UpTrust Privacy Policy

Effective Date: September 27, 2024. Updated November 3, 2026.

At UpTrust, we take your privacy very seriously and are dedicated to protecting it - maybe even more than you'd expect. This Privacy Policy outlines the data we collect, how we use it, and your rights when using our site. If you ever need more specifics, feel free to reach out to our team. This policy will be updated as our services evolve.

1. Information We Collect

Your account details (email, and phone if you add one, or the name and email Google or Apple share when you sign in with them); your profile; what you post, comment and vote; whom you trust and on which topics; the groups, channels and events you join; and the reports and feedback you send us. We also record which posts we show you in your feed.

Accounts you connect. If you connect another account, we receive what you authorize. From GitHub, your public profile and the repositories you have starred, imported as trust statements. From X, your public profile and, if you ask us to read your X history, your public posts and the accounts you interact with. From ORCID, your public record. From Slack, your identity; when your group moves from Slack, the workspace's channels, messages and files; and, if you choose, your own Slack direct messages, which we keep as imported history without end-to-end encryption. If your Slack workspace is connected to UpTrust, we also read who replied to or reacted to whom in its public channels, as trust evidence, without storing the message text.

When you connect an AI assistant such as ChatGPT or Claude, we receive what it sends to UpTrust's tools for you, such as a question, a topic or an introduction you asked it to submit, and we log which tool was called, by which assistant, how long it took and whether it failed.

Contacts. If you invite people from your contacts, we receive only the names, email addresses or phone numbers you choose to invite. Google contacts are read from Google by your browser, with your permission. To show which of your phone's contacts are already on UpTrust, the app sends us a one-way hash of each phone number and email address; we compare the hashes with our members' and do not store them.

Messages. Direct messages, group chats and encrypted channels are end-to-end encrypted: we store them only in a form we cannot read, and the keys stay on your devices, or in a backup sealed with a recovery key only you hold. We do see who is in a conversation, when each message was sent, its disappearing-message timer, and the names of group chats. Photos you send in a chat are stored with Uploadcare without end-to-end encryption. Messages in group channels that are not encrypted are stored like posts, and we can read them.

Devices and logs. When you use UpTrust, our servers log your IP address, your browser or device type, the addresses you request and when. We use your IP address to limit spam and abuse, and do not keep it in our database. If you allow notifications, we keep your device's push address.

Payments. If you pay for an event or a plan, or are paid as a host, you give your card or bank details to Stripe on its own pages; we never see your full card number.

If you RSVP or sign in with your phone, we also collect your phone number and the name you give. We keep a record that your browser has signed in, in a cookie on your device and a fingerprint of it on our servers, so that signing in by text from the same browser is quicker next time.

If you uptrust or downtrust posts before signing up, those votes stay in your browser for seven days after your last one, and become your account's votes when you sign up there.

2. How We Use Your Data

To rank posts and people from your position in the trust network, to show your posts to others, to send you the notifications you choose by email, text and push, to answer your assistant's requests, to keep accounts safe and stop spam and abuse, to find and fix errors, to measure which of our ads bring people to UpTrust, and for internal analytics. We email product updates to members who have not turned them off, and every one has an unsubscribe link. We do not sell your data.

3. Sharing Information with Service Providers

We may share information with trusted vendors, consultants, and other service providers who require access to certain data to perform tasks on our behalf. These service providers are subject to their own confidentiality and security obligations to ensure the protection of your personal information.

These are the providers that receive personal data from us:

• DigitalOcean hosts our servers, our database and its encrypted backups, in San Francisco.
• Grafana Labs stores our server logs, including IP addresses and browser types, and our performance metrics.
• Sentry receives reports of errors in the website and the app: the page, the browser or device, and the error; we do not attach your name or email address.
• Mixpanel records what people do on UpTrust, such as signing up or posting, under a random identifier for your account, with the browser or app version and the campaign that brought you.
• Meta measures our ads, as described under Cookies and Tracking below.
• Google and Apple sign you in when you choose to sign in with them. Expo delivers updates to the UpTrust app, and its notifications through Apple and Google; a notification can name who acted and quote a few words of what they wrote.
• Cloudflare checks the sign-up, sign-in and password-reset forms for bots (Turnstile).
• Uploadcare stores and serves the images and files you upload, including photos sent in chats.
• Mailtrap delivers our email. It receives your email address and the email, which can quote posts and comments, and keeps the list of members who get product updates.
• Twilio delivers our text messages, as described below.
• Stripe processes payments and payouts.
• Anthropic and OpenAI run the AI models described below.
• Slack hosts our team's workspace, which receives notices of new posts and comments (the author's username and a link) and the feedback you send us.
• SocialData fetches public X posts when you ask us to read your X history.

People who work with us under confidentiality, such as an outside data analyst, may get read-only access to a copy of our database for analysis. In that copy, email addresses are cut to their domain, IP addresses, passwords and sign-in tokens are removed, and chats are left out.

Our servers are in the United States, as are many of these providers, so your data is processed there.

AI processing. Some UpTrust features use AI models run by Anthropic and OpenAI. OpenAI receives the text of every post, comment and channel message that is not end-to-end encrypted, including those in private groups, to compute search embeddings and topic tags, and the threads it summarizes. Anthropic receives posts to score them and to cast AI perspective votes, and the threads a group admin asks it to synthesize. When a group turns on its AI agent or someone summons a bot, the messages in that group or conversation, including private ones, go to the model that answers. Content you import or connect from another service, such as X posts, an introduction you paste or your assistant submits, and Slack replies read as trust evidence, may also be sent to them to classify. End-to-end encrypted chats and channels are never sent to them. Under their API terms, these providers do not use the data we send to train their models.

Connected AI assistants. An assistant you connect, such as ChatGPT or Claude, can read what the permissions you grant allow: for example rankings, introductions and events, and, with channel access, the messages in the groups and channels you can read, but never end-to-end encrypted messages or other members' email addresses. If you allow it, it can also post for you. What it reads goes to the company that runs the assistant, such as OpenAI or Anthropic, under that company's terms.

If you have any concerns or questions about how we work with these service providers, our team is happy to discuss this in more detail.

4. Cookies and Tracking

Always on. Cookies the site needs to work: they keep you signed in and protect your session, carry you through sign-in and invitation links, remember your theme and layout, and record your cookie choice. Cloudflare Turnstile checks the sign-up, sign-in and password-reset forms for bots, and Sentry receives reports of errors in the site.

Measurement. The Meta Pixel runs on pages you see signed out and on the sign-up pages, to tell Meta which of our ads led to a visit or a sign-up; it sets Meta cookies on this site. Mixpanel records what people do on UpTrust and sets its own cookie. Your browser also keeps which campaign link or ad brought you here, so a sign-up can be counted toward it. When you sign up, and again if you come back within a week, our server reports it to Meta with your IP address, your browser type, Meta's cookie and ad-click identifiers, and your email address only as a one-way hash. A video from YouTube, Vimeo or TikTok, or a track from Spotify, shared in a post plays in a frame from that service, which sets its own cookies.

Your choice. On the website, if your device's time zone is in the European Union, the European Economic Area or the United Kingdom, none of the measurement above runs in your browser until you choose Accept in the cookie banner. If you have not accepted in the browser you sign up in, our server does not report your sign-up to Meta. Your browser keeps your choice for up to six months. When you choose while signed in, your account keeps it too, and until you accept, our server sends nothing about you to Meta or Mixpanel, including what you do in the app. Reject also deletes the campaign and ad details your browser kept. You can change your choice at any time with Cookie Settings at the foot of the signed-out pages, or here. The UpTrust app shows no banner, and the website pages it opens run none of this measurement for you. Otherwise, the app sends what you do in it to Mixpanel through our server, and our server may report its sign-ups to Meta.

5. User Rights

You have the right to request access to any data we may hold about you, and to have it corrected or deleted. We are enthusiastically committed to protecting your privacy and will respond to any inquiries or concerns you have about your data. In Settings you can edit your profile, turn email, text and push notifications on or off, view and revoke any AI agents you have authorized to access your trust graph, download a copy of your data once a week (your posts, comments, trust, groups, events and settings, but not your encrypted chats), and delete your account. For anything else, email support@uptrusting.com.

6. Data Retention

We keep your account data until you delete your account in Settings. Deleting it erases your email address, password, phone number and profile, your votes, trust, reactions and connected accounts, and the images and files you uploaded, and cancels any paid subscription. Your username is replaced with an anonymous one, and your posts and comments stay, shown under it.

Copies of deleted data remain in our encrypted backups until those backups expire. We keep backups for at most one year, and a backup we discard is erased from storage 30 days later. If we ever restore a backup, we delete again every account deleted since that backup was made. Providers keep what we have already sent them under their own retention; for example, our email provider keeps your address marked as unsubscribed.

Server logs are kept for 30 days. Records of the calls connected assistants make, and of which posts we showed you, are kept for 90 days. A data download you request is deleted after a week. A browser's sign-in-by-text record is deleted after 400 days without use.

7. SMS / Text Message Communications

If you add and verify a phone number, we may send you transactional SMS messages related to your account: one-time verification codes, notifications of activity directed at you (replies, mentions, reactions, direct messages, bridge requests, group invites, event updates), and security alerts. We do not send marketing or promotional SMS.

If a host enters your phone number to invite you to an event, we text that number the invitation: it names the host, links to the event, and says to reply STOP to opt out. We keep the number with the invitation, so the event opens to you if the number is on your UpTrust account. We also count it toward the host's limit on texts, to curb spam. If any UpTrust text to the number is refused because you replied STOP, we keep a record of that, even after an account is deleted, so no host's invitation is sent to it. We use the number for nothing else.

If you RSVP with your phone, we create an UpTrust account for you, verified by the code we text; signing in with your phone works only for a number already on an account. Entering your number for a code turns on no other SMS notifications. Your number is never shown to other members. If a host typed it in to invite you, that event's hosts and co-hosts can see it among its pending invites. Before a text code signs you in to an account that also has an email or password, we may ask Twilio whether the number has changed hands or had its SIM card moved recently, so that someone who gets your old number cannot get into your account.

SMS is delivered via Twilio, a third-party provider. Twilio processes your phone number and message content solely to deliver messages on our behalf and is bound by its own privacy and security obligations. We do not sell phone numbers, share them with marketers, or use them for advertising purposes. No mobile information is shared with third parties or affiliates for marketing or promotional purposes, and SMS opt-in data and consent are not shared with any third party except Twilio, which delivers the messages for us.

You opt in by adding and verifying your phone number on UpTrust, or by entering it to receive a one-time code when you sign in or RSVP by phone. You can opt out at any time by replying STOP to any UpTrust SMS, by removing your phone number under Settings → Phone Number (not possible while the number is your only way to sign in), or by disabling SMS for individual notification types under Settings → Notifications. Standard message and data rates from your carrier may apply. For full details on consent, frequency, opt-out, and HELP keyword behavior, see our SMS Notifications & Consent page.

8. Public Email Lists

Some pages let you sign up for a recurring email (for example, the weekly perspective split) without creating an account. For these lists we store your email address, when you confirmed, the version of the sign-up promise you saw, and which page you signed up from. We use this information only to send you that list. Every send happens after you confirm your address by clicking a link we email you (double opt-in), and every email includes a one-click unsubscribe link.

If you never confirm, we delete your address within 7 days. After you unsubscribe, we delete your address within 30 days. You can also ask us to delete it right away at support@uptrusting.com. We do not connect these addresses to accounts, sell them, or use them for anything but the list you asked for.

9. Changes to This Policy

We are likely to update this Privacy Policy as our platform evolves. We encourage you to review this policy periodically for any changes, and we'll do our best to let you know when changes occur.

If you have any questions or concerns regarding this policy, please get in touch with us at support@uptrusting.com.