Privacy Policy
Last updated: September 21, 2026
FriendFund ("we," "us," or "our") operates the FriendFund application and website (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
1. Information We Collect
Account Information
We use Clerk for sign-in and email verification, and Firebase Authentication for phone verification. We store account details, profiles, nominations, private invitation notes, notification preferences, and any avatar you choose to upload. A nomination may include a contact address for someone who has not created an account yet. Recipients confirm their actual first and last name before publishing a support page. The full last name is private and available to the recipient and authorized reviewers.
Mailed invitations
If someone chooses a mailed invitation, we collect the recipient’s mailing name and US address and share them with Lob for printing and delivery. The letter includes a first name and a private invitation code. Your organizer’s identity, private note, and pledge are not printed. Mailing addresses are stored encrypted, are never published on support pages, and are scheduled for removal from our mail queue after 45 days. We retain limited delivery and abuse-prevention records. Lob’s own records follow its retention policies.
Payment Information
Stripe processes monthly support, optional FriendFund contributions, and one-time payments for mailed invitations. We store payment, subscription, transfer, refund, dispute, payout, fee and reconciliation records. We do not store full card numbers. Checkout identifies whether a payment is live or a sandbox test.
If you opt to save a card for future support, Stripe stores it and makes it available in your private FriendFund checkout. We store a reference linking your account to your Stripe payment profile, not your full card number or security code. Saved payment information is not shared with recipients. Each new monthly commitment requires your confirmation.
Automatically Collected Information
Hosting and service providers process technical information needed to deliver and protect the website. Private invitation tokens, contact values and notes must not be included in routine analytics or application logs.
Discovery and anonymous support
Accepted, visible support pages can be found by an exact verified email address or phone number. Searches do not notify the person searched for. Public pages show the recipient-approved first name and last initial, introduction, avatar, monthly support totals, and a support log showing contribution amounts and months with generated supporter names and avatars. These anonymous identities are specific to each receiving page and do not use supporters’ real names or photos. Users can also choose to publish their age and a family doodle lineup from the page editor, and can remove those details at any time. Organizer and supporter identities are not displayed to recipients or publicly. FriendFund and its providers still process identity and payment information; anonymity does not hide that information from those services.
Recipient verification
Stripe hosts the ID and selfie verification process. FriendFund does not store the raw ID images, selfies or biometric templates. We store verification references, status, account links, the recipient-provided name, and private operator review records. During sandbox testing, use Stripe’s test choices instead of real documents. Stripe’s own privacy terms describe its handling of verification data.
2. How We Use Your Information
- To provide, maintain, and improve the Service
- To process payments and manage subscriptions
- To communicate with you about your account or the Service
- To enforce our terms of service and protect against misuse
3. Third-Party Services
We share information with the following third-party service providers:
- Clerk — Authentication and user identity management
- Firebase Authentication — Phone verification and abuse prevention
- Stripe — Payments, recipient onboarding and identity verification
- Vercel — Website hosting and uploaded avatar storage
- Neon — Database hosting
- Resend — Invitations and transactional email delivery
- Lob — Printing and delivery of mailed invitations
Each provider processes data in accordance with their own privacy policies. We do not sell your personal information to any third party.
4. Data Retention
Closing an account hides its support page and starts cancellation of future support. Closure does not immediately erase every record. Financial records, unresolved payment obligations, security and audit records, and invitation suppression preferences may need to remain. Contact us to request access, correction or deletion; provider records and backups have separate retention and deletion processes.
5. Data Security
We implement industry-standard security measures to protect your information, including encrypted connections (TLS/SSL), secure authentication via Clerk, and access controls on our infrastructure. However, no method of electronic transmission or storage is 100% secure.
6. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Export your data in a portable format
- Object to or restrict certain processing of your data
To exercise any of these rights, please contact us at the email address below.
7. Children's Privacy
The recipient pilot is limited to adults aged 18 or older in the United States. Do not submit a minor’s identity documents or create a recipient page for a minor. Contact us if you believe an ineligible recipient’s information was submitted.
8. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised "Last updated" date. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.
9. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: