stamp Transparent. Charitable. Forever. Back to Stamp

Privacy Policy.

Last updated: 13 October 2026

This policy is written by the Stamp team in plain English. Questions about your data: privacy@stamp.foundation.

1. Who we are

Stamp Social Ltd (Company No. 17188757, trading as Stamp Foundation) is the controller of your personal data. Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are registered with the UK Information Commissioner's Office under the Data Protection Act 2018 (registration ZC142084).

Because Stamp Social Ltd is established in the United Kingdom and processes UK personal data from the UK, we are not required to appoint a UK Article 27 representative. For users in the EEA, we currently rely on the same UK establishment; if our processing of EEA personal data triggers Article 27 of the EU GDPR in future, we will appoint an EU representative and name them here.

We have not appointed a Data Protection Officer because our processing does not meet the criteria in UK GDPR Article 37. The named contact for all data-protection matters, including subject-access requests and complaints, is our Data Protection Lead at privacy@stamp.foundation. We respond within one calendar month.

2. What we collect

Account data (name, @handle, email, password hash, birthday if provided). Content you post (photos, captions, events, RSVPs). Circle relationships. Availability you mark. Device info we need to deliver the app (OS, app version, approximate timezone), your push notification token, and the IP address and time of your requests to our servers. Call set-up information (who called whom, when, and whether the call connected; never the call itself). Records of reports and blocks you make or that are made about you, and of our moderation decisions.

Places. When you add a place to a post or drop a Beacon, you type a place name or pick a place on the map (optional). We store the place name and the full-precision coordinates of the place you chose, attached to that post or Beacon. They are the coordinates of the place you picked, not of where your phone is. The place is shown to your circle so it can appear on your Stamps map. We never read your device location or GPS. Places never leave your circle.

If you submit your email through the "Notify me at launch" form on stamp.foundation, we store only your email address, the referring page (so we can tell whether you arrived from YouTube, social media, press or directly), your browser user-agent string and the timestamp. We use this to send you one email when the iOS and Android apps go live (and a final email if you ask to unsubscribe). The launch-notify list is held in our Supabase database and is not shared with any third party.

3. What we do not collect

No advertising identifiers. No third-party trackers. No contact list upload. Microphone is used ONLY when you tap the voice-note record button in chat or accept a voice or video call; we do not record in the background. Camera is used ONLY for photos you explicitly pick AND for video calls when you switch the camera on; we never access it in the background. We never read your device location or GPS, at all, foreground or background; the app has no access to where your phone is and never asks for it. The only "location" in Stamp is a place you choose to type or pick for a post or Beacon; leave it blank and the post simply has no place. Your Stamps map is built only from places you typed or picked.

We do not seek special-category personal data (information about your health, race, ethnic origin, religion, political opinions, trade-union membership, genetic or biometric identifiers, sex life, or sexual orientation) as defined in Article 9 of the UK GDPR. Please do not share such data through Stamp. If you choose to include it in a post or message, we will process it only as part of that content within your circle; we do not analyse or infer special-category data from anything you share.

4. Legal bases (UK/EU GDPR)

For each purpose, the basis we rely on is:

  • Running your account, posts, messages, calls, games and map (including the map tiles from Esri): contract, UK GDPR Article 6(1)(b).
  • Push notifications: contract, for the notifications you have switched on; you can switch each kind off in Settings.
  • Managing your membership and subscription status: contract, Article 6(1)(b). Apple and Google handle the payment itself.
  • Scanning uploaded images, handling reports and blocks, and preventing abuse: legitimate interests, Article 6(1)(f), in keeping members safe; and legal obligation, Article 6(1)(c), for our duties under the Online Safety Act 2023.
  • Crash reporting and security logs: legitimate interests, Article 6(1)(f), in keeping the service reliable and secure.
  • Optional features (adding a place to a post, searching for a GIF, the "Notify me at launch" form): consent, Article 6(1)(a), which you can withdraw at any time.
  • Tax and accounting records, and valid legal requests: legal obligation, Article 6(1)(c).

Where we rely on legitimate interests you have the right to object (see section 9).

5. How we use your data

To show your posts to your circle, match you with people you already know, deliver messages, run the word games, detect abuse, and send essential service emails (e.g. sign-in confirmations). We do not offer live chat or personal support. Launch-notify emails are used solely to tell you when the app goes live and to honour any unsubscribe request. That email names Stamp Social Ltd as the sender and carries a working unsubscribe link. The list is never enriched against third-party data, and never sold or shared.

6. Who we share with

These are the companies that handle personal data for Stamp, what they do, and where. A processor acts only on our instructions. Where a company is an independent controller, it decides for itself how it handles the data it receives, under its own policy.

  • Supabase (processor): hosting, database, file storage and sign-in. Region: London, United Kingdom (AWS eu-west-2). Supabase is owned by a US parent company.
  • Expo, including Expo Application Services (processor): delivers app updates and relays push notifications. Region: United States.
  • Sentry (processor): crash and error reports. Region: United States.
  • Sightengine (processor): automated safety scanning of images you upload. Region: France. It does not keep the image.
  • Resend (processor): sends our service emails, such as sign-in confirmations and data exports. Region: United States.
  • Cloudflare (processor): content delivery for stamp.foundation, and the relay that carries voice and video calls when two devices cannot connect directly. Region: global network, with the company based in the United States. Call media is encrypted end-to-end using DTLS-SRTP with keys negotiated directly between the devices on the call, so the relay carries opaque bytes only.
  • Apple (independent controller for payments and your Apple ID; processor for push delivery): billing and subscription management on iPhone and iPad, and the Apple Push Notification service. Apple is the merchant of record for in-app purchases. Region: United States.
  • Google (independent controller for payments and your Google account; processor for push delivery): billing and subscription management on Android through Google Play Billing, and Firebase Cloud Messaging for Android push. Google is the merchant of record for in-app purchases. Region: United States.
  • Esri (independent controller of its own server logs): supplies the map tiles for your Stamps map. When the map is open, your device requests tiles directly from Esri's tile service. Each request carries the map tile and zoom level being viewed, which shows roughly the area of the map on your screen, and your device's IP address, as any web request does. We send Esri no account data, no handle, no email and no post content. Region: United States.
  • Klipy (independent controller of its own logs): animated GIF search when you use the GIF picker. Your search query is sent to Klipy, which may log it under its own policy. Region: United States.
  • Open Library, Google Books and TVMaze (independent controllers of their own logs): book and TV cover lookups when you add a Love. We send only the title and author you typed. Region: United States.
  • Google Workspace (processor): our staff email. Region: United States.

Each processor handles data only on our behalf, under its data-processing terms.

7. International transfers

Some processors are based outside the UK and the EEA. Where that happens, transfers are protected by the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses with the UK addendum, or an equivalent safeguard recognised by the ICO, together with additional technical and contractual measures where the destination country warrants them.

The regions are listed against each company in section 6. In summary: your account data, posts, messages and files are stored in London, within the United Kingdom. Sightengine is in France, within the EEA, which the UK recognises as adequate, so no further mechanism is needed. The other companies listed are in, or have operations in, the United States or run a global network. For a US recipient that is certified under the UK-US Data Bridge, we rely on that. For the others we rely on the IDTA or the Addendum, as above.

We are preparing a written transfer risk assessment for each transfer outside the UK, covering lawful-access exposure, encryption in transit and at rest, and contractual remedies. Until it is complete, write to privacy@stamp.foundation if you want to know how a particular transfer is protected.

8. Retention

We keep each category of data only for as long as we need it, then delete it. The table below sets out the period for every category we process.

  • Account data (name, @handle, email, password hash, optional birthday): kept while your account is active; on deletion, removed immediately from primary systems and within 7 days from backups.
  • Posts, messages, voice notes, photos, events, RSVPs: same as account data; removed immediately on account deletion, within 7 days from backups.
  • Sentry crash logs: 90 days, then automatically purged by Sentry.
  • Reports, blocks and moderation decisions (including the record of any illegal-content report and our response): kept for up to 6 years, so we can show how we handled them to a regulator or court. If you delete your account, we keep these records only to the extent the law requires or allows.
  • Sightengine moderation scans: 30 days at most; Sightengine does not retain the image itself.
  • Klipy GIF search queries: not retained by Stamp; Klipy may log queries under their own policy.
  • TURN relay media (Cloudflare): not stored; relayed packets pass through in real time and are not recorded.
  • Authentication and security logs (sign-in events, rate-limit events, admin actions): 90 days.
  • Subject-access and erasure correspondence: 1 year, so we have a record of how we handled your request.
  • Email correspondence with support addresses: up to 3 years, then archived or deleted.
  • Launch-notify email list (stamp.foundation form): deleted within 30 days of the launch broadcast, unless you explicitly opt into further updates inside that email; unsubscribe requests honoured immediately, row removed within 7 days.
  • Tax and financial records: 6 years, as required by HMRC.
  • Anonymised, aggregate analytics: indefinitely (no personal data).

9. Your rights

Access, rectify, erase, restrict, object, port, withdraw consent at any time, without affecting past lawful processing. Email privacy@stamp.foundation; we respond within one month. In the app you can ask for a copy of your data from Profile, Settings; it is emailed to you as a link that works for 7 days. Your end-to-end encrypted messages are included as ciphertext, because the keys live on your device and not on our servers. When you ask for access we search for your data in a reasonable and proportionate way, and we keep a note of where we looked.

Complaints. If you are unhappy with how we have handled your personal data or a request, tell us first. Email privacy@stamp.foundation with "Complaint" in the subject line, and say what happened and what you would like us to do. We will acknowledge your complaint within 30 days of receiving it, and usually much sooner. We will look into it, reply without undue delay, and tell you what we found and what we have done. You do not have to complain to us before going to the regulator. You can complain at any time to the UK Information Commissioner's Office (ico.org.uk/make-a-complaint, helpline 0303 123 1113) or to your local EU data protection authority.

10. Law enforcement and legal requests

We disclose personal data to law enforcement, regulators, or other public authorities only where we are required to by valid UK legal process, such as a court order, warrant, or formally issued statutory request that meets the relevant legal standard. We do not share data voluntarily, and we do not respond to informal requests.

When we receive a valid request, we limit our response to the narrowest scope that the request demands. We will notify the affected user where we are lawfully able to do so. We cannot disclose the content of end-to-end encrypted messages or end-to-end encrypted call media, because we do not hold the encryption keys; only the metadata that allows the service to function (for example, sender and recipient identifiers, timestamps, IP addresses tied to a session) is available to us, and only that metadata can be produced.

Requests should be sent to privacy@stamp.foundation.

11. Automated decision-making

We do not carry out automated decision-making that produces legal effects or similarly significant effects on you, as set out in Article 22 of the UK GDPR. One automated step does exist: images you upload are scanned for safety, and an image that the scanner flags as clearly unsafe is not posted. If that happens to an image of yours and you think it was wrong, email appeals@stamp.foundation and a person will review it. We do not profile members for advertising, content recommendation, or feed ranking; the Stamp feed is chronological and is not algorithmically curated.

12. Record of processing activities

We are preparing a written record of our processing activities under Article 30 of the UK GDPR. It will set out the categories of data we process, the purposes, the recipients, the international transfers, the retention periods, and the security measures we have in place. When it is complete we will make it available to the ICO on request.

13. Personal-data breaches

We monitor for incidents that affect personal data. If a breach is likely to result in a risk to your rights and freedoms, we will notify the UK Information Commissioner's Office within 72 hours of becoming aware of it, as required by Article 33 of the UK GDPR. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by Article 34, and tell you what happened, the likely consequences, and the steps we are taking.

14. Transparency reporting

We commit to publishing our first transparency report within 12 months of public launch. It will cover the number of law-enforcement and government requests we have received, the number we have complied with, and the categories of data disclosed, alongside a summary of any material privacy incidents during the period.

15. Change of control

If Stamp Social Ltd is ever sold, merged, or restructured, your personal data may transfer to the acquirer or to a successor entity as part of that transaction. We will notify you in advance through the app and by email, so you can review the new arrangement and delete your account before the transfer if you choose. Your rights under the UK GDPR continue to apply to the acquirer in the same way they apply to us.

16. Security

We use TLS in transit, encryption at rest for the database, scoped row-level security policies, and rotate keys on a schedule. One-to-one and group messages, and the photos, voice notes and videos you share in them, are end-to-end encrypted: sealed on your device, addressed to the specific devices in the conversation, and unreadable on our servers. A small lock icon appears next to encrypted messages. Beams and GIFs are sent over encrypted connections and stored encrypted at rest, but are not end-to-end encrypted. Voice and video calls use end-to-end encrypted media (DTLS-SRTP), the signalling that sets up a call passes through Supabase (encrypted in transit), and the media itself is encrypted with keys negotiated directly between the devices on the call. Posts, events, profile fields and the feed are intentionally not end-to-end encrypted because they are meant to be visible to your circle, they are protected by TLS in transit, AES-256 at rest, and row-level security policies.

17. Cookies & similar

The app uses minimal local storage to keep you signed in and remember preferences. No advertising cookies. Sentry sets a per-session correlation identifier in app storage so crash reports can be linked across the same session; this is not used for advertising or analytics. The website (stamp.foundation) sets no analytics cookies, no advertising cookies, and no third-party trackers. If you arrive through a friend's share link, the site asks first, and only if you accept does it keep the name of the friend who shared it in your browser's localStorage, so that it can be applied when you sign up. If you decline, nothing is stored. We keep your choice in localStorage too, so we do not ask again.

18. Children

Stamp is 18+. We do not knowingly collect data from anyone under 18; if you believe we have, email privacy@stamp.foundation and we'll delete it.

19. Changes

Material changes will be notified in-app at least 30 days in advance.

20. Contact

privacy@stamp.foundation

21. Company details

Stamp Social Ltd, a company registered in England and Wales, Company No. 17188757, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Registered with the ICO (ZC142084) under the Data Protection Act 2018.