Kalabash Group LLC ("we," "us," or "our") operates the Ussembly mobile application ("App"). This Privacy Policy explains how we collect, use, and protect your information when you use the App.
You create an account by verifying your phone number. We send a one-time code by SMS; we store your phone number only as a salted SHA-256 hash, never in plain text on our servers. You provide a display name during setup, but your name is kept on your device and is not stored on our servers — other users see you under the name saved in their own phone's contacts. You may optionally provide a bio, and a city (see Location below).
You may set a profile photo from your device's photo library. Profile photos are stored locally on your device and are not uploaded to or stored on our servers.
With your permission, the App accesses your device contacts (names and phone numbers) to help you find people you know on Ussembly. Phone numbers are hashed using SHA-256 with a salt on your device before being sent to our server for matching. Raw contact data is stored locally on your device in a SQLite database and is never transmitted to our servers in unhashed form.
When you add someone to Ussembly yourself — by typing in their details or scanning their Ussembly QR code — the App also saves their name and phone number to your phone's own contacts, so you don't have to add them twice. This happens entirely on your device; nothing about it is sent to our servers. The App never deletes anything from your address book, and it never writes your Ussembly topics, tags, or private notes there.
With your permission, the App accesses your approximate location once during onboarding to determine your city. The precise coordinates are processed on your device and are not transmitted to or stored on our servers. The resulting city is saved to your profile so that others in your network can discover you by area; you can change or remove it at any time. We do not track your location or access it on an ongoing basis.
With your permission, the App registers a push notification token for your device so we can alert you when someone sends you a connection request or other activity occurs. The token identifies the device, not you personally, and it is deleted when you sign out. Notification text is intentionally generic — for example, "You have a new connection request" — because our servers cannot determine who the sender is to you: your contacts' names never leave your device. The sender's name appears only after you open the App, where it is matched locally. This means a lock screen never reveals who you know. Declining notifications does not restrict any feature; requests still wait for you inside the App.
Chat messages you send through the App are transmitted in real time and stored on our servers to provide the messaging service.
A JSON Web Token (JWT) is stored securely on your device using encrypted storage to keep you signed in. This token is not shared with any third party.
The App uses Google Firebase to operate and improve the service:
This data may include device information and a Firebase-generated identifier. We do not use it for third-party advertising, and we do not use it to track you across other companies' apps or websites.
We also keep, on our own servers, a daily count tied to your account of how often you use core features — for example: days you were active, searches run, connection requests, invites and recognitions sent, connections made, introductions requested and accepted, messages sent, and circles joined. We record counts only — never the content of your messages, and nothing about your contacts. If you delete your account, these counts are kept under an internal account identifier. Your phone number and its hash are deleted at the same time, so that identifier can no longer be matched back to you.
We do not sell, rent, or trade your personal information. We share information only in these circumstances:
You have the right to:
Depending on where you live (for example, California/CCPA or the EU/UK GDPR), you may have additional rights. Contact us to exercise them; we will not discriminate against you for doing so.
Ussembly is not directed at children under the age of 13, and we do not knowingly collect personal information from them. If we learn we have collected information from a child under 13, we will delete it promptly.
We may update this Privacy Policy from time to time. We will post the updated version here and revise the Effective Date; we may notify you of material changes through the App. Your continued use of the App after changes are posted constitutes acceptance of the updated policy.
If you have questions or concerns about this Privacy Policy, contact us at:
Kalabash Group LLC
Email: support@ussembly.com