Privacy Policy

1. Who we are

Agreed ("we", "us"), the group decision-making service at getagreed.app, is operated by KealyTech Ltd, a company registered in England and Wales (company number 14767982), registered office 63 Kingsdown Parade, Bristol BS6 5UG, which is the controller of your personal data. This policy explains what personal data we collect, why, and the choices you have. If you have questions, contact us at [email protected].

2. Information we collect

We collect information you give us and information generated as you use the service:

• Account details — when you create an account, your name and email address. If you sign in with Google or Apple, we receive your name, email, and profile image from that provider.
• Content you create — the lists, items, swipes, votes, and sessions you make or take part in.
• Usage and device data — pages viewed, actions taken, your IP address and the approximate location it gives, browser and device type, and similar technical information.
• Session recordings — if you accept analytics cookies, we record on-screen interactions (with input fields masked) to understand and improve the experience.

3. Cookies and similar technologies

We use a small number of cookies and local storage. Strictly necessary storage keeps you signed in and remembers your current session and preferences — these are always on. Analytics cookies (used by our analytics provider, see below) are only set if you accept them via the cookie banner. You can change your mind at any time by clearing the choice in your browser. If you reject them, or haven’t chosen yet, we still count your visit anonymously, without storing anything on your device and without session recording.

4. How we use your information

• To provide the service — create accounts, run sessions, match group preferences, and save your lists and results.
• To improve the service — understand which features are used and find and fix problems.
• To secure the service — detect, prevent, and investigate abuse or fraud.
• To communicate with you about your account or important changes.

Our legal bases (where applicable) are performance of our contract with you, your consent (for analytics cookies and session recording), and our legitimate interests in operating, securing and improving the service (this covers anonymous visit counts and keeping IP addresses to spot misuse).

5. Analytics and session replay

We use PostHog for product analytics and session replay, hosted in the European Union. Recordings mask the contents of input fields. Full analytics and session recording only happen after you accept analytics cookies. Without that, visits are counted anonymously: nothing is stored on your device, and PostHog groups events using a short-lived code it calculates on its own servers. This helps us see how people use the app so we can make it better. Your IP address is kept with it so we can spot misuse, such as automated traffic or one person posing as many. It is not used for advertising.

6. Service providers we share data with

We do not sell your personal data. We share it only with providers that help us run the service, under agreements that limit their use of it:

• Convex — application database and backend.
• Cloudflare — hosting, content delivery, and security.
• PostHog (EU) — product analytics and session replay.
• Google and Apple — sign-in (OAuth) when you choose those options.
• Firebase Cloud Messaging (Google) and Apple Push Notification service — to deliver notifications to your device, if you turn them on.
• Paddle — to take payment and to hold the transaction and tax records that follow from it.
• Google Places, Google Geocoding and TMDB — to resolve places and to enrich restaurant and film items with photos and posters.
• Wikipedia and Pexels — to find images for generated lists.
• OpenRouter — to generate suggested lists from your prompts.

We may also disclose information where required by law, or to protect our rights, users, or the public.

7. Agreed in ChatGPT, Claude and other AI assistants

If you add Agreed to an AI assistant such as ChatGPT or Claude and ask it to help a group decide, the assistant sends us only what it takes to set the decision up:

• A short title and the options it suggested, each with a one-line description, an emoji, and hints that help us find a photo (such as a film's year or a Wikipedia article title).
• A category, and for restaurants and activities the area the options are in (such as "Soho, London") — not your own location.
• Your first name, if the assistant knows it, shown as the room's host.
• Links to rooms you or your group already have, when you ask it to add options or check on one.

We don't receive your conversation, your account with the assistant, or your precise location, and you don't need an Agreed account. Your IP address is counted against daily limits that stop the service being abused; those counters are deleted after 7 days.

What we send back to the assistant is the room's links and its progress as numbers. We never send it photos, the names of the people in the room, or who said yes to what, and the group's result only once everyone has finished. People's first names go only to the Agreed card shown in your conversation, kept apart from the text the assistant reads.

A room set up this way that nobody swipes in is deleted along with its options, usually within 6 hours and at most 14 days after its last activity. Once people swipe, it's kept like any other room (see Data retention). Your conversation with the assistant is handled by its provider, such as OpenAI or Anthropic, under their own privacy policy.

8. Affiliate links

Some links to the option a group agrees on are affiliate links. If you follow one and go on to book or buy, we may earn a commission from the partner, at no extra cost to you. Following an affiliate link shares standard click information (such as that the click came from us) with that partner, who handles your data under their own privacy policy. Affiliate links never change which options appear or how a group's choices are matched — they only attach to the option you have already chosen, and we tell you when a link is one.

Affiliate links pass through a short hop on our own site, where we count the click against the link (not against you). When you arrive, the partner (such as Amazon, or a travel or retail site) and the affiliate network that runs its programme (such as Amazon Associates or CJ) may set their own cookies or similar tracking on their site to record that you came from us and whether you went on to book or buy. Those cookies are theirs, not ours, and are governed by their privacy and cookie policies. In our iOS and Android apps these links open in an in-app browser window, which works the same way.

9. Data retention

We keep your account and profile for as long as your account is open. If you delete it, there is a 14-day cool-off during which you can change your mind, after which your personal data is erased. Decisions you have completed, and the lists they ran on, are kept as your history — lists you created stay published but stop being linked to you.

• A room nobody swiped in is deleted 14 days after its last activity. Once anyone has swiped, the room is kept as your history, whether or not it was finished. Leaving a room removes your swipes from it, and deleting your account removes your data from every room.
• Analytics events, including the IP address they came from, are held by PostHog (EU) for one year, the standard retention on our plan, and are then deleted automatically.
• Where session replay is enabled it is kept for 30 days, with the values you type into forms masked.
• Records of content moderation and abuse reports are kept after an account is deleted. We need them to enforce our rules and to meet legal obligations, so an erasure request does not clear them.
• Payment, transaction and tax records are kept for the period the law requires, and then deleted.

Deleting your account removes your data from our live systems. Existing backups age out on their own cycle, so it can persist there for a short period afterwards. Full details of what is deleted and what is kept are on our Delete account page.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent at any time. To exercise any of these rights, email us at [email protected]. You also have the right to complain to your local data protection authority.

You can manage your analytics choice, delete specific data or your whole account, and make a request from one place — your privacy choices at getagreed.app/privacy-choices.

11. International transfers

Some of our providers may process data outside your country. Where that happens, we rely on appropriate safeguards (such as standard contractual clauses) to protect your information.

12. Children

The service is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

13. Security

We take reasonable technical and organisational measures to protect your data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you in the app.

15. Contact

Questions about this policy or your data? Email [email protected].