Effective date: October 20, 2026
Bow Out (“the App”) is operated by A2ZAI LLC (“we”, “us”). This policy explains what the App collects, why, and how long we keep it. We do not sell your data, show ads, or use advertising identifiers.
| Data | Why | How long |
|---|---|---|
| Phone number | Sign-in with a one-time SMS code (Firebase Authentication), and so friends who have your number can find you | Until you delete your account |
| Display name you choose | Shown to people in your sessions | Until you delete your account |
| A one-way, keyed hash of your phone number | Lets friends match you from their contacts without us storing a readable list of numbers | Until you delete your account |
| Contacts (only if you allow it) | To find which of your contacts use Bow Out. Numbers are hashed on your phone before they are sent, compared, and not stored. Contact names never leave your phone. | Not stored |
| Sessions, statuses (mood, battery, short note) and LET'S GET OUT replies | The core feature: shared with the people in that session only | Deleted automatically when the session ends (at most 12 hours) |
| Push notification and Live Activity tokens, a random install ID | To deliver status updates and alerts to your phone and watch | Until you sign out or delete your account |
| Crash reports and recent app log lines | Fixing bugs (Firebase Crashlytics). Logs never contain phone numbers, codes, contact names or full tokens. | Up to 90 days |
| Server logs (user ID, request IDs, timings, errors) | Security, abuse prevention and debugging (Google Cloud Logging) | Up to 30 days |
| App integrity check (Firebase App Check: Apple App Attest / Google Play Integrity) | Blocks fake clients from reaching our servers | Not stored by us |
No location, no photos, no microphone, no health data, no advertising ID, no analytics tracking, and no contact names. We never message your contacts.
Session recaps and your recent groups are kept only on your phone; we never receive them. If you share an invite link, it works only until that session ends and is deleted with it. You choose who you send it to; Bow Out never sends it for you.
All traffic is encrypted in transit. Our database only lets members of a session read it, and only you can write your own status. Contact matching uses hashing with a secret key held on the server.
The App is not intended for children under 13, and we do not knowingly collect data from them.
If we change this policy we will update the date above and, for significant changes, tell you in the App.
A2ZAI LLC · contact@a2zai.app