Privacy Policy

Last updated: 27 August 2026

imDown is a small app for making plans with people you already know. This policy explains exactly what it collects, why, and what it deliberately does not keep. It is written to be read, not to be survived.

Who we are

imDown is operated by Lukas Lechau. You can reach a human at llechau12@gmail.com.

What we collect

• Account details. Your email address, and your name if you sign in with Apple or Google. Plus the username, display name, bio and profile photo you choose.
• Your phone number — as a fingerprint, not a number. We verify it by SMS, then store only an irreversible SHA-256 hash of it. The number itself is never written to our database. See below.
• Contacts, if you allow it. Used only to find which of your contacts already use imDown, and to let you text an invite. See below — this one matters.
• What you post. Plans, responses, comments, chat messages and any photos you attach.
• Your school, if you use Campus. We verify a .edu address by emailing you a code, then record which school you belong to. We do not store the .edu address itself after verification.
• Device tokens for push notifications, if you turn them on.
• Crash and error diagnostics, so we can fix what breaks.

Contacts: what actually happens

If you choose to sync contacts, phone numbers are hashed on your device. Only those hashes are sent to us, and they are compared against the hashes of people who already use imDown.

Hashes that do not match are discarded immediately and never stored. We do not build a copy of your address book, we do not keep the names in it, and we never upload raw phone numbers.

Contact sync is entirely optional. You can skip it during sign-up and use the app normally, and you can revoke access at any time in iOS Settings.

Invites are sent by you, not by us

When you invite someone who is not on imDown, your own Messages app opens with the text and recipients filled in. You review it and you send it, from your number. imDown never sends text messages on your behalf and never messages people who have not heard from you.

How we use it

• To run your account and sign you in
• To show your plans, responses and messages to the people you shared them with
• To notify you when something happens in a plan or chat you are part of
• To find which of your contacts already use imDown, if you asked us to
• To keep the app working and to investigate crashes

We do not sell your personal information. We do not share it with advertisers. There is no advertising in imDown, and we do not track you across other apps or websites.

What other people can see

Plans are visible to the audience you pick — all your friends, a group, or specific people. Campus posts are visible to verified members of your school, and may be posted anonymously; when you post anonymously, your identity is withheld from other users by the server, not merely hidden in the app.

Your profile — username, display name, photo and bio — is visible to people you are connected to and to people who find you in search.

How long we keep things

• Plans expire automatically 24 hours after posting. That is the point of the app, not a cleanup job.
• Group chats that a plan created outlive the plan, so you can still coordinate.
• Account data is kept while your account exists.
• Reports made to moderators are retained while they are reviewed, including a snapshot of the reported content, so a report is still reviewable if the content is deleted.

Deleting your account

You can delete your account and its data from inside the app: Profile → Delete account. It is permanent and takes effect immediately — your posts, responses, friendships and messages are removed. You do not need to email anyone to do it.

Safety and moderation

You can report or block any person, plan, chat message or campus post from inside the app. Reports go to a human moderator. Campus posts are additionally screened by an automated moderation service before anyone else can see them.

Who we share data with

Only the service providers that make the app work:

• Supabase (hosted on AWS) — database, authentication and file storage
• Twilio — sends the SMS code that verifies your phone number
• Resend — sends account and campus verification emails
• Apple Push Notification service — delivers notifications
• Sentry — crash and error diagnostics
• OpenAI — automated screening of campus posts before publication

Each of these receives only what it needs to perform that function.

Children

imDown is not intended for anyone under 13, and we do not knowingly collect information from children under 13. If you believe a child under 13 has created an account, email us and we will delete it.

Your rights

You can view and edit your profile in the app, delete your account at any time, and revoke contacts, notification and photo permissions in iOS Settings. If you are in a place with additional rights over your data — such as the EEA, the UK, or California — you may request a copy of your data or its deletion by emailing us, and we will respond.

Changes

If this policy changes in a way that affects you, we will update the date at the top and, where the change is significant, tell you in the app.

Contact

Questions, requests, or something we got wrong: llechau12@gmail.com.