Privacy Policy

1. Who we are

Karma Inc. ("karma", "we", "us"), a company incorporated in Delaware, USA, operates the website www.karma-app.com (the "Site") and the karma mobile application (the "App"), together the "Services". Karma Inc. is the "data controller" of the personal information collected through the Services.

US mailing address: Karma Inc., 1272 S Governors Ave, Unit #2036, Dover, DE 19904, United States.

UK office: Karma US-UK Ltd, Workspace, Barley Mow Centre, Chiswick, London W4 4PH, United Kingdom.

Questions about this policy or your data: support@karma-app.com.

If you are in the United Kingdom or the European Economic Area, you can contact us about anything in this policy at the same address, marking your message for the attention of our data protection contact, or by post at our UK office above.

2. What this policy covers

This policy explains how we handle personal information collected through the Site (including our waitlist) and through the App. It applies from the moment you visit the Site, join the waitlist, download the App, or create a karma account.

karma is a social app, so some of what you put into it is shown to other people. Section 5 explains exactly what other users can see, and section 6 explains what happens when a request contains something personal or sensitive. If you only read two sections, read those.

3. Information you give us

Finding people you know. This is optional and off unless you turn it on. If you do, the phone numbers in your address book are converted on your device into one-way codes (SHA-256 hashes), and only those codes are sent to us, so that we can see which of them belong to people already on karma. We do not store your contacts or their phone numbers, and we never contact anyone in your address book or tell them you have them saved. The codes are designed not to be turned back into numbers; that said, a hash of a phone number is not impossible to guess with enough effort, so we treat the codes as personal information, protect them accordingly, and discard them as soon as the comparison is done. The lookup key for your own number is additionally protected on our servers with a secret value that never leaves them. We keep only the matches, as connections between existing karma accounts. You can turn this off at any time, and doing so removes any matches we derived from it.

4. Information we collect automatically

• Location. Matching is local, so the App uses your location. With your device-level permission we collect precise location to suggest requests and helpers near you; if you decline, we use approximate location (from your IP address or the area you set in your profile). Other users never see your precise location; they see only an approximate distance or neighbourhood. You can change location permissions at any time in your device settings; the App will still work, with less relevant matches.
• Where location is stored. To be specific about this: we store a location point on your profile, which you set, and a location point on each request you post, so that we can work out distances. We do not build or keep a continuous record of your movements, and we do not track you in the background when you are not using the App. What other users see is always an approximate area or a distance, never the stored point itself.
• Address lookup and maps. When you type an address or choose a place, we use address lookup and geocoding services to suggest and standardise it: Ideal Postcodes and Loqate in the UK, and Google's Geocoding and Places services elsewhere. Those providers receive the text you type. Maps inside the App are drawn with the Google Maps SDK, which receives the area being shown.
• Technical and usage data. IP address, device and browser type, operating system, device identifiers, pages or screens viewed, interaction events, and crash reports, to keep the Services secure, fix problems, and understand how they are used.
• Push notification tokens. If you enable notifications, we collect the device token needed to deliver them (matches, messages, and important account updates). You can turn notifications off at any time in your device settings.
• Records of what we sent you. We keep a log of notifications we generated and sent — what it was about, when, and whether it was delivered — so we can tell whether the App is working. We do not log the content of notifications beyond what is needed for this.

5. What other users can see

• Your profile. Your name, photo, bio, skills, verification badge, general area, and public activity such as how many people you have helped are visible to other users of the App.
• Your request. Visible as described above, until it is completed, cancelled, or expires.
• When someone accepts. A private chat opens between the two of you. Anything more detailed that a helper needs — where to meet, your address, how to reach you — is shared by you, in that chat, at that point. We do not reveal it for you.
• Completed help in the feed. When help is completed we may show it in the feed as a completed moment, including the names and photos of the people involved and what the help was. This happens automatically and is part of how the App works. If you would rather a particular moment was not shown, email us and we will remove it.
• Never shown to other users. Your email address, phone number, date of birth, ID document or verification images, exact stored location and address, karma balance, who you have blocked or reported, your contacts, and any feedback you have given about someone.
• Blocking is quiet. The person you block is not told.
• Outside the App. We do not publish your profile, your requests, or your photos on the open web, and we do not make them available to search engines.

6. Sensitive information in requests

Because you describe what you need in your own words, a request can easily end up containing information the law treats as special category data — anything revealing health, religious or philosophical beliefs, racial or ethnic origin, political opinions, sex life or sexual orientation, or trade union membership. "I need a lift to my hospital appointment" is a lift request to you, and health information in law.

• We check every request automatically before it goes anywhere. An AI classifier reads it and flags anything that appears to touch the categories above, or that suggests a crisis, abuse, addiction, or immigration matter.
• Flagged requests are not posted publicly. They are not added to the board or the feed. They are sent privately to nearby helpers instead, so you still get help — it just isn't published with your name and face on it.
• When it isn't sure, it keeps the request private. We would rather match a request slightly more slowly than publish something personal about you.
• Completed help arising from a private request is not shown in the feed.
• The check is not perfect. Please avoid putting health, financial, or other private details in a request in the first place. Share what a helper needs to know in the chat, after you have accepted them.
• Where a request you post is published and does contain this kind of information, we rely on the fact that you chose to post it after being told it would be visible to others. You can delete a request at any time, and you can ask us to remove one.

7. AI-powered matching

When you post a help request or offer, we use artificial-intelligence models, including services provided by Anthropic, to summarise and categorise the text and to suggest likely matches based on your request, profile, and approximate location. These are suggestions only: you and your match each decide whether to connect, and no decision with legal or similarly significant effect is made about you solely by automated means. If you have questions or concerns about a match, contact us at support@karma-app.com.

To be complete about where automation is used, and what it can do:

• It summarises and categorises your request. You see and confirm the summary before anything is posted.
• It decides whether your request is posted publicly or sent privately, as described in section 6.
• It ranks who is shown or sent a request, using signals such as distance, availability, the kinds of help someone offers, their verification level, and their history on the App.
• It can hold a request for human review, or decline it — for example where the category is one we do not support, or where it appears to involve a risk of harm.
• Where a request appears to involve a crisis, self-harm, or abuse, we may decline to match it and show information about professional services instead. karma is not a crisis, medical, or mental health service.

We keep a record of how the AI handled your request. We use Langfuse to trace these AI steps so that we can check they are working and investigate mistakes. Those traces include the text of your request as the model saw it, and are kept with our technical logs (see section 18).

These systems get things wrong, and you can ask a person to look. If a request of yours was declined, held, or routed in a way you think is a mistake, email support@karma-app.com and a member of our team will review it and tell you the outcome.

8. Chat safety and message screening

Chat is private between you and the person you are matched with, but it is not unmonitored, and we would rather you knew exactly how it works. Chat is delivered and stored by Stream, our messaging provider, on our behalf; photos you attach to requests or send in chat are stored in Firebase Storage (Google Cloud Storage).

• Photos are checked automatically too. Photos you attach to a request or send in chat are scanned by Amazon Rekognition for nudity, violence, and other prohibited content before they are shown, and may be held for review if flagged.
• Messages are checked automatically as you send them. Before a message is delivered, our systems check it against a set of patterns — for example contact details, addresses, and prohibited language. If it matches, the message is blocked before it is sent and you are asked to edit it. This is automatic, applies to everyone, and is not a judgement about you.
• We record blocked attempts — which pattern was matched, by whom, and when — so we can improve the patterns and spot misuse. We do not keep the content of a message that was never sent beyond what is needed for that.
• People at karma read chat content only for a reason: where a chat is reported, where the emergency button is used, where our systems flag a safety concern, or where we are required to by law. We do not read chats routinely, for analytics, or to train AI models.
• Frozen and locked chats are kept even when they are no longer visible to you, because they are often the record of exactly the situations that need investigating. See the retention table below.

9. Feedback, ratings and reports

• After help is completed, both people can leave feedback. We keep it, linked to both of you.
• Negative feedback is never shown to the person it is about. It comes to us, and it may affect how often that person is matched or whether we look into their account.
• Feedback and ratings are used to rank and select people for future matches, as described in section 7.
• Reports and blocks are kept, including after the account they relate to is closed, so that we can recognise patterns and enforce blocks properly.
• If you ask us for a copy of your data, we will give you what the law requires. We may withhold or redact material where providing it would reveal someone else's personal information or undermine a safety investigation.

10. karma points, rewards and partners

• We keep an append-only record of karma points earned, spent, shared, and reversed. Every entry is linked to the event that caused it. This is what makes the points system auditable and makes it possible to reverse mistakes and detect misuse, so entries are never edited or removed — a correction is recorded as a new entry. After you delete your account the entries are anonymised, not deleted; section 18 explains why and for how long.
• When you redeem a reward, we share only what the brand or NGO needs in order to provide that particular reward. For some rewards that is nothing beyond a redemption reference; for others it is a name or an email address, because the reward cannot be issued or honoured without one. Each offer's own terms, shown to you before you confirm, set out what is shared for that reward. We do not share your request history, your messages, your location, or your karma balance with partners.
• Those partners decide what they do with what we send them, which makes them separate controllers for that information, under their own privacy policies.
• Partners receive aggregate reporting about their campaigns — how many people redeemed, broad categories of activity — which does not identify individual users.
• When you share points with another person, they see that it came from you, along with your name and profile photo. When you share points with a cause, the organisation does not receive your name, photo, or any other personal information — your share is counted towards their total only.

11. Keeping the community safe

We look for patterns that suggest someone is misusing the App: unusual volumes of requests or completions, repeated reports about the same person, duplicate or linked accounts, and arrangements between users that appear designed to generate karma points rather than to give real help. This involves analysing activity across accounts, including yours.

Where something is flagged, a person reviews it before we act. Depending on what we find we may warn, limit features, restrict matching, suspend, or close an account, and we keep a record of that decision and the reasons for it. If you think we have got it wrong, email support@karma-app.com and a person will review it.

12. Tribes, and interacting with what brands and NGOs publish

If you subscribe to a tribe run by a brand, NGO, or public figure, we use that subscription to send you what they publish and to personalise your feed. The organisation does not see who its members are. It sees how many members it has and how many people responded to a campaign, and does not receive your name, contact details, photo, or profile from us simply because you subscribed. If you respond to something a tribe publishes, and that response involves contacting them, what you send them is between you and them under their own privacy policy.

The same applies when you interact with content inside the App — tapping into an event, answering a poll, or responding to a moment posted by a brand, NGO, or public figure. We record what you did so we can personalise what you are shown, but the organisation sees counts and totals only: how many people responded, how a poll broke down, with no names, photos, or profiles attached.

13. Identity verification

To keep the community safe, we ask users to verify their identity before they can ask for or offer help. Verification is carried out by our specialist provider, Didit, which processes your ID document and selfie on our behalf to check that they match and that you are 18 or over. We receive and store the verification result (verified or not) and a session reference; we do not store copies of your ID document in our own systems. The provider retains verification data in line with its own retention rules and data-processing terms.

Until you verify, your account is restricted. You can create a profile and look around, but you cannot post a help request or offer to help someone. Verification unlocks both.

Two further details about this, because it involves some of the most sensitive information we handle:

• A selfie check is biometric data. Comparing your face to your ID is a way of identifying you uniquely, and the law treats that as a special category of information needing your explicit consent. We ask for that consent separately, at the point of verification, and explain what it is for before you start. You can decline; your account then stays restricted, so you can browse but cannot post requests or offer help. Your images are captured and processed by our provider and are never stored in karma's own systems.
• We keep a one-way hash. Alongside the result we store a short scrambled value derived from your ID document, which cannot be turned back into the document or read by us. Its only purpose is to tell us if the same document is used to open more than one account. We do not use it to identify you anywhere else, and we do not share it.
• We also keep a dated record of verification attempts and outcomes, so that we can answer questions about how an account was verified.

If you are in the United States, and depending on your state, you may have additional rights over biometric information, including rights to notice, to consent before collection, and to a published schedule for its destruction. Our practice is set out above; contact us for anything further.

14. Legal bases (UK & EU GDPR)

If you are in the United Kingdom or the European Economic Area, we process your personal information on the following legal bases:

• Contract: to provide the Services you signed up for: your account, profile, matching, messaging, and notifications about your matches.
• Consent: for precise location, the waitlist and marketing emails, marketing push notifications, and analytics cookies/identifiers on the Site and in the App. You can withdraw consent at any time via your device settings, the unsubscribe link in any email, your cookie choices, or by contacting us.
• Legitimate interests: for identity verification, safety and content moderation (including automated screening of messages and photos), preventing fraud and abuse, securing the Services, crash reporting so that we can fix faults, and responding to enquiries.
• Legal obligation: where we must keep or disclose information to comply with law.

Some of what we do involves special categories of information, which need an additional basis. For completeness:

• Explicit consent for the biometric part of identity verification (section 13). You can withdraw it, and we will stop and delete the associated result; your account then returns to restricted access, so you will not be able to post requests or offer help until you verify again.
• Information you have chosen to make public, where a request you posted is published and contains special category information, after you were told it would be visible (section 6).
• Substantial public interest — specifically safeguarding and the prevention or detection of unlawful acts — where we screen messages, review reports, investigate misuse, and keep records of safety decisions (sections 8, 9 and 11).
• Our legitimate interests in running a safe service, preventing fraud, and improving matching are balanced against your rights, and we keep a record of that assessment. You can object to processing based on legitimate interests at any time; see section 16.

15. Cookies & analytics

We use Google Analytics for Firebase (a Google LLC service) to understand how the Site and the App are used, for example, which pages or screens are viewed and how people arrive. These tools use cookies and similar identifiers and process technical data such as your IP address and device information. We have configured analytics to avoid collecting more than we need, and we do not use it for advertising.

Where required by law (including in the UK and EEA), analytics runs only after you accept it: via the cookie banner on the Site, and via the consent screen when you first open the App. You can decline or withdraw acceptance at any time, block cookies in your browser settings, and learn more about Google's practices at policies.google.com/privacy. Strictly necessary cookies and identifiers, needed for the Services to function, are always active.

Crash reporting is separate from analytics. The App uses Firebase Crashlytics to send us a report when it crashes: what went wrong, the device and operating system, and the App version. This does not ask for your acceptance. We rely on our legitimate interest in finding and fixing faults, the reports contain no message or request content, and we keep them with our technical logs (section 18). You can object to this processing; see section 19.

16. Who we share information with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it with:

• Other karma users: when you are matched, the other user sees your profile (name, photo, bio, verification status), your approximate distance or neighbourhood, your request or offer, and the messages and photos you send them. Never your precise location, email address, or ID details.
• Other karma users, before a match: as set out in section 5, your profile, your posted request, your name, your photo, and your approximate distance are visible to users of the App generally — not only to the person who ends up helping you. Completed help may also appear in the feed with your name and photo.
• Platform.sh: hosts the Site.
• Supabase: provides the database where your account, profile, requests, karma record, and other App data are held.
• Stream: delivers and stores in-app chat. Your messages, and the record of who is in each chat, are held on Stream's servers on our behalf.
• Google LLC: provides the App's core infrastructure: Firebase Authentication (sign-in), Firebase Storage on Google Cloud Storage (your profile photo and the photos you attach or send), Google Analytics for Firebase (analytics), Firebase Crashlytics (crash reporting), Firebase Cloud Messaging (push notifications on Android), Firebase Remote Config (feature settings delivered to the App), the Google Maps SDK (maps in the App), Google Geocoding and Places (address lookup), and the Google Workspace tools (including Google Sheets) where waitlist emails are stored.
• Google Cloud Platform: runs the App's backend services, scheduling, and internal messaging between those services.
• Apple Inc.: delivers push notifications on iOS, and provides Sign in with Apple where you use it.
• Didit: verifies your identity and age, as described above.
• Amazon Web Services (Rekognition): scans photos for prohibited content, as described in section 8.
• Ideal Postcodes and Loqate: address lookup in the UK, as described in section 4.
• Anthropic: powers matching, as described above.
• Langfuse: records how the AI handled each request so we can check and correct it; this includes the request text.
• Charter brands, NGOs, and other reward partners: receive only what a particular reward requires in order to be provided, as described in section 10. They do not receive member lists, poll responses, or anything identifying you from your interactions with their content.
• Internal administration and support tools used by our own team to review reports, investigate safety concerns, and answer your questions.
• Email and messaging providers used to send account, service, and support messages.

These providers process data on our behalf under their applicable data-processing terms. We may also disclose information if required by law, to protect our rights or users' safety (including sharing information with law enforcement where we believe someone is at risk), or as part of a corporate transaction (e.g. financing or acquisition), in which case this policy will continue to apply to it.

17. International transfers

We are based in the United States, and your information is processed on servers that may be located in the US or other countries. If you are in the UK or EEA, we rely on appropriate safeguards for these transfers, including the EU–US Data Privacy Framework and its UK Extension (to which Google is certified) and, where applicable, Standard Contractual Clauses.

18. How long we keep your information

Deleting an account, in practice. When you delete your account, this is what happens: we revoke your sign-in (Firebase Authentication, and Sign in with Apple where you used it); we delete your account and profile data from our database and your photos from storage; we close your identity-verification session with Didit; we remove your contact matches and any karma-share links you created; we purge your device, usage, skills, and causes data; and we send you a confirmation email. You stop being visible to other users straight away. Chat messages are deleted from Stream within the period in the table. A small amount of information is anonymised rather than deleted — it stays, but it is no longer connected to you or to your name:

• Your completed help history and the karma points record, because the points record is append-only by design and both are needed for our accounts. Deleting entries would break the integrity of the whole system and make it impossible to audit. After deletion the entries remain, taken out of public view and no longer linked to an identifiable person, for 6 years.
• Safety and moderation records, where keeping them is necessary to protect other users or to defend a legal claim. These are kept for the periods in the table.
• Aggregate statistics, such as how many acts of help have happened on karma, which never identified anyone individually.

19. Your rights and choices

You can delete your karma account at any time in the App (Profile → Personal details → Delete account), which removes your profile and data as described in the retention table above. If you no longer have the App, you can request deletion from our Delete account page. You can also edit your profile, change location and notification permissions in your device settings, and unsubscribe from emails via the link in any email.

Depending on where you live, you also have rights over your personal information, including the right to access it, correct it, delete it, restrict or object to its processing, receive a copy in a portable format, and withdraw consent at any time. Exercising these rights is free, and we will not discriminate against you for doing so. To make a request, email support@karma-app.com; we will respond within the timeframe required by applicable law (one month for UK/EU requests, 45 days for California requests).

Some things you can do without asking us: delete a request you have posted, ask us to remove a completed help moment from the feed, block someone, withdraw your consent to the biometric part of verification, and turn off notifications. Section 18 explains the limited categories of information that are anonymised rather than deleted, and why.

California residents: the California Consumer Privacy Act (CCPA/CPRA) gives you the rights to know, delete, and correct the personal information we hold about you, and to opt out of "sales" or "sharing" of personal information. We do not sell or share personal information as defined by the CCPA.

UK and EEA residents: you can complain to your data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, your local supervisory authority. We'd appreciate the chance to resolve any concern first.

20. Children

The Services are for adults. You must be at least 18 years old to use the App or join the waitlist, and we do not knowingly collect information from anyone under 18. We enforce this: you give your date of birth when you create an account, and identity verification with Didit reads the date of birth from your ID document. Anyone found to be under 18 is stopped at verification and the account is closed. If you believe a minor has given us personal information or is using the App, contact us and we will delete the information and close the account. See also our Child safety standards.

21. Security

We use appropriate technical and organisational measures to protect your information, including encryption in transit (HTTPS) and at rest, and access controls limiting who at karma can view user data. No online service is 100% secure, but we work to protect your data in line with industry standards.

In practice this means: access to user data is limited to the members of our team who need it for their role and is logged; sensitive actions such as reviewing a reported chat are recorded; we remove location information embedded in photos when they are uploaded; and we design our systems so that the most sensitive material — ID documents in particular — is never stored by us at all. If a breach occurs that is likely to put you at risk, we will tell you and the relevant regulator within the timeframes the law requires.

22. Changes to this policy

We may update this policy as the Services evolve. We will post the new version here with an updated date, and for significant changes we will notify you in the App or by email before they take effect.

23. Contact

US mailing address: Karma Inc., 1272 S Governors Ave, Unit #2036, Dover, DE 19904, United States.

UK office: Karma US-UK Ltd, Workspace, Barley Mow Centre, Chiswick, London W4 4PH, United Kingdom.

Email: support@karma-app.com