1. Who operates sorlo
sorlo is a project based in the United Kingdom. General enquiries: hello@sorlo.app. Privacy: privacy@sorlo.app.
2. Information we process
We process your phone number and SMS authentication information to create and secure an account. You may optionally provide an email address.
Your profile may include name or username, private date of birth for 18+ eligibility, gender, profile content, interests, travel style, photos, privacy preferences and selected structured places. Raw date of birth is private and is not returned through the canonical profile projection.
We process information created through the Service, including Trusted choices, Met or Meetup confirmations, Vouches, connection requests, Introductions, messages, Trips, Plans, Plan invitations and access grants, optional Trip or Plan cover media, temporary Around signals, positive venue recommendations, product feedback, reports and blocks. These records may concern you or another user.
3. Purposes and lawful bases
We process information on the basis that it is necessary to provide the Service you request. This includes account authentication, age eligibility, profile media, selected location and travel context, Trusted/network functionality, live Met/Meetup functionality, Vouch, Personal Key, Introductions, Trips, Plans, messaging/chat media and optional push-notification functionality.
We rely on legitimate interests for safety and moderation, security and fraud prevention, limited retained relationship-integrity or Met/Meetup evidence, product feedback and product improvement. These interests are applied plainly, proportionately and with appropriate privacy controls.
We process information where necessary to respond to applicable data-protection rights and other specific legal obligations. Consent is not a blanket basis for normal product processing.
4. Information from other users
Most information is supplied directly by you. We may also receive information about a person from other sorlo users through Trusted, Met or Meetup confirmation, Vouch, Introductions, Personal Keys and connection requests, Plans, blocking, reporting and related network interactions. We use it to provide the relevant feature, maintain appropriate relationship/network context, protect users and operate the Service. Another user’s information does not identity-verify them.
5. Location context
sorlo does not currently collect live device GPS. You can choose structured places and Trips. Selected places may include provider-supplied coordinates internally to resolve and organise place context. Ordinary network experiences show authorised broad or city-level context rather than raw coordinates.
Around is published only when you explicitly confirm a coarse place, selected upcoming days, preference and audience. It expires after that period and does not establish your live or inferred presence.
Typed location searches may be sent to Geoapify for search and resolution. We store selected structured place data needed to provide the feature.
6. Visibility, media and sharing
Visibility is controlled by privacy settings, relationship context and feature permissions. Hidden removes ordinary graph discovery, while an intentional Personal Key route is separate and subject to account and safety rules. We do not sell personal information or use it for behavioural advertising.
Avatar delivery currently uses public media delivery. Cover, gallery and chat media use controlled or signed access where established.
7. Providers and international transfers
Relevant provider categories include Supabase for backend, database, authentication and storage infrastructure; Geoapify for typed location search/resolution; Expo push infrastructure; Apple Push Notification service and Google Firebase Cloud Messaging where applicable; and Twilio or other authentication SMS infrastructure where applicable. This is a high-level description rather than a fixed subprocessor register.
Primary Supabase project data is hosted in the selected West EU (Ireland) region. We do not claim that all sorlo data remains in the UK or EU. Some providers, including push and communications infrastructure, may process information outside the UK. Where UK data-protection law requires safeguards for an international transfer, appropriate recognised safeguards or mechanisms are used.
Push notifications are optional. If enabled, the device push token and information needed to deliver a notification may pass through Expo and the relevant Apple or Google push infrastructure. Push is not required to use sorlo.
8. Retention
Normal live profile, account and user-owned product data is handled through the account-deletion lifecycle. Minimal detached or pseudonymised Met/Meetup integrity evidence may be retained for 12 months where genuinely required. Necessary detached or pseudonymised safety or moderation records may be retained for 24 months, with longer retention only where an active safety or legal matter reasonably requires it. Product feedback is retained for 12 months. Shared canonical locality or place infrastructure may remain where it is not user-owned personal data; user-linked records are removed as appropriate.
9. Account deletion
You can initiate account deletion in the app. Reauthentication may be required. Requests are ordinarily fulfilled within 30 days. Live account data is deleted or anonymised as applicable; authored messages delete with the account, Vouches involving a deleted subject are removed and owned media is cleaned up. Limited information may be retained in minimised, detached or pseudonymised form where necessary for safety, fraud, security, legal or audit purposes under the retention policy. Deletion does not mean every permitted retained record is immediately destroyed, and deleted profiles are not kept available to other users.
10. Your rights
Depending on applicable law, you may have rights to access, correct or delete your information, restrict processing where applicable, object to processing based on legitimate interests, and receive or ask us to transfer data in a portable format where applicable. Contact privacy@sorlo.app to exercise rights or ask questions. You may also complain to the UK Information Commissioner’s Office (ICO).
11. Security
We use reasonable measures appropriate to the beta Service, but no online service can guarantee absolute security. Do not send passwords or authentication codes by email.
12. Changes
We may update this policy as the Service develops. The date above identifies the latest version.
13. Contact
Privacy and data rights: privacy@sorlo.app. Safety: safety@sorlo.app. General: hello@sorlo.app.