Last updated: September 2026
GoPals lets groups of people, friends, families, teams, and clubs run their shared money, activities, and lists in one place. This Privacy Policy explains what information we collect, why, who can see it, how long we keep it, and what rights you have over it.
GoPals is operated by Ekdutn Inc., a corporation incorporated under the Canada Business Corporations Act, with its registered office in Ontario, Canada, on the public register maintained by Corporations Canada. In this policy, "GoPals," "we," "us," and "our" mean Ekdutn Inc., which is the organisation accountable for the personal information described here. Under the GDPR we are the controller of that information.
You can reach the person accountable for privacy at GoPals at privacy@gopals.app.
Account information from Google or Apple. Signing in is the only way to create an account, and we do not offer password sign-up. When you sign in, your provider gives us a unique identifier for you, your email address, and your name, and where you have one and the provider shares it, your profile picture. We never see or store your password. If you use Sign in with Apple and choose to hide your email, we receive Apple's private relay address instead of your real one, and that is all we hold.
Profile information. In your Member Profile you may optionally add a phone number, birthday, emergency contact, home address, and a profile photo. All of it is optional, edited only by you, and used only to help your own groups coordinate.
Group content. Anything you or other members create inside a group: activities and RSVPs, pool contributions, expenses, splits and settlement records, checklists, polls, photos, notes, wishlist items, calendar events, and announcements.
Public group page information. If a group's admin requests a public page and we approve it, that group's display name, bio, cover photo, and member count become visible to anyone, including people who are not signed in.
Usage and security data. Standard server logs, including IP address, browser and device type, and timestamps, used to diagnose problems, enforce our limits, and keep the Service secure.
Error logs. If something breaks, we may log a short technical message with your account and the screen you were on, solely to find and fix the bug. These logs do not include the content of your groups.
Reports you send us. If you report content or a member, we receive what you send, including the content you are reporting, and we keep a record of the report and what we did about it.
Messages to us. If you email us, we keep the message and our reply.
We do not collect precise location data, we do not use advertising or analytics trackers, and we do not buy personal information from data brokers.
We do not read, scan, index, or analyse the content inside your private groups, and we never use it to train machine learning or AI systems, ours or anyone else's. We do not sell your personal information, we do not share it for advertising, and we do not use it to build a profile of you. The only content we look at is what a group asks us to publish on a public page, content someone reports to us, and anything a valid legal process requires us to produce.
We use your information to provide and operate GoPals, to let group members coordinate with each other, to let admins manage their groups, to send notifications you or your group's admin have enabled, to review public page requests, to investigate reports of abuse, to enforce our limits and prevent fraud and spam, to fix bugs, and to comply with legal obligations.
If the GDPR or UK GDPR applies to you, our legal bases are: contract, for everything needed to give you the Service you signed up for; legitimate interests, for security, abuse prevention, debugging, and protecting the Service and its users, balanced against your rights; legal obligation, where a law requires us to keep or disclose something; and consent, for the optional profile fields you choose to fill in, which you can withdraw at any time by clearing the field.
We do not carry out automated decision-making that produces legal or similarly significant effects about you.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
We use a small number of providers to run GoPals. They process personal information on our instructions, under contract, and only to provide their service to us.
We will update this list if it changes.
Your emergency contact and home address are the most sensitive fields GoPals stores. Both are entirely optional, edited only by you, and visible only to members of your own groups, never on a public group page and never to a group you are not in. You can clear them at any time. A free-text Medical Notes field existed until 2026-09-05 and was removed: health information is special-category data, and GoPals is not the right place to keep it.
Photos you upload may reveal information about you and other people. Only upload photos of others where they are content for the members of that group to see them, and never publish a photo on a public page without the consent of everyone in it.
GoPals is operated from Canada. Your data is stored on Supabase infrastructure in the United States (US East, Ohio), with row-level security policies enforced at the database level so a group can only ever access its own data, and delivered through Cloudflare. Traffic is encrypted in transit with HTTPS, and data is encrypted at rest by our providers.
Our providers operate in several countries, so your personal information may be stored or processed outside the country you live in, including outside Canada, the European Economic Area, and the United Kingdom. While it is in another country, it is subject to that country's laws, and courts, law enforcement, and national security authorities there may be able to obtain access to it under those laws.
If we ever experience a data breach that puts your personal information at meaningful risk, we will notify affected users without undue delay and report it to the regulators we are required to report it to.
You can download a copy of everything tied to your account at any time from the app. You can delete your account at any time from your Member Profile. Deletion removes your name, email, phone number, birthday, emergency contact, home address, and profile photo, disconnects your Google or Apple sign-in, and removes you from every group. Historical expense, pool, and activity records you were part of stay with each group, attributed to "Former member," so the group's shared math stays correct for everyone else. Our Delete Your Account page explains this in full, including the one case where deletion is blocked, when you are the sole admin of a group and need to promote someone first.
You can also leave any group yourself, at any time, without deleting your whole account, and you can clear any optional profile field without deleting anything else.
GoPals uses a session cookie set by our authentication provider to keep you signed in, and local browser storage for the same purpose and for app preferences. These are strictly necessary for the Service to work. We do not use advertising cookies, tracking pixels, or third-party analytics.
Depending on where you live, you may have some or all of the following rights over the personal information we hold about you: access, correction, deletion, restriction of processing, portability, objection to processing based on legitimate interests, withdrawal of consent, and the right not to be discriminated against for exercising a right.
Most of these you can exercise yourself: edit or clear anything in your Member Profile, export your data, or delete your account. For anything else, email privacy@gopals.app. We will respond within the time the applicable law requires, and we may need to verify who you are first.
If you are in Canada: PIPEDA gives you the right to access the personal information we hold about you and to challenge its accuracy, and the right to complain to us and then to the Office of the Privacy Commissioner of Canada. If you are in Quebec, Law 25 also gives you rights of de-indexing and data portability.
If you are in the EEA or the UK: you may lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office.
If you are in California: you have the right to know what personal information we collect, use, and disclose, the right to delete it, the right to correct it, and the right to opt out of sale or sharing. We do not sell or share personal information.
GoPals is not directed at children, and you must be at least 16 to use it. We do not knowingly collect personal information from anyone below that age. If you believe a child has given us personal information, contact privacy@gopals.app and we will delete it and close the account.
We may update this Privacy Policy from time to time. We will update the date at the top of this page, and for material changes we will give you reasonable notice by email or in the app before they take effect.
Questions, requests, or complaints about privacy: privacy@gopals.app, or, if you need a postal address, email legal@gopals.app and we will provide one. General questions: hello@gopals.app.
This document was written to be genuinely thorough and grounded in what GoPals actually does, but it is not a substitute for review by a qualified lawyer, and it has not had one. Treat it as a solid starting point, not final legal sign-off.