Privacy Policy

FriendsWithTools ("we," "our," or "us") provides a private, invite-only platform that helps people coordinate the sharing of tools with people they already know in real life. The Service also includes public tool comparison and review content on our website.

This Privacy Policy explains what information we collect, how we use it, and the choices available to you when you use our website and mobile application (the "Service").

2.1 Information You Provide

We collect the following information when you create an account or use the Service:

• Email address (required for account creation and authentication)
• Full name and display name (optional)
• Profile photo or avatar (optional, uploaded to our storage service)
• Phone number (optional, required only if you enable SMS notifications; stored in E.164 international format)
• Group and tool information, including:
  • Tool names, descriptions, categories, and subcategories
  • Tool photos (stored in our cloud storage)
  • Group names and descriptions
• Borrow request messages exchanged within private groups
• Tool Ownership and Brand Preference Data. We collect information about tools you list on the platform, including brand name, model, battery platform, condition, category, purchase date, purchase price, replacement value, serial number, warranty expiry, and tool specifications. Under the California Consumer Privacy Act (CCPA), this is classified as "commercial information" — records of personal property. We collect this information to facilitate tool-sharing matches between users in your trusted groups.
• Location data (optional). If you choose to use neighborhood features, you may provide your approximate location via GPS or by placing a pin on a map. This is used solely for matching you with nearby users who have also opted into neighborhood discovery. Your precise coordinates are never displayed to other users.
• Borrowing agreements you create, including terms, return dates, and replacement values for one-off shares.
• Waiver signatures (Commercial tier only), including the date signed, your IP address, and browser or device identifier at the time of signing.
• Newsletter email address (optional). If you subscribe to our marketing newsletter from a public page, we store your email address along with the page you subscribed from, the date you subscribed, and your IP address and user agent at the time of signup. See Section 19 for details on how this is used and how to unsubscribe.

All interactions within the tool-sharing platform occur only within private, invite-only groups or between users who have mutually opted into neighborhood discovery.

2.2 Information Collected Automatically

We may collect limited technical information necessary to operate the Service, including:

• Internet Protocol (IP) address (via our infrastructure providers)
• Authentication tokens and session identifiers
• Push notification tokens (if you enable push notifications on your mobile device; used solely to deliver notifications you have opted into)
• Error and crash data (via Sentry on web and Firebase Crashlytics on mobile). This may include stack traces, device type, operating system version, and app version. We do not intentionally collect personally identifiable information in crash reports.

On our mobile application, we use Firebase Analytics to collect anonymous usage events (such as tool searches and borrow actions). These events do not contain personally identifiable information.

2.3 Information We Do Not Collect

We do not collect:

• Physical addresses
• Contact lists or address books
• Financial or payment card information (payments are processed entirely by Stripe, Apple, or Google; we never see your card number)
• Health information
• Browsing or search history outside the Service
• Biometric data

We use the information we collect solely to:

• Provide and operate the Service
• Enable private group functionality and tool sharing coordination
• Authenticate users and secure accounts
• Display user-generated content to authorized group members
• Send you notifications you have opted into (in-app, push, email, and SMS)
• Process subscription billing and manage your account tier
• Match you with nearby users if you opt into neighborhood discovery
• Deliver SMS messages including verification codes and borrowing alerts (if you enable SMS)
• Maintain the safety, integrity, and security of the Service
• Track and resolve software errors
• Comply with legal obligations

We do not sell your personal data. Aside from the limited data shared with advertising partners to deliver and measure ads — the mobile advertising identifier used by Google AdMob (see Section 18) and the website advertising pixels described in Section 20 — we do not share personal data for advertising purposes. Where this sharing qualifies as a "share" for cross-context behavioral advertising under the California Consumer Privacy Act (as amended by the CPRA), you may opt out as described in Section 20.

FriendsWithTools enables coordination between users who already know each other or who have mutually opted into neighborhood discovery. All physical exchanges, meetups, and tool sharing occur offline, outside the Service.

We are not a party to any agreements or exchanges between users and do not mediate disputes. Borrowing agreements created through the Service are between the participating users; FriendsWithTools does not enforce or guarantee their terms.

We use a limited number of trusted service providers to operate the Service:

• Supabase — authentication, database, and file storage
• Infisical — secrets management (no user content)
• Stripe — subscription billing and payment processing. When you subscribe to a paid plan, Stripe processes your payment and stores your billing information. We receive only your Stripe customer identifier, subscription status, and billing period dates. We never receive or store your credit card number. Stripe's privacy policy governs their handling of your payment data.
• RevenueCat — in-app purchase validation for Apple App Store and Google Play subscriptions. RevenueCat receives your anonymous user identifier and purchase receipts to validate your subscription status.
• Twilio — SMS message delivery. When you enable SMS notifications and verify your phone number, we share your phone number and message content with Twilio to deliver text messages. Twilio processes this data solely to transmit messages on our behalf.
• Firebase (Google) — push notification delivery (Firebase Cloud Messaging), anonymous mobile analytics (Firebase Analytics), crash reporting (Firebase Crashlytics), and feature configuration (Firebase Remote Config). Firebase may collect device identifiers and anonymous usage data on our mobile application. No personally identifiable information is intentionally sent to Firebase.
• Apple Push Notification Service (APNs) — push notification delivery to iOS devices.
• Sentry — error tracking and performance monitoring on our web application. Sentry may receive technical context about errors, including stack traces, request metadata, and an anonymous user identifier. Sentry does not receive your name, email, phone number, or tool data.
• Google AdMob — advertisement display within the mobile application. AdMob may collect device advertising identifiers and approximate location (if permitted by your device settings) to serve ads. You can opt out of personalized ads through your device settings.

These providers process data only as necessary to provide their services to us.

Tool Manufacturers. We do not sell, share, or disclose your tool ownership data or brand preferences to tool manufacturers, brand owners, or their representatives. Brand names appear on the platform solely because users list tools made by those manufacturers.

If you subscribe to a Premium or Commercial plan, you may opt into SMS notifications. Here is how SMS works on our platform:

• Opt-in is explicit. You must (1) verify your phone number by entering a one-time code we send via text, and then (2) separately enable SMS notifications in your settings. SMS is never enabled by default.
• Message types. We may send you the following types of SMS messages:
  • Verification codes — a one-time passcode to verify your phone number
  • Borrow request alerts — when someone requests to borrow one of your tools
  • Loan updates — when a borrow request is approved or a tool is returned
  • Overdue and due-date reminders — reminders about upcoming or past-due returns
• Message frequency. Message frequency varies based on your borrowing activity. Verification codes are sent only when you initiate phone verification (limited to 3 per hour).
• Message and data rates may apply. Standard messaging and data rates from your wireless carrier may apply to SMS messages you receive from us.
• Opt-out. You can stop receiving SMS notifications at any time by:
  • Replying STOP to any message we send you
  • Disabling SMS notifications in your account settings
  • Removing your phone number from your account
• Phone number storage. Your phone number is stored in our database while SMS is enabled. If you remove your phone number, it is deleted from your profile. A masked version (last 4 digits) may be retained in our SMS delivery logs for billing and troubleshooting purposes.
• Third-party delivery. SMS messages are delivered through Twilio. Your phone number and message content are shared with Twilio solely for message delivery.

If you choose to use neighborhood features, you may share your approximate location:

• How we collect it. You can share your location via your device's GPS or by placing a pin on a map. This is entirely optional.
• How we use it. Your location is used to find other users near you who have also opted into neighborhood discovery. We use spatial queries to determine proximity without exposing your exact coordinates to other users.
• What other users see. Other users never see your precise location. They see only that you are within a general area (e.g., within 1 mile).
• How to remove it. You can disable neighborhood discovery and remove your location data at any time in your settings.
• Storage. Your coordinates are stored in our database for as long as you have neighborhood discovery enabled. When you disable it, your coordinates are removed from active queries.

If you use our mobile application, you may enable push notifications:

• Opt-in. Push notifications require your explicit permission through your device's operating system.
• What we send. Notifications about borrow requests, loan updates, due-date reminders, and messages from other users.
• How they work. We store a device token provided by Apple (APNs) or Google (FCM) and use it to deliver notifications. These tokens do not contain personal information.
• Opt-out. You can disable push notifications at any time through your device settings or within the app.

Your data is stored in the United States. We may expand data storage to other regions, including the European Union, in the future. If we do, this Privacy Policy will be updated before any change takes effect.

You may request deletion of your account and associated data at any time through the app or by contacting us.

When an account is deleted:

• Associated data is removed from active systems
• Certain data may be retained for up to 30 days for legal, security, or operational purposes
• Data may be retained longer if required by law or ongoing legal obligations
• SMS delivery logs and loan event records may be retained in anonymized form for billing reconciliation and audit purposes

Tool Listing Data. We retain your tool ownership and brand preference data for the duration of your active account. Upon account deletion, we will delete or anonymize this data within 30 days.

Phone Number. If you remove your phone number or delete your account, your full phone number is deleted from your profile. Masked records (last 4 digits only) in SMS logs may be retained for up to 90 days for billing purposes.

Location Data. If you disable neighborhood discovery or delete your account, your stored coordinates are removed from active systems.

Depending on your location, you may have rights to:

• Access your personal data
• Export your data in a machine-readable format (available to Premium and Commercial subscribers via the data export feature in your account settings)
• Correct inaccurate information
• Delete your account and associated data

We respond to valid requests as required by applicable law. To exercise any of these rights, use the relevant feature in the app or contact us at the email address below.

FriendsWithTools is intended for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18.

We may disclose information when required to do so by law or valid legal process. Where legally permitted, we will notify affected users before responding to such requests.

We may update this Privacy Policy from time to time. The "Last Updated" date at the top indicates when changes were made. If we make material changes to how we handle personal data, we will notify you through the Service or by email before the changes take effect. Continued use of the Service after an update constitutes acceptance of the revised policy.

For questions about this Privacy Policy or our data practices, contact us through the app or at:

support@friendswithtools.io

Our tool comparison and review pages use a first-party cookie called fwt_cid to attribute purchases you make through our affiliate links. Here is how it works:

• What it stores: A randomly generated anonymous identifier (UUIDv7). It does not contain your name, email, or any personally identifiable information.
• Duration: 2 years from your first visit to a tool comparison page.
• Domain: .friendswithtools.io (first-party only — never shared with third parties).
• Purpose: When you click an affiliate link to a retailer (Amazon, Home Depot, Lowe's), this identifier lets us know which of our pages referred the purchase so we can track commission accuracy. Retailers see only the anonymous ID, not your FriendsWithTools account information.
• How to delete it: Clear your browser cookies for friendswithtools.io, or use your browser's cookie management settings to remove fwt_cid specifically.
• Legal basis: Legitimate interest in measuring affiliate program performance. This cookie does not require consent under GDPR because it is a first-party, anonymous, functional cookie used for affiliate attribution rather than advertising profiling.

We permit major AI systems (including GPTBot, ClaudeBot, Google-Extended, and others listed in our robots.txt) to read our publicly accessible tool comparison and review content. This means your interactions with our public review pages may be included in AI training datasets. Your private tool-sharing groups, account information, and platform activity are never accessible to AI crawlers — they are behind authentication and explicitly excluded via robots.txt.

Our mobile application may display advertisements served by Google AdMob. AdMob may use your device's advertising identifier and, if you have granted location permission, your approximate location to serve relevant ads. On iOS, we ask for your permission through Apple's App Tracking Transparency (ATT) prompt before the advertising identifier is used to personalize ads. If you decline, you will still see ads, but they will not be personalized. You can control personalized advertising through your device's privacy settings:

• iOS: Settings > Privacy & Security > Tracking
• Android: Settings > Privacy > Ads

We do not share your FriendsWithTools account data, tool listings, or group information with advertising networks. Ad-related data collection is governed by Google's privacy policy.

If you subscribe to our marketing newsletter through a signup form on our public website (for example, the footer of our marketing pages), here is how that works:

• Opt-in is explicit. You must enter your email address in a signup form and submit it. We do not auto-subscribe you to the newsletter when you create a FriendsWithTools account.
• What we collect. Your email address, the page or form you signed up from (so we can tell what's working), the date you subscribed, and your IP address and user agent at the time of signup (kept for spam-detection and abuse-prevention purposes).
• What we send. A monthly (or less frequent) email with product updates, tool-sharing tips, and information about new features or city launches. We do not send transactional or account-related emails through the newsletter list — those go through our standard account email channel.
• Message frequency. We send no more than one newsletter per month under normal operations, and occasionally fewer.
• Storage. Subscriber records are stored in our Supabase database alongside the rest of our data. We do not currently use a third-party email marketing platform; if we add one in the future (for example, to handle large-scale sending), this Privacy Policy will be updated before any change takes effect.
• Unsubscribe. Every newsletter email contains an unsubscribe link. Clicking it immediately marks your record as unsubscribed and removes you from future sends. You can also email support@friendswithtools.io to be removed.
• Newsletter list ≠ account email. Unsubscribing from the newsletter does not affect transactional emails related to your FriendsWithTools account (security alerts, billing receipts, magic-link sign-ins, etc.). Those are managed separately in your account settings.

The newsletter list is never sold, rented, or shared with third-party advertisers.

Our public website (our marketing and tool comparison pages) uses advertising pixels from Meta (Facebook) and Reddit to measure the performance of our advertising and to reach people who may be interested in FriendsWithTools. These pixels are not present in our mobile application.

• What they do. When loaded, these pixels record events such as page views and sign-ups and associate them with advertising cookies (for example, Meta's _fbp/_fbc and Reddit's _rdt_uuid). This information is shared with Meta and Reddit so they can measure ad performance and build advertising audiences.
• What is collected. Page URL and referrer, your IP address and browser/user-agent, the advertising cookies above, and — only after you consent, and always in hashed form — your email address (used by Meta and Reddit for matching). We never share your tool listings, group activity, or borrowing data with these networks.
• Consent first. The browser pixels load only after you accept our cookie/consent banner. If you decline, the browser pixels are not loaded.
• Server-side measurement (Conversions API). Alongside the browser pixels, we may send matching conversion events to Meta and Reddit directly from our servers so measurement remains accurate when browser settings or ad blockers interfere. Personal identifiers such as your email address are included only when you have consented, and always in hashed form.
• How to opt out. Decline or change your choice in our consent banner, use your browser's cookie controls, or adjust your ad preferences directly with Meta and Reddit.
• California (CPRA). Use of these pixels may constitute "sharing" of personal information for cross-context behavioral advertising under California law. You may opt out by declining our consent banner or by contacting us at support@friendswithtools.io.

These pixels are used only on our public website and are never active inside private, authenticated tool-sharing areas.