Frrand privacy policy

Last changed October 28, 2026

Frrand is where small groups of friends run each other's errands along the routes they already travel. This says what Frrand collects about you, what it's for, who sees it, who else gets it, how long it's kept, and what you can do about it.

Vespene is responsible for your information in Frrand. Here "we" means Vespene. Write to us at [email protected].

Who Frrand is for

You must be 18 or over to use Frrand.

What Frrand collects

Your account: your email address, the name your friends see, and your password, kept only as a hash, never as you typed it. If you sign in with Apple or Google, Frrand gets the email address they share (Apple's private relay address, if you chose it) and an id for your account with them.
Your phone: whether it's an iPhone or an Android phone, Frrand's version on it, its time zone, whether you've allowed location and notifications, a token for sending it notifications, a token for starting a Live Activity and one for each Live Activity it shows, and when it last used Frrand.
Your location, if you allow it: where your phone is, when, how accurately and how fast, collected in the background, also while Frrand is closed. Frrand turns it into your trips and the routes you usually travel. If, on one request, you choose to share where you are with the friend who runs it, Frrand also holds your latest position for that request. When you search for a place, and for Home's map, your phone also sends where it is, as Your location says, and Frrand keeps none of it. More in Your location.
Your friends: who you're friends with, who you've removed, and the invite links you share. Frrand never reads your phone's contacts.
Your photo, if you add one: the picture and nothing else, with no place or time it was taken. More in Your photo and your counts.
Your counts: how many requests you've made, how many you've delivered for a friend, and how far, in whole kilometres, you've run them, kept as running numbers with no place. More in Your photo and your counts.
Your requests and errands: what you ask for, where it can come from, where to deliver it, when you need it and your price limit; your saved places; which friends Frrand asked to run a request and what they answered; and for an errand, who ran it, when they expected to deliver and its updates.
What friends owe each other: each debt's amount, who owes whom, and when a reminder is due or was sent.
Notifications: the ones Frrand sends you and what each is about.

What it's used for

Your routes are used only to match your friends' requests to friends who can run them, and to estimate when they'll arrive.
Your raw location points are also kept, for now, to work on how routes are learned.
Where you are, on a request you chose to share it on, is used only to show the friend who runs it, and to tell them when they're near you.
A description you tap to turn into a list, on a phone with no model of its own, is used only to make that list.
Your photo is for your friends to see in place of your initial. Your counts are for your friends to see on your profile.
Your email address is for signing in, and for the codes Frrand emails you to confirm it or to reset your password.
While Frrand is tested before it launches, we count how many members allow background location and how often a request finds no friend to run it, from what Frrand already holds, as counts with no member named.

Who sees what

Your requests are private. A friend sees one only when Frrand asks them to run it, and then sees the item, where to pick it up, your name and where to deliver. If you chose to share where you are on that request, then until they say yes, where to deliver is "wherever you are" and the name of the neighbourhood you're in, never a point; after that, Your location says what they see. Nobody can browse your requests, not even a friend.
Before a friend says yes, you see only whether it can be run now or an estimate, with no names. Once one says yes, you see their name and when they expect to deliver, never where they are. A friend who says no, or doesn't answer in time, is never shown to you.
Your friends never see your routes. Frrand shows each member a map of where their friends together may be matched in a block of the day: only areas at least three friends cover, with no names or routes, so no area points at one friend or a pair.
A debt is seen only by its two friends. Nobody else sees your debts, a total of them, or whether you pay.
A notification about a request never names its item or an amount, so your lock screen shows neither.

Your photo and your counts

A photo is optional. If you add one, only your friends see it, in Friends and on your profile, in place of your initial. An invite shows your name alone.
Frrand keeps one photo for you, and nothing in it but the picture: no place or time it was taken. It's deleted when you remove or replace it, or close your account.
A friend sees four counts about you on your profile: how many friends you have, how many requests you've made, how many you've delivered for a friend, and the kilometres you've run for friends. They never see who or which.
Frrand keeps the counts of requests and kilometres as running numbers on you, with no place, so they stay when a request is deleted.

Your location

Frrand explains what it collects before your phone asks for location. Without background location you can still make requests and get deliveries, but you won't be asked to run errands.
You can pause learning in Frrand's Settings. While it's paused, no location points are recorded and you aren't asked to run errands, but a request you chose to share where you are on still sends it, as below. Your routes stay, and you can still see and delete them.
Points waiting on your phone to be sent are kept under the phone's own storage protection and out of its backups. Signing out deletes them.
Sharing where you are on a request: instead of a place to deliver to, you can choose, on one request, to have it follow you. It's offered only when background location is on, and Frrand asks you to confirm it on each such request. Your phone then sends where you are about every minute until the request is delivered.
Only the friend who runs that request sees where you are, on a map, from when they say yes until it's delivered or ends. Before a friend says yes, they see only the name of the neighbourhood you're in, never a point. No other member sees it. The map it's drawn on is Apple's on an iPhone and Google's on an Android phone, so Apple or Google sees the area around you that the map shows, as the section below, Who else gets it, says.
Frrand's server keeps only your latest position for this, and deletes it when the request is delivered, or when it ends if that comes first. Nothing about it stays in your history.
The runner's phone keeps your last point, only to tell them when they're near you, until it next checks in with Frrand after the request ends: as soon as they move or open Frrand.
Searching for a place, and Home's map: while you've allowed location, each time you search for a place your phone sends where it is with your words, so Frrand can list what's near you first. Home's map sends it too, rounded to 2 decimals of a degree (about 1 km), so Frrand can draw the roads around you; if you've saved a home, Frrand draws around it and ignores that position.
Frrand uses the position for that one search or map and neither stores nor logs it. Nothing about it stays in your history.
On Frrand's server, raw location points are kept 30 days from when they arrive. Your trips and routes are coarsened to about 200 m and 30-minute windows, with travel times to 5 minutes, and hold no exact time or place.
A route is kept until you delete it, close your account, or don't travel it for 8 weeks. Deleting a route also deletes the raw points of the trips it was learned from, and closing your account deletes all your raw points with your routes.
Any member's raw points may be copied from the server to the computer Frrand's developer uses to tune how routes are learned. A copy is deleted there once its points are 30 days old. Deleting a route or closing your account doesn't reach copies already taken: only their 30 days delete them.

Selling and ads

Frrand never sells members' data and shows no ads.

Who else gets it

Your information is stored and processed in the United States, by these companies:

Render runs Frrand's server and database, so it holds everything Frrand keeps. It also keeps request logs with the address each request came from, for up to 14 days.
Resend sends the codes Frrand emails you, so it gets your email address and the code.
Expo passes on Frrand's notifications, so it gets their words and your phone's notification token. Expo also delivers Frrand's over-the-air updates to the app, so it sees each phone's update checks: its address and Frrand's version on it.

Held in the United States, it may be reachable by US courts and authorities.

Apple and Google get some of it too:

A notification goes from Expo through Apple's service to an iPhone, or Google's to an Android phone, so they carry its words too.
A Live Activity, which shows a request under way on an iPhone, is started and updated from Frrand's server through Apple's push service directly, not through Expo. Apple gets its words (names, the latest update and the expected time, never an item or an amount) and its push tokens.
When Frrand's own search can't find an address or area you type, it searches with Apple (on an iPhone) or Google (on an Android phone) by itself, so your search's words go to them. An address found that way is kept like any other you pick.
The map on a route's screen, the one for pinning a place, the one that shows the place you chose to save, the Friends' map, and the one that shows the friend running a request where you are, if you chose to share it, are Apple's on an iPhone and Google's on an Android phone. Apple or Google sees which area it shows, such as the area around a place you pin or choose to save, or around you, but not the route drawn on it.
The map for pinning a place, and the Friends' map when it has no area to open on, open around where your phone is while you've allowed location, so Apple or Google sees the area around you. Without location they open around your home, if you have one, so Apple or Google sees the area around it.

Anthropic gets some of it too:

Anthropic turns a description into a list of items on a phone with no model of its own. Where your phone has one, it makes the list itself and nothing leaves the phone. Otherwise, only when you tap to turn a request's description into a list, Frrand's server sends the description alone to Anthropic's Claude, with no names, places or times. Anthropic's terms say it doesn't train on it and deletes it within 30 days. It keeps it longer only to enforce its usage policy (up to 2 years, for a request it flags), or as the law or an agreement with it requires.

How long it's kept

Your account, until you close it.
Your photo, only while you have it, as Your photo and your counts says.
Raw location points and routes, as Your location says.
Where you are, on a request that shares it: on Frrand's server only the latest position, until the request is delivered or ends. The runner's phone keeps your last point until it next checks in with Frrand after that, as Your location says.
A description sent to Anthropic to turn into a list, deleted there within 30 days, or kept longer only in the cases the section Who else gets it lists.
A notification, with the names its words carry, for up to a day after it's sent, then it's deleted.
A debt is deleted when it's marked paid. Nobody can look back at a settled debt.
A request that has ended (its debt marked paid, closed with no friend to run it, or cancelled) stays in the history of the friend who asked and of the friend who last said yes to it, if any, for a year, with no amount, then it's deleted. Each can delete it sooner from their own history.
Render's request logs, with the address each request came from, for up to 14 days.
Something deleted, such as a route, raw location points or a whole account, stays in Render's backups for up to 7 days after it's gone from the database.

Closing your account

You can close your account in Frrand. It deletes your email address, password, Apple or Google sign-in, photo, routes, raw location points, saved places and your own history, and Frrand revokes its Apple tokens if you used Apple.

Your name stays only where a friend's ledger or history still names you, or a request of yours is still open, and goes once nothing does. A balance you owe a friend stays on their ledger until they mark it paid; one you're owed is deleted. Your requests stay in a friend's history until their year ends or they delete them.

If you no longer have Frrand, you can still ask for your account to be closed: write to [email protected] from the account's email address, and we'll close it, as closing it in the app does.

Seeing and correcting your information

In Frrand you can see and change your name and photo, see and delete your routes, saved places and history, pause learning, and close your account. For anything else, such as a copy of your information, a correction or a question, write to [email protected] and we'll answer within 30 days.

The law

Frrand is for people in Ontario for now. It follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). If you aren't satisfied with how we've handled your information, you can complain to the Office of the Privacy Commissioner of Canada.

Changes

The date at the top is when this policy last changed. Until Frrand launches, we'll tell you ourselves of a change to what Frrand collects or whom it shares it with, before the change applies.

Need help with the app instead? Frrand support