Privacy policy
OneFish Studios operates Something Soon for adults aged 18 and over. This policy covers the app, personal invitation pages and related support. Reading an information page does not create an account.
Accounts and invitations
We store your account identifier, verified email, display name, authentication/session information and adult attestation to provide accounts and recipient-bound invitations. We do not ask for a birth date. If you use Sign in with Apple, Apple supplies an account identity and, when authorized, email/name; a relay email may be used. Existing accounts link Apple only after signing in. Guests verify their invitation email and can respond only to that plan.
Optional phone discovery and selected contacts
Phone verification and allowing discovery are separate choices. Discovery starts off. Phone numbers are for discovery and personal invitations, not sign-in or recovery; unlink or disable discovery in Friends settings. Optional verification uses Twilio Verify for US numbers. With your permission, contacts are displayed on your device so you can select multiple people. Only phone numbers you select and submit are processed to find opted-in members or prepare phone-addressed invitations. Inviting a contact to a plan also sends a friend request. Recipients verify the invited number and choose separately whether to join the plan and become friends. We do not upload the address book or automatically send messages to your contacts.
Plans and what participants see
We store circle membership, friendships, blocks, invitations, proposed times, activity text, locations you enter, RSVPs, ballots and confirmed details. Circle members share logistics. Guests cannot see the circle roster, other plans, private notes/history or albums. Individual ballots remain private; totals follow the poll’s reveal setting. Blocks restrict direct contact and hide authored content where supported; shared logistics can remain visible. Discover does not require precise device location.
Plan album photo deadlines
Free plan album photos and thumbnails expire seven days after upload. With organizer Plus and uploader consent, eligible photos last 90 days from the original upload. Existing deadlines stay if Plus ends or the organizer changes. Backups exclude uploaded images, so a storage failure can remove a photo sooner. Save photos you want to keep while they’re available. Open a photo in Memories to report it or remove your own upload.
Your profile picture
Your initials appear by default. An uploaded profile picture has no time limit. Anyone who can see your profile, including someone with a pending friend request, can see it. Blocked people cannot see it. You can replace, save or remove your picture in Profile & settings. A full backup restore brings back your initials until you upload a picture again.
Saved gathering templates
Templates are private to your account and stay until you remove them or delete your account. They contain the text and preferences you save, without participant lists, votes, photos or scheduled dates. They are included in your personal export and encrypted backups, which last seven days. A seven-day recovery journal keeps only the template ID and action to prevent removed or replaced text from returning after a restore. A changed template may be absent after recovery; create it again if needed. Applied plan designs do not change who can access the plan.
Device permissions, notifications and exports
Photo and contact access occur when you choose those features. Calendar and sharing actions use your device’s confirmation screens. Sessions and invitation context are stored on the device; the invitation website uses an HttpOnly session cookie. Notifications store preferences and inbox/read state. When enabled and permitted, Apple push delivery uses a device token. Previews start generic. Exports and copies saved outside the app remain under your control.
Separate optional measurements
App usage analytics and JavaScript crash diagnostics each start off and require their own opt-in. They record an account reference, time and fixed event/error categories, with plan or circle references for certain counts. They exclude raw message text, ballot choices, contacts and photos; guest activity is excluded. Individual records expire after 30 days, leaving daily counts without account references. Turning a switch off deletes its remaining individual records. Subscription processing described below is separate from these optional app measurements.
Providers and subscription processing
DigitalOcean hosts our self-hosted Supabase account, database and app services. Cloudflare R2 stores encrypted selective backups and the recovery journal, not uploaded images. Resend delivers sign-in email and processes recipient addresses, message content and delivery information. Twilio and carriers process optional phone-verification numbers and delivery data. Apple provides sign-in, push delivery and App Store billing. RevenueCat processes the app account identifier, purchase history and subscription status for entitlement verification and subscription reporting. We do not send it names, email addresses, contact lists or photos as customer attributes. Apple/RevenueCat process purchase records even if optional app analytics is off; we do not receive payment-card details. Provider records and backups have their own retention and legal obligations, separate from our app-record periods. We do not sell app data or use it for advertising or cross-app tracking.
Subscription records and account deletion
We keep current subscription and ownership state while your account exists. Minimal processing/retry records expire after 30 days or account deletion, whichever is sooner. We request RevenueCat erasure after account deletion and keep only its customer identifier and deletion-task status/time for up to seven days while confirming completion. Failed erasure is investigated, not treated as complete. A keyed purchase fingerprint and deleted-owner marker remain for the service’s lifetime to prevent reassignment. This pseudonymous lock contains no account ID, email, name, receipt or payment details. Apple maintains its own transaction records. See Privacy for backups and provider processing.
Backups and recovery
Encrypted database backups are made daily and kept for seven days. They exclude all uploaded images, thumbnails and photo-export files. Deleted account data may remain in an older backup for up to seven days. A separate encrypted recovery journal keeps only identifiers, action/state and time for seven days, including after account deletion, to reapply deletions and privacy/access changes before service resumes. Changes needing this protection may fail temporarily when it is unavailable. A server failure can lose changes since the last successful backup; a missed backup increases that window. Recovery does not bring uploaded images back.
Support correspondence
If you contact support, we receive your email, message and any attachments. We use them to answer you and investigate the issue. We delete resolved support emails and attachments 30 days after resolution, or sooner after a verified account-deletion request when we can identify the correspondence. Unresolved requests remain while we handle them. Please do not send passwords, sign-in codes, invitation links, identity documents or account exports.
Reports and account restrictions
Reports go to studio review and do not extend a photo’s deadline or automatically suspend an account. The owner may restrict access after reviewing credible underage use, serious harassment or account takeover. You may request review through support. A lifted suspension record is deleted 30 days after lifting, or immediately on account deletion first. Case details are excluded from backups; recovery can preserve an active restriction without recovering its history.
Your choices, export and deletion
Use Profile & settings to correct your name, export personal records or delete your account. Verified guests can export/delete their own participation on the invitation page. Exports exclude other people’s ballots and image files; download eligible images separately. Deletion removes your profile, uploads, private templates, favorites and individual measurements; closed totals and eligible shared history may remain. Open plans you organize are canceled unless transferred; an ownerless circle is archived. App removal is not account deletion, and account deletion does not cancel Apple billing. For access, correction, deletion or an account you cannot access, contact support@onefishstudios.com; we verify ownership before disclosing or changing records. Policy changes will be reflected in these pages.