The short version
Your team's messages, photographs, video and voice notes, the descriptive parts of its bookings and News, and what you choose to tell the team about yourself are encrypted on your device before they reach us. We store the encrypted bytes.
We also hold a wrapped copy of every team's key — which means we can open that content for the features that need it, such as tagging a photograph. Nothing else opens it, and every opening is recorded.
That is encryption at rest with per-team keys. A team has no mode that destroys our copy, so this policy makes no stronger claim for a team than that.
Everybody in a team can read what is said in it, including what was said before they joined. What one member books, and what they ask to open in News, is kept from the other members by access rules on our server, not by encryption. The team's lead sees all of it.
Some things are never encrypted, because the server has to act on them. They are listed below, in full, rather than summarised.
Who this is
5D Trust for teams is made and operated by SpringVibe. This policy covers the 5D Trust for teams app for iPhone and Android, and the servers behind it, which it shares with 5D Trust for two. One account works in both apps; what you do in a pairing is covered by that app's own policy.
For anything in this policy, including a request to see or delete what we hold, write to springvibe77@gmail.com.
How a team is arranged
A team is one person — its lead — and the people they invite. The lead creates the team, sends each person an invitation link, and lets each new phone in once that person has accepted. The lead can remove a member at any time.
A team has one shared space: the conversation, the album, the calendar, the map, Bookings and News. There are no separate private channels inside a team: what is said there is said to the whole team.
The lead decides the team's settings for everybody in it — the ones listed under “What the lead decides” below. Members can see how they are set but cannot change them.
A lead cannot leave their own team or hand it to somebody else. They can end it, which closes it for everybody.
What is encrypted, and where the keys are
Each team has a key of its own, generated on the lead's phone when the team is created. It never leaves a device in the clear. It is stored only as wrapped copies: one for each member's phone, handed across by a phone that already holds it, and one sealed to a service key we hold in a managed key store.
Content is encrypted under per-object keys, wrapped by the team's key, before it is uploaded. This covers:
- message text
- photographs and video, including every derivative size, and voice notes
- AI descriptions and tags of the team's photographs
- the team's name, its picture, and the description its lead writes of it
- the personal details you choose to give a team — a year of birth, a link to a profile page
- a booking's title, place, activity, requirements and notes; booking comments; the labels on the lead's pick-lists
- a News entry's title, description and link
- a shared position, and the team's marked places
- the descriptive parts of a calendar entry — its title, its kind, its colour
Everybody in the team holds the key, and anybody in the team can open the team's content alone. Someone who joins a team can read what the team said before they joined: there is one key, and it does not change when people come and go.
Leaving a team, or being removed from it, withdraws your phones' copies of the key and ends your access at once. What already reached your phone stays there — we cannot reach into a phone — but nothing new does. The key is not replaced when somebody leaves.
What we can read, and what we cannot
Because our wrapped copy of the team's key exists, our servers can decrypt the team's content. We do so only to run a feature somebody in the team asked for:
- describing and tagging a photograph, if richer photo tags is on for the team
Every one of those openings writes a line into a record kept for the team — what was opened, why, which model, and when. Ask us and we will send it. A service key is only honest if you can audit what it was used for.
We do not read a team's content for advertising, for training a model, for product analytics, or out of curiosity, and we do not sell or rent it. The app contains no advertising and no third-party analytics or tracking SDK.
Unlike 5D Trust for two, a team has no Vault mode: there is no way for a team to destroy our copy of its key. If you need a space we can never open, a team is not it, and we would rather say so here than have you find out later.
What is not encrypted
A server that can read none of it cannot deliver a message in order, stop two bookings landing on the same hour, or add up what a member owes. So some facts are held in the clear, and the honest thing is to list them:
- which team a row belongs to, its position in the conversation, who wrote it, and when
- the kind of a message — text, photograph, voice note — its size in bytes, a media file's duration and dimensions, and which emoji was used to react
- your email address, a securely hashed password (never the password), your display name, and which teams you are in, as lead or as member
- when each member joined, and the name the lead gave an invitation link to tell it apart from the others
- a device token, if you turn push notifications on, and which devices hold the team's key
- a booking slot's start, length, end and time zone, whether it is a one-to-one slot or an activity, and its status; who booked it, and how that booking stands; its reminder times
- a booking's price and currency, whether the lead has marked it paid, and whether the member attended
- every change to a booking — who did what, and when — in a history that is only ever added to
- a News entry's shelf (instruction, tip, playlist or product link), its price and currency; who asked to open it, how that request stands, and whether it is marked paid; which entries each member has opened
- the team's own settings: whether members' locations show, its booking hours, currency and cancellation window, and whether members may propose times
- a calendar entry's start time, its length, whether it is marked as mattering, and whether it repeats yearly — never its title, its kind or its place
- ordinary operational logs — timestamps, request paths, error traces — which we keep briefly to run the service
Prices are in the clear on purpose. The lead's ledger — what each member has booked, paid and still owes — is worked out by our server, and it cannot add up numbers it cannot read.
This matters more than it first looks, so it is worth saying twice: from this metadata alone, without any key, we can see who is in a team, how often it talks, who booked which hour, at what price, and whether it was paid. We cannot see a word of what was said, or what a booking is for.
What the lead sees, and what other members see
Everybody in a team sees the whole team conversation, the team's album, its calendar and its marked places, the list of members, and the personal details each member has chosen to give the team.
The lead also sees:
- every booking, every comment on a booking, and the full history of changes, for every member
- the ledger: what each member has booked or asked to open, at what price, what is marked paid, and what is still outstanding
- every request to open a priced News entry, and how it stands
- the open invitation links
A member sees the open slots nobody holds, every activity, their own bookings, comments and history, and their own ledger. Other members cannot see your bookings, your comments on them, or your requests in News.
Every member's phone holds the team's key, so that last promise cannot be kept by encryption: a member's phone could open another member's booking if it were ever handed one. Our server never hands one over. One rule on our side decides what each person may read, and live updates to the team carry only a signal that something changed, so each phone fetches its own view.
If a member leaves or is removed, their pending and future bookings are cancelled and the slots go back to the team. Their booking history and ledger entries stay for the lead until the team ends.
Bookings, News and payments
Payments are arranged directly between you and the lead, not through this app. We never take, hold or pass on money for a booking or a News entry, and the app does not collect card or bank details for them. “Paid” is the lead's own note that money changed hands elsewhere.
In News, an entry with a price stays greyed out until you have asked to open it, been shown its price, and been let in by the lead. Until then our server does not hand over the full picture or video — only the small preview on the page. While a picture or video is on a priced News entry it is also taken out of the members' Moments; it comes back if the entry is withdrawn.
Booking reminders are set on your own phone and stay there.
Your profile in a team
In each team you may add a year of birth and a link to a profile page elsewhere. Both are optional. They are encrypted on your phone before they reach us, shown to everybody in that team in the member list, and shown nowhere else: what you tell one team is not shown in another.
Only you can change your own details. When you leave a team, or are removed, they are deleted from it.
Photographs, and the AI that reads them
Every new photograph is analysed on your phone, by the phone's own on-device image recognition, for basic tags. Nothing leaves the phone for that.
Richer photo tags — which the team's lead decides, and which is on unless they turn it off — adds a second pass. Your phone sends a small copy of the picture to our server, which passes it to Anthropic's Claude for a description and fuller tags. The stored photograph is never opened for this; the copy your phone sends is what is looked at. The words that come back are encrypted before they are stored. Turned off, no picture leaves a phone for tagging.
Pictures in a team show the people in it. By joining a team you agree that photographs and videos you appear in may be shared in it, are stored for the team as this policy describes, and — while richer photo tags is on — are described and tagged by AI. If there is a particular picture you would rather not be in, ask the team's lead to remove it from the team's Moments: open it in Moments and tap the raised hand, and the lead is told. A picture you uploaded yourself you can simply delete. Removing it deletes the picture, its description and its tags. The lead decides; if they keep it and you still object, write to springvibe77@gmail.com and we will look at it with them.
A team has no stories. In 5D Trust for two a story is written from the pair's recent weeks; in a team that would mean reading everybody's messages on one member's say-so, so a team does not offer it.
Two other features send something to Claude, and only when you ask: turning a picture of a poster into a suggested calendar entry, and turning a page about a venue, which your phone has already loaded, into a suggested place. What comes back is a suggestion your phone shows you; nothing is added until somebody accepts it.
Anthropic processes what we send under its commercial terms, which do not permit training on it.
What the lead decides
In a pairing, privacy settings need both people to agree. A team cannot work that way, so in a team the lead sets them, once, for everybody, and members see how they stand. They include:
- Richer photo tags — whether a copy of a new photograph is sent for AI tagging, or tagging stays on each phone
- Screenshot protection — whether chat text and photographs come out blank in a screenshot or a screen recording
- Privacy lock — whether Face ID or a fingerprint is needed to reopen the app
- Members' locations — whether members can share where they are on the team's map at all
- Bookings — the hours slots may be offered in, the currency, how long before a booking a member may still cancel, and whether members may propose times of their own
Some things are fixed for every team and cannot be changed: a link shared in a team is always looked up by the phone showing it, so it can be drawn as a preview; adult material and AI-generated artwork stay off.
Location
Location is used in these ways, and each is separate.
- Your time zone and country, resolved coarsely on your phone, so the app knows what time it is where you are
- A photograph's place, if you allow it, encrypted into the same payload as the picture's tags
- The team's map: the team's home address and the places it marks, encrypted like everything else the team writes
- Sharing where you are with the team — a single pin, or a walk you share for a fixed time, which stores a trail and then stops. Positions are encrypted on the phone that sends them
Whether members can share at all is the lead's decision, and it is off for a new team. While it is off, only the lead's own position can be shared, and members are not offered a way to share theirs. While it is on, sharing is still each member's own choice: a phone answers a request for a fresh position only if its owner is already sharing.
A team has no live location — no pin that follows you continuously — and no way to see where another member is unless they chose to share it. Your location is shown to your team and never to anyone else.
Trying the demo
The app offers a demo team anybody can look at, and a signed-in person can try for ten minutes at a time. Its people and its conversation are invented. Anything you add during a demo session can be seen by anyone else looking at the demo while it lasts, and all of it is deleted when the session ends — so please do not put anything real in it.
When a demo session ends we may ask how it was. Your stars and comment, if you give them, are stored unencrypted, because they are addressed to us.
Where your data lives, and who else touches it
We use a small number of processors, and no more than the app needs:
- Railway — the application servers and the Postgres database, in the United States
- Cloudflare R2 — encrypted photographs, video and voice notes
- Amazon Web Services — the cold archive of older encrypted media, the encrypted nightly database backups, each team's encrypted monthly snapshots, and the managed key store holding our wrapped copy of each team's key
- Apple — push notification delivery to iPhones, and Sign in with Apple if you use it
- Google — push notification delivery to Android phones
- Anthropic — the model calls described above
Everything at rest with those providers is encrypted content or metadata as described above. Data may be processed in the United States and in the European Union; where personal data of people in the EEA or the UK is transferred, it is under the providers' standard contractual clauses.
How long we keep it
A team's content stays while the team does. What you wrote in a team stays in the team after you leave it: it was said to the whole team, and there is one key per team rather than one per person, so there is no way to remove only your part of a conversation.
A lead can end a team at any time, from the team's page. Everybody's access ends at that moment, the lead's included, and every open invitation stops working. 14 days after a team ends, everything it stored — its conversation, pictures, plans, bookings and News — is deleted from our live systems; backups age out as described below.
Deleting your account: you ask for it in the app, and the account is removed 14 days later. Signing in again before then calls it off. When it is removed, you leave every team you are in, exactly as described above, and a team you lead ends. What goes with the account is your login, your device tokens, your keys and your memberships.
One thing to know so it is not a surprise: we keep encrypted backups of the whole database so a failure cannot lose anybody's history. A nightly backup is kept for 30 days; one backup a month is kept for 2 years. Anything deleted remains inside those backups until they age out — up to 2 years for the monthly one — and the keys are inside them too. Those backups are encrypted to a key that exists only offline, on paper, away from our servers; nobody restores one except to recover from a failure, and if that ever happened after a deletion we would apply the deletion again. We cannot reach into a backup to remove one team or one person; what we can do, and do, is let it expire.
Separately from those backups, once a month — and whenever the lead asks — we take a snapshot of the team on its own: its messages, pictures, plans, places and profiles exactly as they are stored, encrypted on your phones before they reached us and still encrypted inside the snapshot. A snapshot holds none of the team's keys, and it does not include bookings or News. It exists so the team's history can be put back if it goes missing; in a team, putting one back is the lead's decision. We keep a team's newest 6 monthly snapshots, and the ones its lead takes for 5 years or until the lead removes one.
A photograph or video you delete is removed from our live storage and our own archive at that moment. Our cloud archive keeps a deleted file for up to 30 days before it ages out, so that a deletion made by mistake can still be undone in that time by writing to us; after that it is gone from everywhere. No snapshot and no database backup contains a photograph or video — they only name the file.
Your rights
Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask for the record of every time your team's content was decrypted, or object to a particular use. Some of it you can do yourself in the app; for the rest, write to us and we will answer within 30 days.
If you are in the EEA or the UK: we process your account data, and what you ask a feature to do for you, to provide the service you asked for (contract). Richer photo tags, which the team's lead sets for the whole team, rely on legitimate interests — the team's interest in an album it can search — and on what every member agrees to on joining (see “Photographs, and the AI that reads them”). You can ask for a picture you are in to be removed, and you can object at any time by writing to springvibe77@gmail.com. A small amount of operational logging, to keep the service running and secure, also relies on legitimate interests. You may complain to your local supervisory authority.
If you are in California: we do not sell or share personal information, and we do not use it for cross-context behavioural advertising. We have never done either.
To exercise any of this, write to springvibe77@gmail.com from the address on your account.
Children
You must be 18 or older to use 5D Trust for teams, as a lead or as a member. It is not directed at children, and we do not knowingly collect anything from anyone under 18. If you believe somebody under 18 has an account, write to us and we will remove it.
Security
Everything in transit runs over TLS. Content is encrypted before it is uploaded, under keys as described above. Each team's data is isolated in the database at the row level, enforced by the database itself rather than by application code remembering to filter. Backups are encrypted before they leave the machine that makes them.
No system is perfect, and we would rather hear about a flaw than not. If you find one, write to springvibe77@gmail.com and we will work with you on it.
Changes to this policy
When this policy changes we update the date at the top of the page. If a change affects what we can read, what a lead can see, or what leaves your phone, we will say so in the app before it takes effect, not after.