Privacy Policy

The people you save live in a database on your phone. Nothing in it is uploaded, synced, or backed up to us on its own — not in the background, not when you sign in, not ever. We do not hold a copy of your notebook and cannot go and get one.

Privacy is the default, and the rest is opt-in. Everything that would put any of your notebook on a server is off until you turn it on, one feature at a time, and each is described on this page. Turning one on sends exactly what that feature needs and nothing else; turning it off stops it, and what it kept is deleted. Nothing is ever sent because you signed in, updated the app, or left a setting alone.

An account is optional. Without one, we hold nothing about you. With one — for listing yourself at an event, claiming your links, or being showcased by a sponsor — we hold the little that those features need, described below, and never your notebook.

Some things you ask for cannot happen on a phone — sorting a spoken note into facts, searching the web for someone. Those send that one request to our service, which stores none of it, and on to the model and the search company that do the work. A web search sends only the search itself, written on your phone and shown to you first. The rest of this page is the detail behind those two sentences.

Names, your notes, the facts they become, photos you attach, events, who introduced you to whom, places and their coordinates, and the dates you met. All of it is written to the app's own database on the device.

If you have connected a calendar, the guest lists of the last three months and next two of your diary are read on the phone and kept there, so the app can tell you which people your invitations keep naming and let you add them, say who they are, or wave them off. Those lists, like the diary itself, never leave the phone; an address is written onto a person only when you say that invitation is them.

Google accounts that are not on your phone can be connected directly, for their calendars — one, or several, such as a work account and a personal one. Each is a sign-in with Google in the phone's own browser — we never see the password — and what Google hands back is kept in the phone's keychain and never sent to our service. With it, the app reads that account's calendar list and entries from Google's servers to your phone, and from there they are under the same rule as the phone's own diary: read on the phone, judged on the phone, never sent anywhere. Disconnecting an account revokes its sign-in with Google and deletes it from the phone, and leaves any others as they were; you can also withdraw any of them at myaccount.google.com/permissions.

If you use the Apple Watch app or the widget, the same data is shared to them through a private App Group on your device. It does not travel any further.

Your device backup may include this database, under Apple's terms rather than ours. That backup is between you and Apple.

Nothing is sent until you ask for something that needs it: sorting a note, looking someone up, finding a photo, rewriting a summary, drafting a message, or suggesting what to ask next time.

When you do, the request carries what that job needs. Sorting a note, rewriting a summary, drafting a message or suggesting what to ask carries the person's name, your summary and notes about them, the facts you have recorded, the place and date you met, the event if there was one, and who introduced you. What to ask next time, what you have in common, and the feed's lines about somebody carry only what you wrote yourself and, for a person with an &tag you are connected to, what their &tag says about them; nothing read off a web page goes, because they never gave you that. Odd one out, the game in Today's Knewspaper, carries the same for the handful of people that day's rounds could draw on, when you open it, so its clues can be written without a name or a word like "here" in them; what comes back is kept on your phone until your notes about that person change, and is not asked for again before then. Looking someone up carries only the search lines the app showed you, the name, and the pages you have already said yes or no to; finding more of their pages carries the pages you confirmed, the name and description those pages give, and their picture when it came from the web. Finding a photo carries the name and the confirmed pages. For a face search, the picture you chose.

Each request also carries a random identifier generated when the app was installed. It is used to rate-limit the service. It is not tied to you, your Apple ID, your device, or anything you have written, and clearing the app clears it.

The service has no database. It answers the request and keeps nothing. Its logs record that a request happened — the route, the status, how long it took, how many tokens it cost, and the first few characters of that random identifier — and never what was in it.

One request is not about a person. When the app opens, it asks Expo's update service (u.expo.dev) whether there is newer code for the build you have, so a fix can reach you between App Store releases. That check carries the build's version, the platform, the release channel, and the id of the code the app already holds — nothing about you, your phone, or your notebook — and a newer version is applied the next time the app opens.

Our service holds the keys for two companies that do the actual work, and the content of the request reaches them:

Anthropic, whose model reads what you sent and writes the summary, the facts, the questions, or the draft. Exa, a search company, which receives the search terms built from what you know about the person and returns matching public pages. What each of them does with a request is governed by their own terms, not by this page.

To read a page it found, the service fetches that page itself, the way a browser would. The site sees a request from us, not from you.

and.com, an identity platform, is asked by our service whether a card exists for a person's name when you open their Research tab or look them up: the name is the whole request, and and.com sees it come from us. A person who has a card there is found there and nowhere else: the app does not search the web for them, finding them costs nothing, and the moment their card is connected everything a search had found about them before — pages, sentences read off pages, a picture — is deleted from your phone, and their picture becomes the one on their card. Your own notes about them stay. If you have connected your own &tag, and the person has one, the app asks and.com, as you, whether the two of you are connected there and shows the answer on their page; sending or accepting a connection request happens only when you tap to, and and.com sees it as you.

Google Places is the third, and it only ever sees the coordinates or the place text described below. If you connect a Google account's calendar, Google also sees the calendar reads themselves, made by your phone directly under your own sign-in; our service is not in that path. Open-Meteo and Windy, for the weather and the city picture on the paper's banner, each see your rounded position from your phone directly, and nothing else.

You can sign in with Apple or Google. We never see a password. What we then keep, in a database hosted by Supabase: your email address as Apple or Google gives it to us (Apple can give us a private relay address instead), the name you choose to show, the links you claim — your LinkedIn, website and the like — and any photos you add to your account's photo library.

For each event you appear at, you choose how you appear there: one of your photos or none, a short bio or none, and which of your links show. Your photo library itself is visible only to you; a photo is shown to others only while an event you are listed or showcased at uses it. If you ask for help writing a bio, what you typed, your links and the event's name are sent to our service and its AI provider to write it, and are not kept.

Your claimed links are shown beside your name when you list yourself at an event, and are offered first when someone looks you up. They are assertions, not checked by us, and you can remove any of them at any time.

Signing in does not upload your notebook. Your account and your notebook stay separate things, and nothing crosses between them. If you subscribe to Pro and sign in, the subscription service records your account's id alongside your purchase so it follows you to a new phone.

Events on knewpeople are public: their name, place and time. An event you publish from the app is public the same way; that you published it is kept, but never shown.

Reports and blocks: if you report someone shown at an event, we keep the report — who it is about, the event, the reason you gave, and your account if you were signed in, so what you reported stays hidden for you — until it is resolved and for our records after. The person reported is never told who reported them. If you block someone, we keep that you did, so neither of you is shown the other; they are not told.

Listing yourself at an event is always your choice. It publishes your name and how you chose to appear there — the photo, bio and links you picked for that event — to anyone looking at that event, and nowhere else. Removing yourself takes effect everywhere at once: from then on no one is shown your listing, including people who kept you — they keep your name, and the photo you showed there, in their own notebook, as anyone keeps the name and face of someone they met, but no longer see your links.

An event's organizers and sponsors can invite people to be showcased there by sharing an invite link. Opening it in the app shows you the event and who is asking, and nothing about you is shown unless you say yes. Nobody needs your email address to invite you. (Requests made to an email address before invite links existed still work as they did: nothing is shown unless you accept, and a request you decline looks exactly like one nobody has answered.)

If you say yes, your chosen name and claimed links are shown at that event with the organizer's or sponsor's name, until you withdraw or they take you off. Sponsors pay through Stripe; nothing about you is sent to Stripe.

When a listed or showcased person's card is on your screen for half a second, or you keep them, the app sends a small count to us: which event, which listing or showcase, and a pseudonym made on your phone from a secret that never leaves it — different for every event, so it cannot link your views across events.

These counts are sent without your account attached, even when you are signed in. Sponsors and organizers see totals, never who, and totals under five are held back.

A lookup is two or three ordinary web searches, written on your phone from what you know and shown to you before anything is sent. You can change them. The search lines are the only thing about the person that leaves the phone; your notes and facts stay. What comes back is people the web has under that name, each with a picture, for you to recognise — nothing is decided for you.

Everything it finds is a suggestion until you confirm it. Nothing is attached to a person until you say it is them, and saying it is not them is remembered so the same wrong match is not offered again. What is kept is pages — a profile, a personal site, an article — never sentences read off them: the app does not write down what a page says about somebody.

Results come from public web pages and can be wrong, stale, or about somebody else entirely. Treat them as a lead, never as a fact about a real person.

With permission, the app reads your position while it is open, for two things: suggesting the place you are standing in when you add someone, and showing who you have met nearby.

There is no background location and no location history beyond the places you deliberately save with a person. You can refuse or revoke the permission; you then pick places by typing instead.

To turn coordinates into a place name, and to offer suggestions as you type one, the app calls the Google Places API with the coordinates or the text you typed. What you have written about a person is never part of that call. Google's handling is covered by the Google Privacy Policy at policies.google.com/privacy.

The front page of The Daily Knews prints the weather beside the date. When location is allowed and the app already has a fix, your position rounded to about a kilometre is sent to Open-Meteo, a weather service, and nothing else goes with it; it is kept on the phone for a few hours. Without location there is no weather, and nothing is asked for on the paper's account.

Behind the paper's banner on the home screen is a recent still of your city from a public webcam, so the banner shows the morning or evening you are in. It is found the same way as the weather: your position rounded to about a kilometre is sent to Windy's webcam service, and nothing else goes with it; the nearest public camera is remembered on the phone for a day and its picture refreshed from there. Without location there is no picture.

Everything the app tells you is scheduled on your phone, from the notebook and the diary already there, and none of it is sent by us: the morning after an occasion, a note before something in your diary starts, a question after it ends, and The Daily Knews in the morning. We never learn that one was booked, shown or opened. Because a notification shows only on your own lock screen, it may name a person or a diary entry — the same words the diary's own prompt uses — and nothing in it leaves the phone. Each kind is a switch in Account, and turning one off cancels what is already booked.

The Daily Knews is written on your phone. Who you will probably see today comes from your own record — who you expected, who hosts, who was at the last one of these, who the invitation names, which crew the occasion is — and what to keep in mind is read off that record: when you last saw somebody and how often, the questions and topics already suggested on their page, and the line a group's news gave you to say. Nothing is sent to compose it. The one exception is a person whose &tag you have connected, whose suggested questions are refreshed by asking and.com, as you, as they are on their page; and.com sees your notes about them and nothing about your day.

The address book on your phone is read only when you open a picker and choose one card. It is written to in one case only: when an invitation gave you somebody's address and they are linked to a card, the app offers to put that address on the card, and does so only if you say yes. Three things use it: naming who introduced you to someone; linking a person in your notebook to their card; and adding somebody you already know as a person, which copies the card's name and picture into the notebook.

Nothing from a card is sent anywhere. A linked card is stored as its identifier, on the device. A phone number or email is read off the card at the moment you tap to text them and is never written down. One thing is: if you have put somebody's &tag on their card as a social profile, it is read off the card and kept on their page as their &tag, because that is you saying where they are found. The app never pages through the whole address book, and nothing in it is matched against anybody else's.

A photo you pick or take is used for one search — matching a face against the people you have already met — and is not saved to your library or kept by us after the request.

Photos you deliberately attach to a person are stored on your phone with the rest of that person's record.

A face drawn from a description is not a photo and not stored as one: the sentence you type becomes a handful of drawing choices (a skin tone if you named one, a hairstyle and colour, glasses, a beard) kept on your phone. Your phone reads the sentence itself where it can; otherwise that one sentence — never the person's name — is sent to our service to be read, and is not kept. A backdrop is a picture of your own kept on your phone. If you ask for Street View of the place where you met them, that place's coordinates are sent to Google to fetch the picture, and nothing about the person goes with it.

When you describe someone out loud, the app uses the operating system's speech recognition to turn speech into text. Depending on your device, your settings, and the language, Apple may perform that transcription on the device or on Apple's servers. That step is Apple's, governed by Apple's privacy policy.

The text it produces is yours and is handled like anything you typed.

The knewpeople app inside Messages (Pro) writes what you type into the notebook on the phone and sends nothing. It cannot read your messages, and it does not learn who a conversation is with; it remembers only which person in your notebook you picked for a thread, on the phone.

Siri commands (Pro) run on the phone against the notebook there. Siri hears what you say, including a person's name, and handles that the way Siri handles any request; the command itself reads and writes your notebook on the phone and reaches no server of ours.

No passwords — signing in is Apple's or Google's. No analytics, no crash reporting SDK, no advertising identifiers, no third-party trackers. Nothing is sold or shared. There is no opt-out because none of it is switched on.

Delete a fact, a person, or the app, and it is gone from the device. There is no deletion request to send for your notebook, because we do not hold it — except for anything you have deliberately shared with someone, which you take back in the app by unsharing it or by disconnecting, and which is then deleted on our side.

If you made an account, delete it in the app under Account → Delete account. That deletes the account and everything above straight away: your name, your claimed links, your photos, how you appeared at each event, your event listings and any showcases you accepted. An event you published stays public until it ends, but no longer points at you.

A Pro subscription belongs to your Apple ID and is not cancelled by deleting the account; manage it in Settings. If you cannot get into the app, write to hello@knewpeople.com from the address on the account and we will delete it for you.

knewpeople is not directed at children under 13 and does not knowingly collect information from them.

If this policy changes, the date at the top changes with it. Questions: hello@knewpeople.com