Privacy policy

Summary

• GC reads only messages that start with “GC”, answers them, and keeps no chat history.
• Receipt photos are processed in memory to split the bill and are not stored in our systems.
• We keep a small set of group settings and short-lived tasks, and erase them when your group stops using GC.
• We never sell your information or use it for ads. Promotions and affiliate links are off in this release.
• We keep a hashed consent record for 4 years and safety records for up to 90 days, as described below. Our providers follow their own retention limits.

Privacy policy

This policy explains how Obrize LLC (“we”, “us”) handles information on the textgroupchat.com website and in GC, our assistant for iMessage group chats (together, the “Services”).

GC is not live yet. Today, only this website runs. This policy describes how the website works now and how GC will work at launch.

Changes to this privacy policy

If we change this policy in a meaningful way, we update the date above and tell you in a message from GC.

Collection and use of information

We collect as little as we can. We use information only to run the Services you ask for, keep them safe, honor your choices, and meet legal duties. We never sell your information, share it for advertising, or use it to build ad profiles.

Information you directly provide us

• Answers to GC’s questions, such as the welcome’s age question, your group’s city, and quiet hours. Every current member must answer the welcome’s age-and-message-consent question before initial service starts.
• A nickname, only if a member sets one for themselves.
• Receipt photos you send to split a bill. They are read in memory to answer you and are not kept in our application storage.
• Opt-in and opt-out answers for promotions and affiliate links, if that feature is ever turned on.
• Emails you send to our contact address.

Information collected through your use of GC

• Your messages. GC processes a message in memory to answer it, then drops it. It keeps no chat history.
• Group settings: city or area, timezone, quiet hours, and group size.
• Open tasks for a short time: a poll, a plan and its reminder, a bill split, or a question GC just asked. Polls last up to 24 hours, splits up to 2 hours, questions up to 120 seconds, and plans through the event plus 2 hours, within the seven-date planning window. Separate marketing questions may last 24 hours. The initial age question lasts at most 14 days, with one reminder after 7 days where sending is permitted. Ordinary group replies are held immediately when a new member joins; after 24 hours without an answer, the group is marked paused.
• Encrypted reply routing, group-local pseudonyms for votes and limits, security controls, and minimal safety suppression. No saved cuisine, activity, budget, or other likes.
• Current age and message-consent acceptance records, kept only for membership/group lifetime and at most four years without renewed assent. Stopped-group controls expire after 30 days.

Information from place and event services

To find places and events, GC sends only public search details, never group or member identifiers or chat history:

• Google Places receives public business identifiers and bounded public-area queries for live checks of hours and ratings.
• Brave Search receives redacted public event searches.
• Ticketmaster Discovery receives public event category, area, and date requests.
• Overture Maps and Foursquare provide the public business catalog. They receive no chat requests. We exclude personal contact fields and provide source licenses and notices on the attribution page.

Information we collect automatically

This website uses no cookies, analytics, or tracking pixels, and we keep no IP logs, device fingerprints, or per-person click histories on the website or in our redirect service.

Network endpoints still process IP addresses to communicate. Cloudflare hosts this website and processes visitor IP addresses to deliver it. For abuse defense, our service may hold a rotating IP hash in memory for up to five minutes, never in logs or the database.

Information collected from other sources

Linq, our messaging provider, delivers group messages and gives us the phone numbers, group membership, and media needed to deliver GC’s replies. Fetching a photo does not itself delete it at Linq; supported deletion requests and contractual retention controls apply.

Deidentified and aggregate information

We use restricted statistical counters to estimate usage and publish privacy-protected totals with small counts hidden. These safeguards reduce identification risk; the underlying counters are not claimed to be anonymous. Daily buckets last up to 31 days and cumulative counters up to 365 days. Member or group erasure resets them. Sponsors, if any, receive only approved totals, never names, numbers, or messages.

Cookies and other tracking technologies

We don’t use cookies or similar tracking on this website or in our link redirects. Event-link continuation uses a one-use nonce held in memory for up to 120 seconds. Link destinations and total continuation counts expire within 24 hours or at the event start, whichever is sooner, and are excluded from backups. Sellers and affiliate services may use their own tracking after you continue to their site, under their own policies.

Promotions and affiliate links

Promotions and affiliate links are inactive in this release pending the required legal and retention changes. If enabled later, after 30 days from completed onboarding and at least two real requests during those days, a one-time notice names the sender and sellers and asks each member to reply “opt in” for both features. At most one promotion in any seven days, during permitted hours. Affiliate links appear only in requested event replies and say “we may earn a commission”. No or silence never changes service; “opt out of offers”, “GC, offers off”, or a clear offers-only refusal stops both; an unqualified “opt out” stops GC. STOP stops GC. Our first-party event link displays a continue button, and previews never automatically follow an affiliate URL. We keep only shared destinations, expiry, and an aggregate continuation count, with no group or person tracking.

Disclosure of your information

We share information only with providers that run the Services for us, under contracts that limit use and retention:

• Linq, which delivers group messages and processes phone numbers and media.
• Anthropic, which processes the current redacted request or sanitized receipt. Approved zero-data-retention arrangements are required before live use; legal and safety exceptions can still apply.
• Google Places, Brave Search, and Ticketmaster Discovery, which receive only the public search details described above.
• DigitalOcean, which hosts the GC service with separate protected roles and retention controls.
• Cloudflare, which hosts this website and our domain’s DNS.
• Authorities, when the law requires it, or to protect people’s safety.

Third-party websites and links

GC’s replies and this website may link to other sites, such as a restaurant, an event page, or a ticket seller. Their own privacy policies apply once you leave our Services.

How long we keep information

• Open tasks: until the deadlines listed above.
• Incomplete initial onboarding: GC erases the group’s saved state and tries to leave after 14 days. At most one reminder may be sent after 7 days, where permitted. A newcomer answers individually without resetting existing members’ setup.
• Groups that stop using GC: after 30 days without a real GC request, we erase saved group data and try to remove GC. An open split or a future requested reminder postpones the clock until that task ends. We allow at most 24 extra hours for one goodbye during permitted hours, then erase even if no goodbye can be sent. If automatic removal is unsupported, GC stops replying and explains manual removal. A verified return starts fresh onboarding.
• Consent and revocation record: a purpose-keyed hash of each verified phone number, the consent text version, the answer, and the time, kept for 4 years so we can prove consent if asked. It is pseudonymous, not anonymous: a stolen key could allow phone-number guessing. It remains after group deletion until its own expiry, with restricted access.
• Safety suppression: separate keyed group-route and phone-number service-revocation indices last up to 90 days. The number-local index helps stop messages to a recipient across groups. We also check independent full-service revocation proof for up to four years, so index expiry does not turn GC back on. We keep no cross-group membership index. START renews service only in the current group and does not erase those revocation records or restore marketing consent.
• Current Yes/START service acceptance is separate from the four-field consent and revocation ledger. It records only current group-local acceptance and notice/times, expires with membership or group deletion, and needs renewal after at most four years.

Your choices and rights

• “GC, what do you know about us?” shows the group-visible state categories. This policy also lists operational records and the separate consent-proof exception.
• “GC, forget me” erases your own nickname and group-linked member state, with the same legal-proof exception.
• “GC, forget us” erases saved group state within five minutes, preserving separate consent proof and safety suppression for their stated periods.
• STOP stops GC immediately, except for one nonmarketing confirmation. It does not erase saved settings yet. A whole-message Delete while stopped erases the group without another reply; otherwise erasure happens after 30 days. START works only for the person who stopped GC while they remain in the group. It renews their agreement to GC’s replies and requested reminders under the current service notice, never restores promotions, and cannot override another person’s stop. If the prior acceptance was erased or expired, START opens an approved age/service question; answer Yes, then send START again. Unverified or stale message ordering cannot restart GC.
• A whole STOP keyword, an addressed request for GC to stop, or a clear request such as “please stop” or “stop texting me” stops group messages without a special prefix. A stop phrase clearly addressed to another person does not delete or stop the group; we quietly pause that sender’s promotion and affiliate eligibility. Ordinary phrases such as “I can’t stop laughing” do nothing. We keep only a static event category in operational logs, never the message text.
• For anything else, email hello@textgroupchat.com. We honor these rights for everyone, wherever you live.

Children’s privacy

GC is for adults 18 and over. We don’t knowingly collect information from anyone under 18. If GC learns a member is under 18, it stops and erases the group’s data.

Data security

Data is encrypted in transit and at rest, each group has its own key, and incoming messages are verified. No system is perfectly secure. If a breach affects you, we will tell you as the law requires.

How to contact us

Obrize LLC · hello@textgroupchat.com