Privacy Policy

TouchGrass is a social marketplace for real-life experiences. We connect people with studios, instructors and hosts who run those experiences. This policy covers the TouchGrass mobile app and tch-grass.com.

When you book an experience, the studio or host running it is a separate business. They receive the booking details they need to provide the experience, and they handle that information under their own privacy practices.

• Account details. Your email address and password, or the account identifier we receive if you sign in with Apple or Google. If you use Sign in with Apple and choose to hide your email, we only ever see the relay address Apple gives us.
• Profile. Your name, username, bio, the location text you enter, and any profile or banner photo you upload.
• Photos and video. Images and clips you choose from your library or capture with your camera, for profile pictures, review photos and studio media. We access your library or camera only at the moment you pick a file, and only after you grant permission.
• Bookings and purchases. What you booked, when, how many places, class packs and memberships you hold, and your cancellation history.
• Content you post. Reviews, ratings, social posts, comments, reactions, the people and studios you follow, your wishlist, and any feedback you send us.
• Waitlist signups. If you join the waitlist on tch-grass.com we store your email address, which side of the list you joined, and the city if you choose to give one. A studio also gives its name and, optionally, its website. The city field is optional and the form works without it.

• Location. If you allow it, we use your device location while the app is open to show experiences near you and to suggest your city. We ask only for while-in-use access and never track you in the background. You can refuse or revoke this at any time in your device settings, and the app still works: you can search by city instead.
• Push notification token. If you enable notifications, we store the push token for your device, along with the device type, so we can deliver booking reminders and social alerts to the right place.
• Usage. Basic records of your activity in the app, such as bookings made and points earned, which power your rewards tier and your activity feed.
• Approximate location on the web. A waitlist signup records the coarse city, region and country our host derives from your connection, alongside the page you came from and your browser's user agent. It is city level at best, never coordinates, and we use it only to decide which cities to open next.

TouchGrass contains no third-party analytics, advertising or tracking SDKs. We do not build advertising profiles, we do not sell your personal information, and we do not track you across other companies apps or websites.

Payments are processed by Stripe. Your full card number never reaches TouchGrass servers: it goes directly to Stripe, which is certified to PCI Service Provider Level 1. We store only what we need to show you your order history and saved payment methods, such as the card brand, the last four digits and the expiry date.

Studios and hosts are paid out through Stripe Connect. If you run a studio, Stripe collects the identity and bank details it needs to pay you and to meet its legal obligations, and Stripe handles that information under its own privacy policy.

• To create and secure your account and sign you in.
• To show you relevant experiences, including ones near you.
• To take bookings and payments, and to pass the booking to the studio or host running the experience.
• To send booking confirmations, reminders, cancellations and changes.
• To run the social features you opt into, such as posts, follows, reviews and group bookings.
• To operate the rewards programme and calculate points and tiers.
• To respond to your support requests and feedback.
• To detect and prevent fraud, abuse and other harmful activity.
• To meet our legal, tax and accounting obligations.

• Studios and hosts. When you book, the studio receives your name, profile photo and booking details so they can run the experience and greet you.
• Other users. Your profile, reviews, and anything you post socially are visible to other people on TouchGrass. Reviews are attributed to you.
• Service providers. Supabase hosts our database, authentication and file storage. Stripe processes payments. Apple and Google deliver push notifications. Typesense powers search. OpenAI screens submitted text and photos for harmful content before publication, including profile text, posts, reviews, group and studio messages, and studio listings. We send the submitted content for this safety check; API keys and payment details are not included. You can withdraw permission in Content Screening settings; new submissions then stay unpublished. Screening decisions can be appealed by contacting support@tch-grass.com.
• Legal and safety. We may disclose information where the law requires it, or where it is necessary to protect the rights and safety of our users.

We do not sell your personal information to anyone.

We keep your account information for as long as your account is open. Booking, payment and tax records are kept for as long as the law requires, typically several years, even after you close your account. Anything else is deleted or anonymised when it is no longer needed.

Safety reports and moderation action records may be kept after account deletion when necessary to investigate abuse, protect people, or meet legal reporting and preservation obligations. Access is restricted to authorized personnel, and records are deleted or anonymised when they are no longer needed. See our Child Safety Standards.

You can delete your TouchGrass account at any time from inside the app: open Settings and choose Delete account.

If you no longer have the app, use our account deletion request page. You can request deletion without reinstalling or signing in to the app.

Account deletion is permanent. It removes your profile, posts, comments, reactions, reviews, bookings, purchases, follows, rewards and sign-in credentials. It cannot be undone, and we cannot restore a deleted account. Records we are legally required to retain, such as transaction records for tax purposes, are kept in a form separated from your profile.

Uploaded personal photos are removed as part of deletion. If file removal is temporarily unavailable, we retry automatically. A minimal cleanup record is kept for seven days after deletion to remove uploads already in flight, or longer if removal still needs to be completed. Studio logos and shared business media remain with the studio when a team member leaves. When a studio permanently closes, its customer bookings and required business and payment records are retained separately from the former owner’s account. Refund processing can continue after account deletion.

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, export it, object to or restrict how we use it, and withdraw consent you previously gave. Most of this you can do directly in the app: edit your profile, change your notification preferences, revoke location access in your device settings, or delete your account.

For anything else, email support@tch-grass.com and we will respond within the time your local law allows. If you are in the UK or EU you also have the right to complain to your data protection authority. If you are in California, we do not sell or share your personal information as those terms are defined by the CCPA, and we will not discriminate against you for exercising your rights.

Data is encrypted in transit. Access to production data is restricted and authenticated, and row-level security rules govern what each account can read and write. Your session credentials are held in the secure keystore on your device. No system is perfectly secure, but we take this seriously and will tell you promptly if a breach affects your information.

TouchGrass is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has created an account, contact us and we will remove it.

Our service providers may process your information in countries other than the one you live in. Where that happens, we rely on the safeguards those providers have in place, such as standard contractual clauses, to protect your information to the standard required by your local law.

If we change this policy we will update the date at the top of this page. If the change is significant we will tell you in the app or by email before it takes effect.