Privacy Policy

1. The short version

• GoTo’s is for finding recommendations from people you know. You decide who sees each of your picks.
• We don’t sell your information, we don’t license it, and we don’t show ads.
• Your searches are private to you, kept for 30 days, and you can clear them. Health-related searches aren’t kept at all.
• Friends of friends can find a pick only for kinds of things you choose to open, and only when a friend you share has named you their GoTo for it.
• Location is optional. If you use it, your exact location stays on your phone or in your browser; for nearby alerts we record only the town.
• You can download your data and delete your account in the app at any time.
• GoTo’s uses AI to read your screenshots, photos and shared posts only if you allow it. You can say no and still use GoTo’s, and change your mind in Settings → Privacy.
• If you choose to connect GoTo’s to ChatGPT, information you allow, including from lists that are private on GoTo’s, is sent into ChatGPT. Section 12 explains what and how to disconnect.

2. What we collect

Account information. Your mobile number (used to sign in), and optionally an email address. Your name, username, short bio and photo if you add one. Your time zone, your home town (we suggest one from the first town you choose or the first place you add, and you can change it in Settings), and confirmation that you’re 18 or older.

What you add. Your picks (GoTos) and notes, who can see each one, places you add (name, street address, neighborhood, city and map coordinates when you choose a place from a map), titles you choose from our movie, TV and podcast catalogs, Asks and replies, saves and whether something was a good call, the waves you send friends (Say hi), who you named your GoTo for something and the cards people gave you, whether you’ve chosen to show those cards or share your GoTo people, and reports you send.

A pro’s work contact details. When you add a pro, such as a plumber, painter or sitter, you can add how to reach them for work: a business phone number, website, Instagram or Facebook page, and the town or county where they work. We show these with your pick to the people who can see it, never to friends of friends or on pages people see before they join. Only add the number or page they use for work. A pro who wants their details corrected or removed can email help@gotos.app, and any member can report a pick in the app.

Your connections. Who you’re connected with, requests you send and receive, and the people you mute, hide or block. Mutes, hides, blocks and “Not now” are private to you.

Contacts (iPhone, optional). If you choose Find friends and allow access, the app reads only the phone numbers and email addresses of the contacts you allow, turns them into one-way codes on your phone, and sends those codes to check for people who chose to be findable. We don’t store your address book or the codes, and contact names never leave your phone. We keep only which members matched, so we can suggest them to you under People you may know, and your data download (Settings → Your data) lists them. While you allow access, the app checks again at most once a day, the same way, so it can tell you when someone from your contacts joins.

Searches. What you search for, kept for 30 days so you can see your history, visible only to you. Searches about health, therapy, legal or money trouble, and other private-life needs are not kept.

Searches that find nothing. When a search on Home, or the words of a new Ask, match nothing on GoTo’s (say, “basketball”), we count those words, simplified and at most 40 characters, for that day. The count isn’t linked to you, your account, your code, your other searches or any other day: all we keep beside the words is a one-way code made with a secret that changes every day and is then discarded, so each person counts once a day. Words with phone numbers, email addresses, links or offensive terms aren’t counted. GoTo’s staff see these words and their counts, and get an email the first time new words are searched, so we can add what people look for. The email has only the words and when, never who. Words about health, therapy, legal or money trouble and other private-life needs are shown to staff only once three or more people have searched them, and are never emailed. We delete these counts after 90 days.

Devices and notifications. Push notification tokens for your iPhone or browser, and your notification choices.

Location (optional). If you turn on nearby alerts on iPhone, GoTo’s uses your device’s location only while you’re using the app (iOS’s “While Using the App” permission; we never ask for “Always”). We use it for two things: to set up alerts, which your iPhone then shows by itself, when you’re about a block from a place on your Wanna try or one of your GoTo’s; and to sort those places by distance. Your exact location stays on your phone: iOS watches for those places on the device, and distances are worked out there too. When a nearby alert arrives or you open one, we record only the town of the place it was for (or its city or region when we don’t have the town), with the pseudonymous usage measurement described below. We never record your coordinates or which place it was. On the website, “Sort by distance” asks your browser for your location each time you press it; it stays in that page and is never stored or sent to us.

Turning location off. Settings → Notifications → Nearby has a switch for each kind of nearby alert. You can turn location off for GoTo’s at any time in iOS Settings → Privacy & Security → Location Services → GoTo’s, or in your browser’s settings for gotos.app. Everything else in GoTo’s works without it.

Usage measurement. A record of actions like searching, posting, saving, answering and opening a place’s map, phone number or website, with the kind of thing involved and simple counts. It’s linked to a random code rather than your name, together with your general area, such as your town (from the home you chose, never your device’s location). It never includes what you typed. Actions about health needs and other private matters aren’t linked to you or your area at all.

Usage data (iPhone app). We use PostHog to see how the iPhone app is used, such as which screens are opened, which features are used and where sign-up stalls, so we can improve it. It’s tied to a random member ID, never your name, number, email or what’s on your lists. It never includes what you type or the names of places, titles or lists. For everyday things we record the kind (like pizza); for private-life matters (like therapy, divorce or debt help) we record only that it was private; and for health needs we record nothing at all. It’s not sold or used for ads, and you can turn it off in Settings → Your data → Share usage data.

Usage data (question pages on the website). On gotos.app, a question link’s page (gotos.app/a/…) tells us when it’s opened, answered, when someone asks for the answers by email, and when someone starts and finishes joining, so we can see whether question links work. With it go only whether the question was about a private kind of thing and how the answer was given (a place, a title or typed). Never your name, your answer, your email, your phone number or what you typed. It uses a random ID kept only for that browser tab (no cookie), and if you join, your random member ID, so it lines up with the iPhone app’s. Browsers that send Global Privacy Control or Do Not Track send nothing. It’s not sold or used for ads. A shared GoTo’s page (gotos.app/g/…) works the same way: it tells us when it’s opened, when someone starts and finishes joining, and when a member saves it, with only whether it was a GoTo or a Wanna try.

Invitations. Who invited whom (shown as “Brought in by”, to the member’s circle; they can hide it, as section 4 explains), and invitation links, which we store only in a scrambled form. If you join from a question link you answered, we record that you did and whose question it was, and connect you to them. If you invite the person who told you about something you saved, anyone with that invitation link sees what it is and your name as members see it (like “Russ F.”). When they join with it, you’re connected, they can see that item, and your save credits them instead of the name you typed. Health and private-life items can’t be shared this way.

The waitlist. If you join the waitlist, we keep your account or the email address you gave, and when it was. Our team is told when someone joins. When you’re let in, we tell you by notification or email (if you joined with only an email, we send you a personal invitation code). You can ask us to remove you from the waitlist at any time.

Answers from people outside GoTo’s. If a member sends you a question and you answer on the web, we keep the name you type and your answer. If you pick a place, title or product from the list instead of typing it, we keep which one you picked (for a product, its link), and the member who asked sees its address and how to reach it. For everyday needs (like a restaurant or a show), other people who answer the same link see your first name, your answer (with a place’s name and town) and why. If you don’t join within 30 days, we delete it. If you ask for everyone’s answers by email, we keep your email address until the question closes, send you one email (for personal and private needs it says only how many answers came in), then delete the address. The member who asked never sees it.

Links and place searches. When you paste or share a link, we read that page’s title and picture from a small list of known sites (such as Yelp, Spotify and IMDb) to fill in your GoTo. We never read Instagram’s or TikTok’s own pages. For an Instagram or TikTok post, we send its link to the platform’s official embed service (Meta for Instagram, TikTok for TikTok). If you’ve allowed AI reading, we then send the caption, who posted it and the cover picture it returns to OpenRouter and the AI model, the same as a screenshot, to work out what the post shows. If you haven’t, the post is read without AI. What the AI found (never the caption) is kept for 24 hours, under a scrambled form of the link, so the same post isn’t read twice, and it’s shown only to members who allowed AI reading. When you search for a place on the website, including when you answer a question link without an account, the words you type and an approximate location (your area, or the question’s) go to Apple Maps. Neither is stored with your name. The places a question link’s search finds are kept for an hour so your answer can name one.

Screenshots and photos. When you add something from a screenshot or photo, your device reads the words in it first. Only if you’ve allowed AI reading does GoTo’s then send the picture, those words and your area (like your county) to an AI service, OpenRouter, which passes them to a company that runs the AI model we choose, to work out what the picture shows. The first time, GoTo’s asks you to choose Allow AI reading or Continue without AI. Without AI, the words your device read are used and you can type the rest. Today we use AI models made by Google; before using a model from another company, we’ll ask you again. We ask OpenRouter to use only providers whose policies say they don’t keep or train on what we send. GoTo’s doesn’t keep the picture: it’s read, then discarded. We keep a record that a reading happened (when, from which app, which AI model, how long it took and the cost), never the picture or what it showed.

Your AI choices. We keep each choice you make about AI (allowing AI reading, continuing without it, turning it off, and including your picks in friends’ ChatGPT), with which version of the explanation you saw and when, so every device and the website follow it. Turning AI reading off in Settings → Privacy stops AI reading from then on. It can’t undo a reading already done, and there’s no picture to delete, because GoTo’s doesn’t keep them.

Technical information. Our hosting and database providers process IP addresses and similar information to deliver the service and protect it from abuse. For contact matching, for place searches from a question link without an account, and when someone joins from a question link, we use a scrambled form of your IP address to limit misuse. We don’t store the address itself.

3. How we use it

• To run GoTo’s: sign you in, show your picks to the people you chose, answer searches, deliver Asks and replies, and remember your settings.
• To send the notifications you’ve turned on, within the limits in the app (at most two a day, plus up to 5 a day for things friends send you, plus an evening digest, and never during your quiet hours).
• If you turn on nearby alerts: to let you know when you’re near a place on your Wanna try or your GoTo’s (usually no more than 3 a day, and the same place at most once every 2 weeks), and to sort places by distance. Both happen on your phone or in your browser.
• To keep people safe: review reports, enforce our Terms, limit spam and abuse, and stop suspended accounts from signing up again with the same number (we keep a scrambled code of that number, not the number).
• To understand what’s working, using the pseudonymous measurement described above, together with your general area, such as your town, and the iPhone app’s usage data.
• To comply with the law and respond to lawful requests.

We don’t use your information for advertising, and we don’t build profiles to sell.

4. Who can see what

• Just me: only you.
• Your circle: your accepted connections (up to 150 people).
• Ask-only: shared only when you reply to an Ask.
• Friends of friends: for kinds of everyday things you choose to open, people connected to your connections can find your pick when they search for that thing and a friend you have in common has named you their GoTo for it. They see your first name, the friend you share, and that pick, not your profile or other picks. You can close this at any time.
• Your profile is visible to your connections. People can find you by your exact username unless you turn that off.
• Who brought you in: if you joined with a member’s invitation or from their question link, your page says “Brought in by” with their name as other members see it (like “Russ F.”), only to people in your circle who are also connected to them. Turn it off in Settings → Privacy (“Show who brought me in”). The person who brought you in sees you among the people they brought in.
• Suggestions: GoTo’s may suggest you to people who have you in their contacts, share friends with you, or were invited by the same person. Only your name, username and photo are shown. Turn it off in Settings → Privacy.
• Never visible to other members: your searches, “Not for me”, who you mute, hide or block, and requests you set aside with “Not now”. The people you’ve named your GoTo for something stay private too, unless you choose to share your GoTo people with your circle and the person you named agrees.
• Saving a friend’s pick: when you save a friend’s pick to Wanna try, or add something and say a friend in your circle told you about it, they’re told that evening, with your name as other members see it (like “Russ F.”), or “a friend” if you turn that off in Settings → Privacy. Never for health or private-life picks.
• Your ToGo’s (things you want to try): in the app’s new, simpler mode, a ToGo you add is shared with your circle unless you turn off “Share with my circle” as you add it. Your circle sees it on your page and on their Home, and when they add the same place or title, that you have it too. Health and private-life ToGo’s (like a therapist or a divorce lawyer) are never shared. Everything you saved before October 22, 2026 stays just for you. In the app’s classic screens and on the website, everything new you save to Wanna try is shared with your circle in the same way, however you save it (from a friend’s pick, an answer to your Ask, something sent to you, a shared link, or through ChatGPT), unless you turn off “Share my Wanna Try items with my circle” in Settings → Privacy. Health and private-life ones never are. What you add with Wanna try on the Add screen or Share sheet of earlier versions of the iPhone app stays just for you.
• Sharing one GoTo or Wanna try: when you share a single GoTo or Wanna try, anyone with the link sees that item, your short name and your note on it, until you stop sharing. Health and private-life ones can’t be shared. If someone joins GoTo’s from your link, they’re connected to you and the item goes on their Wanna try.
• Sending to a friend: when you send one of your GoTo’s or Wanna try (ToGo’s) to people in your circle, each of them sees that item, your short name and any note you add, even if its list is Just me. Health and private-life ones can’t be sent. They can save it, say it’s one of theirs too, or thank you, and you hear which; nobody else sees it.
• ChatGPT: only if you turn on “Include my picks in friends’ ChatGPT” (it’s off unless you do), when someone in your circle connects GoTo’s to ChatGPT with circle access, the picks you share with your circle can be returned to their ChatGPT, as section 12 explains.
• “GoTo for” badges: when three or more people name you their GoTo for the same thing, you can choose to show it as a badge on your profile, with your picks and when people ask about that thing. Only your circle sees it.

Health, therapy and other private-life picks (like divorce, debt or immigration help) are never shown to friends of friends. Some are shared only in reply to an Ask.

When you send a question link for an everyday need (like a nail salon or a show), the link’s preview in a chat shows your name as other members see it (like “Russ F.”) and what you asked, to anyone who can see the message. For personal, private and health needs, and once the link has closed, the preview says only that someone asked a question.

5. Service providers

We use a small number of companies to run GoTo’s. They process information only on our behalf and under contract:

• Supabase (database, sign-in, file storage and server functions), with data stored in the United States.
• Vercel (website hosting).
• Twilio (sending sign-in codes by text message).
• Resend (email, if you turn on email notifications).
• Apple (iPhone notifications, map search in the app and on the website, and the small map previews in the app) and your browser’s push service (web notifications).
• The Movie Database (TMDB) and Apple Podcasts search (we send your title searches to find matches).
• Open Library (book search and covers; we send your book title searches to find matches).
• Catalog.beer (beer search; our server sends only the words you search for to find matching beers, never your name or account).
• Wine search uses our own copy of Liv-ex’s LWIN wine list and Open Food Facts’ wine data, so your wine searches never leave GoTo’s.
• Untappd and Vivino receive nothing from GoTo’s. When you tap a beer’s “Untappd” or a wine’s “Vivino” link, or a brewery’s website, your phone or browser opens that site or app, which then handles your visit under its own privacy policy.
• OpenRouter and the company it passes them to that runs the AI model (today, models made by Google), only if you allow AI reading (reading the screenshots and photos you add, and the captions and cover pictures of Instagram and TikTok posts you share).
• Meta and TikTok (their official embed services, which receive the link of an Instagram or TikTok post you share or paste).
• OpenAI, only when you connect GoTo’s to ChatGPT, or when someone in your circle does and you’ve turned on “Include my picks in friends’ ChatGPT” (see section 12). OpenAI handles what it receives under its own terms, not ours.
• PostHog (usage data from the iPhone app, which you can turn off, and from question and shared-GoTo pages on the website), with data stored in the United States.

6. We don’t sell or share for advertising

We don’t sell personal information and we don’t share it for cross-context behavioral advertising. If GoTo’s is ever sold, these commitments go with it, and you’ll get 60 days’ notice and a chance to download your data first.

7. How long we keep it

• Your account and picks: until you delete them or your account.
• Search history: 30 days (health-related searches: not kept).
• Counts of searches that found nothing: 90 days, never linked to anyone.
• Asks and replies: deleted 90 days after the last activity, unless a reply was kept as a GoTo.
• Answers from people outside GoTo’s: 30 days, unless they join.
• An email address left for a question’s answers: until that one email is sent, when the question closes.
• Screenshots and photos sent for AI reading: not kept (read, then discarded).
• What was read from an Instagram or TikTok post you shared (never its caption): 24 hours.
• A record of each screenshot or photo reading (when, from which app, which AI model, how long it took and the cost, never the picture or what it showed): 13 months.
• Your AI choices (with the version you saw and when): as long as you have an account.
• Pseudonymous usage measurement: 13 months.
• Usage data in PostHog (iPhone app, question pages and shared-GoTo pages): 1 year.
• Safety records (reports, audit logs, and scrambled codes of suspended numbers): as long as needed to keep the community safe and meet legal obligations.
• Waitlist entries: until you ask us to remove them or delete your account.
• Backups: deleted on a rolling schedule of 30 days.
• ChatGPT connection records: see section 12.

8. Your choices and rights

• Choose who sees each pick, and change it at any time.
• Turn contact matching, being findable, and friend-of-friend opening on or off.
• Control notifications, including quiet hours and email.
• Turn nearby alerts off in Settings → Notifications → Nearby, or turn off location for GoTo’s in iOS Settings or your browser.
• Turn off usage data in the iPhone app (Settings → Your data → Share usage data).
• Clear your search history.
• Download your data in the app (Settings → Your data).
• Delete your account in the app (Settings → Your data → Delete my account).

Depending on where you live, you may have rights to access, correct, delete or get a copy of your information, and to appeal our decision on a request. Email help@gotos.app and we’ll respond within the time the law requires.

9. Health information

Some picks and searches relate to health, such as a dentist, doctor or therapist. We ask for your consent before you save or ask about these, keep them out of search history and measurement tied to you, and never show them to friends of friends. Our Consumer Health Data Privacy Policy explains this in detail.

10. Children

GoTo’s is only for people 18 and older. We don’t knowingly collect information from anyone younger. If you believe someone under 18 is using GoTo’s, report them in the app or email help@gotos.app.

11. Security

We protect information with encryption in transit, access controls enforced by the database for every member, scrambled storage of invitation links and contact codes, and limits on how often sensitive actions can happen. No system is perfectly secure, so please keep your phone and sign-in codes safe.

12. Using GoTo’s with ChatGPT

GoTo’s offers an optional connection to ChatGPT, run by 9i9e LLC. ChatGPT itself is a service of OpenAI. Nothing is shared with ChatGPT unless you connect it, and you choose what it can do on a GoTo’s screen before connecting. The connection is currently available to invited members who are 18 or older, and it’s free.

What it can do, if you allow it. Depending on the permissions you approve: read your display name and username; read your own lists and Wanna try saves in supported everyday categories, including lists that are private on GoTo’s; save items you ask for to your Wanna try (shared with your circle like your other Wanna try saves, unless you turn that off in Settings → Privacy; never health or private-life ones); create lists and add, rank or replace recommendations on lists you choose (changes to a list shared with your circle can be seen by your circle, like any other change); and read the recommendations people in your circle share with you. It can’t send Asks, message anyone, or delete anything. Health, money, legal and other private-life categories are never part of it.

What GoTo’s receives from ChatGPT. Only what ChatGPT sends when it uses GoTo’s for you, such as words to search for, the name, city or link of something to look up or save, and the change you asked for. GoTo’s doesn’t get access to your chat history. When ChatGPT looks up a place GoTo’s doesn’t know yet, the place’s name and city go to Apple Maps.

What GoTo’s returns to ChatGPT. The information needed to answer you: your display name and username; your list names, what’s on them and their ranks; your Wanna try entries and their plans; places’ names, towns and addresses; and, with circle access, recommendations your circle shares with you, with each person’s name, username, list name and rank.

Why. To check what you and your circle already recommend or saved, show you cards with those recommendations, personalize suggestions, and make the saves and list changes you ask for.

If you’re in someone’s circle. Your picks go to a friend’s ChatGPT only if you turn on Settings → Privacy → Include my picks in friends’ ChatGPT, after GoTo’s shows you what’s shared. It’s off unless you turn it on, including for members who joined before October 28, 2026, and a friend connecting ChatGPT never turns it on for you. When it’s on and a member of your circle connects ChatGPT with circle access, the picks you share with your circle (on lists shared with your circle) can be returned to their ChatGPT when they ask about something, with your name, username, list name and rank, and a place’s town and address. This goes to OpenAI, which runs ChatGPT. Your private and Ask-only lists, your Wanna try saves, private-life categories, and anything you’ve blocked them from are never included. Hidden and muted people are left out too. Turning it off stops this from then on; it can’t remove what was already returned into a ChatGPT conversation. You can also set any list to Just me.

Pictures. Cards shown in ChatGPT may include public pictures of the places or titles involved, loaded from the sites that host them. To find a picture, GoTo’s may send only the item’s name, city and creator to OpenAI’s image search, never who you are.

How long we keep it. Sign-in codes for the connection last 2 minutes and are then deleted; access passes last 15 minutes; a connection stays signed in for up to 30 days, then asks you to connect again. Places looked up for a save are kept for 20 minutes. We keep a record of the connection (when you connected, the permissions you gave and when you disconnected) and of each save or list change made through it (so a repeated request doesn’t save twice) for as long as you have a GoTo’s account. What ChatGPT saved for you stays in GoTo’s like anything you added yourself, marked “From ChatGPT”, until you remove it. Deleting your GoTo’s account deletes all of it.

Disconnecting. Disconnect at any time in GoTo’s Settings on iPhone or the web (Settings → ChatGPT). GoTo’s then stops answering that connection right away. Disconnecting doesn’t remove information already returned into a ChatGPT conversation, and it doesn’t remove what was saved to your GoTo’s.

How OpenAI handles it. Information returned into ChatGPT, and what you type there, is handled by OpenAI under its own terms and privacy policy (openai.com/policies/privacy-policy) and your ChatGPT settings, including whether your chats may be used to improve its models (help.openai.com/en/articles/5722486). Your ChatGPT account settings are yours; GoTo’s doesn’t control them.

13. Changes and contact

If we make material changes, we’ll tell you in the app or by email before they take effect. Questions or requests: help@gotos.app. Mail: 9i9e LLC, PO Box 96, Morganville, NJ 07751.