profile photo, date of birth, gender, job title, a short description, your interests, and a phone number.

If you sign in with Google or Apple instead, we receive your name and email address from them, and never a password. Apple lets you hide your email; we then receive a private relay address that forwards to you.

Your profile photo matters more here than in most apps: the Bar / Club game works by showing one guest another guest’s photo so they can find each other in the room. Only people with a photo are ever called into that game.

Your location, if you allow it. Used for three things: finding people and plans near you, showing your own position on the Explore map, and working out the distance between you and someone in Connect.

Photos you take in the app. Profile photos, photos taken during a Photo Challenge, and the shared photo roll for an event.

Voice recordings, if you record a weekly reflection by speaking instead of writing.

Your steps, only while you run a Running Challenge. The app reads your phone’s own step count from when you start (Apple’s motion data on iPhone, Health Connect on Android) and turns it into a distance. Only that distance is sent, to the others in the game; the step count itself stays on your phone.

What you buy. If you subscribe to Thrive+ or buy something in the app, a record of it: which plan or item, when, and whether it is active. Apple or Google take the payment; we never see your card.

What you write. Messages to other people, messages to the in-app coach, your weekly reflections, answers you give in games, quiz questions you write as an organiser, and feedback or reports you send us.

How you use the app. Which games you played and when, your Thrive Score and the events behind it, and your notification preferences. We do not use advertising identifiers and we do not track you across other apps or websites.

Your device’s push token, once you allow notifications, so we can send you one.

An age band from Apple or Google, if your phone can provide one, plus how it was established (whether someone typed it, a guardian set it, or it was checked against an ID or a card). We store the band and that label, not any document. See “Age” below.

Crash reports and a short list of product events, described under “What leaves our systems” below. We do not record your screen.

Who can see what

This is the part worth reading closely, because “we do not share your data” is meaningless in an app whose whole purpose is showing you to other people.

Your exact location is never shown to anyone. It is stored so we can calculate distances, and other people only ever see a rounded distance (“~1.2km”). Your position on the Explore map is drawn on your own device and is never sent anywhere. Your exact coordinates are not readable by your friends, your matches, or anyone else using the app.

Your exact date of birth is never shown to anyone. People browsing Connect see an age, and only if you have chosen to show it.

Your phone number is only ever shared with a friend if you switch on “share my phone number with friends”. With it off, nobody can get it.

Your display name and profile photo are visible to your friends, to people you are connected with, to anyone in a game with you, and to people nearby in Connect if you have made yourself visible there.

Messages are visible to the people in that conversation. Messages to the coach are not visible to any other user.

Photos from an event are visible to everyone who was in that event, and can be saved by them. Photos from a Photo Challenge are visible to the people who played that game.

Weekly reflections, including voice recordings, are private to you. They are never shown to other users.

Notifications we send you say who something is from and what it is about — never the contents of a message, because a notification travels through Apple’s or Google’s servers and sits on a lock screen.

What leaves our systems

Supabase hosts the database, file storage, and the server functions. Everything described above is stored there, on servers in the European Union (Paris). Your profile, your photos, your voice recordings, your messages, your reflections and your location never leave the EU.

Anthropic’s Claude model powers two features: the social coach, and the feedback on your weekly reflection. When you use either, the relevant text is sent to Anthropic’s API in the United States to generate a reply. This is the one place your own writing leaves the EU, and it only happens for those two features — if you never use them, nothing you write is sent abroad. Your voice recordings are not sent: speech is turned into text on your own device, and only the text is used. Anthropic does not train models on data sent through its API.

Expo’s push service, plus Apple and Google, deliver notifications. They receive your device token and the notification text.

Google Workspace sends our emails — the code to confirm your email or reset your password. Google receives your email address and the code.

Apple and Google take every payment in the app. RevenueCat keeps track of which subscriptions and purchases are active, on servers in the United States; it receives a random account id, what you bought and when, and never your name, email or card.

If you sign in with Google or Apple, they confirm who you are to us. That is between you and them under their own terms; we receive only your name, email address and an id.

PostHog hosts our crash reporting and usage analytics, on servers in the European Union. In the UK, the EEA and Switzerland it is switched off until you say yes: nothing reaches PostHog unless you have given permission, which we ask for once and which you can change at any time in Profile → Privacy.

If you allow it, PostHog receives crash and error reports — the error and its technical trace, which screen you were on, your app version, your platform and OS version — plus which screens you open as you move around the app. It identifies your device by a random id its own library generates. It does not receive your account id, your name, your email, your messages, your reflections, your photos or your location.

We do not record your screen. Thrive has no session-replay or screen-recording feature of any kind. If that ever changes we will say so here before it is switched on.

Separately, and whether or not you allow PostHog, we keep our own crash log and a short list of product events in our own database: a game started or finished, a session created or joined, onboarding completed, the content rating changed, the paywall opened. These never leave Supabase and are never sent to PostHog or anyone else. They are how we tell a quiet launch from a broken one, and they are why refusing PostHog costs you nothing.

That is the complete list. We do not sell your data, we do not share it with advertisers, and there is no advertising SDK in the app — PostHog is used for crash reporting and usage analytics only, never for advertising or tracking you across other apps.

In short, on where your data lives: everything personal stays in the EU. The database and file storage are in Paris, and analytics is in the EU too. The exceptions are in the United States: Anthropic, only for the social coach and weekly reflection feedback, and RevenueCat, only for the record of what you bought. Where we do send data to the United States we rely on the contractual safeguards that law requires for such transfers.

Keeping it, and deleting it

We keep your information while your account exists.

You can delete your account from Profile → Settings. It is a real deletion, not a deactivation: your profile, messages, matches, photos, recordings, reflections, scores and game history are all removed. Some things necessarily survive in a form that is no longer about you — a message you sent stays in the other person’s conversation, and a photo added to an event roll stays with that event.

A report you make about someone may be kept after your account is gone, because deleting an account should not erase a safety record.

If we ban an account for fraud we have to tell the people it had been messaging, and we do. That notice, and the record that it was sent and when, is kept for three years — it is the evidence a duty was performed, so it outlives the account it is about.

Where we ban an account for something other than fraud, we keep a short list of who it had been messaging, in case a fraud finding follows later. Banning an account destroys its conversations, so that list cannot be reconstructed afterwards — it is why we take it at the time. It holds no messages, only who was talking to whom, and it is deleted after 90 days.

Your choices

Location, photos, microphone, camera and notifications are all permissions you grant, and can withdraw at any time in your phone’s settings. The app keeps working without them; the features that need them stop.

You can hide yourself from Connect entirely, set how far away people can find you, choose whether your age is shown, and turn off each kind of notification separately.

You can block or report anyone. Blocking stops all contact, including notifications, in both directions.

You can see and change everything we hold about you in the app, and export or correct it by writing to us.

Age

Thrive is for adults only. You must be 18 or over, and we check twice: sign-up asks for your date of birth and refuses an account under 18, and we also ask your phone — Apple or Google — which age band your account is in. We receive a band and how it was established, never your identity documents, and we never see a date of birth from them. If your phone reports the account as under 18 we will not let sign-up finish, whatever was typed. If your phone cannot answer — an older operating system, no account signed in, or you decline — you can still sign up on the date of birth you gave, and we record that the check was not available.

Because every user is an adult, the two content levels a host can pick — Easygoing and Spicy — describe how spicy the game prompts get, not who is allowed to play. Connect will not match anyone whose age we do not hold on record. We do not knowingly collect anything from children. If you believe a child is using Thrive, write to us and we will remove the account.

Security, and its limits

Data is encrypted in transit and at rest by our hosting provider. Access to your information is enforced in the database itself, per row and per column, rather than only in the app — so a bug in a screen cannot expose something the rules do not allow.

Private photos and voice recordings are stored in private buckets and reached through short-lived signed links. Profile photos are stored in a public bucket, because they have to load for the people allowed to see you.

No system is perfect. If we discover a breach affecting you, we will tell you.

Changes, and getting in touch

We will update this policy when the app changes, and the date at the top will change with it. Material changes will be shown to you in the app rather than quietly published.

Questions, requests, or anything you think this policy gets wrong: management@dineri.info.