Privacy Policy

FriendsWithTools is operated by FriendsWithTools LLC, a Colorado limited liability company ("we," "our," or "us"). We provide a private, invitation based platform that helps people coordinate the sharing of tools with people they know.

This policy explains what we collect, how we use it, and what choices you have.

Contact

FriendsWithTools LLC 1500 N Grant St #5939 Denver, CO 80203 [email protected]

2.1 Information you provide

• Email address, required to create an account and sign in.
• Full name and display name, both optional.
• Profile photo or avatar, optional.
• Phone number, optional, and needed only if you turn on SMS notifications. Stored in E.164 international format.
• Tool information, including names, descriptions, categories, photos, brand, model, battery platform, condition, purchase date, purchase price, replacement value, serial number, warranty expiry and specifications. Under the California Consumer Privacy Act this is commercial information, meaning records of personal property. We collect it so people in your groups can find and borrow the right tool.
• Group information, including group names and descriptions.
• Messages. Direct messages about a specific tool, and group chat messages in the groups you belong to. See section 6.
• Borrowing agreements you create, including terms, return dates and replacement values.
• Waiver signatures on the Commercial tier, including the date signed, your IP address, and a stored copy of the exact waiver text you signed.
• Location, optional. See section 7.
• Records of your acceptance of these documents, including which version you accepted and when.

2.2 Information collected automatically

• IP address, through our infrastructure providers.
• Authentication tokens and session identifiers.
• Push notification tokens, if you turn push notifications on.
• Error and crash data, including stack traces, device type, operating system version, app version and an anonymous user identifier. See sections 5 and 9 for where this is processed, including outside the United States.

2.3 Information we do not collect

We do not collect:

• Physical addresses
• Contact lists or address books
• Financial or payment card information. Payments are processed by Stripe, Apple or Google, and we never see your card number
• Health information
• Browsing or search history outside the Service
• Biometric data
• Advertising identifiers such as Apple's IDFA or Google's Advertising ID

We do not use advertising or analytics trackers and we do not work with ad networks. Nothing about you is sold or shared with advertisers.

We use what we collect to:

• Provide and operate the Service
• Run private groups and coordinate tool sharing
• Authenticate users and secure accounts
• Show your content to the people you chose to share it with
• Send notifications you asked for, in app, by push, by email or by SMS
• Process subscription billing and manage your plan
• Find members near you if you turn on Nearby discovery
• Deliver SMS messages, including verification codes and borrowing alerts
• Keep the Service safe and working
• Find and fix software errors
• Meet legal obligations

We do not sell your personal data. We do not share personal data for advertising. We do not use your content to train machine learning models.

FriendsWithTools helps people who already know each other, or who have both opted into Nearby discovery, coordinate with each other. All physical exchanges happen offline, outside the Service.

We are not a party to any agreement or exchange between users and we do not settle disputes. Borrowing agreements and waivers created through the Service are between the participating users.

• Supabase. Authentication, database and file storage. United States.
• Fly.io. Application hosting. United States, Ashburn, Virginia.
• Cloudflare. Content delivery and edge security. Global edge network, so requests are handled at the location nearest the visitor.
• Infisical. Secrets management. No user content.
• Stripe. Subscription billing and payment processing. We receive your customer identifier, subscription status and billing period dates. We never receive or store your card number.
• RevenueCat. Purchase validation for Apple and Google subscriptions. Receives an anonymous user identifier and purchase receipts.
• Twilio. SMS delivery. Receives your phone number and message content only to send messages on our behalf.
• Resend. Transactional and support email delivery. Receives your email address and the contents of the message we send you or you send our support team.
• Firebase (Google). Push delivery, crash reporting and feature configuration.
• Apple Push Notification Service. Push delivery to iOS devices.
• Sentry. Error tracking on our web application. Our Sentry project is hosted in Sentry's European Union data region, in Germany. Sentry receives technical context about errors, including stack traces, request details and an anonymous user identifier. Sentry does not receive your name, email address, phone number, tool data or location.

These providers process data only as needed to provide their service to us.

Tool manufacturers. We do not sell, share or disclose your tool ownership data or brand preferences to tool manufacturers, brand owners or their representatives.

There are two kinds of conversation on the Service.

• Direct messages are about one tool, between the owner and the person borrowing it.
• Group chat is one shared conversation per group. Every member of that group can read it.

Who can read what. Direct messages are readable by the two participants. Group chat messages are readable by every member of that group, including members who join after a message was posted.

Deleted messages, and what deletion actually does. You can delete a message you sent. A group admin can delete any message in their group. In both cases the message stops being visible to members and is shown as removed.

The original text is not erased. It is moved to a separate record that group admins of that group can read. The person who wrote the message cannot read it back after deleting it, but a group admin can. We keep it so admins can handle reports of abuse and see what was removed from a group they are responsible for.

If you would rather a message not exist in that record at all, do not post it. Deletion in group chat is a removal from view, not an erasure. When you delete your account, these records are removed under section 10.

Muting. You can mute notifications for a group's chat. Muting stops the notification record being created on our side, so it does more than silence the alert on your device.

If you use Nearby features, you can share your location:

• How we collect it. From your device's location service, by placing a pin on a map, or by entering a postal code. This is optional and off by default.
• Precision. The mobile app rounds your coordinates to four decimal places, roughly 11 metres, before storing them. Most state privacy laws treat anything that locates a person within about 1,750 feet as precise geolocation, so we treat your coordinates as sensitive data even though they are rounded.
• How we use it. To find other members near you who have also opted in.
• What other members see. An approximate distance, not your coordinates and not your address.
• Not attached to tools. We do not attach location or distance to tool listings, and we do not show maps of tools.
• Turning it off. You can turn off Nearby discovery and remove your stored location at any time in your settings.
• Consent. Because precise location is sensitive under several state laws, we ask you to opt in before collecting it and we record that you did.

• Opt in. Push notifications need your permission through your device.
• What we send. Borrow requests, loan updates, due date reminders, and messages from other users.
• How they work. We store a device token from Apple or Google and use it to deliver notifications. These tokens contain no personal information.
• Opt out. Turn them off in your device settings or in the app.

Your account data, tool listings, photos, messages and location are stored in the United States.

Two exceptions, both limited to technical diagnostic data, and neither containing your name, email address, phone number, tool data or location:

• Sentry. Our web error monitoring project is hosted in Sentry's European Union data region, in Germany.
• Cloudflare. As a global content delivery network, Cloudflare handles requests at the edge location nearest the visitor.

If we materially change where personal data is stored, we will update this policy and tell you before the change takes effect.

You can ask us to delete your account and its data at any time, in the app or by writing to the address in section 1.

Category	How long we keep it
Account profile, tools, groups	Life of the account, removed from active systems when the account is deleted
Messages, including group chat	Life of the account. A message you send to a group remains visible to that group until you or an admin deletes it
Records of deleted group messages	Kept while the group exists so admins can review moderation. Removed when your account is deleted
Flagged listing text in the review queue	Kept while the review item is open and for audit afterwards. Removed when your account is deleted
Tool ownership and brand preference data	Deleted or anonymised within 30 days of account deletion
Phone number	Deleted from your profile when you remove it or delete your account. Masked records showing the last four digits are kept in SMS logs for up to 90 days for billing
Location coordinates	Removed from active systems when you turn off Nearby discovery or delete your account
Waiver signature records, Commercial tier	Kept as evidentiary records of an agreement between two users. Retained for 7 years or as the signing organisation requires
Loan and borrow request history	Anonymised records may be kept for billing reconciliation and audit
Error and crash reports	Per our providers' retention settings, currently 90 days
Backups containing deleted data	Purged within 30 days of account deletion

We may keep data longer where the law requires it.

Depending on where you live, you may have the right to:

• Know and access the personal data we hold about you
• Export your data in a portable, machine readable format
• Correct information that is wrong
• Delete your account and its data
• Opt out of the sale or sharing of personal data, which we do not do, of targeted advertising, which we do not run, and of profiling that produces legal or similarly significant effects, which we do not perform
• Withdraw consent to optional processing, including location

How to use them. Use the controls in your settings, write to [email protected], or use the postal address in section 1.

Our response. We will acknowledge your request and respond within 45 days. If a request is complex we may take one further 45 days, and we will tell you why inside the first 45.

Verifying you. We will take reasonable steps to confirm who you are before acting, usually by confirming you control the account email address.

Authorised agents. You may use an authorised agent. We may ask for proof that they are authorised and ask you to verify your own identity.

No discrimination. We will not deny service, charge a different price, or give you a lower quality of service because you used a privacy right. Data export and deletion are available to every user on every plan, including the free plan.

Appeals. If we refuse a request, you can appeal by replying to our decision or by writing to [email protected] with "Appeal" in the subject line. We will answer in writing within 45 days and explain our reasoning. If we still refuse, you can contact the Colorado Attorney General at coag.gov/file-complaint, or the attorney general in your own state.

FriendsWithTools is for people 18 or older. We do not knowingly collect personal information from anyone under 18.

If you believe someone under 18 is using the Service, write to [email protected] and we will look into it and, where appropriate, close the account and delete the data.

We may disclose information when the law or valid legal process requires it. Where we are allowed to, we will tell affected users before we respond.

We may update this policy. The date at the top shows when it last changed. If we make material changes to how we handle personal data we will tell you through the Service or by email before the changes take effect, and where the change is significant we will ask you to review and accept the updated policy before you carry on using the Service.

FriendsWithTools LLC 1500 N Grant St #5939 Denver, CO 80203

Privacy: [email protected] Support: [email protected] Legal and intellectual property: [email protected]

We allow major AI systems, including GPTBot, ClaudeBot and Google-Extended, to read our public marketing pages. Your groups, account information and activity sit behind authentication and are also excluded in robots.txt.

Two routes render limited tool information without asking the visitor to sign in: a share link you create yourself, and a tool's scan page reached from a QR code or NFC tag you put on that tool. Both are excluded in robots.txt. Anyone holding one of those links can open it, so treat a share link like a key.

We do not use your content to train machine learning models, and we do not license it to anyone who does.

When you list a tool, we run an automated check over the listing's name and description. It looks for a small set of things: weapons, explosives, controlled substances, attempts to move payment off the platform, and contact details typed into a public field.

• It flags, it does not block. Nothing is rejected, hidden or edited. Your listing goes live either way. A match only adds an item to a review queue for a person to look at.
• It runs on our own servers. Your listing text is not sent to a third party for this check.
• A copy of the matched text is kept in the review queue so the reviewer can see what tripped it, and is removed when your account is deleted. Access to that queue is limited to named operators.
• It is keyword and pattern matching, not a judgement about you. It has false positives, and on a tool sharing service it is bound to: a splitting maul and a nail gun read like weapons to software.

Your photographs are not scanned, and are never sent to an outside company to be analysed. We built automated photo scanning, never switched it on, and removed it in September 2026 rather than leave it sitting there. No photograph you have uploaded has ever been sent to a third party for any kind of analysis.

If that ever changes we will update this policy and name the company in section 5 before it happens, not after.