Privacy Policy

Are We On? (Android app, package com.cyriacapps.areweon, and its invitation web pages) · Developed by Cyriac Apps · Effective: July 17, 2026

The short version: we collect only what the scheduling feature needs, we never upload your address book, we never sell personal data, we show no ads, and you can delete your account and data yourself at any time.

Information we collect

• Account & profile — when you sign in with Google we receive and store your name, email address, profile photo URL, and a user ID. Signing in uses Google's own account picker; we never see your password.
• Contacts you pick — when you add friends to a group, we store only the entries you explicitly choose: their name, the phone number you selected, and a one-way code (hash) of that number used to detect duplicates. The default "pick a contact" flow uses the Android system picker, so the app never sees your contact list at all. The optional "select many at once" flow reads your contact list on your device (with your permission) solely to show you a list to choose from; unselected entries are discarded and your address book is never uploaded.
• Plans you create or answer — group names, activity types, proposed times and dates, response deadlines, and any note or free-text location you type; each participant's Yes/Maybe/No answers or the times they say they are free or could start; and, when someone answers through a shared plan link without an account, the display name they type in.
• Invitation links — invitations use random tokens. We store only a cryptographic hash of each token; links are scoped to one person and one plan, expire, and can be revoked.
• Push notification identifiers — if you enable notifications, a Firebase Cloud Messaging token and an app-generated random installation ID, so we can deliver notifications to your device.
• Crash & diagnostic data — production builds send crash reports (stack trace, device model, OS version, a Crashlytics installation identifier) via Firebase Crashlytics so we can fix bugs. We attach no personal identifiers to crash reports.

What we do NOT collect

• No address-book upload — ever.
• No location data (a plan's "location" is just text you type).
• No analytics or behavioral tracking SDKs, no advertising identifiers.
• No payment information (the app has no payments).
• No calendar access — "Add to calendar" hands an event file to an app you choose.
• No SMS — we never message your contacts; you share invitation links yourself.

How your information is used

Solely to run the product: signing you in, storing your groups and plans, delivering invitations and collecting responses, sending the notifications you enabled, and fixing crashes. We do not sell personal data, we do not use it for advertising, and we do not use it to train AI models.

What other people can see

Audience	Sees
People you invite	Your display name (as organizer), the plan title, note, location text, proposed times, and — after they respond — their own answers. Never other participants' phone numbers or contact details.
Other members of a shared group you are in	The group's name, description and settings; the list of plans and confirmed events in that group; and the display names of the people taking part. Whether each person is available at a given time is shared according to the setting the plan's organizer chose — private (organizer only), an anonymous overlap summary (counts, no names), or full group (names next to availability), which the organizer is warned about before choosing. Phone numbers are never visible to anyone but the group's owner, and the address book is never shared at all.
Anyone holding a shared plan link	If an organizer shares a plan's open link (for example in a group chat), whoever opens it sees the plan title, note, location text and candidate times, and can add their own answer under a name they type. They never see other people's contact details.
The public	Nothing. There is no public discovery, feed, or search. Invitation links are unguessable, scoped to one plan, and can expire or be revoked.

Service providers

Data is processed and stored by Google Firebase / Google Cloud (Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging, Crashlytics, Hosting) acting on our behalf, in United States data centers (region us-east4). Google's infrastructure encrypts data in transit (TLS) and at rest. We share personal data with no other third parties.

Retention & deletion

• Your data is retained while your account exists.
• Delete your account yourself: Settings → Delete account (in-app), or follow the account-deletion instructions if you no longer have the app. Deletion removes your profile, your groups including every imported contact detail, your plans, responses, invitation tokens, push registrations, and your sign-in account. Your name in other people's plans becomes "Deleted user" and your number is removed there.
• Limited retention after deletion: a minimal, non-personal deletion/security audit marker (up to 12 months); crash diagnostics age out within 90 days; contact entries that another organizer imported about you from their own address book belong to that organizer and can be removed on request.

Security

All traffic is encrypted in transit. Server-side security rules deny access by default and then grant only what each person needs: imported contact details (names and phone numbers) are readable by the group's owner account only, and a plan's participants can read their own answer and nothing else. Invitation tokens are 256-bit random values stored only as cryptographic hashes, scoped to one person and one plan. Sensitive operations — creating invitations, resolving links, recording answers, confirming and cancelling — run on our servers with their own authorization checks, not in the app.

Children

Are We On? is intended for adults 18 and older and is not directed at children.

Changes

If this policy changes materially, we will update this page and the effective date, and note the change in the app's release notes.

Contact

Privacy questions or requests: cyriac.apps@gmail.com · Support · Terms of Service