Privacy Policy

1. Controller and scope

This policy applies to the Probably iPhone app, its group-sync service, and this website. The controller under applicable data-protection law is:

2. The short version

3. Data we process

Local journal data

Predictions, forecasts, check-ins, comments, notes, outcomes, reflections, streak activity dates, credits, and local reminders are stored on your device. A personal prediction is not uploaded unless you deliberately share it with your group.

Device identity and credentials

The app creates a random user identifier. Group credentials and the group identifier are kept in the iOS Keychain; preferences are kept in local app storage. These values let a reinstall reconnect to the same group without an email/password account. A membership transfer replaces the old device's credential with a new credential generated and saved by the destination device.

Group and membership data

When you use Groups, we process the random user identifier, your chosen display name, group name, membership role and colour, join/leave timestamps, and hashed membership credentials. The application database stores only a keyed hash of an invite code together with its expiry and revocation status. The plaintext code is still processed on your device and in the invite URL, so hosting infrastructure can receive it as part of the request path. Membership-transfer codes are stored as SHA-256 hashes. After transfer or authenticated deletion, a one-way hash of the invalidated bearer remains so an old or retrying device receives an unambiguous signed-out response without retaining the plaintext credential.

Shared content

Shared prediction titles, descriptions, types, dates, options, units, forecasts, notes, comments, stakes, resolution status, and outcomes are stored so the group can see and merge them. Other active group members receive this data.

Safety and moderation data

Shared group text is checked by a small deterministic on-server filter for severe abuse, direct threats, explicit sexual solicitation, and obvious link spam before storage. The filter does not use a third-party AI service and does not build a profile about you. If a member reports a shared prediction or comment, we store the reporter's random user identifier, the reported content type and identifier, reason, optional context, reported author's random user identifier, and a minimized snapshot of the reported text for human review. Directional member blocks are stored privately as the two random member identifiers; other group members do not receive your block list.

Subscription and entitlement data

If you purchase or restore Probably Together, Apple provides a signed transaction containing a pseudonymous app-account token, product identifier, transaction and original-transaction identifiers, App Store environment, purchase and expiry dates, and any revocation status. We verify and retain the minimum entitlement state needed to decide whether a group may use subscription features. Apple processes the payment method and billing details; Probably does not receive your card number or Apple Account password.

Notifications

Group activity notifications are off until you explicitly enable them in Settings. Only then does the app ask for notification permission and register with Apple Push Notification service. We store the resulting device token and its production/sandbox environment. Merely joining or using a group does not register a push token. Lock-screen content previews are a separate opt-in. If they remain off, Apple receives generic group-activity copy without a display name, prediction title, comment, forecast, or outcome. If you enable previews, notification text may contain those shared-content details and is sent through Apple. Local deadline reminders are planned on your device.

Network and security data

Our hosting provider receives ordinary request information such as IP address, timestamp, path, device/browser details, and response status. Probably also uses a client IP address as a short-window rate-limit key for invite preview and redemption and membership-transfer redemption attempts. Transfer minting is rate-limited by pseudonymous user identifier. Probably also generates request identifiers for diagnostics.

Support messages

If you email us, we process your address, message, attachments, and related correspondence to answer the request.

4. Why we use this data

• Provide the service:create and maintain a group, authenticate its members, verify an organizer's subscription access, synchronize shared content, and deliver requested notifications. The legal basis is performance of our agreement with you (Article 6(1)(b) GDPR where applicable).
• Security, safety, and reliability: limit invite abuse, diagnose failures, filter severe objectionable content, suppress blocked-member notifications, review member reports, keep credentials secure, and protect the service and its members. The legal basis is our legitimate interest in a safe and reliable service (Article 6(1)(f) GDPR).
• Support and legal obligations: answer requests, establish or defend legal claims, and comply with law. The legal bases are Article 6(1)(b), (c), and (f) GDPR as applicable.
• Notifications: Probably asks for device-level permission when you enable notifications. You can turn group activity notifications off in the app or visible alerts off in iOS Settings. Turning the in-app group notification choice off unregisters that device token from the service. This does not affect the lawfulness of earlier processing.

5. Who receives data

• Your group and invite holders:active members receive group rosters and content deliberately shared with the group. A person with a valid invite code can preview the group name and active members' display names before joining. Please do not put sensitive personal information in group names, display names, prediction text, or notes.
• The Probably moderation operator: a separately authenticated operator can view submitted reports and their minimized snapshots to assess abuse and take appropriate action. Ordinary group-member credentials cannot access this queue.
• Vercel: hosts the web application and API and processes traffic and runtime data on our behalf. See the Vercel Privacy Notice.
• Neon / Databricks: provides the managed PostgreSQL database used for group-sync records. See the Databricks Privacy Notice.
• Apple: distributes the app, processes Probably Together purchases and subscription lifecycle events, and delivers push notifications for group activity. Your iOS setting controls whether alerts are presented; the separate in-app group-notification switch controls server registration. Apple processes its service data under the Apple Privacy Policy.
• Email infrastructure: the mail service carrying and storing a support message processes the sender, recipient, routing data, and message content. Ask us if you need current provider details before sending sensitive information.

We may also disclose data when required by law, to protect rights and safety, or during a business transfer subject to appropriate safeguards. Our providers are required to protect data consistently with this policy and applicable law.

6. International transfers

Some providers are based in the United States or may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, the EU Standard Contractual Clauses, or another lawful safeguard. You may ask us for more information about the relevant safeguard.

7. Retention

• Local journal data remains on your device until you delete it or remove the app. Some random identifiers and group credentials may remain in the iOS Keychain after uninstall so a reinstall can restore group access.
• Group membership and shared content are kept while needed to operate the group and preserve a consistent shared history. Leaving a group revokes your access, but does not automatically erase contributions already shared with other members. Authenticated group-data deletion removes the member's current- group footprint as described on the Data Deletion page. When other members remain, erased content is represented by empty tombstones retaining record type/UUID and sequence/timestamp/schema metadata. The original author UUID is replaced by a fixed non-identifying nil value required by the record schema. These markers exist solely so deletion propagates and erased records cannot reappear.
• Verified subscription identifiers and entitlement status are retained while needed to provide access, process renewals, refunds, revocations, and support, prevent one purchase from being misapplied, and meet legal record-keeping obligations. They are not used for advertising or cross-app tracking.
• Expired unconsumed membership-transfer rows are removed opportunistically by a later transfer request. The latest consumed hash remains while its membership is active so a destination device can recover even after a long offline period if the success response was lost. A later authenticated transfer mint, leave, or group-data deletion removes that recovery row. The current service has no automatic expiry job for expired/revoked social-invite rows or IP-based rate-limit rows; they remain in the operational database until an operator removes them. Hosting logs and backups follow the retention configured in the relevant provider account; contact us for the current periods.
• A push token is removed when Apple reports it as invalid, when its owner turns off group notifications in the app, when that identity leaves its group, or when the owner uses authenticated group-data deletion. Support correspondence is retained while needed to resolve the request and meet legal obligations.
• A block remains until you unblock the member or either involved membership is deleted. Reports remain while open or under review. Reports marked actioned or dismissed are automatically removed after 180 days when the operator queue is next processed. Authenticated deletion removes reports you submitted and block relationships involving your identity; reports about content you authored lose your author identifier, replace the snapshot with a privacy-removal marker, and clear moderator-event notes that may quote that content.

8. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, restrict, or receive a portable copy of personal data, and to object to certain processing. Where processing relies on consent, you may withdraw it. You also have the right to lodge a complaint with a data-protection authority.

Use Settings → Your datafor a portable personal-journal archive, an authenticated current-group export, local journal deletion, or authenticated deletion of your current-group data. The group export includes only your own membership profile and records authored by your identity; it omits other members' profiles and records and strips structured mentions. Free text you wrote can still refer to another person. Read the data-deletion instructions for the exact scope. For other requests, email mail@pmuench.com. Never send a membership credential by email.

In a shared prediction's detail menu you can report another member's prediction, and each other member's comment menu offers Report comment. In the Groups roster, use the other member's menu to block or unblock them. Blocking hides their comments on your device and stops activity notifications between both identities; it does not erase shared predictions or forecast history.

In Germany you may contact the Bavarian State Office for Data Protection Supervision, or any other competent supervisory authority.

9. Security

We use transport encryption, random bearer credentials, hashed server-side credential, invite, and transfer-code representations, single-use transfer rotation, access checks, input limits, and restricted database access. No online service can guarantee absolute security; protect invite and transfer codes and do not share sensitive information in predictions.

10. Children

Probably does not ask for age and is not designed to solicit children's personal data. A parent or guardian should supervise a child's use and ensure that display names and shared content do not reveal unnecessary personal information. Contact us if you believe a child's data should be removed.

11. Changes and contact

We may update this policy when the app, providers, or law changes. The date at the top identifies the current version. Material changes will be communicated in an appropriate way. Questions can be sent to mail@pmuench.com.