Pre-release. I'm Going is in a small friends-only test and is not in the stores yet. This policy describes the test version and will be checked again before release.
Who we are
I'm Going is made by XFour IT Limited, trading as XFour Labs ("we", "us"). We are a company registered in England and Wales, number 11776254. Our registered office is 100 Berkshire Place, C/O KT Wells Ltd, Winnersh Triangle, Wokingham, RG41 5RD, United Kingdom. We are the controller of the personal data described here, under UK data protection law (UK GDPR and the Data Protection Act 2018).
Questions about this policy: gdpr@xfour.co.uk.
The short version
I'm Going is a friends-only plans app. You post a plan, choose which friends or circle can see it, and friends tap "I'm in" or "Ask to join". People going to a plan can chat. Plans can also be shared with a private link that opens on imgoing.xfour.co.uk.
You sign in with Apple or Google. We receive your name and email from them. You choose a display name.
- We do not collect: your location.
- We do not collect: analytics or crash reports. The test version has none.
- We do not collect: advertising IDs. No ads.
What we collect, where it goes, and how long we keep it
| Data | Where it is stored | Why | How long |
|---|---|---|---|
| Account: email, name and provider ID from Apple or Google, display name, invite code | Supabase (our database host) | To sign you in and show your name to friends | Until you ask us to delete your account |
| Friends, friend requests, circles and mutes | Supabase | To decide who sees your plans | Until you change them or your account is deleted |
| Plans: title, date and time, place, link, cap, ticket note, who can see it, who is going | Supabase | To run the app | Until your account is deleted. Cancelled plans are kept, marked as cancelled |
| Chat messages (up to 2,000 characters) | Supabase | So people going to a plan can talk | Until your account is deleted. Messages cannot be edited or deleted one by one yet |
| Push token and phone type | Supabase, and sent to the Expo push service | To send notifications such as "Sam is going" | Until you sign out or your account is deleted |
| Contacts' phone numbers (only if you use "find friends") | Sent to our database to check for matches, then thrown away | To show which contacts already use the app | Not stored |
| Share page visitors who tap "I'm in": the name and mobile number they type | Supabase. Only the plan's host can see them | So the host knows who is coming | Until the host's account is deleted |
| Your last 50 plans, for use with no signal | On your device | To show plans offline | Wiped when you sign out |
What other people can see
- A plan is visible only to you and the friends you chose when you posted it. Everyone who can see the plan can see who is going.
- Anyone who has a plan's share link can see the plan title, time, place and the first names of people going, without signing in. Only share links with people you trust.
- Opening someone's invite link or QR code makes you friends with them straight away.
- Your phone number and invite code are never shown to other users.
Permissions the app asks for
The app asks before it uses any of these. You can say no, or change your mind later in your phone's settings. The rest of the app still works.
| Permission | What it is used for |
|---|---|
| Contacts (optional) | Checks which of your contacts already use the app. Numbers are not stored. |
| Camera (optional) | Scans a friend's QR code to add them. |
| Notifications (optional) | Tells you when a friend is going somewhere, or replies in a plan chat. |
Why we use your data (our lawful basis)
| Purpose | Lawful basis |
|---|---|
| Running the app, sign-in, plans and chat | Contract: to provide the service you asked for |
| Contacts matching, camera and notifications | Your consent, through the system permission |
| Storing names and numbers from the share page | The visitor's consent when they tap "I'm in", and the host's legitimate interest in knowing who is coming |
We do not sell your data. We do not use it for advertising. We do not make automated decisions about you that have legal or similar effects.
Service providers
We use these companies to run the app. They may only use your data to provide their service to us.
| Provider | What they do | Location |
|---|---|---|
| Supabase | Database, sign-in, chat and notifications back end | See supabase.com/privacy |
| Apple and Google | Sign-in | Apple / Google |
| Expo (650 Industries), Apple Push and Firebase Cloud Messaging | Deliver push notifications. The notification says the host's first name and the plan title | United States |
| Cloudflare | Hosts the share page | Global network |
Where a provider processes data outside the UK, we rely on UK adequacy regulations (for example for the EU), or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or the UK-US Data Bridge where the provider is certified.
Deleting your data
- There is no delete-account button in the test version yet. Email us from the address you signed in with and we will delete your account and everything linked to it within 30 days.
- Signing out removes the offline copy of your plans from your device.
- If you joined a plan from the share page and want your name and number removed, email us with the plan link.
Children
I'm Going is not for children under 13. If you think a child has given us personal data, email us and we will delete it.
Security
Data sent between the app and our providers is encrypted in transit. We give access only to the people and systems that need it, and we keep the amount of data we collect small. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of your personal data;
- ask us to correct data that is wrong;
- ask us to delete your data;
- object to, or ask us to limit, how we use your data;
- ask for your data in a format you can move to another service;
- withdraw consent at any time, where we rely on consent.
Email gdpr@xfour.co.uk. We will reply within one month. Much of your data may be only on your device, where we cannot see it.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113. We would like the chance to fix it first, so please contact us.
Changes to this policy
When the app changes what it collects, we update this page and the date at the top. If a change is significant, we will also tell you in the app.
Contact
XFour IT Limited, 100 Berkshire Place, C/O KT Wells Ltd, Winnersh Triangle, Wokingham, RG41 5RD, United Kingdom.
Privacy: gdpr@xfour.co.uk · Support: support@xfour.co.uk
Policy based on a review of the app's source code (im-going-app, develop branch) on 29 October 2026.