Driftwood

Privacy Policy

Last updated 29 October 2026

Driftwood makes phone apps. Product Lab, for iPhone and Android, is where we try early prototypes before they become part of a product, and some of them are also their own apps: Campfire, Breakwater, Almanac, Common Room, Viewfinder, Reverie, Metropolis, Riverglass and Resonance. This page explains what Product Lab and these apps do with your data. It covers them and the driftwood.app pages their links open. Where it says what an app does, that app does the same inside Product Lab.

Accounts (optional)

You can use Product Lab, and most of each app, as a guest. If you choose to sign in, you do it with Apple or Google. Driftwood receives your email address (Apple may give us a private relay address instead) and, if you share it, your name, and creates a Driftwood account for you. These are stored in Driftwood's own Google Cloud project and used only to run your account. Anything you write while signed in, such as a thought, a message or a note in Cairn, is stored with your account, along with the place a note is about. The people in the rooms you write in can read it.

One Driftwood account works in all our apps. If you add a profile photo, it is stored with your account. If you send us a note with “Share a thought”, it goes to our Thoughts room, which other people testing our apps can read, with a screenshot of the screen you were on unless you leave it out.

So that our apps on the same iPhone can offer to continue as you, and tell you when two of them are signed in to different accounts, each Driftwood app keeps a short note of the account signed in to it: your name, a small copy of your profile photo, the email you signed in with, and whether you used Apple or Google. These notes are kept in a part of your iPhone’s keychain that only Driftwood apps can read. They stay on that phone: they are never backed up to iCloud and never sent to us. Signing out of an app removes its note, and “Remove from this phone” removes every app’s note for that account. It leaves only that account’s id and when it was removed, in the same part of the keychain, for up to a year, so an app you open rarely still signs that account out. If you signed in with Apple and chose to hide your email, that hidden address is never kept.

If one Driftwood app on your iPhone is signed in to a different Driftwood account from your other apps, or isn’t signed in while they are, it asks which account to use. If you keep the one it’s on, or say not now, that app remembers your answer on the phone only, as the ids of the accounts it was about, so it doesn’t ask again. The answer is forgotten as soon as the account in that app, or the one your other apps use, changes, including when you sign out.

Deleting your account

Open Account settings and choose “Permanently erase”. Each app opens Account settings from its own place:

• Product Lab: the You tab;
• Campfire: tap your initial at the top right of the sky;
• Breakwater: “Driftwood account” at the foot of the home screen;
• Almanac: “Driftwood account” at the foot of the Profile tab;
• Common Room: the gear beside your name on the You tab;
• Viewfinder: “Driftwood account” at the foot of the Archive;
• Reverie: “Driftwood account”, on the first screen or at the foot of your picks;
• Metropolis: “Driftwood account” in Your Letters;
• Riverglass: tap the chapter at the bottom right, then “Driftwood account” at the foot of the list;
• Resonance: “Driftwood account” at the foot of Your profile (the pencil on the You tab).

Erasing deletes your Driftwood account in every one of our apps. Your account is scheduled for deletion thirty days later, and you can cancel until then. After that, your account, your sign-in and everything stored with it, including the usage analytics recorded while you were signed in, are permanently deleted.

No longer have the app? Email finn@driftwood.app from the address on your account, or tell us which sign-in you used, and we'll erase your account on the same thirty-day schedule.

Location

Our apps use your location only while you are using them, never in the background, and only after you allow it. Campfire, Breakwater, Common Room, Reverie, Riverglass and Resonance don't use it at all; Riverglass reads where your photos were taken, as described below.

• In Product Lab, Lodestone and Cairn use it on your phone to point you toward nearby places or let you pin a note where you are standing. A note you save while signed in records the place it's about, not your position. If you don't allow location access, those experiments show a sample place instead.
• Driftwood Maps sends it to plan a route, and Almanac uses it to find walks and plans near you and, if you turn on sharing, to show friends you choose roughly where you are, as described below.
• Viewfinder rounds it to about 100 metres to name the district and city a photo was taken in, as described below.
• Metropolis addresses a new letter to where you are, and that place is shown to everyone, as described below.

Photos

One experiment, Photo taste, can look at your photo library to suggest places you might like. It reads only when each recent photo was taken and, where the library has it, where it was taken. That happens on your phone; nothing about your photos is uploaded or stored, and it is forgotten when you leave the experiment.

Riverglass

Riverglass shows the photos in your library, or the ones you choose to share with it, and lets you write about them. Your photos stay on your phone unless you share them, as described below. To name the place a photo was taken, Riverglass sends that photo's position, never the photo, to your phone's place-name service (Apple's on an iPhone, Google's on Android). To suggest photos that belong together, it can recognise the same face across your photos; that happens on your phone, and nothing about the faces leaves it.

To read your chapters, Riverglass finds the city and country of photos across your library by sending each photo's position, rounded to about 5 km, to your phone's place-name service. A short written summary of each chapter goes to Anthropic through Driftwood's own service so it can write the chapter's reading. The summary gives places as city and country, dates, what's in the photos as labels, and people only as stand-in names. It never includes the photos themselves or their exact positions.

What you write is kept on your phone. If you are signed in, it is also stored with your account, so it comes back on another phone and is deleted with your account: your chapters, what you wrote, and for each photo you wrote about, when and where it was taken, its caption and the identifier your phone's library gives it. On another phone your writing comes back without the photos.

In a chapter you share with other people, one you invited them into or one you joined, a photo you write about is uploaded, as a copy without its camera information, and everyone in the chapter can see it, with what you wrote, and comment on it. When you join someone's chapter, you agree that the photos and comments you share there may become public if the chapter does. If you give a chapter as a gift, its photos are uploaded and anyone with the gift's link can read the chapter on driftwood.app, until you take the gift back. The rest of your library never leaves your phone.

Directions in Driftwood Maps

When you ask Driftwood Maps for directions, it sends the start and end of the route to Transport for London (for transit) or Mapbox (for walking) to plan it. If you start from “Your location”, the start is where your phone is at that moment, sent only to plan that route. Mapbox also draws the map.

Near you in Almanac

If you've allowed location access, Almanac finds where you are when you open it, so your walks and plans start near you. Your phone asks its place-name service (Apple's on an iPhone, Google's on Android) for the postcode there, then keeps only its district (the part before the space, such as E8) and your position rounded to about a kilometre; the exact position is dropped. Almanac sends Driftwood that district and rounded position to find cafés, walks and open plans near you. Your exact position is never sent to Driftwood. If you'd rather not, pick a neighbourhood from the list instead, which uses no location at all.

If you're signed in, Driftwood keeps the district from the last time you looked at walks near you, and when that was, updating it at most once an hour. It's used only to tell your friends nearby about walks and plans happening now or soon: when a friend starts a walk, or makes a plan starting within the next couple of hours, for all their friends, only friends within about 3 km of it get the notification (unless they choose to tell everyone), so getting one means you're roughly nearby. Everyone in a plan's chat can still see the plan, and whoever makes it sees how many friends are nearby, never who. Your district is never shown to anyone or shared outside Driftwood. It's deleted after 14 days, and when you erase your account.

When you make a plan for all your friends, we note whether you chose to tell only friends nearby or all of them, so the right people get the notification. That note is deleted with the plan or with your account, or after a week if the plan is never made.

When you start a walk, the friends who are told see the area it starts from, such as “near E8”. When you open a plan to anyone nearby, Driftwood keeps only the area of a few kilometres (about 5 km by 3 km in London) that your rounded position falls in, while the plan is open; nobody who sees the plan is shown your position.

Friends on the map in Almanac

If you turn on sharing, the friends you choose (all your friends, or ones you pick) can see your approximate location on Almanac's map. Your phone rounds it to about 150 metres before it's sent, so it's never your exact position. It's updated only when you open Almanac, never in the background, and it stops being shown 8 hours after you last opened the app.

Driftwood keeps only your current approximate location, never a history. It's deleted when you turn sharing off, 8 hours after it was last updated, or when you erase your account. While you share with no one, you don't see friends' locations either. You can change who sees you at any time from the map.

Your way to a plan in Almanac

When Almanac shows you a plan, it shows your way there. If your phone already knows where you are, Almanac sends that position and the place you're meeting at to Mapbox to plan the walking route, only to draw that route. It doesn't show your position to the people you're meeting.

The people Almanac matches you with see your first name, a rough area and the line you wrote about yourself, and you share a group chat with them.

Sharing a photo in Viewfinder

When you share a photo in Viewfinder, it is cut to the square on your phone first, so only what's inside the square is uploaded. It goes to everyone using Viewfinder without your name. Others see the photo, the words you wrote with it, the district and city you took it in, and the local time you took it. To name the district, Viewfinder asks your phone for a rough position once you've taken a photo, rounds it to about 100 metres, and sends that to your phone's place-name service (Apple's on an iPhone, Google's on Android). Only the name is kept and shared, never your position, and you can remove it before you share. The copies of your photo that others see carry no camera information.

When someone lights a flame on your photo, you see their city and how many flames it has, never who they are. When you light one, its author sees your city, taken from the place on a photo you shared that day. Your photos are kept on your phone; the ones you share are also stored by Driftwood until you delete your account.

Reverie and YouTube

Reverie uses YouTube API Services. If you connect YouTube, Reverie reads your liked videos, your subscriptions and the videos in your own playlists on your phone; it never stores your YouTube sign-in on our servers. You can disconnect in Reverie, or remove its access in your Google account's settings. See YouTube's Terms of Service and Google's Privacy Policy.

To choose your picks, your phone sends Driftwood's service the videos you've liked or saved (their title, channel and length), the ones you finished or skipped in Reverie, and the channels you subscribe to. To choose and explain the picks, those videos and the ones it might pick are sent to Anthropic, the AI company that writes them, through Driftwood's own service.

Your latest picks, and which of your liked videos each came from, are kept in your Driftwood account until your next picks replace them. They're erased 30 days after they were made, or straight away when you disconnect YouTube in Reverie. Public details of the videos and channels Reverie looks at, including ones you've liked or subscribe to, are kept for up to 30 days to help choose picks for everyone, with nothing that links them to you.

Campfire

Listening in Campfire needs no account. If you sit at a fire and talk, other signed-in Campfire listeners can see your first name, which fire you're at and what you write there; friends you've added may get a notification that you're at a fire. Campfire plays radio, recordings and podcasts from their own servers, which see your device's address, as any player's would; some podcast links pass through the publisher's own listening counter.

Breakwater

Breakwater opens Instagram's and YouTube's own websites inside the app, with the parts you choose hidden, such as Reels and Shorts. The pages come straight from those services, and you sign in to them on their own pages, so Instagram, YouTube and Google see what they would in a browser, and their own privacy policies apply. Breakwater never reads your passwords or what you type there, and the sites' cookies stay in the app's web view; none of it is sent to Driftwood.

If you turn on blocking, Breakwater uses Apple's Screen Time to block the apps you choose. The apps you choose stay on your phone and are never sent to Driftwood or recorded in analytics. Breakwater has nothing of its own for people to post, and doesn't use your location, camera or microphone.

Common Room

Common Room is a public feed. Anyone using it can read the links people share, the notes with them and the comments on them, and each shows who wrote it. Reading needs no account; posting and commenting do. You can delete your own posts.

Letters in Metropolis

Letters in Metropolis are public and anonymous: everyone using Metropolis can read them, and a letter never shows who wrote it. When you start a new letter, Metropolis asks for your location and addresses the letter to the exact spot where you are, which you can change before you send it. The letter's place is shown on the map to everyone, so choose another place if you don't want to share where you are. Photos you add to a letter are shown with it. Metropolis uses your location on your phone to show the letters near you; it doesn't send it to fetch them. Mapbox draws the map.

Resonance

If you bring your work into Resonance, by connecting an account (GitHub, Bluesky, Medium or Threads) or pasting a link to a profile, a website or something you've made, we read what's published there: your words, and the pictures, which we copy so they keep working. For Threads, you sign in with Meta and we keep that access on our servers, never on your phone. To build your Resonance page, our service asks AI models to describe your pictures and videos (Google's Gemini), to choose the few pieces that show who you are and write a line about each (Anthropic's Claude), and to write the short notes on your matches (Google's Gemini, with OpenAI as a backup). Each provider gets only what that request needs, sent by our service, never your account details.

If you've agreed to be matched, the people Resonance matches you with see your Resonance page. Removing a source takes its work off your page and out of your matches; deleting your account erases all of it.

Words written by AI

Apart from Reverie, Riverglass and Resonance, described above, some words in Product Lab and Driftwood Maps are written by AI (Anthropic) from what's on screen, such as the time, light, weather and the places on the map. They're never written from what you write or your photos. Your location stays on your phone. It's used there to work out what's near you, and only those place names reach the AI, never your position.

Weather

Product Lab asks Open-Meteo for London's weather; it sees your device's address and nothing about you. Weather data by Open-Meteo.com.

Usage analytics

Product Lab and our apps use analytics we built ourselves, not a third-party analytics company. It records:

• a random id created for your installation of the app, not your name or email;
• on an iPhone, in all of our apps, the identifier iOS gives Driftwood's apps on that phone: it is the same in each of them, so we can see one phone across our apps, and it changes if you remove them all;
• if you are signed in, your Driftwood account id (never your name or email);
• when you open and close each app or experiment, and how long you spend in it;
• which parts of it you use, such as reading a post or sending a letter;
• invite codes, as described below.

The account id lets us see how the lab is used over days and weeks, and across phones. If you used Product Lab as a guest on a phone before signing in there, that earlier use is joined to your account through the installation's id. What we keep about a guest who never signs in names no one: our team's alerts about a guest keep only the installation's id and a label such as "Guest 1936", for 30 days. Our team's tools may show such a guest as a person's phone ("Finn's phone") when only one Driftwood account appears signed in on that phone in the last 90 days of analytics, counting accounts since closed, and that account is still active. The label is shown only to us, is worked out each time it's shown and never kept, and goes back to the guest label shortly after that account is closed or starts being deleted. A notification already sent to our team keeps the words it was sent with.

Your installation has its own invite code, a short random code with nothing about you in it, and links to Product Lab that you share carry it. When you share, analytics records where your phone says it went, such as Messages, never who you sent it to. When you open an app from a link someone shared, analytics records the invite code it carried. This is how we see the lab pass from one person to the next.

Analytics never includes your location, your photos or anything you write; the only thing you enter that it keeps is an invite code. It is stored in Driftwood's own Google Cloud project. What it records while you are signed in, including how you found each app (the link that brought you, installing and first opening it, first using it, and sharing it), is kept until you delete your account, and deleting your account deletes all of it. Use recorded before you sign in, or on a device that never signs in, is deleted after 90 days. We use it only to learn which prototypes work and how people find them; it is never sold or shared outside Driftwood.

Links to our apps

When you open a link someone shared to one of our apps, driftwood.app counts the visit: which app, what kind of link, the sender's invite code if the link carries one, and the name of the website you came from, if your browser says (for example "linkedin.com"), never the page or post itself. It sets no cookie and records no IP address or other browser details, so a visit can't be tied to you or to a later install. When you open a friend's or a group's invite link here, its page saves that link and which app it's for in your browser, so that app's page on driftwood.app (or Product Lab's) can pass it to the app when you install it. It's never sent to us, and it's deleted after a day (when you next open a link or app page here) or when its page finds the link no longer works. Pages for Panorama films show the film's picture from YouTube and play it through YouTube's privacy-enhanced player, which YouTube's own privacy policy covers.

Crash reports

If one of our apps crashes or hits an unexpected error, a report goes to Sentry, the crash-reporting service we use (data is processed in the United States). A report describes the error along with your device model, its iOS or Android version and the app's version. If you are signed in, it also carries your Driftwood account id (never your name or email), so we can tell whose phone is having the problem. Once our analytics has started in the app, a report, signed in or not, also carries the random id it gives your installation, so a crash can be matched to what happened in the app before it. Sentry keeps reports for 90 days. A guest's report carries no account id; if you later sign in on that installation, analytics joins the installation to your account, so its earlier reports could be matched to you.

Our team is alerted to each crash. The alert is kept for 30 days, with the time, the app, its version, the crash's short title, and the ids that point to the crash service's own report. It names a person only when that account is active and either the report carries their account id, or the app that crashed was signed in to that account at the time; it then keeps that account and the name it had then. Otherwise it keeps only the installation's guest label, or "Someone". When an alert names no one, our team's tools may guess whose phone it was from the last 90 days of analytics, naming only an active account. The guess is shown only to us, is worked out each time it's shown and never kept. A notification already sent to our team keeps the words it was sent with.

Notifications

Our apps ask before they send notifications. If you allow them, Product Lab tells you when someone writes in a room you're in, replies to you, mentions you, messages you directly or asks to join, and each app tells you about its own things, such as a match in Almanac. A notification shows who wrote and what they said. Your installation's notification address is stored with Driftwood's own service so we can reach you through Apple's or Google's notification system. When you delete your account, the address is no longer linked to it. We also keep which of our apps your phone has opened, by name only and linked to your account, so each app's own news, like Viewfinder's daily prompt, only reaches people who use it; when you delete your account, that list is no longer linked to you either. You can turn notifications off at any time in your phone's settings.

What we don't do

We don't sell your data, share it with advertisers or data brokers, build an advertising profile of you, or track you across other companies' apps or websites.

Questions

Write to finn@driftwood.app with any question about this page or what our apps do with your data.