Privacy & cookies

1. Who is responsible for your information

[company name], a company registered in England and Wales (company number [company number]) is the controller of your personal information, which means we decide how it is used and are responsible for looking after it. Our address is [postal address]. We are registered with the Information Commissioner’s Office (ICO), registration number [ICO number].

For anything about your information, email [email].

2. What we collect

When you create an account

• Your email address and a password. The password is stored only in scrambled (hashed) form by our login provider. Nobody at Knock can read it.
• If you sign in with Google instead, Google gives us your email address and the name and profile picture on your Google account. We use the email address to sign you in; your Knock profile uses the name and photo you give Knock, not Google’s. We don’t ask for access to anything else in your Google account, and we never share, sell or use Google account information for advertising.
• That you confirmed you are 18 or over and accepted our terms, when you did it, and which version of the terms you accepted.

Your profile

• Required: your first name and your university.
• Optional: a photo of yourself taken in the app (and when it was taken), your course, your year of study, a one-line bio, your Instagram and Snapchat usernames, a song from Spotify, and the kinds of music you like.
• If you get the student badge: your university email address and a record that you confirmed it. The six-digit code we email you is stored only in scrambled form.

When you host

• The party’s details: title, date and times, rough area, type of place, numbers, house rules, music, dress code, a note, and any photos you add.
• The exact address, and optionally the venue name, directions for getting in, and a phone number for guests.

When you ask to come

• How many of you are coming, what you’re bringing, and any note for the host.
• What the host decided (yes, maybe or no), your pass code if you’re let in, and when you were checked in at the door.

Keeping Knock safe

• Reports you make or that are made about you, and anyone you block.
• A record of hosts’ decisions on requests, kept to look into problems.
• Records of how often badge codes and reports have been sent, to stop abuse.
• Our hosting and database providers automatically keep short-lived technical logs of requests to the service, including your IP address, device and browser type, and the time. We use these only to keep Knock running and secure.

We don’t ask for your date of birth, your phone number (unless you’re a host and choose to give one), your location, or information about your health, beliefs, sexuality or ethnicity. Your photo is only shown to people, never used for facial recognition or any kind of automatic analysis.

Where it comes from

Most of this you give us yourself. Some comes from other people or services: a host’s decision about your request, reports other people make about you, and, if you sign in with Google, the details Google shares with us.

Reports can include allegations that someone has broken the law (for example, about drugs or someone being under 18). We use these only to review the report and keep people safe, keep them to the people who need to see them, and handle them under the conditions the Data Protection Act 2018 sets for this kind of information.

3. Who can see what

These limits are enforced by the database itself, not just by what the app chooses to display.

4. Why we use it, and our legal basis

The law requires us to have a lawful basis for each use. Ours are:

• To provide Knock to you (contract). Running your account and profile, showing listings, sending requests to hosts, issuing passes, sharing a party’s address with the guests a host lets in, and checking people in at the door.
• To keep people safe and Knock secure (legitimate interests). Handling reports and blocks, looking into misuse, removing people who break the rules, limiting how often codes can be requested, and keeping technical logs. We have weighed these uses against your rights and keep them to what’s needed.
• The student badge (legitimate interests). Confirming a university email address so hosts can see who is a student, if you choose to get the badge.
• Where the law requires it (legal obligation). For example, responding to lawful requests from the police or a court, and our duties under the Online Safety Act 2023.

We don’t send marketing, we don’t sell or rent your information, we don’t use it for advertising, and we don’t make decisions about you by automated means that have legal or similarly significant effects.

5. The companies that help us run Knock

We use a small number of providers. They process your information only on our instructions and under contracts that require them to protect it.

Some services are used only when you choose to use them, and they handle your information under their own privacy policies: Google, if you sign in with Google; Google Maps, which opens with the party’s address if you tap “directions”; Spotify: when someone adds a song we look up its name and artwork from Spotify using only the song link, the artwork is loaded from Spotify’s servers when a profile with a song is shown (so Spotify receives your device’s IP address), and Spotify’s player and cookies load only if you press play; and Instagram and Snapchat, which open if you tap someone’s username.

We may also share information if the law requires it, to protect someone from serious harm, or with a buyer if Knock is ever sold.

6. Information sent outside the UK

Where a provider handles information outside the UK, we make sure it is protected to UK standards: by sending it only to countries the UK recognises as adequate (for the United States, to organisations certified under the UK Extension to the EU-US Data Privacy Framework), or by using the ICO’s approved data transfer contracts. Email us for more detail.

7. How long we keep it

These are deleted automatically, by a clean-up that runs every day:

After a party is deleted, your profile keeps only a count of the parties you’ve hosted and been to, and nothing about which ones. When you delete your account, your profile, photos, requests, parties and login are deleted straight away (any copy in our providers’ backups is overwritten on their normal cycle). Some records are kept for the periods above even after you delete your account, because they’re needed to keep people safe: reports you made (no longer linked to you), reports made about you, and hosts’ decision records. We may keep something for longer only if the law requires it or it’s needed for a legal claim.

8. Keeping it secure

Information is encrypted when it travels to and from Knock and when it’s stored. Profile photos are kept private and shown only through links that expire after an hour. Addresses are stored separately from everything else and released only as described above. Access to our systems is limited to the people who need it to run Knock.

9. Your rights

You have the right to:

• get a copy of the information we hold about you;
• have anything wrong corrected (most of it you can edit yourself in your profile);
• have it deleted: you can delete your account at any time from your profile, and it’s gone immediately;
• object to how we use it, or ask us to restrict it;
• receive the information you gave us in a format you can take elsewhere.

Email [email] to use any of these. We’ll reply within one month, and it’s free. We may need to confirm it’s really you first.

Your right to object. Where we use your information because of our legitimate interests (see section 4), you can object at any time by emailing [email]. We will stop unless we have compelling reasons that override your interests (for example, keeping a record of a report about someone’s safety), or we need it for a legal claim.

10. Complaints

If you’re unhappy with how we’ve handled your information, you have the right to complain to us first, at [email] or through the contact page. We’ll acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.

You can also complain to the Information Commissioner’s Office at any time: ico.org.uk/make-a-complaint or 0303 123 1113.

11. Under 18s

Knock is only for people aged 18 or over. If we learn that someone under 18 has an account, we will close it and delete their information. If you think a child is using Knock, please tell us.

12. Cookies and storage on your device

Knock uses only what it needs to work, plus one thing you can choose (remembering your email). There are no analytics, advertising or tracking cookies, so we don’t ask you to accept any.

If you press play on someone’s song, Spotify’s player loads and Spotify may set its own cookies. Before that, only the song’s artwork is loaded from Spotify.

13. Changes to this policy

If we change how we use your information, we’ll update this page and change the date at the top. If the change is significant, we’ll tell you in the app.