Privacy Policy

My Friend's Show LLC ("Company," "we," "us," or "our") operates the Krawl mobile application and website (collectively, the "Service"). This Privacy Policy ("Policy") describes how we collect, use, disclose, and protect your information when you use the Service. By using the Service, you acknowledge that you have read this Policy. If you do not agree, please stop using the Service.

This Policy is part of our Terms of Service. Questions or requests: info@krawlapp.com.

2.1 Account Information

When you create an account, we collect:

• Your first and last name.
• Your email address (used for passwordless sign-in codes sent via email). We do not store passwords.
• Your phone number (optional; collected only if you choose phone-based sign-in where available).
• Your date of birth. You must be 18 or older to use Krawl. If you sign in with Google or Apple, we ask you to confirm your birthday the first time you open the app. If you are under 18, your account is deleted immediately. We do not retain information from accounts we delete for age.

You can also sign in through Google or Apple. In that case, Google or Apple confirms your identity and passes us your name and email address. We do not receive your Google or Apple password.

2.2 Profile and Social Data

• Your public profile (name, display color, initials).
• Friend requests you send or accept, and the resulting friend relationships.
• Mutual connections (automatically calculated when two people have four or more friends in common).
• Your "Show up in friend search" setting (discoverable), which is on by default. Turning it off means other users cannot find you through name search or contact sync.
• People you block or report.

2.3 Krawl Content

Content you create in the Service:

• Krawl names, stop names and addresses, routes, schedules, and notes.
• RSVP responses and attendance records.
• Co-host invitations you send or receive.
• Watch links shared from your Krawl and view counts for those links.
• Live location data while you host (described in Section 2.5).

2.4 Organization and Partner Data

• If you join or manage an organization (Krawl Organizers): your membership role, any org admin invitations you send or receive, and org-related Krawl activity.
• If you apply to become a Krawl Organizer: your name, email, and application content.
• If you apply to become a Krawl Partner (venue account): your business name, venue type, contact name, email, phone number, city, website, social handles, and a free-text message. If approved: the pricing tier and monthly amount for your partner account.
• Billing discrepancy reports and bug reports or feedback you submit through the app.

2.5 Location Data

While planning: When you open the map in the app, we use your device's location to center the map on you. This is "when in use" location only.

While hosting a live Krawl: If you are a host or co-host, the app collects your GPS coordinates continuously and shares them with people who can view that Krawl. On iOS, this continues in the background while your phone is locked, so participants keep seeing your position even when the app is not open. This is disclosed in the iOS permission prompt. You can stop sharing at any time by ending the session.

As an attendee (crew member):

• On a public Krawl: you join hidden by default. The app does not send your location until you explicitly choose to share it with a "Share my location" toggle.
• On a friends-only Krawl: you can choose to share your location or stay hidden. The choice is presented when you join.

While you are hidden, the app does not transmit your location and no location is stored for your account for that session.

Who can see live locations:

• Host and co-host locations are visible to anyone who can view the Krawl (public: anyone with the link; friends-only: your friends).
• Attendee locations (when they choose to share) are visible only to other people on the same Krawl session: other participants, the host, co-hosts, and admins of the Krawl's organization.

GPS trails: The app stores a trail of host GPS positions during an active session. This trail is used to generate a session recap (distance covered, route, statistics) and is kept as long as your account is active. It is deleted when you delete your account.

2.6 Badge Check-ins

Hosts, co-hosts, and organization admins can scan a participant's badge QR code at a Krawl stop. Each scan records which stop was visited and when. This data is visible to the Krawl's hosts, co-hosts, and the organization's admins. You can see your own check-ins in your recap and receive an in-app notification when you are checked in.

2.7 Push Notification Tokens

When you grant notification permissions, your device generates a token (issued by Apple or Google) that we store to send you push notifications. You can revoke this permission at any time in your device settings, which stops push delivery.

2.8 Watch-Link Identifiers

Opening a shared watch link to follow a Krawl does not require an account. If you view one without signing in, we store a randomly generated identifier in your browser's local storage to count views (including repeat visits from the same browser). This identifier is not linked to your name, email, or any other identifying information. You can remove it by clearing your browser's site data.

2.9 Contacts

If you tap "Sync Contacts," your device reads the phone numbers and email addresses stored in your contacts and converts them to one-way codes (SHA-256 hashes) locally on your device before anything is sent to our servers. We receive only the codes, not the underlying phone numbers or email addresses. We use the codes only to find existing Krawl accounts and return their names and relationship to you. We do not store the codes after the matching call completes. Only contacts whose Krawl accounts have a confirmed email or a carrier-verified phone number are matched. The feature is entirely optional.

2.10 Google Calendar

If you connect your Google Calendar, we read upcoming events from your primary calendar (title, location, start and end time, up to 14 days ahead) to help you schedule a Krawl. We access the calendar read-only and only while you use the scheduling feature. We do not write to your calendar or store calendar content beyond what you choose to import into a Krawl.

• To operate the Service: authenticate your account, display your Krawls and social connections, and deliver core features.
• For live Krawls: transmit your GPS coordinates to authorized viewers during a hosting session, consistent with the visibility rules described in Section 2.5.
• To communicate with you: send push notifications and in-app alerts (friend requests, co-host invitations, check-in notifications, org notices) that you have enabled. Send transactional emails: sign-in codes, organizer application decisions, partner approval notices, billing notices, and co-host invitations.
• To operate the Partners and Organizers programs: evaluate and manage venue and organizer relationships.
• To generate recaps: calculate distance, route, and statistics from your GPS trail after a session ends.
• To enforce our Terms of Service and comply with law.

Krawl does not use third-party analytics services, advertising SDKs, or tracking pixels. We do not sell or share your personal information for advertising purposes.

We share data with these providers only as needed for them to perform services on our behalf:

• Supabase, Inc.: database hosting, user authentication, and real-time infrastructure. Data is hosted in the United States.
• Vercel Inc.: application hosting and content delivery.
• Google LLC: "Sign in with Google" authentication; Google Calendar read access (if you connect it); Firebase Cloud Messaging for push notification delivery. Google's use of data is governed by Google's Privacy Policy.
• Apple Inc. (MapKit JS): map display and geocoding. Apple's use of data is governed by Apple's Privacy Policy.
• Project OSRM (router.project-osrm.org): open-source routing for turn-by-turn directions between Krawl stops. Waypoint coordinates are sent to this public API; no personal account data is included.
• Komoot GmbH (photon.komoot.io): place search and geocoding for venue lookup. Search terms and coordinates are sent; no personal account data is included.
• Overpass API (OpenStreetMap data): venue and point-of-interest search. Queries and coordinates are sent; no personal account data is included.
• Resend, Inc.: transactional email delivery. Your email address is sent to Resend only to deliver messages you would expect to receive.

These providers are not permitted to use your data for their own marketing or commercial purposes.

Krawls can be set to public (anyone with the link) or friends-only (your accepted friends only). Attendee lists shown to other users are limited to mutual friends who have RSVPed. Full guest lists are not shared with other users.

You can block another user from your Settings. Blocking removes them from your friends list, prevents them from viewing your Krawls, and hides your profile from them.

See our Accessibility page for information on assistive features.

We use only essential cookies and local storage:

• Session and authentication cookies: keep you signed in across page loads.
• Organization mode: remembers which organization context you last used.
• Birthday confirmation: records that you confirmed your age so you are not asked again.
• Watch-link identifier: a random ID used only for anonymous view counting (see Section 2.8).

We do not use advertising cookies, tracking pixels, or analytics cookies.

We keep your personal information while your account is active and for as long as necessary to fulfill the purposes in this Policy. Specific rules:

• GPS trail data (positions table): kept to power session recaps; deleted when your account is deleted.
• Active sessions: any session left running is automatically closed after 48 hours.
• Partner and lead data: kept for the duration of the business relationship and for a reasonable period afterward for record-keeping.
• Deleted accounts: all personal information is removed as described in Section 8.3. We may keep a minimal record of the deletion itself and any data required by law for the shortest period necessary.

8.1 Edit Your Profile

You can update your name and contact information in Settings at any time.

8.2 Discoverable (Show Up in Friend Search)

You can turn off "Show up in friend search" in Settings. When off, other users cannot find you by name search or contact sync.

8.3 Location Permissions

You can change location permissions for Krawl at any time in your device's OS settings. Revoking location permission stops map centering and live location sharing.

8.4 Ghost Mode (Hide Your Location)

During a live Krawl, you can switch to hidden mode at any time using the location toggle. While hidden, the app stops sending your location and clears any stored position for your session row.

8.5 Contact Sync

Contact sync is entirely optional. You initiate it by tapping the button. We do not retain contact data after the matching call completes.

8.6 Delete Your Account

Go to Settings > Delete account in the app. Deletion is immediate and permanent.

Deletion removes your profile, Krawls you created, stops, routes, schedules, social connections (friends, mutuals, co-host relationships), RSVPs, GPS trail data, device push tokens, and all other personal information linked to your account. Content you contributed to Krawls hosted by someone else (for example, a stop you added as a co-host) may be kept in that Krawl in de-identified form so the host's Krawl stays intact.

If you no longer have access to the app, email info@krawlapp.com from the address on your account with the subject "Account deletion request." We will verify your identity and delete your account within 30 days.

8.7 Request a Copy of Your Data

Email info@krawlapp.com from the address on your account with the subject "Data export request." We will respond within 30 days.

8.8 US State Privacy Rights

If you are a California resident (and, to the extent applicable, a resident of other US states with similar privacy laws), you have the right to:

• Know what personal information we have collected about you, its sources, our purposes, and with whom it is shared.
• Delete personal information we hold about you, subject to legal exceptions.
• Correct inaccurate personal information.
• Limit use of sensitive personal information, including precise geolocation. You can do this by revoking location permission in your device settings.
• Opt out of sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising.
• Non-discrimination. We will not treat you differently for exercising these rights.

To submit a request, email info@krawlapp.com from the address on your account. We will respond within 45 days. If we need more time, we will let you know. You may designate an authorized agent to submit a request on your behalf, subject to our verification of the agent's authority.

Questions, requests, or concerns:

Our Terms of Service and Accessibility pages are also available on the site.