Privacy Policy

FriendsWithTools ("we," "our," or "us") provides a private, invite-only platform that helps people coordinate the sharing of tools with people they already know in real life.

This Privacy Policy explains what information we collect, how we use it, and the choices available to you when you use our website and mobile application (the "Service").

2.1 Information You Provide

We collect the following information when you create an account or use the Service:

• Email address (required for account creation and authentication)
• Full name and display name (optional)
• Profile photo or avatar (optional, uploaded to our storage service)
• Phone number (optional, required only if you enable SMS notifications; stored in E.164 international format)
• Group and tool information, including:
  • Tool names, descriptions, categories, and subcategories
  • Tool photos (stored in our cloud storage)
  • Group names and descriptions
• Borrow request messages exchanged within private groups
• Tool Ownership and Brand Preference Data. We collect information about tools you list on the platform, including brand name, model, battery platform, condition, category, purchase date, purchase price, replacement value, serial number, warranty expiry, and tool specifications. Under the California Consumer Privacy Act (CCPA), this is classified as "commercial information" — records of personal property. We collect this information to facilitate tool-sharing matches between users in your trusted groups.
• Location data (optional). If you choose to use neighborhood features, you may provide your approximate location via GPS or by placing a pin on a map. This is used solely for matching you with nearby users who have also opted into neighborhood discovery. Your precise coordinates are never displayed to other users.
• Borrowing agreements you create, including terms, return dates, and replacement values for one-off shares.
• Waiver signatures (Commercial tier only), including the date signed, your IP address, and browser or device identifier at the time of signing.
• Newsletter email address (optional). If you subscribe to our marketing newsletter from a public page, we store your email address along with the page you subscribed from, the date you subscribed, and your IP address and user agent at the time of signup. See Section 17 for details on how this is used and how to unsubscribe.

All interactions within the tool-sharing platform occur only within private, invite-only groups or between users who have mutually opted into neighborhood discovery.

2.2 Information Collected Automatically

We may collect limited technical information necessary to operate the Service, including:

• Internet Protocol (IP) address (via our infrastructure providers)
• Authentication tokens and session identifiers
• Push notification tokens (if you enable push notifications on your mobile device; used solely to deliver notifications you have opted into)
• Error and crash data (via Sentry on web and Firebase Crashlytics on mobile). This may include stack traces, device type, operating system version, and app version. We do not intentionally collect personally identifiable information in crash reports.

2.3 Information We Do Not Collect

We do not collect:

• Physical addresses
• Contact lists or address books
• Financial or payment card information (payments are processed entirely by Stripe, Apple, or Google; we never see your card number)
• Health information
• Browsing or search history outside the Service
• Biometric data
• Advertising identifiers, such as Apple's IDFA or Google's Advertising ID

We do not use advertising or analytics trackers, and we do not work with ad networks. Nothing about you is sold or shared with advertisers. The service providers listed in Section 5 process data only to run the Service itself — hosting, sign-in, payments, crash reporting, and push notifications — not for advertising.

We use the information we collect solely to:

• Provide and operate the Service
• Enable private group functionality and tool sharing coordination
• Authenticate users and secure accounts
• Display user-generated content to authorized group members
• Send you notifications you have opted into (in-app, push, email, and SMS)
• Process subscription billing and manage your account tier
• Match you with nearby users if you opt into neighborhood discovery
• Deliver SMS messages including verification codes and borrowing alerts (if you enable SMS)
• Maintain the safety, integrity, and security of the Service
• Track and resolve software errors
• Comply with legal obligations

We do not sell your personal data. We do not share personal data for advertising purposes.

FriendsWithTools enables coordination between users who already know each other or who have mutually opted into neighborhood discovery. All physical exchanges, meetups, and tool sharing occur offline, outside the Service.

We are not a party to any agreements or exchanges between users and do not mediate disputes. Borrowing agreements created through the Service are between the participating users; FriendsWithTools does not enforce or guarantee their terms.

We use a limited number of trusted service providers to operate the Service:

• Supabase — authentication, database, and file storage
• Infisical — secrets management (no user content)
• Stripe — subscription billing and payment processing. When you subscribe to a paid plan, Stripe processes your payment and stores your billing information. We receive only your Stripe customer identifier, subscription status, and billing period dates. We never receive or store your credit card number. Stripe's privacy policy governs their handling of your payment data.
• RevenueCat — in-app purchase validation for Apple App Store and Google Play subscriptions. RevenueCat receives your anonymous user identifier and purchase receipts to validate your subscription status.
• Twilio — SMS message delivery. When you enable SMS notifications and verify your phone number, we share your phone number and message content with Twilio to deliver text messages. Twilio processes this data solely to transmit messages on our behalf.
• Firebase (Google) — push notification delivery (Firebase Cloud Messaging), crash reporting (Firebase Crashlytics), and feature configuration (Firebase Remote Config). No personally identifiable information is intentionally sent to Firebase.
• Apple Push Notification Service (APNs) — push notification delivery to iOS devices.
• Sentry — error tracking and performance monitoring on our web application. Sentry may receive technical context about errors, including stack traces, request metadata, and an anonymous user identifier. Sentry does not receive your name, email, phone number, or tool data.

These providers process data only as necessary to provide their services to us.

Tool Manufacturers. We do not sell, share, or disclose your tool ownership data or brand preferences to tool manufacturers, brand owners, or their representatives. Brand names appear on the platform solely because users list tools made by those manufacturers.

If you subscribe to a Premium or Commercial plan, you may opt into SMS notifications. Here is how SMS works on our platform:

• Opt-in is explicit. You must (1) verify your phone number by entering a one-time code we send via text, and then (2) separately enable SMS notifications in your settings. SMS is never enabled by default.
• Message types. We may send you the following types of SMS messages:
  • Verification codes — a one-time passcode to verify your phone number
  • Borrow request alerts — when someone requests to borrow one of your tools
  • Loan updates — when a borrow request is approved or a tool is returned
  • Overdue and due-date reminders — reminders about upcoming or past-due returns
• Message frequency. Message frequency varies based on your borrowing activity. Verification codes are sent only when you initiate phone verification (limited to 3 per hour).
• Message and data rates may apply. Standard messaging and data rates from your wireless carrier may apply to SMS messages you receive from us.
• Opt-out. You can stop receiving SMS notifications at any time by:
  • Replying STOP to any message we send you
  • Disabling SMS notifications in your account settings
  • Removing your phone number from your account
• Phone number storage. Your phone number is stored in our database while SMS is enabled. If you remove your phone number, it is deleted from your profile. A masked version (last 4 digits) may be retained in our SMS delivery logs for billing and troubleshooting purposes.
• Third-party delivery. SMS messages are delivered through Twilio. Your phone number and message content are shared with Twilio solely for message delivery.

If you choose to use neighborhood features, you may share your approximate location:

• How we collect it. You can share your location via your device's GPS or by placing a pin on a map. This is entirely optional.
• How we use it. Your location is used to find other users near you who have also opted into neighborhood discovery. We use spatial queries to determine proximity without exposing your exact coordinates to other users.
• What other users see. Other users never see your precise location. They see only that you are within a general area (e.g., within 1 mile).
• How to remove it. You can disable neighborhood discovery and remove your location data at any time in your settings.
• Storage. Your coordinates are stored in our database for as long as you have neighborhood discovery enabled. When you disable it, your coordinates are removed from active queries.

If you use our mobile application, you may enable push notifications:

• Opt-in. Push notifications require your explicit permission through your device's operating system.
• What we send. Notifications about borrow requests, loan updates, due-date reminders, and messages from other users.
• How they work. We store a device token provided by Apple (APNs) or Google (FCM) and use it to deliver notifications. These tokens do not contain personal information.
• Opt-out. You can disable push notifications at any time through your device settings or within the app.

Your data is stored in the United States. We may expand data storage to other regions, including the European Union, in the future. If we do, this Privacy Policy will be updated before any change takes effect.

You may request deletion of your account and associated data at any time through the app or by contacting us.

When an account is deleted:

• Associated data is removed from active systems
• Certain data may be retained for up to 30 days for legal, security, or operational purposes
• Data may be retained longer if required by law or ongoing legal obligations
• SMS delivery logs and loan event records may be retained in anonymized form for billing reconciliation and audit purposes

Tool Listing Data. We retain your tool ownership and brand preference data for the duration of your active account. Upon account deletion, we will delete or anonymize this data within 30 days.

Phone Number. If you remove your phone number or delete your account, your full phone number is deleted from your profile. Masked records (last 4 digits only) in SMS logs may be retained for up to 90 days for billing purposes.

Location Data. If you disable neighborhood discovery or delete your account, your stored coordinates are removed from active systems.

Depending on your location, you may have rights to:

• Access your personal data
• Export your data in a machine-readable format (available to Premium and Commercial subscribers via the data export feature in your account settings)
• Correct inaccurate information
• Delete your account and associated data

We respond to valid requests as required by applicable law. To exercise any of these rights, use the relevant feature in the app or contact us at the email address below.

FriendsWithTools is intended for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18.

We may disclose information when required to do so by law or valid legal process. Where legally permitted, we will notify affected users before responding to such requests.

We may update this Privacy Policy from time to time. The "Last Updated" date at the top indicates when changes were made. If we make material changes to how we handle personal data, we will notify you through the Service or by email before the changes take effect. Continued use of the Service after an update constitutes acceptance of the revised policy.

For questions about this Privacy Policy or our data practices, contact us through the app or at:

[email protected]

We permit major AI systems (including GPTBot, ClaudeBot, Google-Extended, and others listed in our robots.txt) to read our publicly accessible marketing pages. Your private tool-sharing groups, account information, and platform activity are never accessible to AI crawlers — they are behind authentication and explicitly excluded via robots.txt.

If you subscribe to our marketing newsletter through a signup form on our public website (for example, the footer of our marketing pages), here is how that works:

• Opt-in is explicit. You must enter your email address in a signup form and submit it. We do not auto-subscribe you to the newsletter when you create a FriendsWithTools account.
• What we collect. Your email address, the page or form you signed up from (so we can tell what's working), the date you subscribed, and your IP address and user agent at the time of signup (kept for spam-detection and abuse-prevention purposes).
• What we send. A monthly (or less frequent) email with product updates, tool-sharing tips, and information about new features or city launches. We do not send transactional or account-related emails through the newsletter list — those go through our standard account email channel.
• Message frequency. We send no more than one newsletter per month under normal operations, and occasionally fewer.
• Storage. Subscriber records are stored in our Supabase database alongside the rest of our data. We do not currently use a third-party email marketing platform; if we add one in the future (for example, to handle large-scale sending), this Privacy Policy will be updated before any change takes effect.
• Unsubscribe. Every newsletter email contains an unsubscribe link. Clicking it immediately marks your record as unsubscribed and removes you from future sends. You can also email [email protected] to be removed.
• Newsletter list ≠ account email. Unsubscribing from the newsletter does not affect transactional emails related to your FriendsWithTools account (security alerts, billing receipts, magic-link sign-ins, etc.). Those are managed separately in your account settings.

The newsletter list is never sold, rented, or shared with third-party advertisers.