Privacy

Updated 2026-05-01

Sortly is built and operated by Igloo Labs Ltd, a company registered in England and Wales. We process personal data under the UK GDPR. This page tells you what we collect, why, how long we keep it, and how to exercise your rights.

What we collect

• Account data. Your phone number (for SMS verification), display name, household identifier, account role.
• Children. First name, date of birth (or year group), school, optional address. You can omit address; address visibility unlocks only when a playdate is mutually confirmed.
• Social graph. Connection requests, friendships, and circles between children's profiles you create.
• Availability and playdates. Time windows you signal as free, the matches we surface, and the playdates you confirm.
• Device data. Push token (so we can send notifications), app version, iOS version, device model class. No advertising identifier.
• Pseudonymous analytics. Product events tied to a random identifier — never your phone number, name, or email.

Lawful basis

We rely on contract (UK GDPR Art. 6(1)(b)) for the data needed to deliver Sortly to you, and on legitimate interest (Art. 6(1)(f)) for security logging and aggregate analytics. SMS-based phone verification and push notifications operate under contract; any future marketing email would require explicit consent (Art. 6(1)(a)).

Retention

• Live accounts: data is retained for as long as the account exists.
• Deleted accounts: a 30-day soft-delete window for accidental deletion recovery, after which the data is purged from the live database. Backups age out within 35 days.
• Idempotency keys: 24 hours.
• Push tokens: deleted within 30 days of inactivity or device deregistration.
• Pseudonymous analytics events: 24 months.

Your rights

Under UK GDPR you have rights to access, rectification, erasure ("the right to be forgotten"), restriction, portability, and to object to processing. Account deletion is self-service from the You tab. For other rights, email privacy@igloo-labs.com and we will respond within 30 days. You can complain to the ICO at ico.org.ukif you are unhappy with our response.

Children's data

Sortly is for parents and carers (16+). We process limited information about children to provide the service — a first name and date of birth are required, address is optional and gated to confirmed-playdate participants only. We do not show photos in H1, do not allow text messaging between users in H1, and never sell or share children's data with advertising networks under any circumstances.

International transfers

We process personal data primarily in the UK and the EU. Some sub-processors are based outside the UK/EU (notably Apple APNs, GitHub, and Cloudflare); transfers to those providers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. The full sub-processor list is at getsortly.app/legal/sub-processors.

Contact

Igloo Labs Ltd, London — privacy@igloo-labs.com.