Privacy Policy

This policy explains how Follow B.V. uses personal data for applications and the waitlist at follow.global, its app and its EU service where available.

1  Who is responsible

Follow B.V., Olympisch Stadion 24, 1076 DE Amsterdam, Netherlands, is the controller. Contact support@follow.global or write to that address about privacy or your rights. This policy takes effect on the same date as the Terms.

2  Information you provide and who sees it

Applications at follow.global collect your personal-or-business applicant choice, first and last name or business name as applicable, Home City, email and/or phone number, and the application information you submit. We record application and waitlist status, acceptance/access-code information, required policy acceptance/acknowledgement and the separate optional launch-marketing choice. We use these to manage applications, the overflow waitlist and controlled onboarding.

Registration requires an email address, phone number or Apple/Google sign-in, plus date of birth, full name, gender, profile photo, country, username and at least one interest topic. Your gender is not shown to other members. An under-18 date of birth causes the attempted account and sign-in to be deleted. Optional profile information includes a silent cover video, bio, identity text and saved base location.

Profiles and videos are available to signed-in members. Members can see your name, username, profile media, intention description, headline and counts of followers, follows and posts. There is no private-account switch; all follow requests need approval. You can make parts of your profile visible only to followers or only to yourself. Open for, Where I'll be and My history default to All members, with Followers and Only me options. Videos and challenges are visible to all members; hosts choose all members or followers for experiences. Business contact details are member-visible.

Your precise personal base-location map point is not sent or disclosed to other members. Members receive only appropriate distance information or a rounded area, and you control whether your address is displayed. Follow may process the precise location internally for location-based features.

You also provide posts, titles, captions, comments, messages and experience and participation details. Recipients may independently copy messages. Other people may supply reports about your content or account, or information about you in their posts, messages or activity details. If you use Apple/Google sign-in, the provider supplies sign-in information to authenticate your account.

3  Check-ins and recommendations

Check-ins help personalize your feed. There are seven check-in questions, one for each pillar: Social Life, Movement, Nutrition, Recovery, Mindset, Helping Others and Sustainability. Each day you answer one of them, scored 1–5. Your answers also form a private insights chart that only you can see.

Your answer only adjusts your own equalizer: if you give a pillar a low score, you see more content from that pillar and less from the others, much like a "show me more of this" setting. Check-in answers are not used to assess your health, no medical or health conclusions are drawn from them, and they are not shown to other members or shared with anyone. If you set the equalizer manually, check-ins don't influence the algorithm.

The For You feed uses for the most part a fixed hand-written formula, not a trained recommendation model. AI (OpenAI) is only used to label posts with topics, as described in section 6. Its main inputs are post performance (joins, shares, comments, saves, likes and completed watches), selected and activity-derived interests, equalizer settings including check-in answers, distance to experience, followed creators, invitations and recency.

Personal scores are account-linked, not anonymous. You can adjust your feed with the equalizer and Not interested, or use the chronological Following and Challenges feeds. For You remains personalized; there is no switch turning off behavioral scoring. Follow does not currently train a recommendation model on these records; section 5 explains future model training.

4  Location permissions and technical data

You can type a base address or choose a map point. It is stored until cleared, changed or account deletion and supports nearby recommendations and people suggestions. Experience addresses are shown to the experience's audience.

With your permission, the app uses your current location while you use it to show nearby results, without saving it. There is no background location tracking, and approximate location is enough. Without permission, the app uses your saved base location or leaves out distance. Revoking permission does not delete saved addresses.

Camera, microphone and photo-library access are only requested when you use a feature that needs them. Follow does not currently access your contacts. If that changes, we will ask your permission first and update this policy.

We record posts shown, completed watches, likes, saves, shares, comments, joins, searches and related scores. Services also receive device/push identifiers, IP addresses, security logs and error information as described below. We use Google Analytics for Firebase to understand how people use the app and identify improvements. Firebase Cloud Messaging separately delivers Android push notifications. We do not use Crashlytics or advertising features; the Meta SDK described in section 6 is used only for sharing.

Sentry receives crash reports, the names of the screens visited before a crash, an account code and performance data from a sample of sessions. This data is linked to your account, but IP addresses are not stored. Server reports have personal data removed.

5  Why we use data and the legal grounds

Account and service delivery: we rely on contract necessity under GDPR Article 6(1)(b), limited to information objectively needed to provide your requested account, posts, messages and participation. Security, abuse prevention and support rely on our legitimate interests under Article 6(1)(f), balanced against your rights. Processing required to meet legal duties, including applicable authority reporting and rights requests, relies on Article 6(1)(c).

Applications and waitlist: we process applications, waitlist requests, acceptance/access codes and submission confirmations to take steps at your request before providing the service under Article 6(1)(b). An SMS confirming application submission is a functional service message, not marketing.

Check-ins: we use check-in answers to personalize your feed and show your private insights chart, based on our legitimate interests under Article 6(1)(f), balanced against your rights. Answers are not used to assess your health. Section 8 explains your right to object.

Recommendations and topic labeling: we rely on our legitimate interests under Article 6(1)(f) to organize content and provide relevant recommendations using ordinary interests, activity and preferences, balanced against your rights. Section 3 explains how recommendations work and the available controls. Section 8 explains your right to object, including to related profiling.

Location: we use saved addresses and experience locations where objectively necessary to provide the location-based features you request under Article 6(1)(b). Access to your device's current location is optional and based on consent under Article 6(1)(a). Section 4 explains the available choices and how to revoke permission.

Functional notifications: we process information necessary to deliver messages, activity updates, reminders and account notices as part of the service you request under Article 6(1)(b). Safety and abuse-prevention notices rely on legitimate interests under Article 6(1)(f), or a legal obligation where applicable. Notification settings and functional exceptions are explained in the Terms. These settings are not marketing consent.

Launch marketing: launch-marketing emails are sent only to applicants who separately opt in, on the basis of consent under Article 6(1)(a). Each email includes an unsubscribe link. We retain minimal opt-out records to honor your choice and prevent unwanted messages, relying on our legitimate interests under Article 6(1)(f). The optional marketing choice is recorded separately from required acceptance of the Terms and Community Guidelines and acknowledgement of this policy. There is no sponsor data sharing or advertising in the app. Any future marketing use will have its own lawful basis and any required opt-in.

Diagnostics: we use crash reports and performance data from Sentry to keep the app stable and secure, based on our legitimate interests under Article 6(1)(f). We limit this to technical information and an account code, and remove personal data from server reports.

Future model training: we do not currently train AI or machine-learning models on your content or usage data. If we start doing so to develop and improve Follow's services, we will update this policy beforehand with the legal basis and how you can object. We will not use check-in answers for this.

6  Service providers and overseas access

AWS hosts the database, messages and media in Frankfurt and supplies sign-in, storage, email/text/push routing, processing and logs. Amazon Rekognition checks uploaded feed videos before publication. CloudFront delivers media through a global network, which may involve servers outside the EEA.

Apple APNs and Google Firebase Cloud Messaging, through AWS SNS, receive push identifiers, notification text and item identifiers. Text may name a sender but contains no private-message text or check-in answer. Apple/Google sign-in is routed through AWS Cognito. Google provides Google Analytics for Firebase for the app analytics described in section 4.

On iPhone, the app includes Meta's software development kit (SDK) only to open the Facebook or Messenger share dialog when you choose to share a post there. Automatic event logging and advertising-identifier collection are switched off in the app. Meta may process this data outside the EEA, including in the USA.

Google Maps shows the map on Android and Apple Maps on iOS, used for profiles, business forms and activities. On both platforms, address search, place details and address lookup use Google Maps Platform. Google Places receives typed address-search text and the precise selected map point; Google Geocoding receives the chosen map point, which may be a home or business address. These requests go directly from your device to Google or Apple, which therefore receive your IP address and the requested map area. These services operate when the picker is used, not through background tracking. Map data may be processed outside the EEA, including in the USA.

Google acts as an independent controller for relevant Maps request data and may process it for its own purposes, including providing and improving its services. Google determines retention according to the data and purpose, rather than applying one fixed period to all Maps requests. Its processing is explained in the Google Privacy Policy and retention policy. Google's published controller terms identify Google Ireland Limited for relevant European data and provide for the EU–US Data Privacy Framework for transfers to covered US entities, with standard contractual clauses where applicable. Apple's Privacy Policy describes its processing and retention practices and states that international transfers of EEA personal data are governed by standard contractual clauses.

Sentry (Functional Software Inc.) uses its EU region in Germany for diagnostics. OpenAI receives post titles and captions in the USA to assign topics, without a separately supplied member/location code. The text itself may contain personal or sensitive data. OpenAI does not use this content for model training. OpenAI may keep submitted content for up to 30 days for abuse monitoring. OpenAI's data-processing agreement, which applies to Follow, provides for standard contractual clauses or an applicable adequacy decision for relevant transfers outside the EEA.

Expo (650 Industries, Inc.) delivers app updates. When the app checks for an update, Expo receives technical information such as the app version, platform, a random update identifier and your IP address, but no account, profile or content data. Expo may process this data in the USA under appropriate safeguards.

Bitrupt provides development and support with remote access from Pakistan. Data is stored in Frankfurt, but that overseas access is an international transfer covered by a processor agreement and EU standard contractual clauses. Access is limited to named personnel with individual accounts, restricted to what their role needs, and logged. Such access can expose stored messages and check-ins. Messages are encrypted in transit and at rest, not end-to-end.

Contact support@follow.global for details or copies of applicable transfer safeguards. We disclose information to staff, providers, advisers and authorities only as needed and lawfully permitted.

If Follow B.V. is acquired, merges with another company or transfers its business, personal data may pass to the new owner, who must continue to protect it in line with this policy. We will tell you before this happens.

7  Storage and deletion

Most account information remains until removed or the account is permanently deleted. Current phone location is not saved. Base location remains until changed/cleared or account deletion. Viewing history lasts 30 days; search history can be cleared at any time.

We keep application information while your application or waitlist place remains active, for a maximum of 12 months from submission. If you join Follow, we transfer only the information needed for your account and delete surplus application information. If you have not joined within 12 months, we delete or irreversibly anonymize your application information. We remove it earlier if you leave the waitlist or the application process closes. Marketing contact details are used until you unsubscribe or launch communications end; only the minimal suppression record remains for as long as needed to prevent further marketing to you.

Check-ins, interests and equalizer settings have no separate routine expiry and are deleted with the account, subject to your rights in section 8. Delete chat hides the conversation only for the person selecting it. Permanent deletion of a sender's account erases their sent message text.

Export files last seven days and export-request logs 90 days. Server logs last 14 days; text-delivery logs 30 days; web access/IP, AWS account-activity and database session/query logs 90 days. Database backups last seven days, deleted media remains recoverable for two days and raw uploads expire after three days. Records of Terms and Community Guidelines acceptance and Privacy Policy acknowledgement are deleted with the account. Where a specific legal duty or the establishment, exercise or defense of a legal claim requires longer retention, we retain only the necessary records, restrict their use to that purpose and delete them when that reason ends.

Sentry keeps errors for 90 days and performance traces, spans and logs for 30 days.

Moderation evidence, including retained removed content and reports needed for the case, and the admin decision log are kept for 180 days after the moderation case closes, and in any event until the six-calendar-month appeal window has expired and any pending appeal has been resolved. Banned accounts follow the period and appeal extension in the Terms. Minimal evidence retained after a banned account is deleted is kept for 12 months after deletion. Sign-in blocks after a permanent ban are reviewed every 12 months and kept only where still necessary.

8  Account deletion and your rights

Use Profile → Settings → Account → Account Deactivation to begin the 30-day recovery period. Your profile stops appearing in recommendations, your hosted experiences are cancelled, you leave experiences you joined and notifications stop. Your name, username, photo and bio remain visible during recovery; comments/messages remain and followers can still reach posts through Following or direct links.

Sign in and select Reactivate Account within 30 days to recover the account; experiences and participation are not restored. After 30 days, the account, check-ins and scores are deleted and contributions to post counters removed, subject to the limited exceptions above. To have your account deleted sooner, contact support@follow.global.

You may request access, correction, erasure, restriction or a portable copy where applicable. You may object, on grounds relating to your situation, to legitimate-interest processing, including related profiling. We then stop that processing unless we demonstrate overriding compelling legitimate grounds or need it for legal claims. You may object to direct marketing at any time, and withdraw consent without affecting earlier lawful use. We ask only for information reasonably needed to verify requests. Requests are free of charge, subject only to the limited exceptions allowed by law. We respond without undue delay, normally within one month, and explain any lawful extension within that month. The recovery period does not override these rights.

You can use Export Data in the app. Ready files last seven days. You may complain to a competent EU data-protection authority, including the Dutch Autoriteit Persoonsgegevens, or seek court remedies.

The COO handles child-safety escalation through support@follow.global. Relevant reports and evidence are restricted to those handling the case and shared with competent authorities where lawful. We date policy changes and explain material new uses; uses requiring consent need a separate valid choice.