Who is responsible for your data
Timefolk, Inc. is the controller of your personal data. Write to privacy@timefolk.com about anything in this notice or to use any of your rights.
What we collect and why
Identity: your government identity document, a selfie for the liveness check and, where asked, your phone number are collected and checked by Didit, our identity verification provider, on Didit's own systems (see "Who else receives your data" below). Timefolk never receives or stores the document images, the selfie, or any biometric template. Didit sends us the result, and we keep: the decision and its date, Didit's reference for your check, the reasons given if a check is declined, your name, date of birth and gender as read from the document, the country that issued it, your age band, and your phone number if it was confirmed during the check.
Of those, two are shown to other members: your age band, and the country that issued your document, which appears as a flag and which we call your nationality. Your name is not shown to other members unless you choose to show it with a Timefolk Membership, and the images never leave Didit. Your gender is never shown to anyone: it is used only to assign a Folk of the same gender when a Client asks for one.
Where your nationality appears, and to whom. On an Expert profile it is public, next to the city they run sessions in, and Clients can narrow a list of Experts by it. On a session, each side sees the other's from the moment the session is confirmed, never before: an expert deciding whether to accept is not shown it, because that is a decision we will not let nationality into. If a Folk is assigned, they are given both, with the venue, on confirmation, for one reason only: if something goes wrong it decides which emergency or consular help applies.
Experts are never given any way to search, sort or filter clients by nationality, and we do not offer it as a reason to decline a session.
If you would rather your nationality was not displayed, write to privacy@timefolk.com and we will hide it everywhere listed above, including from a Folk. Offering sessions, scheduling them and verification all remain available either way.
Account: your display name, email, and phone number. Phone and email are stored hashed where they are used only for matching.
Location: an approximate area roughly 1 to 2 km across. We never collect or store precise location, never track movements, and never build a location history. The app works fully with location permission denied.
Experts on the map: if you are an Expert and turn on Show me on the map, Clients see your username, photo, skills and session fee on the area you chose, placed about 1 km round, never your live location. It is off until you turn it on, and you can turn it off at any time in your Expert settings.
Sessions and payments: what you scheduled, when, where, for how long, and what it cost.
Safety: messages tied to a session or to a question you asked an Expert, the reasons any message was refused, check-in records, and reports.
Looks: if you are an Expert, the photos of your work you add to your page, the labels you pick for them, and your tick that the work is yours and that anyone shown agreed. Looks photos are shown on your Expert page once they pass our checks.
Event reviews: the face you pick to rate an event and the tags you choose. Other members see them with your username, and the event shows an overall rating.
Credits proofs: if you ask for "Credits checked", the 1 to 3 files you send to show your name on your work, such as a contract, invoice or screen credit. Only our review team sees them. Members only see "Credits checked" and the kinds of work, never the files or a client's name.
What we never show publicly
Your government name, home or work address, live location, phone number, email address, identity document, bank details, full date of birth, movement history, or private social media handles.
Photos
Photos are stored privately, delivered at reduced size through short-lived links tied to your session, and stripped of camera and GPS metadata before anyone sees them.
Each copy carries an invisible mark identifying who was shown it, so a leak can be traced. We detect screen capture where your device allows it.
We cannot prevent someone photographing their screen with another camera, and on some devices we cannot prevent screenshots at all. Only upload photos you would be comfortable having seen outside Timefolk.
Who else receives your data (our processors)
Didit (identity and phone verification): your identity document, a selfie, and your phone number. The check runs on Didit's systems; Timefolk receives the outcome, your name, date of birth, nationality and gender, never the images.
Twilio (verification codes): your phone number and the one-time codes we send you by SMS.
Prelude (verification codes): your phone number and the one-time codes we send you, in countries where Twilio cannot deliver them.
Stripe (payments and expert payouts): card details are entered into Stripe's own fields and never reach our servers. A card you choose to save is kept by Stripe; we keep only its brand, last four digits and expiry. Experts' payout identity and bank details are collected by Stripe.
Resend (transactional email): your email address and the content of the emails we send you.
Google Cloud Vision (photo safety checks): photographs you upload are sent to Google to be checked for explicit content and for whether the same image already appears elsewhere on the web. Google acts on our instructions and does not use them to train its own models. The result is a decision on the photograph; we do not receive a face template and we do not use face recognition to identify or match anybody.
Anthropic (SI: Claude, through Anthropic's own service, with Amazon Web Services Bedrock as a fallback when it is unavailable): only to do these jobs, and the first three only after you have accepted this policy: (1) Search: the sentence you type into search, with your city, so we can find the right skills and Experts; your account is not sent. (2) Support: your support messages and the conversation so far, with the account facts needed to answer them (your account status, country and city, whether you are an Expert, your identity check status, your membership, and your recent sessions and payouts with their amounts), so we can draft a reply; a person checks anything it is unsure of. (3) Safety refunds: if you ask for a refund for a safety reason, your statement, the text read from screenshots you attach, and the replies of the other member and any Folk, to help us decide it. (4) Listings: the public text of Expert skills, signature skills and events (titles, descriptions, About text and boundaries) and descriptive labels of event pictures, checked against our Community Standards. It never receives photographs, your name, email address or phone number from your account, and a person decides anything it cannot. Anthropic does not use this data to train its models. If you do not accept, search works by word matching and support replies come from our written answers or a person.
OpenStreetMap Foundation (address and place lookup): the text you type into an address or place box, so we can turn it into a location. Your name and account are not sent with it.
Google Places (place details): the name or address of a place you are searching for, to confirm it exists and is open to the public.
NOWPayments (digital-currency payments and payouts, only if you choose one): for a payout, your payout wallet address and the amount, used only for experts and Folks who opt into this rail instead of a bank transfer; for a payment, the amount and the session reference.
Google Firebase (Android app only): Firebase Cloud Messaging delivers push notifications to your phone using a device token. Firebase Analytics records when you sign up and when you send a session request, together with Firebase's automatic app events (such as first open and session start), an app-instance identifier, your device model, operating system, app version and approximate country, so we can measure which installs go on to use Timefolk, including installs from our Google Ads campaigns. No name, email address, phone number, session fee or other member is sent, the advertising ID is not collected, and ad personalisation signals are off. We can switch analytics off from our server, which also stops collection on your phone.
Google Ads (sign-ups from our ads): if you reach Timefolk by tapping one of our Google ads, Google adds a click code to the link. If you then create an account, our server sends Google Ads that click code, the time you signed up and the fact that a sign-up happened, so we can see which ads bring new members and stop paying for the ones that do not. No name, email address, phone number, session fee or anything else about you is sent. This applies only to accounts created on or after 17 October 2026, and you can ask us to stop at any time by writing to hello@timefolk.com.
Meta pixel and Conversions API (website only, with your consent): if you choose Allow in the cookie note, our website tells Meta when you view a page or tap an app store button, and our server tells Meta when you create an account or schedule a session on our website, with your email address in hashed form. This lets us see which of our ads bring people to Timefolk. Meta may link this to your Meta account under Meta's own privacy policy. If you are in California, choosing Allow may count as "sharing" for advertising under California law. Choose No thanks, or change your choice any time under Cookie settings, and nothing is sent.
Google, Apple and Meta (only if you sign in with them): a sign-in request, which returns your name and email address to us. We never receive your password, and we do not post anything or read your contacts.
Amazon Web Services, United States (Northern California) region (hosting): our servers and encrypted backups run there. If you are outside the United States, your data is transferred there; we rely on standard contractual clauses or equivalent safeguards where the law requires them.
IP geolocation: we resolve your IP address to a country using a table stored on our own server (data by DB-IP, CC BY 4.0). The IP address is not sent to any third party for this and is not stored; only the resolved country is used.
We do not sell personal data, do not use advertising identifiers, and do not do cross-app tracking. Apart from Firebase Analytics in the Android app, the Google Ads sign-up report and the Meta pixel on our website (only if you choose Allow), all described above, we do not use third-party analytics or advertising tools.
Our legal bases (EU / UK)
Performance of a contract: account, sessions, payments and support.
Legal obligation: identity and age verification, financial record-keeping, tax reporting, responding to lawful requests.
Legitimate interests: safety, fraud prevention (for example comparing your declared country with your IP country and your document country), security logging, service improvement. You may object at any time.
Consent: optional location access on your device, marketing (none at present), and any use we would otherwise have no basis for.
Security
Data in transit is encrypted (TLS 1.2 or later, HSTS). Passwords are hashed with scrypt; verification codes and email addresses in logs are hashed. Access to production is by key only, and the server runs sandboxed with a host firewall and intrusion banning.
Backups are encrypted with a key held separately from the backups and kept for 14 days.
If a breach is likely to affect your rights, we will notify you and the relevant authority without undue delay, and within 72 hours where the law requires it.
Your rights
Access and export, correction, deletion, and withdrawal of consent, from inside the app, plus a web page for deletion.
Withdrawing consent for the verification that gates access means losing access. We would rather say that plainly than bury it.
You can withdraw your consent at any time, as easily as you gave it, in the app or by writing to privacy@timefolk.com. Withdrawing it does not affect anything done before you withdrew it.
You can complain to us at any time, and to your local data protection authority.
California residents: you have the rights to know, delete, correct, and to opt out of sale or sharing (we do none), and not to be discriminated against for exercising them. Requests: privacy@timefolk.com. We respond within 45 days.
Brazil (LGPD), India (DPDP Act), Australia, Canada and other regions: you have equivalent rights of access, correction and deletion under your local law, exercisable through the same channels.
We do not knowingly collect data from anyone under 18; if we learn we have, we delete the account and the data.
What we keep after you delete your account
Session, session fee and payment records: legal obligation, for the statutory retention period.
Safety case evidence involving you: legal claims and protecting others, for case close plus 24 months, or until a legal hold lifts.
Your verification reference (and a document hash, where an older check recorded one): to stop a removed account returning, for the account plus 12 months, or indefinitely if you were banned.
Enforcement and audit records: accountability and regulatory reporting, for 7 years, append-only.
Looks photos and credits proofs: kept while your account is open. You can delete a look at any time, and its photos are deleted from our storage straight away. When you delete your account, your Looks, credits and event reviews stop being shown to anyone at once.
Event reviews: kept while your account is open, so an event keeps its overall rating. Reported or removed reviews are kept as safety case evidence for as long as that case needs them.
We show you this list on screen before you confirm deletion, not afterwards.
This policy is in force from 2026-11-07 (version 2026-11-07.1). The version you accepted is recorded against your account. Nothing here is legal advice, and it does not remove rights given to you by the consumer law of the country you live in. Questions: legal@timefolk.com.
