Privacy Policy · SHPEEL

SHPEEL is operated by SoulToSoul (“we”). This policy explains what we collect, why, and what you can make us delete. It applies to the SHPEEL app on iPhone and Android, and to shpeel.me. Last updated 30 September 2026.

What we collect

Your phone number. Used only to sign you in and to stop one person flooding the feed. Never shown to anyone else, never sold.
Your display name and the country you sell in, both public on your Shpeel.
Your video and its thumbnail. Recorded in the app, stored on Cloudflare R2 and served over a CDN. Public once your listing is live.
Your destination link and its domain, public on your Shpeel card.
Swipe events: which listing, which direction, how long it was watched. Attached to your account if you are signed in, or to an anonymous device-scoped id if you are not.
Basic device and app data: app version, platform, crash information.
Who you follow, so their Shpeels and plans can reach you.
If you write to us through the form on shpeel.me: your name, how to reach you and your message, kept until we have answered and for as long as the conversation needs.

If you use Connect

Your date of birth, asked once the first time you open Connect, because Connect is for adults. Never shown to anyone, and used for nothing else.
Your location, while the app is open. When you look for plans, your position is used to find what is near you and is not stored. When you post a plan, the point you post it from is stored with it: people who are not in the group see the area and a distance rounded to 100 metres, or the place, if you named one; the exact spot is shown only to people the group has let in. A plan is only ever shown to people within 5 km of it and people who follow you. We never read your location in the background.
The videos you record for Connect: the plan itself, the fifteen seconds about yourself, and each request to join. The one about yourself is shown only to the people deciding whether to let you in — never in the feed, on your profile or in search.
What you write in a group, visible to the people in that group.

If you sell, or get paid

Your email address, asked only when you set up payouts, because Stripe needs it for the payout account and its receipts.
Payments and payouts are handled by Stripe, who collect the card and bank details themselves. We never see a card number.

We do not collect contacts, health data, or advertising identifiers. There is no ad network in SHPEEL.

Why we’re allowed to

Under the GDPR our lawful bases are: contract (we cannot run an account or publish your Shpeel without your number, name, video and link); legitimate interests (measuring the feed, preventing abuse and keeping the platform safe); and consent (camera, microphone and location access, which your phone asks you for and you can withdraw in its settings at any time).

Who processes it

Telnyx: sends your one-time login code by text message.
Cloudflare (R2 + CDN): stores and serves videos and thumbnails.
OpenAI: receives sampled video frames and text for automated safety checks, and the audio of a Connect plan so we can show what was said in words. Neither is used to train their models.
Stripe: takes payments for products and pays out sellers and creators.
Google Places: when we look up the name of a place near you, the approximate point is sent to Google.
Fly.io: runs the API and the database that stores account records.
Vercel: serves shpeel.me.

Some of these process data outside the EEA under Standard Contractual Clauses. We do not sell personal data to anyone, and we never will.

Outbound links

Swiping right opens a seller’s own site with utm_source=shpeel&utm_medium=swipe appended, so the seller can see the traffic came from us. Everything that happens on their site is governed by their privacy policy, not ours. SHPEEL is not a party to any transaction.

How long we keep it

Account records and listings: until you delete them.
Connect plans, their point, their videos and their group’s messages: until you delete them or your account.
Records of payments, orders and payouts: as long as Portuguese tax law requires, even after you delete your account.
Video files: deleted from storage on re-record, listing deletion, or account deletion.
Swipe events: retained for product analytics and stripped of any link to you when you delete your account.
Login codes: minutes.

Deleting everything

Settings → Delete account. Your listings are removed, your video files are deleted from storage, your phone number is purged and your swipe history is anonymised. Gone is gone. No app? Ask us on the web and we’ll do it.

Your rights

Access, correction, deletion, portability, objection, and the right to complain to your data protection authority (in Portugal, the CNPD). Ask us at hey@shpeel.me.

Age

SHPEEL is for people 17 and over, and Connect is for people 18 and over. It is not for children.

Changes

If this policy changes materially we’ll say so in the app before the change takes effect.