Privacy Policy

1. Who is responsible

Phriend is the personal information controller for data processed through phriend.app, web.phriend.app, provider.phriend.app and the Phriend and Phriend Provider apps. Our Data Protection Officer can be reached at support@phriend.app.

2. What we collect

• Account data: the name and email address of the Google or Apple account you sign in with, or the name, email address and password you register with (the password is stored only as a hash), plus the display name and photo you set, and the legal name and birth date from your ID when you verify. None of these private details is shown to other members.
• Provider profile and service data: your name, a face photo, a title, an About me, the languages you speak and your base city; for each service, its title, description, price, up to 6 photos, visit type, schedule, area and lockout dates; and the FAQ answers you set for the chat.
• Saved addresses: the addresses you save for at-home services (Home, Work and others). An address is shared with a provider only for a booking you make at that address.
• Bookings, reviews, favorites, job posts and notes: the date, time, hours, address or place, note and status of each booking request; the reviews you write, with up to 4 photos; the profiles and services you favorite; the job posts (gigs) you post; and your private notes, which only you can read.
• Chat messages: the messages, images and payment account details you exchange with other members. Messages are stored by Phriend and delivered live through Ably. A message that contains listed offensive words is refused and recorded, with the matched words, for moderation.
• Identity verification data: if you verify, you submit a government ID and a selfie to Phriend. Phriend's team reviews each provider's documents (the government ID and selfie, plus any optional clearances and certificates: NBI clearance, police clearance, barangay certificate, certificates, business documents and proof of address) and records the result. The documents are stored privately: only our reviewers can open them, and every access is logged.
• Device and usage data: IP address, browser and device type, pages viewed, approximate location derived from IP, crash and performance logs.
• Reports and support: the reason and up to 4 photos you attach when you report a profile or a job post, and anything you send support.

3. Why we use it

We process your data to:

• run your account and show your provider profile and services to other members (performance of our contract with you);
• deliver chat and booking requests between members;
• verify age and identity, prevent fraud, and keep minors off the Service (legal obligation and legitimate interest);
• review reports, profiles, services, documents and job posts, including an automated first pass, enforce the terms and community guidelines, and cooperate with lawful requests;
• keep the Service secure and working, limit abusive request rates, and fix bugs;
• send you service emails (a welcome on first sign-in, verification results and booking updates) and in-app notifications for bookings and reviews, and announce policy changes.

We do not sell personal data and we do not use it for third-party advertising.

4. Who we share it with

We share data only with processors that help us run the Service, under contracts that limit what they can do with it:

• Hostinger: hosting of the Service and its database.
• Upstash: request rate limiting, short-lived caches and the scheduling of background jobs, keyed by your account or IP address.
• Ably: real-time delivery of chat messages and notifications.
• Cloudflare R2: storage of uploaded photos and, in private storage that has no public address, of verification documents.
• Sentry: error reports, so we can find and fix faults.
• Anthropic and OpenAI: the automated review of photos, documents, services, profiles, reviews and reports; a person reviews the cases the automated review is unsure about.
• Google: sign-in with Google (we receive your name, email address and profile photo), and address search and maps (Google Places) when you pick an address or an area.
• Apple: Sign in with Apple, on iPhone.
• Our email provider: delivery of account and service emails.

Other members see your profile, your provider profile and services, and the messages you send them; a provider also sees the address you pick for a booking with them. We may also disclose data when Philippine law, a court order or a lawful law-enforcement request requires it, or to protect members' safety. Some processors store data outside the Philippines under contractual safeguards consistent with the Data Privacy Act.

5. How long we keep it

• Verification documents: an approved document is kept while your account exists, as the record behind your badge. The files of a document that was rejected, or replaced by a newer upload, are deleted from our private storage 30 days after that decision or replacement; the record of the decision (the kind of document, its status and dates) stays. When you delete your account, all your verification documents, files and records, are deleted.
• Account data is kept while your account is active. When you delete your account, your name, profile photo, sign-in links, work and chat photos, verification documents, saved addresses, favorites and chat settings are deleted right away, and your provider profile, services and job posts are taken down. Reviews and reports about you, the record of your bookings, and the messages the other member can still read stay, shown as “Deleted account”, and the moderation log keeps a record of any action taken on the account. The details are on the Delete your account page.
• Logs are kept for up to 90 days.

6. Your rights

Under the Data Privacy Act you have the right to:

• be informed about how your data is processed;
• access the personal data we hold about you;
• correct inaccurate or outdated data;
• erase or block data that is unlawfully obtained, no longer necessary, or being misused;
• object to processing, including for direct marketing or profiling;
• data portability: obtain a copy of your data in a commonly used electronic format;
• be indemnified for damages caused by inaccurate, incomplete or unlawfully obtained data;
• file a complaint with the National Privacy Commission (privacy.gov.ph).

To exercise any of these, email support@phriend.app from the address on your account; we respond within 15 working days. You can also download your data and delete your account yourself, in Settings in the app.

7. Cookies

We use essential cookies (a session cookie that keeps you signed in and one that remembers your preferences) and Google Analytics 4 to count visits and see which pages are used. Analytics sets first-party _ga cookies, uses no advertising or cross-site tracking cookies, and Google does not store IP addresses. You can block it in your browser or with an extension without affecting the site.

8. Children

9. Security

Data is encrypted in transit, Google and Apple sign-in never give us a password and email passwords are stored only as hashes, production access is limited to the people who need it, and verification documents are kept in private storage that only our reviewers can open, with every access logged. If a breach affects you we will notify you and the National Privacy Commission as the law requires.

10. Changes and contact

We will update this policy when our practices change and show the new date at the top. Material changes are announced in the app or by email. Questions: support@phriend.app. See also our Terms of Use.