Privacy policy

1. Who we are

Shoal is operated by SHOAL MESSAGING LTD, a company registered in England and Wales under company number 17286024, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are the data controller for the personal data described in this policy.

We are registered with the UK Information Commissioner's Office (ICO); our registration reference is ZC178426.

For privacy questions or to exercise any of the rights described below, email privacy@shoal.chat.

2. What we collect, and why

We process three categories of personal data:

Account data

When you sign up, we store the email address you provide and the display name you choose. You can also upload a profile picture. Your email address is held in plaintext, because we use it to sign you in (whether by email link or code, or as the identifier returned when you sign in with Google or Apple). It is the only identifying detail we hold unencrypted. Your display name and profile picture (if you set one) are encrypted. Some unencrypted service data is also linked to your account — see Device data and Routing metadata below. It contains no names or message content, but because it's linked to your account, data protection law still counts it as personal data. The legal basis for processing this account data is performance of a contract.

You can sign in either with a one-time link or code sent to your email, or by linking a Google or Apple account. If you sign in with Google or Apple, we receive a basic identity token containing an account identifier and an email address, which we use to create or match your account; if you use Apple's Hide My Email, we receive a private relay address rather than your real email. We request only basic profile information and use it solely to authenticate you — see the subprocessors section for more.

Device data

For every device you sign in on — the Shoal app for iPhone or Android, or a web browser — we store a session record: a device name (encrypted), the app or browser's user-agent string, when the session was created and last used, and, if you turn on notifications, the push token or subscription needed to deliver them. The legal basis is performance of a contract.

Routing metadata

When you send a message, we store the encrypted message along with the metadata required to deliver it: the ID of the conversation it belongs to, the account IDs of the sender and recipients, and when it was sent. This routing metadata, and the record of which account IDs are linked to which families and conversations, is not encrypted, because we need it to deliver messages and to enforce who can see what. The legal basis is performance of a contract.

Family settings

We store each member's role in a family (including whether an account is a child's), each child's interface setting (their skin), and each child's active-hours schedule without encryption, because our servers use them to enforce the family's rules. Word and link rules are encrypted. The legal basis is performance of a contract.

Voice notes

When you send a voice note, the audio is encrypted on your device with the same conversation key that wraps text messages, and the ciphertext is stored on our servers for delivery. If a recipient turns on transcription for a conversation, their device runs a speech-recognition model locally (the app downloads the model once) and encrypts the resulting transcript before storing it alongside the audio. We do not receive decrypted audio, do not call any cloud speech service on your behalf, and do not receive transcript text. The legal basis is performance of a contract.

We additionally process diagnostic and security logs (errors, request volumes, rate-limit events) on the basis of legitimate interest in keeping the service running and protecting it from abuse. These logs are aggregated and do not identify individuals.

3. What we don't collect

We do not collect:

Plaintext message contents — messages are encrypted on your device before they reach our servers, and our servers store and route them only as ciphertext (see section 4 for what that does and doesn't guarantee). The one exception is a link you share: to show a preview card, your device sends that link to our link-preview service, as described in section 4.
Phone numbers
Date of birth, address, or other identity data beyond what you choose to put in your profile
Precise location data
Your browsing or activity outside of Shoal
Behavioural profiles or fingerprinting from third-party SDKs
Anything from advertising networks — we don't have any ad networks integrated

4. Encryption

We want to describe Shoal's encryption precisely, including what it does not do, so you can decide what trust we've earned. In one line: messages are encrypted in storage and in transit, family admins can read children's chats, and Shoal holds the keys — so Shoal is not end-to-end encrypted.

How it works

Shoal uses server-assisted envelope encryption with two layers of AES-256-GCM keys. Each family has a family key, and each conversation has its own conversation key. Message text, reactions, photos, videos, voice notes and the names shown in a conversation are encrypted on the sending device with the conversation key, and decrypted on the recipient's device. Our servers store and route that content only as ciphertext and never decrypt it in normal operation.

The conversation key is itself encrypted ("wrapped") under the family key of each family taking part. Family keys are stored in our database encrypted under a root secret held by our servers. When you sign in, our servers unwrap your family's key and send it to your device over an encrypted connection, so your device can open your family's conversations. Your display name, family name, device names and profile picture are encrypted under these keys too.

What Shoal staff can see

Shoal staff can't see your messages, names or pictures. In our database they exist only in encrypted form, and no code path exists today — no admin tool, no support screen, no server routine — that decrypts them. Our servers handle encryption keys only to deliver them to your family's own devices and to set up new conversations; the content itself is decrypted only on those devices. The root secret that protects family keys is not exposed in normal staff workflows.

What staff can see is the unencrypted service data described in section 2: your email address, internal account IDs and the families and conversations they're linked to, whether an account is a child's and their skin setting, message and read times, active-hours schedules, and device and notification details.

Because Shoal holds the keys, building a way to decrypt content would be technically possible. We haven't, and we have no plans to. That makes this an operational protection rather than a mathematical one, and we'd rather you knew the difference.

What this protects against

Someone who obtains a copy of our database or file storage, without our root secret, sees encrypted content they cannot read.
Someone intercepting network traffic sees encrypted traffic, with the content encrypted again inside it.
One family reading another family's conversations. Family keys never leave their own family; in a conversation between two families (a Connection), only that conversation's key is shared.

What it does not protect against

Shoal itself, in principle. Because our servers hold the root secret, Shoal could technically decrypt any family's key and therefore any message. No code path does this today (see What Shoal staff can see above). We keep the capability deliberately: it is what makes parental oversight, account recovery and lawful access possible.
Legal compulsion. Because we hold the keys, we could be required by law to produce message contents. As no tool to do that exists, we would have to build one, and we will only ever do so where the law obliges us to.
Anyone with access to our root secret and database. That includes a malicious insider or an attacker who compromised both.
Metadata. Which account IDs message each other, when, and how much is visible to our servers, whatever the content encryption. Account IDs carry no names, but an adult's account ID is linked to their email address.
Links you share. When a message contains a link, your device asks Shoal's separate link-preview service to fetch that page so it can show a preview card. That service receives the link itself, but not your account or the rest of the message, keeps no logs, and caches previews only briefly (about an hour for page details and a day for images). Previews are switched off for anyone with word or link rules set.
An unlocked device. A device that's signed in can read the conversations on it — that's intrinsic to how messaging works. Signing out, or clearing local data in the app, removes the keys stored on it.

If we ever change how this works, we will update this policy and tell users before the change takes effect. For more detail, see our security page.

5. Children's privacy

Shoal is designed to be safe for children, and is built to comply with the UK Age-appropriate Design Code (the "Children's Code"), the UK GDPR provisions on children, and equivalent regimes in other jurisdictions.

A family admin can add a child to a Shoal family without an email address or a password. Children use Shoal on a family device that an adult has set up, choosing themselves from a list of the family's children. The data we hold about a child is:

The display name chosen by the family admin or the child (encrypted)
A profile picture, if one is set (encrypted)
The contents of messages the child sends (encrypted)
The account IDs that link the child to their family and conversations, and routing metadata for the child's messages (not encrypted — see section 2)
The settings a family admin chooses for them, such as their skin, active hours and word and link rules

We do not collect children's email addresses, phone numbers, dates of birth, or other identifying information. We do not profile children. We do not show advertising to anyone. We do not allow third-party tracking.

Family admins are responsible for ensuring they have appropriate authority to add a child to a family. If you believe a child has been added to Shoal without appropriate consent, contact privacy@shoal.chat and we will remove the relevant data.

6. Admin oversight in family conversations

Family admins can read children's chats — that's how the safety features work. The app gives each family admin a read-only view of every conversation a child in their family takes part in. This is a core feature of Shoal, described openly on our security page, not a hidden pathway.

If you are a child member of a Shoal family, the family admins of that family can read:

Your conversations within the family
Your conversations with a Connection — a friend in another family whose admins have both agreed. The other family's admins can read that conversation too.

That visibility does not extend to:

Other Shoal families you may belong to
Conversations you have on accounts that aren't part of an admin-managed family

7. Subprocessors

We use the following third parties to operate Shoal. Each has appropriate data-processing agreements in place and complies with UK GDPR and EU GDPR:

Cloudflare, Inc. — provides our hosting, edge network, database (D1), object storage (R2), and message queues. The primary database is configured to reside in the EU. See Cloudflare's privacy policy.
Resend — sends transactional email (magic-link sign-in messages). See Resend's privacy policy.
Sentry (Functional Software, Inc.) — collects application error and diagnostic reports so we can detect and fix faults. We use Sentry's EU-hosted region, so this data is stored in the EU. We use it only for error monitoring. Error reports can include limited technical context (such as device and error details). See Sentry's privacy policy.
Google (Google LLC) — if you choose to sign in with Google, Google authenticates you and returns a basic identity token containing an account identifier and your email address. We request only basic profile information, use it solely to sign you in, and do not access any other Google data. See Google's privacy policy.
Apple (Apple Inc.) — if you choose to sign in with Apple, Apple authenticates you and returns a basic identity token containing an account identifier and an email address. Apple's Hide My Email feature lets you share a private relay address instead of your real one; if you use it, that relay address is what we hold. We use this only to sign you in and do not access any other Apple data. See Apple's privacy policy.
Push notification services — when you enable push notifications, encrypted notification payloads are routed via Apple Push Notification Service (Apple Inc.), Firebase Cloud Messaging (Google LLC), or Mozilla Push Service (Mozilla Foundation), depending on your device. These services see metadata (your device's push token or subscription endpoint, and the size and timing of the notification) but cannot read the message, which is encrypted.

We do not sell or rent personal data to anyone, ever.

8. International transfers

Shoal's primary data store is in the EU, and our error-monitoring provider (Sentry) uses its EU-hosted region, so that data stays in the EU. Some of our other subprocessors — notably Cloudflare, the push notification services, and the Google and Apple sign-in services — are headquartered in the United States and may process limited operational or authentication data there.

For transfers from the UK or EU to the US, we rely on the UK Extension to the EU-US Data Privacy Framework, the EU-US Data Privacy Framework, and/or Standard Contractual Clauses, depending on the subprocessor. Equivalent safeguards apply for transfers to other jurisdictions.

9. How long we keep data

Account record (email, display name, profile picture): until you delete your account.
Message ciphertext: until you delete the message, the family, or your account. Deleting a single message in a conversation that includes a child keeps the original for that family's admins (see section 6); deleting the family or your account removes it.
Session records (device name, push token): until you sign the device out or delete your account.
Magic-link sign-in tokens: 15 minutes.
Session tokens: until you sign out, or after a period of inactivity — 7 days for personal devices and 30 days for family devices.
Diagnostic and security logs: edge request and security logs (Cloudflare) are kept for 7 days; application error logs (Sentry) are kept for 30 days.
Backups: encrypted database backups are kept on a rolling 30-day cycle and are automatically overwritten as they age out.

Deleting your account deletes your account record, signs out all of your devices, and deletes every message you've sent from our servers, including in conversations with other people. Copies already saved on their devices may stay there. If you leave a family, you can choose to have every message you sent in that family deleted.

When you delete your account, we remove your account record and sign out your devices in our live systems straight away. Two kinds of data are not erased in that same instant: short-lived diagnostic and security logs, and our encrypted database backups. Both age out automatically — logs within the windows above (7 or 30 days), and backups within the rolling 30-day cycle — so any residual copies are gone within 30 days of deletion. In the meantime those copies are kept beyond use: we do not use backups for anything other than disaster recovery, and if we ever have to restore a backup we re-apply any deletions that were made after it was taken, so deleted data is not brought back into live systems. Backups are encrypted at rest throughout.

10. Your rights

If you are in the UK, EU, or another jurisdiction with similar data-protection rights, you have the right to:

Access the personal data we hold about you
Rectification of inaccurate data
Erasure of your data ("right to be forgotten")
Restriction of processing
Portability of data you've provided
Objection to processing based on legitimate interest
Withdrawal of consent, where consent was the legal basis for processing

To exercise any of these rights, email privacy@shoal.chat. We respond within 30 days, with a possible extension of up to 60 additional days for complex requests as permitted by GDPR.

You also have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk, or with the data protection authority of your country of residence within the EU.

Deleting your account

You can delete your Shoal account, and the data that goes with it, at any time, with or without the app.

In the app (iPhone, Android or the web): go to Settings → Account → Delete my account. We email you a link to confirm, so nobody can delete your account from a device you've left signed in. If you're the only family admin in a family, the app tells you and lets you delete that family too, or you can make another adult an admin first.
Without the app: email privacy@shoal.chat from the address you sign in with and ask us to delete your account. We'll check the request is yours and reply within 30 days.
A child's account: a child added without their own email address has no sign-in to delete. A family admin can delete the family (Settings → Family), which also deletes any child who isn't in another family, or email us to delete one child's account. A child with their own sign-in can delete it the same way as an adult.

What's deleted straight away: your account record (email address, display name and profile picture), your devices and sign-ins, your family memberships and settings, and every message, photo, video and voice note you've sent. If you chose to, families where you were the only admin are deleted too, with everything in them.

What isn't: copies of your messages already saved on other people's devices may stay on those devices. Short-lived logs and our encrypted backups age out within 30 days, as described in section 9.

11. Cookies and similar technologies

The Shoal marketing site (shoal.chat) does not set any cookies and does not use tracking technologies of any kind.

The Shoal apps for iPhone and Android, and the web app at app.shoal.chat, store data on your device (in the app's secure storage, or in browser storage such as IndexedDB and localStorage) to:

Hold your family's encryption keys, so messages can be decrypted on your device
Hold a session token, so you stay signed in
Cache the application's static assets for offline use

These are strictly necessary for the service to function and are not used for tracking, analytics, or advertising. We do not display a cookie banner because we do not use any non-essential cookies or similar technologies.

12. Security

Our practical security measures include:

Encryption of message contents, media and names on the sending device (AES-256-GCM) before they reach our servers — see section 4 for the full picture, including what this does not protect against
Family keys stored encrypted under a root secret that is not exposed in normal staff workflows
TLS 1.3 for all transport between devices and our servers
Magic-link authentication with single-use tokens that expire after 15 minutes
Rate limiting and abuse protection on authentication endpoints
A responsible disclosure programme at security@shoal.chat

For our full threat model, see /security.

13. Changes to this policy

If we make material changes to this policy we will notify users by email and update the "Last updated" date at the top. Non-material changes (typo fixes, clarifications) will be made without notification. The current version is always live at shoal.chat/privacy.

14. Contact us

For privacy questions or to exercise your rights: privacy@shoal.chat

For security disclosures: security@shoal.chat

For general enquiries: hello@shoal.chat

By phone: 03330 41 49 49

You can also write to us at: SHOAL MESSAGING LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.