Shoshana — Privacy Policy

Effective date: July 30, 2026 · Contact: [email protected]

Shoshana ("the app") is a consent-based friend-finding app made by Samet Cohen Studio. It helps you and your friends find each other — only when you both choose to. This page explains exactly what data the app handles and why.

Data we collect

Account data — your phone number (and your Google account email, if you link Google sign-in), a display name you choose, and an emoji avatar. No photos are collected.
Friend connections — who you've added as a friend (friendships are created only by explicit friend codes, group invitations you accept, or requests you approve — the app never reads your contacts).
Precise location — only while a sharing session that you started is active. Sessions are always time-limited or manually stopped, and your location is visible only to the specific friends or group you chose. When no session is active, your precise location is not collected.
Background location — only during an active sharing session, so friends can still find you with the screen off. On Android this runs as a visible foreground-service notification; it stops the moment the session ends or expires.
Guest share links (optional) — if you create a "share by link" session, anyone holding that link can see your display name, avatar and live location in their browser until the link expires (24 hours at most) or you stop it. Treat the link like the location itself: share it only with people you trust.
Coarse presence (optional) — if you enable the "Serendipity" feature, the app publishes only an approximate area (~1 km cell), never exact coordinates, to detect when a friend is nearby. Both sides must agree before names are revealed. You can turn this off at any time.
Private notes and places — notes about friends and pinned places you create are visible only to you.
Group check-ins ("Safe Check") — when someone in a group you belong to starts an "are you OK?" check-in, the app stores the group roster and who answered "I'm OK" and when. Check-ins are cleaned up automatically within about a day.
Quick messages — one-tap preset messages (like "On my way") are delivered as push notifications and store only which preset was chosen, the sender's display name, and a timestamp. There is no chat and no free-text messaging.
Blocking and reports — if you block someone, the block is stored and visible only to you; the blocked person is never told. If you report someone for abuse, the report (who reported whom, the reason, and when) is kept for safety review — see the retention note below.
Gamification stats — "Petals" points and counters, shown on leaderboards together with your display name and emoji avatar.
Push notification token — so friends' requests and shares can reach your device.
Crash reports — technical error data (via Sentry) to fix bugs. Crash reports do not include your location history.

What we don't do

No ads, no analytics-for-marketing, no selling or renting data to anyone.
No always-on tracking — location leaves your device only during sessions you start or features you enabled.
No reading of your contacts, photos, messages, or files.

Service providers

Data is processed by Google Firebase (authentication, database, server functions), Expo (push notification delivery), and Sentry (crash reports). Each receives only what is needed for its function.

Retention

Live location entries are overwritten continuously and become inaccessible when a session ends; presence cells are cleared when disabled; expired sessions, encounters, check-ins and quick messages are cleaned up automatically. Account data is kept until you delete your account. Abuse reports are the one exception: they are retained for safety review even after the reported account is deleted, so a report cannot be erased by deleting the account it points at.

Deleting your account

In the app: Settings → Delete account — this permanently removes your profile, friendships, sessions, locations, stats, notes, places, and sign-in credentials. You can also request deletion without the app on the account deletion page.

Children

The app is not directed at children under 13.

Changes

If this policy changes materially, the effective date above will be updated and the app will point to this page.