Privacy policy

Updated 2026-10-19

This policy explains what personal data Sortly collects, why we use it, who we share it with, how long we keep it and what your rights are. If anything is unclear, email privacy@getsortly.app.

Who we are

Sortly is run by Igloo Labs Limited (company number 16931262). Our registered office is 1st Floor, Gallery Court, 28 Arcadia Avenue, London N3 2FG, United Kingdom. We are the controller of your personal data under the UK GDPR and the Data Protection Act 2018. Our registration number with the Information Commissioner's Office (ICO) is ZC163696.

For anything about your data, email privacy@getsortly.app. For anything else, email hello@getsortly.app.

Who Sortly is for

Sortly is for parents and carers aged 18 or over. Children don't use Sortly and can't have accounts. Parents add a few details about their children so they can arrange playdates with families they know.

What we collect

About you

• Your mobile number and its country code. We use it to sign you in with a code sent by text message.
• Your first and last name.
• Your email address. New accounts add one during sign-up and confirm it with a 6-digit code. If your account was made before we asked for one, you can add one in You → Edit profile. We use it to send codes that confirm your email, to send the link to your data export, to tell you about a playdate that needs your answer or has changed while notifications are off on your phone (you can turn this off in You → Settings → Notifications) and, unless you say no, news about Sortly. The same switch covers friend requests and their answers while notifications are off. If you host a playdate at your home, it also covers the day-of heads-up about a guest's Good to know details (see "What other people can see").
• Playdate and friend-request emails show the other family's first names and last initials, your child's first name, and the playdate's day, time and place. A playdate at someone's home says whose home, never the address, and notes between parents stay in the app. Anyone who can read your inbox can see these details, and our email provider, Resend, handles them to deliver the email.
• If you add or change your email or mobile number, we hold the new one while you verify it.
• A profile photo, if you add one.
• Your settings, such as which notifications you get and the times you mean by morning, afternoon and after school.
• A record that you accepted our terms when you signed up: which version and when. When we update our terms, the app shows a notice on Home. When you tap Got it, we record that version and the time too.
• Your choice about news from Sortly. Each time you turn news on or off, we record your choice, the version of the wording you saw, where you made it (sign-up or Settings) and when. We keep every change, not just the latest one.
• Your terms and news records are kept in a log that we only add to, and they're included in your data export.

About your household

• Your home address (two address lines, town and postcode), if you add one. We only show it to the other family when a playdate at your home is confirmed.
• Your time zone.

About your children

• Their first name, and their last name if you add it.
• Their school year and school. If their school isn't in our list and you type its name, we save that name as your child's school only. We don't add it to the list other parents search.
• A photo, if you add one.
• An approximate date of birth, worked out from their school year. We don't ask for their birthday.

Good to know about your child (only if you add it). In You → Edit child's details, you can tell other families what to know when your child visits. Some of this is health information, so we ask for your explicit consent first, for each child.

• Allergies, from a list of common ones, with whether each is severe, any medication, and an optional note.
• Fears, from a list, with an optional note.
• Food preferences, from a list, with an optional note.
• Halal and kosher are on the food list. They can show a religious belief, so the same consent covers them.
• Whether you've chosen "Nothing to note", and the version of the consent wording you saw, when you gave it and when you withdrew it. We keep every change, even after you clear the details, until the child or your account is permanently deleted.

Who sees it, and when, is under "What other people can see" below. Apart from this, we don't ask for health information.

Friends and circles

• Friend requests you send and receive, including the optional request note you add, and who your children are friends with.
• Requests you decline and suggestions you dismiss.
• The circles you make, who is in them and their settings.
• Invite links you share, and who joined through them.

Free time and playdates

• The free times you share, including repeating ones, and which friends and circles you share them with.
• An optional short note, and whether you'd rather host, go out or either.
• Your answers when Sortly suggests a time to meet.
• Playdate details: the agreed time, where you're meeting and any changes. If a playdate is at your home, we keep a copy of your address with it.
• If you cancel, the reason and any detail you add. The other parent sees these.
• A history of updates about your playdates, shown in the app.

Travel estimates. When you arrange a playdate for one child, Sortly may show an approximate driving distance and time to another playdate your family has confirmed for that day. To work this out, our servers send the addresses involved (UK addresses with a full postcode) and any meeting place that includes one to Apple's Maps service, which finds their position and the driving route. That can include another family's home address, if the playdate is at their home. We keep the coordinates on our servers only, never show them to anyone, and delete them within two days. You see only rounded miles and minutes, never an address or coordinates. Before a playdate is confirmed, the other family's address isn't shown to you, but the approximate distance from it may be.

Your contacts (only if you choose to find friends from your contacts)

• Before anything leaves your phone, the app scrambles (hashes) each phone number with a key unique to your account. We compare the scrambled numbers with our members' numbers. We don't keep them, and we never receive names from your contacts.
• We keep the list of members we found for you for up to 2 days, so a repeated request gets the same answer.
• We record when you gave permission.
• You can stop at any time. In You → Settings, open Who can see your details, then Your contacts (shown once you've used your contacts), and tap Stop using my contacts. This deletes any scrambled numbers we hold for you, clears the record of your permission, resets your matching key and clears the matches saved on your iPhone. Friends you've already added stay friends. To stop iOS sharing your contacts with Sortly, turn off Contacts for Sortly in iOS Settings.

Your device

• A push notification token, a device identifier and your device type, so we can send you notifications. When you delete your account, we stop sending notifications to your phone straight away.
• Notifications are delivered by Apple. Their text, which can include other parents' and children's names and playdate times, passes through Apple to reach your phone.
• We don't collect your advertising identifier or your location. Tapping an address opens it in Apple Maps.

Crash and error reports

When the app crashes, it may send a crash report to Sentry. It may also send a short error code when something else goes wrong, such as a failed request. These reports hold the app version, whether it's a test or live build, the type of error and technical details of where the code failed. They don't include your name, phone number, email, notes or any account identifier.

When something unexpected goes wrong on our servers, or sign-in limits are being hit, our servers send Sentry a report of the error and where it happened. Before a report leaves our servers we remove the request details and replace email addresses, phone numbers and quoted values with placeholders. We don't send your IP address, and Sentry is set not to store IP addresses.

Security records

When you sign in, we record each request for a code and each wrong code entered, with the mobile number and the time. With these we keep a scrambled (hashed) form of the network (IP) address the request came from, not the address itself, so we can limit requests from one network. When we text a code to check a new mobile number, we record the number and the time. We also record similar requests, such as invite links and school searches. This lets us limit repeated requests and stop abuse.

We keep a short-lived copy of our response to many requests, including sign-ins, so a repeated request on a weak connection gets the same answer and isn't carried out twice.

Our hosting providers, Supabase and Vercel, keep request logs, including IP addresses, to run and protect the service.

Calendar

If you turn on calendar sync, the app adds your confirmed playdates to a separate calendar called Sortly, in the calendar service you choose: iPhone Calendar (which may be your iCloud calendar), Google Calendar or Outlook. Each entry holds the names of the two children, the date and time, the place (which can be a family's home address) and a link back to the playdate in Sortly. The app sends these straight from your phone to Apple, Google or Microsoft. They don't pass through our servers. Your calendar provider then keeps them under your own agreement with that provider, and may store them outside the UK. If a playdate is cancelled, the app removes its entry.

To connect Google or Outlook, you sign in with that provider. The app keeps that sign-in on your phone only, and reads just your account's email address so it can show which account is connected. The app only reads and writes the Sortly calendar. It doesn't read your other calendars or events. Disconnecting stops updates and removes the sign-in from your phone. The Sortly calendar and the entries already in it stay in your account until you delete them. You can remove Sortly's access at any time: for Google at myaccount.google.com/connections, and for Microsoft at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work or school accounts).

Sortly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Our website

• If you join the waitlist, we send your email address to our email provider, Resend, and email you a link to confirm. Once you confirm, we'll only email you when Sortly is ready for you. We keep a record of your consent with your address at Resend: which page you used, the version of the wording you saw, when you asked and when you confirmed. To unsubscribe at any time, reply to any of our emails or email hello@getsortly.app.
• We use your IP address to limit repeated sign-ups to the form, and keep it for that purpose for up to 2 hours. Vercel's request logs are covered above.
• The website doesn't use cookies or analytics.

When you email us

Mail to hello@getsortly.app, privacy@getsortly.app and safety@getsortly.app is received by Resend and passed to our support mailbox. We use your message and email address to reply.

Reports and blocks

• Report a concern, on a friend's page, opens an email to safety@getsortly.app in your own email app. It holds the concerns you chose, any note you add, the other parent's first name and last initial, reference codes for their account and for the connection between your families, and your app and iOS versions. You send it from your own email address. Resend receives it and passes it to our support mailbox. The other family isn't told. We use it to look into the concern.
• If you block a family, we record which family blocked which, who in your household did it and when. Blocking ends the friendships between your families, cancels the plans you share and stops them sending you requests or invites. You can't undo a block in the app. To undo one, email hello@getsortly.app.
• Removing a friend or disconnecting from a family ends those friendships. It doesn't block anyone.

TestFlight

If you test Sortly through Apple's TestFlight, Apple shares with us the feedback, screenshots and crash reports you choose to send. Apple's privacy policy covers TestFlight itself.

What other people can see

• Families you're connected with see your first name, last initial and photo. For each of your children who is friends with one of theirs, they see the child's first name, last initial, school year, school and photo.
• When you send a friend request, the other parent sees your first name, last initial and photo, and the name, school year and photo of the child it's from.
• Anyone who opens an invite link you share sees who it's from: your children's first names and last initials, and the circle's name for a circle invite.
• If someone who has your mobile number in their contacts uses "find friends from contacts", they may see your first name, last initial and your children's school years.
• Your free times are seen only by the friends and circles you share them with, with your note.
• Your mobile number, and your address if the playdate is at your home, are shown only to the other family on a confirmed playdate, until the end of the day of that playdate.
• What you add under Good to know about a child is seen only by the child's parents in your household and by the other family on a confirmed playdate, from the moment it's confirmed until the end of the day of that playdate. Friends, circles, friend requests, Who's free and matches never show it. The app doesn't save it on the other parent's phone.
• On the day of a confirmed playdate at their home, the host family gets a notification if the visiting child has something under Good to know. It says there's something to look at and names no one. If they have notifications off on their phone and haven't switched off playdate emails, we email them instead. The email names the children but never anything you added.
• People in a circle you created see your first name and last initial as the circle's owner.
• Your circles are private. If you turn on "Members can see each other" for a circle, its members can see who else is in it.
• In the 30 days after you delete your account, other families can't see you or your children. If you remove a child, other families stop seeing them straight away.

Why we use your data

The UK GDPR needs a lawful basis for each use. These are ours:

• To run Sortly for you (your account, friends, circles, free times, playdates and notifications): this is necessary for our contract with you.
• Your children's details: our legitimate interest, and yours, in letting you arrange playdates for your children. We keep this to what the app needs.
• Security, preventing abuse, safety reports, blocks, and crash and error reports: our legitimate interest in keeping Sortly safe and working.
• The records of your terms and news choices: our legitimate interest in being able to show what you agreed to and when.
• Good to know about your child (allergies, fears and food preferences): your explicit consent, given separately for each child. Allergies are health information, and halal or kosher can show a religious belief, so we only hold and share this with your consent. Fears and food preferences also rest on it. You can withdraw it at any time: in You → Edit child's details, tap Clear and stop sharing. That deletes it. Once cleared, the other family can't see it any more. Clearing it doesn't undo what they've already seen.
• Photos and finding friends from your contacts: your consent. You can remove a photo or stop using your contacts at any time.
• News emails: our legitimate interest in telling parents who use Sortly about Sortly. The Privacy and Electronic Communications Regulations allow this as a "soft opt-in": you can say no when you sign up and stop at any time.
• The website waitlist: your consent, which you give by confirming.
• Replying to your emails: our legitimate interest in helping you.
• Legal obligations: where the law requires us to keep or share data.

News from Sortly

News is only about Sortly. At sign-up there's a box, already ticked, that says "Send me occasional news about Sortly". Untick it and we won't send you any. You can turn News from Sortly on or off in You → Settings → Notifications at any time, and every news email will have a link to stop them. News needs a verified email address. If the box was unticked when you signed up (it used to start that way) and you left it unticked, we won't send you news unless you turn it on. We haven't sent any news yet.

Who we share it with

We use a small number of service providers to run Sortly, such as our database host and the services that send our text messages, emails and notifications. They act only on our instructions. The full list, with what each one receives and where, is on our sub-processors page.

We never sell your data. We don't show ads, and we don't share data with advertising networks. We may share data if the law requires it, or to protect a child's safety.

We don't make automated decisions that have legal or similarly significant effects on you. When Sortly matches free times, it only suggests options. You decide.

Data outside the UK

Sortly's database and website are hosted in London. Some providers handle data outside the UK:

• Twilio sends sign-in codes from the USA.
• Resend sends email from Ireland, and keeps account data and logs in the USA. It also receives the mail you send us.
• Apple delivers push notifications from the USA.
• Apple's Maps service works out travel estimates in the USA, using the addresses described under travel estimates above.
• Sentry stores crash and error reports in the EU (Germany).

For these transfers we rely on the UK's adequacy regulations (for Ireland and the EU), the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

How long we keep it

Your rights

• Get a copy of your data. Go to You → Settings → Export data. You'll need a verified email address. We email you a link to download it.
• Correct your data. Go to You → Edit profile, or edit your child's details.
• Delete your data. Go to You → Settings → Delete account. If you sign in again within 30 days, your account comes back, apart from cancelled playdates and any child you removed separately.
• Withdraw consent. Tap Clear and stop sharing under Good to know, remove a photo, stop using your contacts, or leave the waitlist by replying to any of our emails.
• Stop news. Turn off News from Sortly in You → Settings → Notifications. We stop straight away.
• Object or restrict. You can object to how we use your data, or ask us to limit it.

For any of these, or if something isn't in the app, email privacy@getsortly.app. We reply within 2 working days and deal with your request within one month. If you're unhappy with how we handle your data, you can complain to the ICO at ico.org.uk. We'd like the chance to help first.

Children

Children don't use Sortly. Parents add their children's details, and we treat those details with extra care. We follow the principles of the ICO's Children's code: we collect only what's needed to arrange playdates, we don't profile children, and we never use their data for ads. Children's names and photos are shown only to families you're connected with, share a circle with, or have sent a request or invite to.

Security

Data is encrypted when it travels and when it's stored. Access rules keep each household's data separate. Photos are kept in private storage, and other families can only see them in the app.

Changes to this policy

When we change this policy, we post the new version here and update the date at the top. If we make a significant change, we'll tell you before it takes effect, in the app or by email.

Contact

Igloo Labs Limited, 1st Floor, Gallery Court, 28 Arcadia Avenue, London N3 2FG, United Kingdom.
Data requests: privacy@getsortly.app.
Anything else: hello@getsortly.app. We reply within 2 working days.
ICO registration number: ZC163696.