Privacy Policy

Last Updated: October 8, 2026

1. Introduction

Supergroup ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile applications, and related services (collectively, the "Service"). By using the Service, you consent to the practices described in this policy.

2. Information We Collect

Information you provide:

• Account information, including your phone number, your display name, and, if you add one, an email address, which lets you sign in with an emailed link and recover your account if you lose your number
• Messages, attachments, and other content you send through the Service
• Reports you submit about another user: who you're reporting, the reason you pick (spam, harassment, inappropriate content, or other), and any details you choose to write
• Block lists indicating users you have chosen to block
• Invitations you send, including the email addresses of people you invite, and — for people you invite by phone — the name you gave them and a one-way code in place of their number (see Section 8)
• Waitlist signup information (email address)
• Communications with us, such as support requests or feedback

Information collected automatically:

• Device information, including device type, operating system, and unique device identifiers
• Usage data, such as conversations you participate in, read markers, and feature usage
• Log data, including IP address, browser type, and access times
• Push notification tokens for delivering notifications to your devices

Information from your device, only if you allow it:

• Phone numbers and email addresses from your contacts, if you allow access, so we can show you which of your contacts are on Supergroup. We match them and don't store them — see Section 8.
• Your approximate location, when you ask for directions on a place card or ask Supergroup about places near you. It's never collected in the background — see Section 9.
• From the calendars on your iPhone, if you choose to use them with Supergroup: the times you're busy, the names and colors of your calendars, and — when you ask Supergroup something about your schedule — the events in the period your question covers. When you ask Supergroup to add or change an event there, what the app did. See Section 7.

Information from services you connect:

• If you choose to connect a calendar account, such as Google Calendar, we receive your availability, the email address of the connected account, and — when you ask Supergroup something about your schedule — the events in the period your question covers, which then appear in the answer we send you. Connecting a calendar is optional — see Section 7 for details.

3. How We Use Your Information

We use the information we collect to:

• Operate, maintain, and improve the Service
• Deliver messages and notifications to you and other users
• Run Groupie, our AI participant, and the other AI features that are part of the Service, including photo descriptions and search (see Section 4)
• Generate link previews for URLs shared in conversations (see Section 5)
• Review reports of user behavior and take appropriate moderation action (see Section 6)
• Answer questions about your schedule, suggest meeting times, and create calendar events when you connect a calendar (see Section 7)
• Show you which of your contacts are already on Supergroup, if you allow access to your contacts (see Section 8)
• Show travel times to places and answer questions about places near you, when you share your location (see Section 9)
• Process invitations and the credit system that rewards inviters
• Process waitlist signups and contact you about product availability
• Respond to your inquiries and provide customer support
• Monitor and analyze usage trends to improve the user experience
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

4. AI and Groupie

AI is part of how Supergroup works, not an add-on. Groupie, an AI participant, is built in: it reads along in your conversations so it can answer questions and help out, and several other features run on AI models behind the scenes. Some of this happens automatically, whether or not you've asked Groupie anything. This section explains what is sent, when, and to whom.

We ask before anything is sent. Before any of your data goes to an AI provider, the app asks for your permission, during sign-up or sign-in, and explains what is sent and to whom. Because AI is a core part of the Service, Supergroup can't be used without agreeing. If you change your mind, you can delete your account at any time.

Groupie reads along to decide whether it can help. Each time a message is sent in any conversation, including one-to-one chats, that message, the roughly 20 messages before it, and the display names of the people who wrote them are sent to an AI model from OpenAI, which decides whether Groupie should respond.

When Groupie responds. Groupie responds when you ask it to (by mentioning @groupie, tapping Ask Groupie, messaging it directly, or replying to it), or when it decides it can help. To write its response, the AI model receives:

• Recent conversation history, up to roughly the last few hours or about 60 messages
• The display names of the people in the conversation
• Images shared in the conversation
• Your approximate location, only if you've allowed it (see Section 9)
• Events from calendars you've connected, only if you've connected one and your question needs them (see Section 7)

Groupie can act in the conversation: it can reply, react to messages, pin messages, and post cards such as weather, places, flights, sports scores, and calendar events. Everything it posts is visible to the people in that conversation. So that Groupie can remember what a long conversation has covered, older parts of it may be summarized by an AI model.

Photos and search. These happen automatically, so that you can find things later:

• Photos you upload are described by an AI model from OpenAI, so they can be found in search.
• Messages, link previews, and photo descriptions are converted into search embeddings (numeric fingerprints of their meaning) using Amazon's Titan model on AWS Bedrock.
• When a search looks like a question, it may be answered by Anthropic's Claude model running on AWS Bedrock, using the snippets of your messages that match.

Groupie's tools. To look things up, Groupie sends search queries — not your messages wholesale — to the services that answer them: SearchApi.io for web and shopping search, Google Maps Platform for places, FlightAware for flights, and eBird for birds. Images Groupie generates are made by OpenAI. Link previews may be fetched through iframely (see Section 5).

Our AI providers. We use OpenAI (including its GPT models, through OpenAI's API), Google (its Gemini models, through Google Cloud's Vertex AI), and Amazon Web Services (AWS) Bedrock, which runs models from Anthropic (Claude), Amazon (Titan and Nova), and others. There's no model picker in the app; we choose which model handles each job. These providers process your data only to provide the Service to us, under terms that protect it as this policy does, and not for their own purposes. Per the AWS Bedrock terms of service, AWS does not retain this data or use it to train its models. Per Google Cloud's terms, Google does not use this data to train its models. OpenAI processes API data under its applicable API data-use and retention terms and does not use API data to train its models by default.

AI-generated responses and images are posted to the conversation they belong to, and are stored and retained like any other message (Section 12).

5. Link Previews

When you or another user shares a URL in a conversation, our servers fetch the destination page, sometimes through the link-preview service iframely, to generate a preview (title, description, and thumbnail image). The destination website sees a request from our servers, not from your device, so your IP address is not exposed to the linked site as a result of preview generation.

6. User Reports and Moderation

You can report or block anyone from their profile in the app. A report contains the user you're reporting, the reason you pick (spam, harassment, inappropriate content, or other), and any details you choose to write. It's delivered to our internal moderation channel, which is hosted by Slack Technologies, Inc. on our behalf. When you block someone, that's logged to the same channel too, so we can spot patterns of abuse.

We review every report within 24 hours. Supergroup has zero tolerance for objectionable content and abusive users (see our Terms of Service): when we find objectionable content, we remove it, and we remove the account of the user who posted it. Your block list is stored on our servers, and other users can't see it.

7. Connected Calendars

The Service includes an optional scheduler feature that helps people in a conversation find a time to meet. To improve its suggestions, you may choose to connect a calendar: a calendar account, such as Google Calendar, or, on iPhone, the calendars already on your phone. Connecting a calendar is entirely optional: the scheduler works without it, and you can disconnect at any time.

When you connect a Google Calendar account, you grant Supergroup permission to:

• Read your availability — the times you are busy — so the scheduler can propose times that work for everyone.
• See which calendars your account has and read the events on them, so Supergroup can answer questions you ask about your own schedule across all of them, not just your main one.
• Create, change, respond to, and cancel events, so a time a conversation agrees on becomes a real invitation.

Calendars on your iPhone. On iPhone you can also use the calendars already on your phone — iCloud, Exchange, or anything else the Calendar app shows. There is no account to sign in to. Your iPhone asks whether Supergroup may access your calendars, and the app reads them on your device. Three things leave your phone:

• When you're busy. The app sends our servers the start and end of the times you're busy, from yesterday to 60 days ahead, along with the names and colors of your calendars. It sends times only: no titles, places, notes, or guests. We store these times so the scheduler can propose times that work for everyone, including when someone else in a conversation is the one looking. The app refreshes them when you open it and when your calendar changes while you're using it, never in the background.
• The events your question covers. When you ask Supergroup about your own schedule from your iPhone, the app reads the events in the period your question covers and sends their titles, places, and times — never their notes or guest lists — so Supergroup can answer. They are handled as the paragraphs below describe.
• What the app did, when you ask for a change. When you ask Supergroup to add, change, or delete an event on your iPhone, the app sends back what it did: the event's title, place, and time as it was saved. If Supergroup had just read part of your calendar to find that event, the app also sends the events in that same period again, so the answer is up to date.

Adding and changing events on your iPhone. Supergroup adds or changes an event on your phone's calendars only when you ask it to, or when you tap a button that says it will: “Add to cal” on an event, or locking in a time on a scheduler or a poll. The app on your iPhone makes the change; our servers cannot reach your calendars. When you ask Groupie to add an event, the app adds it. When you ask it to change or delete one, the app shows you the event and waits for you to confirm. An invitation is answered by you, on your iPhone's own event screen. To do any of this, the details of what you asked for — the event's title, time, place, and notes — pass through our servers to your phone as part of that conversation, visible only to you. They stay with that message until your phone has answered — for a change or a delete, until you tap — and Supergroup's reply then takes their place. An event added this way goes on your calendar only: no invitations are sent. A calendar you've switched off in Settings → Connected Accounts is never written to.

You can stop at any time from Settings → Connected Accounts, which deletes the busy times we hold. If you turn off calendar access for Supergroup in your iPhone's Settings instead, nothing more is sent, and the app disconnects the calendars and deletes those times the next time it checks, usually when you next open it.

We read your calendar only when you ask for something that needs it, and only for the period your question covers. Answering means sending those events to our AI providers, under the terms in Section 4 — they do not train on them. We change your calendar only when you ask us to, never on our own initiative.

We don't keep a separate copy of your events. But the answer itself is a message: it's stored with the rest of that conversation's history and retained on the same terms as any other message (Section 12). That also means if you ask about your schedule in a group conversation, the answer is visible to the people in it — the same as anything else said there. Ask in a one-to-one conversation if you'd rather it stay between you and Supergroup.

To provide this feature, we store the OAuth access and refresh tokens Google issues when you connect. These are encrypted at rest and used only for the purposes above. You can disconnect at any time from Settings → Connected Accounts, or revoke our access from your Google Account permissions page; either way we revoke the tokens and delete them from our systems.

Supergroup's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features described above. We do not use it for advertising, we do not sell it, and neither we nor our providers use it to train machine-learning models. We do not transfer it to anyone except as needed to provide those features, to comply with applicable law, or to protect against security threats. No one at Supergroup reads your Google user data except with your explicit consent, where necessary for security, or where the law requires it.

8. Contacts

Finding friends from your contacts is optional. The app asks for access once, right after you finish signing up, and after that only if you tap to see who's on Supergroup. If you've said no before, it doesn't ask again. You can turn access off at any time in your device's settings. Inviting someone by picking them from your contacts doesn't need this access at all.

Once you allow access, the app checks your contacts when you open the home screen or start a new chat, at most every 15 minutes. Each check sends the phone numbers and email addresses in your contacts to our servers over an encrypted (TLS) connection. We compare them against the verified phone numbers and email addresses of Supergroup accounts and send back the matches: each person's name, username, and profile photo. We don't store the contacts you send, we don't keep a record of who matched whom, and we don't use your contacts for anything else — not to suggest you to other people, not for advertising, and not to contact anyone. Only accounts that have verified that phone number or email can be matched.

If you invite someone who isn't on Supergroup by phone, the invitation text goes from your own phone, not from us. So that we can recognise them when they sign up, we keep the name you gave them and a one-way code (an HMAC) in place of their number — never the number itself. The invitation expires after 30 days.

9. Location

Supergroup asks for your location only when a feature you're using needs it, and only while you're using the app. We never collect it in the background, and we don't save it to your account. You can decline, and you can change the permission at any time in your device's settings. Two features use it:

• Directions on place cards. When you tap to share your location on a place card, the app shows how far away the place is and how long it would take to get there. On iPhone this is worked out on your device by Apple Maps, and your location isn't sent to us. On Android, the app sends your location to our servers, which round it to about 100 metres and ask Google Maps Platform for the travel time. We keep that rounded location for up to five minutes, so repeat lookups don't ask Google again, and then discard it.
• Places near you (iPhone). When you ask Supergroup about something nearby and it needs your location to answer, the app asks, then includes your approximate location and the name of your city with your requests for up to 10 minutes. It's used to answer your question: it's sent to our AI providers (Section 4), and, rounded to about 100 metres, to Google Maps Platform to search for places around you. The answer is a message, stored and retained like any other (Section 12), and visible to the people in that conversation.

10. How We Share Your Information

We do not sell your personal information to third parties, and we never share your phone number or text-message opt-in data with third parties or affiliates for marketing. We share your information in the following circumstances:

• With other users: Messages and content you send are visible to the members of the conversations in which they are sent.
• Service providers and processors: We rely on the following third-party providers to operate the Service. Each is bound by contractual obligations to protect your information:
  • Amazon Web Services (AWS): hosting, database, and file and image storage (Amazon S3); and AI processing through Amazon Bedrock, which runs models from Anthropic (Claude) and Amazon (Titan and Nova), among others. Bedrock turns messages, link previews, and photo descriptions into search embeddings, and answers searches that look like questions (see Section 4).
  • Google Cloud (Vertex AI): AI processing for Groupie with Google's Gemini models, for the tasks we route to them (see Section 4).
  • OpenAI: AI processing for Groupie — deciding whether it should respond, writing its responses, and summarizing older parts of conversations — as well as describing the photos you upload and generating images (see Section 4).
  • SearchApi.io: web and shopping searches Groupie runs to answer questions. We send the search query, not your messages.
  • FlightAware: flight status and details for flight cards. We send the flight being looked up.
  • eBird (Cornell Lab of Ornithology): bird sightings and information when Groupie answers questions about birds. We send the search, not your messages.
  • iframely: fetching link previews for URLs shared in conversations. We send the link.
  • Twilio SendGrid: delivery of transactional emails, including magic-link sign-in emails. We may use Amazon Simple Email Service (SES) instead.
  • Twilio Inc.: delivery of the one-time verification codes we text to your phone number. Carriers require proof that you asked for these texts, so we keep a record of each request: when it was made, from which app, and a scrambled, one-way code in place of your number.
  • Apple Push Notification service (APNs): delivery of push notifications to your iOS devices.
  • Firebase Cloud Messaging (Google LLC): delivery of push notifications to your Android devices. Like APNs, a notification carries what it needs to display: the sender's name, the conversation, and a preview of the message.
  • Google Maps Platform (Google LLC): place details, photos, and maps for place cards; searches for places near you; and, on Android, travel times. We send the place or search, and — when you've shared it — your location rounded to about 100 metres (see Section 9). Your name and account details are not sent.
  • Slack Technologies, Inc.: delivery of user reports and blocks to our internal moderation channel, and of feedback you send us from the app.
  • Google Calendar (Google LLC): if, and only if, you connect a Google Calendar account, we exchange OAuth tokens with Google, read your calendar when you ask us to, and send event details (title, time, and attendee email addresses) to Google Calendar when you schedule or change a meeting.
• Legal requirements: We may disclose your information if required to do so by law, regulation, legal process, or governmental request.
• Safety: We may disclose information to protect the rights, property, or safety of Supergroup, our users, or others.

11. Data Storage and Security

Your data is stored on Amazon Web Services (AWS) infrastructure in the United States. We implement appropriate technical and organizational measures to protect your information, including encryption at rest and TLS encryption for all data in transit. Credentials for connected calendar accounts are additionally encrypted before storage. However, no method of transmission over the Internet or electronic storage is 100% secure.

12. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Credentials for a connected calendar account are retained only until you disconnect that account, after which they are revoked and deleted. The busy times from the calendars on your iPhone are replaced each time the app refreshes them, and deleted when you disconnect. If you request deletion of your account, we will delete your personal data within 30 days. Some data may be retained in encrypted backups for up to 90 days. We may retain anonymized or aggregated data indefinitely for analytical purposes.

13. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that we correct inaccurate or incomplete data
• Deletion: Request that we delete your personal data. You can delete your account yourself at any time, in the app or on the web — see Delete your account for the steps and for what we delete and keep.
• Portability: Request a copy of your data in a structured, machine-readable format
• Objection: Object to certain processing of your personal data

To exercise any of these rights, please contact us at support@supergroup.chat.

14. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete such information promptly.

15. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access.

16. International Data Transfers

Your information may be transferred to and processed in countries other than your own. By using the Service, you consent to the transfer of your information to the United States, where our servers are located.

17. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on the Service and updating the "Last Updated" date. We encourage you to review this policy periodically.

18. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at support@supergroup.chat.