Privacy policy

Last updated: 30 October 2026

imp.me hasn't launched yet. This policy describes the app as it will work when it launches in the UK. It may change before then. If it does, we'll update it here and change the date above.

This policy explains what imp.me collects about you, what we do with it, who else handles it, how long we keep it, and what you can do about it. We've tried to write it in plain English. If anything is unclear, ask us (see Contact us).

Who we are

imp.me is an app for families and friends to share things, talk about them and turn them into plans. It is run by Stuart Graves, as a sole trader ("we", "us"). We are the controller of the personal data described here, under UK data protection law (the UK GDPR and the Data Protection Act 2018).

• Contact: hello@theimp.me, for questions about your data, requests, complaints and online safety.
• Data protection officer: we haven't appointed one. Write to us at hello@theimp.me.
• Online safety: Stuart Graves is responsible for safety on imp.me, at the same address.
• Registration with the Information Commissioner's Office (ICO): we're registering, and we'll add our registration number here.

At launch, imp.me is available in the UK only, to people aged 13 and over (see Children).

The short version

• imp.me is for people aged 13 and over, in the UK. Under-18s get more private settings (see Children).
• We collect what you give us (your account, what you share, your messages and plans) and a little about how you use the app (our logs, and crash reports and analytics if you agree to them).
• The imp is our AI. When it works on something, the text goes to Anthropic, who run the model. It only works where someone has an imp at work: your own things if you're on Pro, or anything in a group where a member has brought their imp in. That can include things you share as a Free member.
• If you choose to, we use your location, Bluetooth "near each other" signals and your Google Calendar's free and busy times. Each is something you switch on.
• Crash reports and analytics are off until you agree to them, and you can change your mind in Settings → Privacy. Under-18s aren't asked, and both stay off for them.
• We don't sell your data, we don't show ads, and we don't collect your phone's advertising ID.
• You can report things and people, block people, and complain to us, all from the app.
• You can download your data from the app, and delete your account from the app or from a web page.
• Logs, location, notifications, the imp's cards and notes, suggestions of things to do nearby, the weather outlook, and reports and complaints each have a set lifetime (see How long we keep it). The rest stays while your account exists.

What we collect, and where it comes from

Your account

• Email address, and your password if you set one. Your password is held by our sign-in provider (Supabase), in hashed form. We don't store it ourselves. We do note when you last set it, and email you whenever it changes.
• Your age: when you sign up, we ask for the month and year you were born. We use them to check you're 13 or over and to work out your age band. We don't keep your date of birth (see Children).
• Profile: your display name, your interests, and whether you're on Free or Pro.
• Home and travel settings, if you add them: your home area (typed, or picked from Google's place suggestions), the coordinates we look up for it, and how far you're happy to travel.
• Household details, if you add them: the birth years of children in your household, whether you're dog-friendly, and whether you want the imp to watch the weather for you. These help the imp suggest things that suit you.
• Places you mark, if you do: places you've made a favourite or hidden from the imp's suggestions of things to do nearby. For a place from Google, we keep only Google's ID for it.
• Group details: groups you create or join, your role, invite codes, and any group icon you upload.

What you share

• Links you share, and the caption you write with them.
• Files you upload: photos and videos you share, photos you add to a plan, and travel documents you add to a plan's itinerary (see Plans). The app cleans each one before it leaves your phone, and we store it as the app sends it:
  • a photo loses where it was taken, details of the device and other hidden information, keeping only what's needed to show it the right way up and in the right colours;
  • a video loses only where it was recorded. When it was recorded, and any make, model or software the phone wrote into it, stay;
  • GIF, WebM and Matroska files go up unchanged;
  • a PDF goes up unchanged, so it keeps its own details, such as its title, its author and the app that made it.
• Link previews we fetch: for a web link, we fetch the page's title, description, image and text, so the share shows a proper card and the imp can understand it. A preview is kept while the share it belongs to exists.
• Event details we pick out of a page or caption, such as what, where, when and price, and any edits you make to them.

Messages and reactions

• Messages in group chats, plan chats, comments on shared things, and direct messages between two people. Your display name is saved with your messages.
• Reactions to shares, and which conversations you've read up to.
• "Drop a pin": if you drop a pin for a plan, the app sends your location to the plan's chat, as an ordinary message containing a map link with your coordinates. A pin needs your phone's precise location, and the app sends one only when Android says it's accurate to within 100 metres. We remove the coordinates 30 days after the plan ends, or 180 days after you dropped the pin if the plan still has no date. The message then reads "dropped a pin", and the copies in other members' notification inboxes change the same way. If the plan is deleted first, the message goes with it, and the inbox copies change the night after.

Plans

• Plans you create or join: title, description, where, dates and time zone (a plan can have no date yet), and who's on it with their answers.
• What you add to a plan: the dates you can do, date changes you propose and your answers to them, polls and your votes, itinerary stops and travel legs (which can include booking references, costs and notes), and shares linked to the plan.
• Travel documents you add to a stop or a travel leg: booking confirmations, vouchers and boarding passes, as PDFs or pictures, with each one's name, type and size and who added it. They can hold other travellers' names and booking codes. Everyone on the plan can see and open them, through links that work for an hour. So that they open without a signal, the app keeps a copy of a plan's documents on the phone of each person on the plan who opens it, in the app's own private storage. Those copies aren't backed up, and they're removed when that person signs out, or leaves or deletes the plan. A plan's public web page never shows them, and the imp never sees them.
• Your bucket list, your categories, and standing requests you give the imp ("let me know if a good gig comes up near us").

Location and nearby phones

All of this is optional. Each part is off until you switch it on, and needs your permission on the phone.

• Your location, for a plan's photos. Pro members can have the imp gather a plan's photos, and choose "Only when near others" to keep just the ones taken while someone else on the plan was nearby. With that on, each time you look for the plan's photos while it's on, the app sends the phone's last known location. The app asks only for approximate location for this, while you're using it. It sends a location only when Android says it's accurate to within the plan's matching distance (150 metres unless you change it), so a rough approximate location isn't sent at all. If you've let the app use your precise location for pins, the location it sends may be precise.
• Where your photos were taken. With "Only when near others" on, when you look for photos taken during a plan, the app reads where each photo was taken from the photo itself, on your phone. It sends us those places only to ask which photos were taken near other people on the plan. We use them for that answer and don't keep them. The photos you then add go up with when they were taken, but not where.
• Nearby phones (co-presence). If you turn on "Let the imp watch passively" for a plan, your phone uses Bluetooth to notice when other members' phones are nearby, so photos taken while you were together can be picked out.
  • It works for one plan at a time. It stops at the end of the plan's last day, or sooner if you stop it, sign out, or leave the plan. A notification shows while it runs.
  • Your phone sends out a short code worked out from the plan, which changes every 15 minutes. Phones on the same plan recognise it. To any other phone it means nothing, and because it keeps changing, it can't be used to follow your phone over time.
  • When your phone hears another member's code, it tells us which code it heard and when, at most once a minute. That's all: no coordinates, and nothing that says which phone or person it was.
  • On Android 12 and later, it needs Android's Bluetooth permissions and no location permission. On Android 10 and 11, your phone only sends out its code and doesn't listen for others, so it needs no location permission there either. On Android 8 and 9, Android only lets an app listen for Bluetooth with location permission, so the app asks for approximate location.

Calendar

If you connect a Google Calendar, we ask Google for two permissions only:

• free/busy (calendar.freebusy), to see when you're busy, up to a year ahead; and
• your calendar list (calendar.calendarlist.readonly), to show you which calendars to include and to learn the account's email address.

We never read your events' titles, descriptions, attendees or locations. We store the busy and free times, which calendars you chose, the Google account's email address, and the access keys Google gives us, encrypted. Your group sees free and busy information as counts ("4 of 6 free"), not who is busy. The imp can see whether each member of a group is free right now (see What the imp does with it).

Your phone and notifications

• A device identifier from Firebase (the Firebase installation ID), the platform, and when it was registered, so we can send you push notifications.
• Your notification preferences, and your notification inbox, which keeps each item for 90 days after you first read it, or 180 days if you never do.
• A record of each push and email we sent or held back (which device, when and what kind), for 30 days.

Voice

If you use your voice to tell the imp about a plan, the app turns it into text with the speech recognition that runs on your phone itself, and sends us only the text. The audio stays on your phone, and we never receive it. If your phone can't recognise speech by itself (it needs Android 12 or later, and support for your language), the app doesn't offer voice, and you type instead.

Crash reports and analytics

The app can send crash reports and analytics to Google's Firebase. Both are off until you agree to them:

• After you sign in, the app asks about each, with both switches off. Leaving a switch off is a no.
• You can change either at any time in Settings → Privacy.
• Your answers belong to your account. When you sign out, the app forgets them, and asks again the next time you sign in.
• If you're under 18, the app doesn't ask, and both stay off.
• While crash reports are off, the app deletes any crash reports waiting on your phone, so none are sent. Reports already sent stay with Google until they expire (see How long we keep it).

If you agree:

• Crashlytics sends a report when the app crashes or hits certain errors: what went wrong in the code, the phone model, Android version, app version, your imp.me user ID (a random string, not your name or email), and whether you're on Free or Pro. A report can also carry short notes on what the app was doing just before, such as the kind of screen a notification tried to open, or the size and type of an upload that failed, but never IDs, messages or the file itself.
• Analytics records which screens you open and a few actions: opening a group or one of its tabs, creating a plan, adding a reaction, opening a share, and bringing the imp into or out of a group. These carry IDs and simple values, never message text, links or names. Google's library also collects some information itself, such as an app-instance identifier, device model, operating system, app version and approximate region.

No advertising ID. The app doesn't have permission to read your phone's advertising ID, and the advertising features of Google's library are switched off.

Logs

Our server keeps records so it can run safely and so we can fix problems:

• Request log: each request to our API, with the time, the kind of request (not its content), whether it worked, how long it took, your IP address shortened to its network (an IPv4 address to its /24, an IPv6 address to its /48), your app or browser's user agent and your user ID. Kept 30 days. It also shows who has used the app lately, so that when someone deletes their account, their groups pass to a member who is still active.
• Activity log: some actions you take, such as sharing something. Kept 180 days.
• Error log: errors on our server, with the request type, your user ID and the error, with secrets removed. Kept 30 days.
• The imp's records: each time the imp runs, which model ran, how many tokens it used, and how it went, without any content (90 days). A record of each AI call made for you: when, which model and feature, and the tokens used (90 days). Copies of the imp's full prompts and answers, which can contain your content. We record these only while quality checks are switched on, and in production they're off by default. Copies are kept 7 days.
• Usage counts: how many link previews and place lookups we made for you each day (90 days).
• Hosting monitoring: our hosting provider, Microsoft Azure, records each request to our API (what was asked for, how long it took and whether it worked), errors, and our server's own log lines, which can include IDs such as your user ID. Azure uses your IP address to work out roughly where a request came from (town and country), and then discards the address. Kept 30 days.
• Sign-in records: our sign-in provider, Supabase, keeps its own records of your sign-ins and sessions.

What the imp works out about you

When the imp runs, it produces things such as labels and categories for shares, notes about what you seem to like, cards and suggestions, suggested links between shares and plans, a weather outlook for your home area, and a list of things to do nearby (Discoveries in the app) with their distance from your home.

What other people give us about you

Other members may add you to a group or plan, share things that mention you, or write about you in messages. Someone who knows your email address can find your account to invite you to a group or a plan (see Other people in the app). If someone reports something you've written or shared, or reports you, we receive a copy of what they reported (see Reports, blocks and complaints).

What we don't collect

• No payment details. Pro is currently set up by us. If we start taking payments, this policy will change first.
• No contacts, no camera, and no audio. The microphone is used only by your phone's speech recognition (see Voice).
• No advertising, and no advertising ID. We don't show ads or share data with advertisers.
• No date of birth. We ask for the month and year you were born, and keep only your age band.

We don't ask for sensitive information (such as health or religion), but you might include it in a message or share. Please think about that before you do.

What the imp does with it

The imp is imp.me's AI. It reads what's going on and, rarely, speaks up with a suggestion. It runs on models made by Anthropic (Claude), through Anthropic's API.

When the imp runs. Only where an imp is at work:

• for Pro members, on their own personal shares and plans;
• in a group where a member has brought their imp in. Then it works on what anyone in that group shares and says, including Free members.

On Free with no imp in your groups, the imp is asleep. The monthly list of things to do nearby (Discoveries) is then put together automatically from your home area, your interests and the places you've marked, with no AI writing. If you're under 18, Discoveries are off until you switch them on.

What is sent to Anthropic. Depending on the job, the imp's request can include:

• a share's link, its caption, the page text and details we fetched, and its labels;
• group chat messages that look like they might be about a plan;
• plan details: title, dates, place, itinerary stops (never the travel documents on them), and shares linked to it;
• group members' display names (a member without one is "Member 1", "Member 2" and so on, never part of their email address), and free and busy information (counts for the group, and whether each member is free right now);
• for your own imp: your interests, your recent shares, and shares you've marked as interesting;
• your standing requests, the weather outlook for your home area, and suggestions near you.

While answering, Anthropic's service can ask our server for more through a secure connection: your interests, a group's members (their names and whether each is free right now, never their email addresses), your recent shares, reactions, free and busy times, plans, and the weather outlook. It can only see groups and shares that the imp's owner can see.

Training and retention. Anthropic's commercial terms don't allow it to train its models on what we send. Anthropic deletes what we send, and the imp's answers, within 30 days. It can keep them longer if the law requires it, or if its automated safety systems flag them, in which case it may keep them for up to two years. Anthropic stores this data in the US, and may run the model in other countries.

Staff testing. Our staff can run the imp against a real user or group in our admin console to check it is working. They can choose to try another AI model through OpenRouter. That sends the same kind of request to OpenRouter and on to the provider of the model they chose (for example, OpenAI). Each request asks OpenRouter to use only providers that don't train on the data. Such a provider may still keep it for a time under its own terms, for example to watch for abuse. If no provider of that model agrees, nothing is sent to one. This is never used for the normal running of the app.

What the imp can't do. It doesn't make decisions that have legal or similarly significant effects on you. Everything it offers is a suggestion that a person can take or leave.

Why we use it, and our lawful bases

UK data protection law says we need a lawful basis for each use. These are ours:

Where we rely on legitimate interests, you can object (see Your rights). Where we rely on consent, you can withdraw it at any time. That doesn't affect what we did before.

Who can see it, and who handles it for us

Other people in the app

• Your groups see your display name, what you share with the group, your messages and your reactions.
• People on a plan see your answer, the dates you've said you can do, your poll votes, and what you add to the plan, travel documents included.
• Plan invitations: if someone you don't share a group with invites you to a plan, you get an invitation only. You see the plan and its chat once you accept.
• Finding people: members of your groups can find you by your name or email address, and see both. Anyone signed in who types your exact email address can find your account to invite you, but sees no name unless you share a group. Someone you've blocked can't find you at all.
• Public plan pages: a plan's creator can publish a read-only web page for anyone with the link. It shows the plan, its itinerary and people's first names only. It leaves out user IDs, surnames, the plan's description, messages, notes and booking references, who voted for what, uploads and travel documents. Anyone under 18 appears only as "a member".
• The imp's suggestions in a group are seen by that group, and those on a plan by the plan's people.

Companies that handle data for us

Most act only on our instructions, as our "processors".

We also use Skiddle to find events near our users. We send Skiddle the area we're searching, never anything about you.

imp.me's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use your calendar's free and busy times only to show availability in imp.me, including to the imp as described above. We never use them for advertising, and we never sell them.

Other times we might share it

• If the law requires it, or to protect someone's safety or our rights.
• If imp.me is sold or merged, with the new owner, who must respect this policy.

We never sell your data, and we never share it for advertising.

Sending data outside the UK

Some of the companies above are based in, or handle data in, other countries, mainly the US. When personal data goes outside the UK, we rely on one of these safeguards:

• UK adequacy regulations, where the UK has recognised a country as protecting personal data properly, such as Switzerland and the countries of the European Economic Area. For a US company, this applies when it is certified under the UK Extension to the EU–US Data Privacy Framework.
• Otherwise, the ICO's International Data Transfer Agreement, or the UK Addendum to the EU's standard contractual clauses, in the company's data processing terms.

You can ask us which safeguard applies to each company.

How long we keep it

While you have an account

Most of what you create (your profile, shares, messages, plans, reactions and settings) stays while your account exists, unless you delete it sooner. So do the places you've marked, until you remove them, and your blocks, until you lift them. So does some of what the imp works out: its labels and categories for your shares, and its suggestions. The imp's cards and notes have periods of their own (see Fixed periods).

Fixed periods

The imp's suggested links and itinerary stops, and its proposals for your standing requests, have no set period. They stay while your account exists, or while their plan does.

Travel documents have no set period either. Each one lasts as long as the stop or travel leg it's on, and goes with it, or with the plan. A file uploaded but never added to a plan is removed after a day.

Backups

Our database provider's plan keeps no backups. Data we delete doesn't survive in a backup.

When you delete your account

1. You confirm it's you: with your password, or with a 6-digit code we email you. You get the code if you don't use a password, or if you set yours in the last 14 days.
2. Your account is switched off at once. Nobody can sign in to it, every device is signed out within the hour, and you get no more notifications, only emails about your account. Until the erasure, your groups and plans still see your messages and shares.
3. We email you a link that keeps the account, which works until the erasure. If you lose the email, ask for a sign-in link in the app, or ask again on the deletion page, with the same address, and we'll send it again. If the link won't work for you, write to us from that address. Once we've checked it's really you, we can stop the deletion ourselves.
4. After 14 days, we erase your account. We delete your profile and age band, your messages, your personal shares and uploads, your plans and groups that nobody else is in, your calendar connection (and ask Google to withdraw our access), your location records, your devices, the places you've marked, and the travel documents you added, on every plan, shared ones included. We also delete your entries in our logs (the error log and the record of notifications sent among them), your usage counts, and any failed background job that names you. Log entries that can't be tied to your account expire on their own within 30 days. We also delete the notifications your messages and actions put in other people's inboxes, which carry your name and the start of your message.

Some things other people rely on stay, without your name:

• Groups you run and plans you made pass to another member, if anyone else is in them. For a group, that's another admin if there is one, then someone who has used the app in the last 30 days. For a plan, it's someone who said yes. The new owner is told that a member has left, not who.
• Links you shared into a group stay for the group, with your name and your caption removed. Stops you added to a plan stay too, without your name.

A record of what our staff did in the admin console is kept for a year, even after your account is erased. It can include the values an operator changed. Reports and complaints are kept for their own 12 months.

Your rights, and how to use them

You have the right to:

• access your data and get a copy;
• correct it if it's wrong;
• delete it;
• restrict how we use it, or object to how we use it;
• take it with you in a usable format (portability);
• withdraw consent where we rely on it;
• not be subject to decisions made solely by automated means that significantly affect you. We don't make any.

In the app:

• Download my data (Settings → Account) gives you one file with your profile, groups, shares, messages, plans, availability, votes, reactions, categories, bucket list, calendar connections (without access keys), standing requests, photos you added to plans (as links that work for an hour), location records, devices and the places you've marked. It doesn't include your plans' itineraries or travel documents.
• Delete account (Settings → Account), as described above.
• Privacy (Settings → Privacy): switch crash reports and analytics on or off.
• Safety (Settings → Safety): see and lift your blocks, and make a complaint.
• Edit your profile and settings, disconnect your calendar, change your notification settings, switch off nearby-phone watching, and change location permission in your phone's settings.

Without the app: you can ask for your account to be deleted at https://api.theimp.me/account/delete. Type the address you sign in with. If it has an account, we email that address a link that works once, for 10 minutes. Pressing the button on the page it opens switches the account off, as described above.

Everything else, including a full copy of what the imp has worked out about you (which the in-app download doesn't include): email hello@theimp.me from the address on your account. We'll reply within one month. We may need to check it's really you.

Complaints. If you're unhappy with how we've handled your data, please tell us first, from Settings → Safety in the app or at hello@theimp.me. We'll acknowledge your complaint within 30 days, look into it, and tell you what we found and what we've done. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator: ico.org.uk/make-a-complaint, 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Keeping it safe

• Everything travels over encrypted connections.
• Uploaded files are private, travel documents included. Only people who can see a share, a plan's photos or its travel documents are given a link to the file, and the link works for an hour.
• Your calendar access keys are stored encrypted. Links and codes we issue, such as links to a plan's web page and the codes and links for deleting or keeping your account, are stored only as one-way hashes.
• Setting or changing your password needs proof that it's you: your current password, a code we email you, or a sign-in link you've just used. A signed-in phone alone isn't enough.
• The app can't read or change the database directly, except to receive live updates for what you can already see. Everything else goes through our server, which checks you're allowed. The app can upload files only into your own private folder.
• When you sign out, or someone else signs in on the same phone, the app clears what it kept on the phone for your account, such as your plans, settings, the notifications it showed and the pictures it saved.
• Staff use a separate admin console with its own sign-in and roles, and what they do there is recorded and kept for a year.

No system is perfectly secure. If something goes wrong that puts your data at risk, we'll tell you and the ICO where the law requires.

Reports, blocks and complaints

imp.me lets people share things and talk to each other, so it gives you ways to deal with anything that goes wrong.

• Reporting. You can report a message, a share, a photo, a person, a group, a plan, or something the imp has said or suggested, from where you see it. A report reaches us with your reason, any details you add, and a copy of what you reported as it was at the time, so we can look at it even if it's changed or deleted later. Reports about a child's safety, self-harm or someone under 13 are flagged to us straight away. We may remove content, or switch off or delete an account.
• Blocking. You can block someone. They aren't told. They can't find you, invite you or start a direct conversation with you, their notifications don't reach you, and what they write or share is hidden from you. You can see and lift your blocks in Settings → Safety.
• Complaints. You can complain to us about anything on imp.me, including how we've handled a report or your data, from Settings → Safety, or by email to hello@theimp.me, which works without an account too. We'll acknowledge your complaint within 30 days, look into it, and tell you the outcome. One made in the app is acknowledged by email straight away.
• Who's responsible. Stuart Graves is responsible for safety on imp.me. Write to hello@theimp.me.

We keep reports and complaints, with the copy of what was reported, for 12 months after we close them.

Children

imp.me is for people aged 13 and over. When you sign up, we ask for the month and year you were born.

• If you're under 13, we don't create an account, and we don't keep anything you entered.
• If you're 13 or over, we don't keep your date of birth. We keep only your age band, and when you told us. If you're under 18, we also keep the month you'll turn 18, so we know when to change your settings, and we delete it when you do.
• If we find out that someone under 13 has an account, we delete it. If you think a child under 13 has an account, contact us.

Because people aged 13 to 17 can use imp.me, we follow the ICO's Age Appropriate Design Code (the Children's Code). If you're under 18:

• crash reports and analytics are off, and the app doesn't ask you about them;
• location stays off until you switch it on;
• Discoveries (the imp's suggestions of places and events, which use your interests and where you live) are off until you switch them on;
• non-urgent push notifications are held back during quiet hours;
• on a plan's public web page, you appear only as "a member", and nothing you've written is shown.

Some protections apply to everyone. Someone you don't share a group with can only send you an invitation to a plan, which you can accept or ignore. And someone who types your email address into a search doesn't see your name unless you already share a group.

The app also lets you record the birth years of children in your household, so the imp can suggest things that suit your family. This is optional. We use it only for suggestions, and it is deleted with your account.

Cookies and trackers

• The app doesn't use cookies. Its crash reports and analytics, which are off until you agree to them, are described in Crash reports and analytics.
• Our website, theimp.me, sets no cookies and loads no trackers or outside scripts. Its host, GitHub Pages, may log visitors' IP addresses for security.
• Our server's web pages (sign-in links, calendar connection, plan pages and account deletion) set no cookies.
• The admin console, used only by our staff, uses a sign-in cookie and a security cookie.

Changes to this policy

When we change how we use your data, we'll update this policy and the date at the top. If a change matters, we'll tell you in the app or by email before it takes effect. We keep earlier versions, and can send you one if you ask.

Contact us

imp.me is run by Stuart Graves. For anything in this policy, including requests about your data, complaints and online safety, email hello@theimp.me.