Frenpath Privacy Policy

Effective date: September 30, 2026 · Last updated September 30, 2026

Frenpath is a LumaLilt project for sharing statuses, making plans, and staying in touch. This policy explains how the Frenpath iPhone app, Android app and website handle information in the testing service. Membership is invitation-only; website guests can browse general ideas and approved web-public plans without an account. “We,” “us,” and “our” refer to the team operating Frenpath.

For privacy questions or requests, contact support+frenpath@lumalilt.com. Do not include your password or verification codes. We may ask for information needed to verify that a request concerns your account.

Delete your Frenpath account or request data deletion — no sign-in or app reinstall is required for an email request.

1. Information we handle

Your display name and profile identifier can appear to other signed-in members in people-selection and social features. Email and phone details are used for authentication and invitations, not displayed as public profile fields. An invitation sender can see the contact details they supplied and the invitation’s status. Later changes to a recipient’s profile contact details do not update that invitation record or disclose the new details to the sender. Friends lists can show display names, the date someone joined Frenpath, shared circles, and circle invitations sent by the viewer. People search filters the information the viewer is already allowed to see.

2. Contacts and invitations

On iPhone and Android, the system contact picker lets you choose a contact or a specific email address or phone number. We use only the details you select and confirm; we do not upload your full address book. You can also enter contact details manually.

You decide whether to share an invitation using Mail, Messages, a share sheet, or a copied link. Those apps handle delivery under their own policies. Frenpath does not automatically message your friend. Firebase separately sends authentication emails and SMS verification messages when requested.

Share invitations only with the intended recipient, and provide other people’s contact details responsibly. An invited person must verify a matching contact detail before accepting. Regular membership also requires both a verified email and phone number.

3. Calendar information and reminders

Calendar access is optional and controlled through iOS or Android permissions and Frenpath settings. On Android, the app reads calendars available through the Android calendar provider, including a Google calendar when it is available on the device; it does not require access to your entire Google account.

• Finding openings: the app reads calendar availability on your device to suggest times and schedule local reminders. It does not upload detailed calendar events merely to find free slots.
• Calendar review and posting: matching events stay on your phone until you explicitly tap Save draft or Post for a chosen event. Calendar matching reads event titles and times locally; on iPhone it can also read descriptions locally. The review list is never automatically uploaded as cloud drafts. Save draft sends the chosen item’s edited content, times, categories, intended audience and source identifiers to your private account so you can continue on another device. Post makes the confirmed content available to its selected audience. Calendar notes and location are not automatically copied into the post. Calendar changes do not automatically update or delete posted plans. Removing an item from the local review list does not delete the original calendar event.
• On-device categorization: on supported iPhones, Apple Intelligence through the Foundation Models framework can use an event’s title and details to suggest a category. On supported Android devices, an optional Google ML Kit on-device model can suggest categories from an event title. The content analysis runs on the device without a remote-model fallback. Google ML Kit separately processes the technical telemetry described below. You can review categories and suggested audiences before posting; no category suggestion automatically shares an event.
• Writing to a calendar: when you add a status to a calendar, its title, description, times, location, and links may be copied there. Your calendar provider and that calendar’s sharing settings then govern the copy.

Calendar matching setups, calendar links, unsent edits, and reminder preferences may be stored locally. The calendar review list is account-specific, limited to upcoming events, protected on disk and excluded from device backup; its saved review edits are also excluded from backup. Calendar review data is not automatically uploaded. Local candidates and their saved review edits are pruned as they expire or leave the review set. Disabling calendar permission stops calendar access but does not erase saved cloud drafts, posted statuses, or copies written to a calendar. App deletion, remote edits, and status deletion do not necessarily remove exported calendar copies.

Activity push notifications use an Apple push token on iPhone or a Firebase Cloud Messaging token on Android, along with an installation identifier, account association, notification preferences and delivery records stored by Frenpath. Apple or Google receives notification text and routing identifiers to deliver the alert. Firebase also uses an installation identifier and app/version information to operate its Android services. Notifications and locally scheduled calendar or connection reminders can reveal plan or reminder details on your lock screen. You can control alert types in Frenpath and permissions and previews in your device settings. Muting notifications does not remove Activity feed items.

On iPhone, Live Activities can show a current posted plan, its title and category, timing, and aggregate join, request, attendance, witness and AfterParty information on the Lock Screen or Dynamic Island. When enabled, we store an activity-specific Apple push token with your account, installation, plan identifier and delivery settings to send updates through Apple Push Notification service. Local calendar review items and private drafts are excluded. Attendee names, contact information and post descriptions are not included in Live Activity payloads. You can disable Live Activities or hide plan titles and categories in Frenpath Notifications settings. Activity registrations are removed when stopped, invalidated or cleaned up after expiry; deleting the account removes its registrations.

4. Location and nearby discovery

With permission, the iPhone or Android app uses your location for nearby places, venues and plans. On Android, nearby coordinates are rounded to one decimal degree before they are sent to Frenpath. Country of residence is separately required for enrollment eligibility. Apple Maps or the Android device’s geocoding provider can receive the venue/area search terms and search region you submit. Opening directions or an external search uses your chosen mapping or search service under its own policies.

Searching for nearby plans does not itself make you discoverable. The Frenpath server uses the search area to return matches; the application does not save that search location as a location-history record. Infrastructure providers may still process request metadata and logs.

When you deliberately enable nearby discovery for a status, an approximate area is stored with that status. A place name or street address you add can be more precise and can be visible to the status’s audience. Do not include your home address or another private location unless you intend to share it. Frenpath does not provide continuous background location tracking.

5. Event discovery and AI

The event browser visits third-party websites, which receive ordinary web requests and may use cookies or other technologies under their own policies. Opening a search engine or an external AI service sends the information you choose to that service.

On supported iPhones, event extraction uses on-device processing, including Apple Foundation Models and, where available, text or image analysis of a page you ask it to read. Android can read text from a photo you select using Google ML Kit and, on supported devices, use an on-device model to extract event details. Selecting a flyer for local text recognition does not itself upload that photo to Frenpath. Frenpath does not send your private calendar, selected flyer or event-page text to a remote language model for these local features. Saving a draft, contributing an event or uploading a post/circle photo is a separate submission.

Reading an event is different from contributing it. If you contribute a source, check an event for Local Legends, or create a status from extracted details, the submitted links, event details, area, and contribution records are sent to Frenpath. Approved community events can be published beyond your circles. Local processing does not make those later submissions private.

Extracted information can be wrong. Review dates, locations, and the original source before contributing or making plans.

6. Audiences, games, and sensitive information

A status can be private to you, shared with selected circles or people, or visible to Frenpath members. Anyone on the web is a separate, explicit choice for eligible adults. After moderation approval, the title, description, categories, dates, location, link and approved photo can be viewed without signing in. Circle names, recipient lists, participant lists and account contact details are not included in the guest view. Edits require a new web review. Removing web visibility removes access through the guest service, but cannot recall copies, screenshots or information already shared. Blocking a member cannot prevent signed-out viewing of a web-public plan. Nearby discovery is an additional choice.

Save draft stores content privately from other members; its intended audience and public/discovery settings take effect when you post. “Private” does not mean end-to-end encrypted or inaccessible to the providers and authorized administrators described below. Links to private or members-only plans remain subject to sign-in and audience checks. Approved web-public plan links can be viewed without signing in.

Category defaults and calendar setup choices can preselect circles. Multiple categories can add their saved circles together, alongside people or circles you select directly. Review the displayed audience before saving a posted edit or tapping Post. Enabling Limit guests also enables Open to company; it does not by itself make a status public or enable nearby discovery. Open to company allows join requests, and confirmation depends on approval and capacity.

Returning your posted status to Drafts removes that shared occurrence and saves its editable content as a private cloud draft. This does not recall notifications, screenshots, messages, calendar exports or other copies someone holds. Reposting creates a new post and does not restore its previous invitations or join responses. Recurring schedules store the content, timing and sharing choices needed to generate their occurrences. Removing one occurrence or returning it to Drafts does not stop the schedule; stopping the series is a separate action.

Circle memberships, participation, game activities, leaderboards, and friend-visible trophies can reveal connections and attendance to the relevant audience. Private trophies use the private visibility option. Blocking restricts access within the app but cannot recall information someone already saw or copied.

Optional JW Mode stores planning preferences such as selected goals, service targets, companions, and notes. These can reveal religious beliefs or associations. Other statuses or categories can reveal health, caregiving, or similarly sensitive matters. Such information is not required for basic use; consider what you enter and whom you share it with. Setup preferences are not automatically a public profile, but plans you create from them follow their selected audiences.

The optional generation-based theme prompt does not save or transmit your generation answer; it uses the answer to choose a theme locally. The resulting theme preference may remain on that device.

7. Providers and other disclosures

We use service providers to operate the app, including:

• Google Firebase Authentication for account verification, sign-in, recovery, and abuse protection. Google receives and stores phone numbers used for authentication for spam and abuse prevention across Google services, including Firebase. See Firebase’s phone-authentication disclosure and Google’s Privacy Policy.
• Google Firebase Cloud Messaging and Firebase Installations on Android for notification delivery and app-installation identifiers; Firebase App Check and Google Play Integrity for security and abuse protection; and Google Play Age Signals, when available and permitted, for eligibility and age-related safety controls. See Firebase’s Android data disclosure and Google’s Privacy Policy.
• Google ML Kit for Android on-device text recognition and supported local AI features. Google receives technical information such as app/device and SDK versions, installation or other identifiers, feature events and error codes, processing latency, configuration and input/output sizes for diagnostics and usage analytics. Content processed locally by these features is not sent to a remote language model. See ML Kit’s data disclosure.
• OpenAI Sites and its hosting infrastructure, including Cloudflare, to host the website, API, and application database. Frenpath uses Firebase sign-in and does not require a ChatGPT account. Hosting through Sites does not mean local AI features send their inputs to ChatGPT.
• Apple services, where you use iOS, TestFlight, Maps, calendar integrations, or device features. TestFlight may provide developer-facing testing, crash, or feedback information under Apple’s settings and policies. See Apple’s Privacy Policy.

Authorized administrators may access information needed to provide support, moderate contributions, investigate abuse, and operate the service. We may disclose information when required by law or necessary to protect users, enforce service rules, or respond to security incidents. We do not promise that shared statuses are end-to-end encrypted.

When you report content, Frenpath sends moderators a copy of the reported content, your chosen reason and explanation, and your account identifier. Your identity is not shared with the person reported. Moderators can hide or restore content and keep decision notes. Limited report evidence and moderation records may be retained after content or account deletion to handle appeals, investigate abuse, and prevent repeated violations.

Frenpath does not sell personal information. The website and native apps do not serve third-party network advertisements or load an advertising SDK. Sponsored activities and labeled ad-preview placeholders can appear. When you hide or report a sponsored activity, Frenpath stores your account identifier, the activity identifier, action, time and any report explanation to remember your choice and review that content.

8. Cookies and device storage

The website uses necessary authentication cookies and Firebase browser storage to provide sign-in, session restoration, and security. Frenpath’s session cookie lasts up to one hour; Firebase sign-in storage persists until sign-out or clearing it. Phone verification may load Google’s security challenge when you request a code. Settings you explicitly choose, including themes, category-audience behavior, and locally created connection reminders, use device storage to provide those features. Temporary form recovery may use session storage for the life of the tab.

Optional browser storage remembers unfinished plan drafts between visits, including any entered location and audience. It is off until you choose Accept all. Necessary only rejects all optional storage and removes saved browser drafts without signing you out, deleting your account, or changing published plans. Text currently open in an editor remains there until you close or leave it. These browser-only recovery copies expire 30 days after their last edit and are removed when the website next checks storage. Explicit Save draft stores a separate private cloud draft regardless of optional browser storage. Cloud drafts remain until you delete them, post them, or your account data is deleted. Posting removes the draft content and retains a small retry record to avoid duplicate posts.

Your choice, notice version, and decision time are stored on this browser for 180 days. You can change or withdraw the choice at any time using Privacy choices in the website footer or Settings. Withdrawal disables optional draft storage and removes saved drafts from this browser. Frenpath does not add advertising or analytics trackers. Accept all applies only to the optional storage described here.

These browser choices do not give blanket consent to processing personal information, change content audiences, or waive privacy rights. Necessary storage cannot be turned off through this optional-storage control; blocking it in your browser may prevent sign-in or other requested features. External websites have their own storage policies. The native iPhone and Android apps use device storage for their requested features and do not use this browser draft-consent setting.

Review or change your privacy choices.

Clearing browser/app data can remove local settings or sign you out. Signing out does not delete your server account. Device backups and calendar-provider copies may retain local information according to their own settings.

9. Retention and deletion

On the website, open Settings → Delete account. On iPhone or Android, open the Account section in Settings → Account & data retention → Delete account. Type DELETE to confirm permanent account deletion. You can also request deletion without signing in or reinstalling the app through our Delete your Frenpath account page. Email support+frenpath@lumalilt.com with the subject “Delete my Frenpath account” and identify the account email you used. We may ask you to verify account ownership; never send your password, verification codes or identity documents unless requested through an appropriate private process. Deletion removes app membership and associated personal app records, including owned statuses, cloud drafts, circles, preferences and participation records, subject to the exceptions below. Deleting a circle affects other members’ access to it.

Delete account data is a separate action that keeps your account active. On the website, open Settings → Delete account data. On iPhone or Android, open Settings → Account & data retention → Delete account data. Type DELETE DATA to confirm. This removes your posts, cloud drafts, recurring posts, owned circles and their invitations, uploaded photos, activity history and Games records. Your sign-in identity, profile, eligibility information, settings, safety controls and membership in circles owned by other people remain. Friends shown only through a deleted circle or its invitations may disappear from your Friends list. Unsent drafts on the device used for deletion are also removed; local drafts on other devices and calendar-provider events are untouched. Approved community-event facts may remain as system-owned content. Limited security and moderation evidence follows the retention limits described here. You can also delete individual content or email support to request selected-data deletion while keeping your account.

Accounts also have an inactivity-deletion setting of 1, 3, or 6 months, with 6 months as the default and no Off option. The inactivity setting measures authenticated app activity, not only the last time you typed a password. Cleanup runs as the service is used, so deletion may occur after rather than precisely at the deadline.

Important limits:

• Firebase identity deletion is queued separately and retried. It is not guaranteed to complete at the same moment as deletion from the app database.
• Limited account identifiers and deletion/retry records can remain to enforce deletion and prevent inappropriate restoration.
• Approved community-event facts may remain as system-owned community content after the contributor’s account is deleted.
• Deletion cannot recall recipients’ copies, screenshots, shared messages, third-party website records, or exported calendar events.
• Provider logs and backups may have separate retention periods. There is no single guaranteed deletion deadline for every provider copy.

If you cannot sign in, contact us using the address above to request help or deletion. For invitation or access questions, you can also contact the person who invited you. Never share your password or verification codes with them. Do not send identity documents unless specifically requested through an appropriate private channel.

10. Your choices and requests

You can review audiences, edit or remove your content, manage circles and blocks, change reminder and discovery settings, revoke device permissions, and choose your inactivity period in the app. Some controls are device-specific.

Depending on where you live, applicable law may give you rights to access, correct, obtain a copy of, delete, restrict, or object to certain processing, withdraw consent, or complain to a privacy regulator. Contact us to exercise applicable rights or ask about information concerning an invited non-member. We may need to verify your identity and explain any legal or technical limits. Revoking a permission or withdrawing consent does not undo processing already carried out.

11. Security, international processing, and children

We use authenticated access, audience checks, secure transport, and restricted server credentials. No service or transmission can be guaranteed completely secure. Protect your account, device, and invitation links, and tell us if you suspect unauthorized access.

Our providers may process information in countries other than yours. Their arrangements and applicable law govern those transfers; this policy does not promise that all data stays in one country.

Frenpath is for people aged 16 and older. Enrollment is available for residents of the United States and Canada. We ask for a country of residence and an age band, not a birthday or identity document. We retain the declaration, eligibility state, source, policy version and update time to enforce account access across devices. The iPhone app can also receive an age range and applicable restrictions from Apple. On Android, where Google Play offers age sharing and access is permitted, the app receives age-range and restriction signals and sends a derived age band, restriction state and source to Frenpath for eligibility and age-appropriate safety controls. Play age signals are not used for advertising, marketing or analytics. These signals can be declarations; they do not establish legal identity or universally verified age. Recorded younger ages or restrictions are not cleared by choosing an older age on another device. Contact support for corrections, age-transition review, underage concerns or privacy requests. We do not provide a parent-managed child-account system, and parental permission does not waive our minimum age.

When available, Firebase App Check uses Apple App Attest on iPhone or Google Play Integrity on Android to help confirm that an enrollment request comes from a genuine app instance. Google processes app/device integrity and Play licensing/attestation information to provide its checks. This does not verify your age or legal identity. We retain the resulting assurance label with eligibility information. Short-lived enrollment challenges and one-use token hashes prevent replay; expired entries are removed when the next challenge is created. We do not store the raw attestation token in the application database.

Protected accounts, including eligible 16–17-year-olds and accounts without established adult eligibility, use private sharing. Public and nearby sharing and automatic category-audience expansion are unavailable. New posts limit circle access to members included when shared, subject to current membership and blocks; newly added members do not automatically gain access to earlier posts. Automatic recurring expansion is paused for protected accounts without deleting saved setups. Account owners can still review their own saved information.

An invited person aged 16 or older in an unsupported country can join an email waitlist without creating an account or requesting an SMS. With explicit consent, we retain their provided email, country, age band, invitation reference, consent version and time, review state and contact dates so the Frenpath team can contact them about availability in that country. Waitlist email addresses are not independently verified and are not used for marketing. Only site administrators can view the contact list. Existing country-interest requests are not automatically enrolled for email. One entry is saved per invitation. People can leave through their original invitation even after it expires, or ask support to remove their details. Entries expire 180 days after the latest consent and are removed on the next waitlist/request check or associated account-data deletion. Joining does not create membership, reserve a position or guarantee availability; normal invitation and eligibility checks still apply when enrollment opens.

Image uploading is available to eligible accounts when enabled. Authorized reviewers can access submitted content as needed for safety review. Access is restricted, and permission changes and review decisions are recorded for security and accountability. Service restrictions do not remove the ability to contact support, request correction or request deletion.

Photos and image review

When image features are enabled, permitted users can attach one still photo to a post or circle. The device resizes and compresses the photo; the server independently re-encodes it and removes embedded metadata, including location tags. We store the processed photo, a thumbnail, its description, owner/item identifiers, review context and moderation records in private service storage. Originals are not retained. Authorized reviewers can privately inspect submitted images and the associated text. An open-source sexual-content classifier runs on the reviewer’s device using a model hosted by Frenpath; photos and post text are not sent to an external AI screening service. Its results assist mandatory human review and are not an age, consent or comprehensive safety check.

Approved images follow the current post or circle audience. Images on an approved web-public plan can be viewed without signing in; other images retain their sign-in and audience checks. Text changes require another image review before the photo is shared with the changed text. Removing an image withdraws access immediately. Rejected, removed, replaced and unreviewed images become eligible for deletion after 30 days and are removed in bounded background cleanup when the service is used. Images whose post, circle or account is deleted are also removed during cleanup. A documented incident hold can preserve restricted evidence until released. Review decisions and safety audit records may remain for abuse prevention and appeals. Display switches can hide approved images without deleting them.

12. About this notice

The date above identifies this notice. It describes Frenpath’s data handling and works alongside the Terms of Use. Privacy choices and use of the service do not waive rights under applicable law.