Privacy Policy

TouchGrass is a social marketplace for real-life experiences. We connect people with studios, instructors and hosts who run those experiences. This policy covers the TouchGrass mobile app and tch-grass.com.

When you book an experience, the studio or host running it is a separate business. They receive the booking details they need to provide the experience, and they handle that information under their own privacy practices.

• Account details. Your email address and password, or the account identifier we receive if you sign in with Apple or Google. If you use Sign in with Apple and choose to hide your email, we only ever see the relay address Apple gives us.
• Profile. Your name, username, bio, the location text you enter, and any profile or banner photo you upload.
• Photos and video. Images and clips you choose from your library or capture with your camera, for profile pictures, review photos and studio media. We access your library or camera only at the moment you pick a file, and only after you grant permission.
• Bookings and purchases. What you booked, when, how many places, class packs and memberships you hold, and your cancellation history.
• Content you post. Reviews, ratings, social posts, comments, reactions, the people and studios you follow, your wishlist, and any feedback you send us.

• Location. If you allow it, we use your device location while the app is open to show experiences near you and to suggest your city. We ask only for while-in-use access and never track you in the background. You can refuse or revoke this at any time in your device settings, and the app still works: you can search by city instead.
• Push notification token. If you enable notifications, we store the push token for your device, along with the device type, so we can deliver booking reminders and social alerts to the right place.
• Usage. Basic records of your activity in the app, such as bookings made and points earned, which power your rewards tier and your activity feed.

TouchGrass contains no third-party analytics, advertising or tracking SDKs. We do not build advertising profiles, we do not sell your personal information, and we do not track you across other companies apps or websites.

Payments are processed by Stripe. Your full card number never reaches TouchGrass servers: it goes directly to Stripe, which is certified to PCI Service Provider Level 1. We store only what we need to show you your order history and saved payment methods, such as the card brand, the last four digits and the expiry date.

Studios and hosts are paid out through Stripe Connect. If you run a studio, Stripe collects the identity and bank details it needs to pay you and to meet its legal obligations, and Stripe handles that information under its own privacy policy.

• To create and secure your account and sign you in.
• To show you relevant experiences, including ones near you.
• To take bookings and payments, and to pass the booking to the studio or host running the experience.
• To send booking confirmations, reminders, cancellations and changes.
• To run the social features you opt into, such as posts, follows, reviews and group bookings.
• To operate the rewards programme and calculate points and tiers.
• To respond to your support requests and feedback.
• To detect and prevent fraud, abuse and other harmful activity.
• To meet our legal, tax and accounting obligations.

• Studios and hosts. When you book, the studio receives your name, profile photo and booking details so they can run the experience and greet you.
• Other users. Your profile, reviews, and anything you post socially are visible to other people on TouchGrass. Reviews are attributed to you.
• Service providers. Supabase hosts our database, authentication and file storage. Stripe processes payments. Expo delivers push notifications. Typesense powers search. Each one processes data on our instructions and for no other purpose.
• Legal and safety. We may disclose information where the law requires it, or where it is necessary to protect the rights and safety of our users.

We do not sell your personal information to anyone.

We keep your account information for as long as your account is open. Booking, payment and tax records are kept for as long as the law requires, typically several years, even after you close your account. Anything else is deleted or anonymised when it is no longer needed.

You can delete your TouchGrass account at any time from inside the app: open Settings and choose Delete account.

Deletion is immediate and permanent. It removes your profile, posts, comments, reactions, reviews, bookings, purchases, follows, rewards and sign-in credentials. It cannot be undone, and we cannot restore a deleted account. Records we are legally required to retain, such as transaction records for tax purposes, are kept in a form separated from your profile.

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, export it, object to or restrict how we use it, and withdraw consent you previously gave. Most of this you can do directly in the app: edit your profile, change your notification preferences, revoke location access in your device settings, or delete your account.

For anything else, email support@tch-grass.com and we will respond within the time your local law allows. If you are in the UK or EU you also have the right to complain to your data protection authority. If you are in California, we do not sell or share your personal information as those terms are defined by the CCPA, and we will not discriminate against you for exercising your rights.

Data is encrypted in transit. Access to production data is restricted and authenticated, and row-level security rules govern what each account can read and write. Your session credentials are held in the secure keystore on your device. No system is perfectly secure, but we take this seriously and will tell you promptly if a breach affects your information.

TouchGrass is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has created an account, contact us and we will remove it.

Our service providers may process your information in countries other than the one you live in. Where that happens, we rely on the safeguards those providers have in place, such as standard contractual clauses, to protect your information to the standard required by your local law.

If we change this policy we will update the date at the top of this page. If the change is significant we will tell you in the app or by email before it takes effect.