Our Privacy Commitments
Simmer Social is built to help you care for your relationships, not to monetize them.
Your contacts, relationship notes, reflections, and personal relationship history are not used for advertising, are not sold or rented, and are not used to train general-purpose AI models.
We use this information only to provide Simmer Social’s features, operate and secure the app, support your account, and improve the service in ways consistent with this Privacy Policy.
Privacy Policy
Last Updated: August 26, 2026
This Privacy Policy describes how Simmer Social, LLC (“Simmer,” “we,” “us,” or “our”) collects, uses, and protects information when you use our services: the simmer.social website and its subdomains, the Simmer mobile apps for iOS and Android, and the accounts and email systems behind them (together, the “Services”).
Simmer exists to help you stay connected to the people who matter to you. That only works if you can trust us with information about your relationships.
The short version
- We never sell your personal information. Not to advertisers, not to data brokers, not to anyone.
- We do not track you.We use no advertising SDKs and we never link your data with other companies’ data about you. Our analytics exist for one purpose: understanding how to improve the application.
- Your content stays on your device.Your contacts, journals, and notes live in a database on your phone and are never uploaded to our servers. They are never sold, never used for advertising, and never enter our analytics. Our analytics know that you wrote a journal entry; they never know what it said. (If you enable third-party contact photos the app asks Gravatar for avatars using an anonymized code derived from a contact’s email address, directly, without involving our servers; see section 2.)
- You can leave cleanly. You can delete your account and your data from inside the app.
1. Information you give us
Account and sign-in. Creating a Simmer account is optional; the core of the app works without one. If you sign in (for a subscription or group access), we collect your email address, or your identity from Apple or Google if you sign in with them.
Profile. You may optionally provide a name, preferred name, language, country, and timezone.
Newsletter. If you subscribe to our mailing list, we collect your email address. Subscriptions are double opt-in: nothing is sent until you confirm by email. Every newsletter includes an unsubscribe link. Marketing email is separate from the transactional email the Services send (sign-in codes, receipts, reminders), which you receive as part of using the Services. We do not sell our mailing lists.
Email measurement. The emails we send include standard open and click measurement. We use it for one purpose: confirming our email actually reaches and renders for you, so we can fix deliverability problems. It is scoped to email; it does not follow you anywhere else, and it is never joined with app or website analytics.
Group access and invitations. If an organization or school sponsors your access, we store your membership and activation details. When an organization uploads a roster, we store the invitee email addresses it provides so we can send and honor invitations; this can happen before an invitee has installed the app. The sponsoring organization can see which of the email addresses it sponsored have redeemed access; it has no access to anything else about you.
Correspondence. We communicate via email. If you email us, we keep the correspondence so we can help you. If you choose to attach screenshots or logs to a bug report, we keep those with it.
2. Information from your use of the app
The app is local-only for your relationship data: the records the app derives from your contacts, your journal entries, labels, follow-ups, and connection history live in a database on your device and are never transmitted to our servers. The only information the app sends off your device is the account information described in section 1 (if you sign in), the content-free usage analytics described here, and the direct-to-Gravatar avatar lookups described below.
Usage analytics and crash reports (so we can improve the app). We collect events about how the app is used: app opens, which screens are visited, onboarding progress, actions like logging a connection or completing a follow-up, subscription flow steps, crash and error reports, and technical context such as device model, operating system version, app version, language, and which permissions you have granted.
What analytics deliberately exclude: contact names, journal text, email addresses, phone numbers, and invitation codes never appear in analytics. Screen tracking records the type of screen, never the content on it; journal events record an approximate length, never the text; connection events record the kind of method (a call, a message), never the person or number behind it. The app does not record your screen.
Analytics identity works in two stages. Until you sign in, analytics are keyed to a random but stable identifier with no connection to your name or email. If you sign in, analytics are keyed to your internal account ID, which is an opaque code. Our analytics provider never receives your email address; the connection between your email and that code exists only in our own database.
You can turn all of this off.Settings > Data has two switches: one for usage analytics and one for crash reports. Both are on by default; turning either off takes effect immediately and stops that collection.
Contact avatars.This feature is off by default; it runs only if you turn on contact photos, during setup or in settings. When enabled, and only for contacts who have no photo on your device, the app derives an identifier from the contact’s email address (a one-way SHA-256 hash) and requests the matching avatar directly from Gravatar, an open avatar directory operated by Automattic that serves the images the owners of those email addresses have chosen to publish. The email address itself never leaves your device, and neither the hash nor the returned image passes through Simmer’s servers: the request goes straight from the app to Gravatar, which, like any web service, also sees your device’s network address. Simmer receives nothing from this exchange, and turning the feature off stops the lookups.
Permissions. The app requests access to your contacts (the app cannot function without it) and notifications, and optionally location. Contact information is used on your device to build your relationship records; your address book is never uploaded wholesale or shared. You can change permissions at any time in your device settings.
3. Information from your use of the website
Analytics. The website uses analytics to measure pages visited, where visitors come from, and errors, keyed to a random first-party identifier. Separately, our hosting provider, Cloudflare, gives us aggregate traffic statistics measured at the network level; these are cookieless counts and involve no per-visitor profile.
Cookie consent by region. If you visit from the European Economic Area, the United Kingdom, or Switzerland, the site sets no analytics cookies and captures nothing until you respond to the consent banner. If you decline, or ignore the banner, you are counted only in anonymous aggregate using a cookieless method that stores nothing on your device. Elsewhere, analytics cookies are set by default, as permitted by applicable law; you can still decline in your browser settings.
Cookies and local storage we use:
| Name | What it does | How long |
|---|---|---|
ph_phc_*_posthog (cookie) | First-party analytics identifier, readable only by simmer.social | Up to 1 year |
__ph_opt_in_out_* (local storage) | Remembers your analytics consent choice | Until cleared |
simmer_consent_source (local storage) | Remembers whether your consent choice was explicit | Until cleared |
simmer_access, auth_challenge (cookies) | Keep you signed in to account pages; sign-in security | Session and 10 minutes |
We determine your country from a network header supplied by our hosting provider, solely to decide whether the consent banner applies. We do not store your IP-derived location.
No cross-site tracking.Our analytics cookie is first-party: it works only on simmer.social, cannot follow you around the web, and is never joined with anyone else’s data.
4. Payments
Subscriptions are purchased through the Apple App Store or Google Play and managed by our subscription provider. We receive subscription status, product, store, and price; we never see your card number or full payment details. Organizations that buy seats for their members may be billed through Stripe, which processes the organization’s payment details; Stripe receives nothing about individual members.
5. Your data at a glance
Everything this policy describes, in one table.
| Data | Why we have it | On your device | On Simmer servers | Shared with |
|---|---|---|---|---|
| Relationship records derived from your contacts | Power the feed, reminders, and dossiers | Yes | Never | No one |
| Journals, labels, follow-ups, connection history | Journaling and follow-up features | Yes | Never | No one |
| Anonymized hash of a contact’s email (only with contact photos on) | Fetch the avatar that email’s owner published | Momentarily, per lookup | Never | Gravatar, directly from your device |
| Account email and sign-in identity (only if you sign in) | Sign-in, subscriptions, group access | No | Yes | Apple or Google, only if you sign in with them |
| Optional profile (name, language, country, timezone) | Personalize your account | No | Yes | No one |
| Usage analytics and crash reports (unless you turn them off) | Improve the app | No | Held for us by PostHog | PostHog (our processor) |
| Subscription status | Honor your purchase | No | Yes | RevenueCat and the app store you purchased through |
| Newsletter email address (only if you subscribe) | Send the newsletter | No | Yes | Mailgun (delivery) |
| Organization roster emails | Send and honor sponsored invitations | No | Yes | The sponsoring organization (redemption status only) |
| Organization billing details | Invoicing | No | Yes | Stripe |
| Website analytics | Improve the website | n/a | Held for us by PostHog | PostHog (our processor) |
| Support correspondence | Help you | No | Yes | No one |
6. How we use information
- To provide and operate the Services, including honoring your subscription or group access
- To send transactional email you would expect: sign-in codes, invitations, payment problems, and access reminders
- To send marketing email only if you subscribed, always with an unsubscribe link
- To understand how the app is used so we can improve it
- To keep the Services secure and prevent abuse
- To comply with law
7. What we never do
- We never sell your personal information.
- We never share your information for advertising, and we use no advertising SDKs.
- We do not track you: we never link your data with third-party data about you, and we never share data with data brokers.
- We never put your content into analytics.
- We never upload your contacts or journals: they stay on your device, and we never use them for anything except providing the Services to you.
8. Service providers
A small number of companies process data on our behalf, under our instructions, to run the Services. They are processors, not owners, of your data, and they may not use it for their own purposes.
| Provider | What it processes for us |
|---|---|
| Cloudflare | Hosts the website and our databases; delivers network traffic |
| PostHog | Product analytics and crash reports (the data described in sections 2 and 3) |
| RevenueCat | Subscription status from the app stores |
| Stripe | Organization billing |
| Postmark | Delivers transactional email |
| Mailgun | Delivers newsletter email |
| Apple and Google | Sign in with Apple or Google, if you choose them; app store purchases |
One service the app talks to is not a processor of ours: Gravatar (operated by Automattic), which the app queries directly for contact avatars as described in section 2. Gravatar receives only a one-way hash of a contact’s email address and your device’s network address; nothing about that exchange touches Simmer’s servers, and Gravatar offers its directory service to the owners of the email addresses being looked up.
9. How long we keep information
| Information | Retention |
|---|---|
| Sign-in verification codes | 15 minutes |
| Account data (email, identities, profile) | Until you delete your account |
| Your relationship data (contacts-derived records, journals) | Never held by us; it exists only on your device, under your control |
| Analytics | Until you delete your account or ask us to remove it |
| Billing and activation records | Retained after account deletion in anonymized form, as required for organization invoicing and legal compliance |
| Support correspondence | As long as needed to resolve the matter |
Our server databases are backed up, and backups are retained for 30 days. When you delete data from our servers, it disappears from the live systems immediately and ages out of backups within 30 days; backups are used only for disaster recovery, never to restore deleted personal data.
10. Deleting your data and your controls
Delete your account, in the app: Account deletion removes your email addresses, sign-in identities, and profile, deletes your data from our subscription provider, and deletes your analytics profile and its events. Activation records are anonymized rather than deleted where organizations require billing history; what remains contains no personal information.
Delete your data, in the app:The delete-my-data control erases the app’s data on your device. Because your relationship data exists only there, deleting it locally deletes it everywhere: there is no server-side copy for us to remove.
Export your data, in the app:Settings > Data includes an export that produces a file of your relationship data (your records, labels, and journals) and lets you save it wherever you choose. Because the data is already on your device, the export is generated there too.
Turn off analytics, in the app:The usage analytics and crash reporting switches described in section 2 live in Settings > Data and take effect immediately.
A limitation: If you never sign in, your analytics are keyed to a random identifier that we cannot connect to you. We could not find that data from your name or email even if you asked, because no link exists. This is a privacy feature, but it also means we cannot service individual requests about data we cannot attribute to you.
Other controls: You can change contacts, notification, and location permissions in your device settings; unsubscribe from any newsletter with one click; and withdraw or change website analytics consent through the banner (in consent regions) or your browser. For anything else, email privacy@simmer.social from the email address on your account.
11. Your regional privacy rights
European Economic Area, United Kingdom, and Switzerland. We process personal data to perform our contract with you (providing the Services), with your consent (website analytics cookies in your region, newsletter), and for our legitimate interests (app analytics designed to be minimal and content-free, security). You have the right to access, correct, delete, and receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent at any time without affecting prior processing. You may also lodge a complaint with your local supervisory authority. We aim to respond to requests within 30 days.
United States. Depending on your state, you may have rights to know what personal information we collect, to access, correct, and delete it, and to opt out of its sale or sharing. We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined in state privacy laws, so there is nothing to opt out of. We will never discriminate against you for exercising a privacy right. Exercise any right in the app or by emailing privacy@simmer.social.
We honor requests from anyone, whether or not a specific law applies to you.
12. Children
The Services are for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, you can delete their account and their data via the app or contact safety@simmer.social and we will delete it. Our child safety standards are published at simmer.social/child-safety; report concerns to safety@simmer.social.
13. Security
All data moves between your device and our servers over encrypted connections. Sign-in uses short-lived codes and scoped tokens; access codes are stored hashed; your relationship data never reaches our servers at all. On your device, the app’s data is protected by your device’s built-in encryption and OS protections; the app does not add an encryption layer of its own. No system is perfectly secure, and we will notify affected users of any breach as required by law. Report security issues to security@simmer.social.
14. Where data is processed
Simmer operates from the United States, and our service providers process data in the United States. If you use the Services from elsewhere, your information will be transferred to and processed in the United States.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time as Simmer Social changes, as our practices evolve, or as legal requirements change. When we update the policy, we will revise the effective date above. If we make material changes to how we collect, use, share, or protect personal information, we will provide additional notice as required by law, such as through the app, by email, or by another reasonable method. Where required, we will obtain your consent before applying material changes to previously collected information. Continued use of the Services after a change means the updated policy applies.
16. Contact us
- Privacy questions and data requests: privacy@simmer.social
- Support: support@simmer.social
- Safety concerns: safety@simmer.social
- Security reports: security@simmer.social
- Legal notices: legal@simmer.social