Plain-language draft, pending lawyer review. The final version may change; we'll say so here when it does.

Privacy

The short version: we keep the least we can, you decide who sees what, and no identity document ever touches this site.

Claims, never documents

Verification on this site works with facts about you, not copies of your papers.

No ID image or identity document is ever uploaded to or stored by this site.
If you verify with FFN, your FFN pass sends a presentation. The site checks it in memory and then discards it.
What we keep is the result: "real person, name matches, 21 or older, verified on a date by an issuer," plus the credential references needed to re-check that it is still valid before a trip. We keep "name matches," not the name on your ID.
For the basic level, a trip's host records that a video call happened and that your two references were contacted.

Your account: email address, display name, city, time zone, and a phone number only if you add one.
Each application: your answers and your two references. Only you and that trip's host can read it.
What you post, your moods, check-ins and the trusted contacts you invite, each shared only as widely as you choose.
Agreements you sign: the document version, when you signed, and the IP address you signed from.

Location is never collected in the background.
It is attached only to a check-in, an SOS or a post, and only when you choose to add it. For each check-in you pick none, town, or precise.
Photos have their GPS and other metadata stripped when you upload them, on your device first and again on our server. Videos are re-encoded without metadata.

Posts, moods, location and contacts start at the most private setting. You widen them, one item at a time or with your default in Settings.
Hosts can't see your private posts, private moods, your trusted-contact list, or any vouch before it's revealed. These limits are enforced by the database rules, not only by the screens.
Your public profile shows your display name, city, completed trips, vouch tags, and only the vouch notes you choose to show.

Your trip page is private while it’s a draft. Once you publish it, it’s public: listed on Explore or link-only, as you choose.
Your name and your badge summary (what was checked, by whom, and when) show on the published page, so travelers can see who is hosting.
You see the applications to your trip, including references' contact details. They're deleted on the schedule below.

A trusted contact sees only what you share: your latest check-in and the posts you share with "My people" or pick them for.
Their link doesn't need an account. Links expire, and you can revoke any contact at any time.

Applications from people who aren't accepted are deleted 30 days after the host sets the roster.
Check-in and SOS location history is deleted 30 days after the trip ends.
Signatures and attestation records are kept. They're the record of what each person agreed to and what the site issued.

Export: download a zip of your posts, media, moods and check-ins from Settings.
Delete: delete your account from Settings. Signatures and attestation records are kept, as described above.
Change your default visibility, reminders and check-in options in Settings at any time.
AI assistants you connect yourself act as you, with your access. Disconnect any of them under AI assistants; it stops right away.

Google Firebase and Google Cloud: hosting, sign-in, the database, file storage and push notifications.
Resend: sign-in and notification emails.
Twilio: text messages for SOS and missed check-ins, if you set up contacts with phone numbers.
FFN Pass (pass.fofo.network): only if you choose to verify with FFN or sign a vouch with it.
If a host uses the trip planner, it sends trip details only (places, dates, budget) to Google Vertex AI, never names or personal details.
An AI app you connect (Claude, ChatGPT and others) gets what it reads or writes for you, under that app's own terms.

Write to adventure@fofo.dev. A person reads it.