Legal
Privacy Policy
Last updated · 10 August 2026
Space is built so that most of what you say stops existing on its own. This policy explains the small amount we do hold, why we hold it, and how to make it go away.
Who we are
Space (“Space”, “we”, “us”) provides the Space mobile application and the services behind it. For questions about this policy, write to privacy@spacechatapp.com. If you are in the EEA or UK, we act as the data controller for the information described below.
What we collect
Account information
You sign in with Apple or Google. We never see or store your password. From the sign-in provider we receive a stable account identifier, and — depending on what you choose to share — your email address and display name. If you use Apple's Hide My Email, we only ever see the relay address.
Inside the app you may add a display name, an avatar image, a colour palette and a short note. Some of these are stored on our servers so the people you talk to can see them; others stay on your device only.
SpaceAI
SpaceAI is optional. When you ask it for wording or an image, the prompt you wrote is sent to Microsoft Azure OpenAI to answer it — see Who we share it with below. A picture it generates is stored like any attachment and fades with the card that carries it; a generated picture you never send is deleted automatically within a couple of hours. We do not log your prompts.
Your conversations
Cards — text, photos, videos and voice notes — are stored on our servers only for as long as they exist in the app:
- Fading cards are deleted from our database by a scheduled job once their fade window has passed for every reader, and in all cases once a hard time-to-live expires.
- View-once cards have their content removed on the server the moment the recipient opens them.
- Kept cards stop fading and stay on your shelf until you unkeep them, leave the space, or delete your account.
We store, alongside each card, the information needed to make fading work: who sent it, which space it belongs to, and when each member first saw it.
Technical information
To operate the service we process device push tokens (so we can tell you something is waiting), session tokens, approximate last-active timestamps, and standard server logs that may include IP address, device/OS type and app version. Logs are retained for a short period for security and debugging, then discarded.
What we do not collect
We do not collect your contacts or address book, your precise location, advertising identifiers, or browsing activity outside the app. Space contains no third-party advertising or analytics-for-ads SDKs.
How we use it
- To deliver cards between you and the people in your spaces.
- To let you sign in, keep you signed in, and recognise you across your devices.
- To send notifications. Push notifications never contain the contents of a card — only that something is waiting for you.
- To keep the service safe and working: preventing abuse, rate-limiting, diagnosing errors.
- To comply with legal obligations.
We do not sell your data. We do not share it with data brokers, and we do not use your conversations to train machine-learning models.
Legal bases (EEA/UK)
We process your information to perform our contract with you (delivering the service), on the basis of our legitimate interests (security, abuse prevention, improving reliability), and with your consent where consent is required — for example, push notifications and access to your camera, photo library or microphone, all of which you can withdraw in your device settings.
Who we share it with
We share only what is necessary, and only with service providers acting on our instructions:
- Google Firebase — authentication (Sign in with Apple and Google) and push delivery via Firebase Cloud Messaging.
- Apple — Sign in with Apple, and push delivery on iOS.
- Microsoft Azure OpenAI — only when you use SpaceAI. The words you type into it, and nothing else, are sent to Azure to generate the phrasings or the picture you asked for. Your ordinary cards are never sent there. Microsoft does not use this data to train models, and we do not keep the prompt after answering it.
- Our hosting and storage providers — the servers, database and object storage that run Space.
We may also disclose information if we are legally required to, or where it is necessary to protect the rights and safety of people using Space. Because faded cards are deleted, there is usually very little to disclose.
Where your data is stored
Our servers and the providers listed above may process data in countries other than your own, including the United States. Where required, these transfers rely on Standard Contractual Clauses or an equivalent safeguard.
Security
Traffic between the app and our servers is encrypted in transit (TLS). Session tokens are stored hashed at rest and rotate on every refresh; a reused token invalidates the whole session family. Access to production systems is restricted. No system is perfectly secure, but ephemerality is itself a defence: most of what you send simply does not exist any more.
How long we keep things
- Cards — until they fade, are consumed, or you unkeep them. Kept cards persist until removed or your account is deleted.
- Account record — until you delete your account.
- Device push tokens — until you sign out, disable notifications, or delete your account.
- Server logs — a short retention period, then deleted.
Your rights
Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal information, to object to certain processing, and to complain to your local data protection authority. You can edit your profile at any time in the app, and delete your account in Profile → Danger → Delete my account. For anything else, email privacy@spacechatapp.com and we will respond within 30 days. See Account deletion for exactly what deletion removes.
Children
Space is not intended for anyone under 16 (or under the minimum age of digital consent where you live, if that is higher). We do not knowingly collect information from children. If you believe a child has created an account, contact us and we will remove it.
Changes to this policy
If we make a material change we will update the date at the top of this page and, where appropriate, notify you in the app before the change takes effect.