Privacy.

The short version.

333 helps friends choose places and make plans. Your friends see travel estimates, not your starting coordinates. We do not provide live friend tracking or record a location trail. Personal saves are private until you share them. Shared lists and place pages can be public. We do not sell personal data or use it for advertising.

Account and activity.

We collect your phone number for sign-in, birth year for age eligibility, username, name, and an optional profile photo. Firebase processes the phone number for verification. Our account database stores a salted phone hash, the last four digits, and a keyed value used only for contact matching. We do not store your full phone number in your account record.

We store friendships, group memberships, invitations, saved places, lists, visits you confirm, preferences, plans, and responses. Technical usage and error information helps us operate and improve the app.

Taste setup stores your chosen area, interests, food and drink preferences, atmosphere, price level, discovery preference, explicit exclusions, favorite places, and setup progress. Your chosen area is discovery context, not a precise device location. You can edit these answers. They are included in your data export and deleted with your account.

If you allow notifications, we send plan updates and RSVP changes, plan reminders, leave-by and getting-home alerts, start requests, friend and crew notices, matches between your saves and friends’ saves, replies to recommendation requests, and rhythm drafts. Plan, day-of, rhythm, and social alerts each have their own setting in Profile. Rhythm drafts are suggestions for you to review. They are not sent automatically.

Location for planning.

Location is requested in context, while you use the app, to find nearby places or estimate travel for an outing. You can decline location and still browse and save places. You can change permission in iOS Settings.

For a plan, each participant shares their own current starting location and travel mode. A starting location is fresh for 15 minutes. Precise starting coordinates are held in temporary Cloudflare Durable Object storage for the planning session, and are deleted once they are 15 minutes old. They are not stored in our durable database and do not appear on public pages. The plan keeps the travel time, the travel mode, and whether each person’s travel is ready or pending. Starting coordinates are sent to routing providers to calculate those travel times.

A missing starting location never blocks publishing. That person’s travel time stays pending until they share one. Friends see each person’s travel time and whether it is ready or pending. Estimates describe travel from current starting locations. They do not predict where someone will be later. Choosing “Visited” records a place you selected, not a tracked journey.

Saves, lists, and sharing.

Personal saves are private until you share them. The first time you save a place, 333 asks once whether saves are shared with friends. You can change that choice under Profile → Privacy and data. Any place can stay private with Keep private.

Lists are private unless you choose otherwise. Each list can be kept to you, shared with all friends, or shared with the friends you choose. A save you lock stays private even when it is in a shared list. Shared saves from friends who are part of an outing can inform its recommendations.

Your taste profile contributes to a group’s recommendations only when you choose to share it with groups. The taste profile of the person planning an outing is always part of that outing. Your favorites shape only solo recommendations. Group ranking never receives them.

Places imported from links or the share sheet land as private saves. Sharing an import is a separate choice. When a person confirms that they went to a place, that visit counts toward their Been total under their own sharing setting.

Finding friends from contacts.

This is optional. It starts only when you tap Find friends from your contacts and allow Contacts access in iOS. Your phone reads the phone numbers in your contacts and converts each one to an international format. Numbers without a country code are read as US numbers. It then computes a SHA-256 hash of each number. It sends up to 2,500 unique hashes per request. Raw numbers never leave your phone.

The server adds a keyed value using a server secret and compares it with the keyed values stored for accounts. It does not store the hashes you send. Matches appear as suggestions. Each account stores a keyed value derived from its own verified number so that other people’s uploads can match it. Deleted accounts are excluded from matches.

Public pages.

Publishing a list makes it public at its own link. The page shows the list name, the first name and photo of its owner, and the places in it that have a provider place page and are not locked. A place in a published list can show there even if you have not shared it with friends, unless you lock it. Only accounts 18 and older can publish lists. Turning a list off stops its link, and the page is marked so search engines drop it.

Place pages are public and searchable. They show the venue, its photo and photo credit, a count of people who have shared it or put it on a published list once there are at least three, and any published lists that include it, with each owner’s first name. They never show the group where a place was saved. A pin you dropped by hand, with no provider place, gets only a bare page with its name and category, which search engines are told to skip.

Plan links, trips, and guest responses.

Plan links show the shared itinerary, the first names of the organizer and attendees, and response options. Trip links show the trip’s city, dates, and each published outing. Anyone with a plan or trip link can open it. Neither appears in search. Share links only with the people you intend to invite.

Private stops appear as “Private gathering” on public pages. Keep their addresses in your group chat. A surprise plan hides its place from invitees until the reveal time, or until that person chooses to peek.

You can respond to a published plan on the web with your name, without an account. A signed first-party cookie lets that browser retrieve and change its response. The cookie is for the response feature, not advertising. It is HTTP-only, Secure, and set to expire after one year. Clearing it or switching browsers may prevent you from editing the same response. The current guest form does not collect a phone number.

For help removing a guest response, contact hey@friendship.co with the plan link and the response name. We may need to verify your request.

The iMessage app and Share extension.

The iMessage app and the Share extension each use their own narrow token, stored in a shared keychain group, rather than your app session. The iMessage token can only create one plan for one place and one time, which is published with a plan link. The Share extension token can only resolve and save imports. Each token expires after 90 days, and each account keeps up to five at a time.

Imports from links and the share sheet.

When you paste or share an Instagram, TikTok, or Google Maps link, 333 fetches only those services’ own pages. For Instagram and TikTok it reads the page’s preview details. Short map links are followed only within map services. We match the link to a venue, using a name guess and a Google Places search, and save it as a private save in your account. The venue itself is part of the shared place catalog that other people see as a place.

Service providers and analytics.

We use PostHog to count website visits and product actions, and to receive error reports. Website counts use no cookies, no form capture, and no personal identifiers, and they respect browser privacy signals. The app sends product events and crash diagnostics under an anonymous installation identifier, without creating a person profile or linking them to your 333 account. Error reports from our server leave out request URLs, search text, coordinates, and account data. The Google Maps SDK separately processes its own device identifiers and diagnostic and interaction data. We do not send it your 333 account identifier or enable its device-location tracking.

333 operates from the United States. Our providers may process information in the United States and other countries where they operate.

Launch interest and texts.

If you join the launch list, we store your phone number, optional name and city, and a record of your consent to contact you about launch. Cloudflare stores these details. Phone sign-in uses verification texts through Firebase. Launch contact is a separate opt-in and is not required to use the app. 333 does not automatically text your friends when you share an invitation. To withdraw launch-list consent or request removal, email hey@friendship.co with the number you used. Message and data rates may apply to texts you request.

Retention and account controls.

Account and activity records stay stored to provide your profile, saves, and plan history until you remove them in the app or delete your account. Parsed outing intents are cached for up to 24 hours, keyed by a hash of the outing text. Planning starting coordinates are removed after 15 minutes. Import and iMessage tokens expire after 90 days. Launch-list records are separate from app accounts, so contact us to remove them.

In the app, open Profile → Privacy and data. Export my data creates a JSON copy of your account data. It includes your profile, saves, lists, plans and trips you created, friendships, blocks, reports you filed, notification settings, taste profile, RSVPs, visit records, and any older coarse location-history records from earlier app versions. It includes only the last four digits of your phone number.

Delete your account removes your profile information, sessions, devices, personal saves, lists, memberships, friendships, RSVPs, taste profile, planning locations, published lists, and recommendation requests. You may be asked to verify your phone number first. Your sign-in record with Firebase is queued for deletion and retried if the provider is unavailable. Trips you created are deleted. Plans you organized can remain for the people who took part, with you removed as their organizer. Leaving a group or deleting the app is not account deletion.

For other stored information, guest data, or questions about provider retention, contact hey@friendship.co. Providers may retain independent security or operational records under their own retention policies.

Privacy requests and age.

Contact hey@friendship.co to request access, correction, a copy, or deletion of your personal information, or to raise a privacy concern. We may ask for information to verify that the request is yours.

333 is for people aged 13 and older. We ask for birth year during signup and reject signups indicating an age under 13. Public lists are for accounts 18 and older. If you believe a child under 13 has supplied personal information, contact us.

We will publish policy changes here with an updated effective date.