Privacy and cookies

TootyToot is responsible for deciding how member information is used to run the service. The legal operator details are being finalised. Privacy and account questions can be sent to hello@tootytoot.co.uk or through the contact page using the privacy option.

This can include your name, email address, password-based sign-in details, confirmation that you are 18 or over, profile details, community join requests, posts, replies, direct messages, lift requests, lift responses, feedback, directory submissions and support messages.

If you upload images or add optional details such as an avatar, phone number or home area, those are also stored so the service can show them back to you and, where appropriate, to other relevant members.

The service also creates operational records such as notification activity, moderation logs, approval actions, report handling, basic security events and limited technical logs needed to keep the platform working and investigate problems.

During the pilot, TootyToot records a small set of meaningful milestones such as requesting or receiving community membership, returning to an approved community, creating a post or reply, asking for or offering a lift, sending a message, or printing a calendar. It does not use this feature to store the content of posts or messages, track scrolling or clicks, copy authentication tokens, or create new IP-address logs.

TootyToot is intended for adults aged 18 or over. New members are asked to confirm that they meet this requirement; TootyToot and community organisers do not currently perform formal age or identity verification.

Community organisers decide which eligible adults may join their communities, but they cannot waive the platform's 18+ rule. If we learn that an account is being used by someone under 18, access may be restricted or removed and associated information handled in line with safety and legal requirements.

Information is used to create and secure accounts, let people join the right communities, deliver posts and messages, coordinate informal lifts, review moderation issues, and send essential account or community emails.

We may also use limited technical and usage information to improve reliability, reduce abuse and understand where the product needs fixing or simplifying.

Signed-in members can see your profile name and the details you choose to add to your profile. Community posts are intended for members of the relevant community, while direct messages are shown only to the people in that conversation.

Lift details are shared with the community members involved in that request or response. Private journey details should be agreed through messages rather than public posts.

Community organisers can review join requests, community reports and some admin records for the communities they manage. Designated TootyToot support reviewers may access contact and safety reports sent to the central support inbox.

Reported or removed content may be retained where needed for safety, moderation, fraud prevention or legal reasons.

TootyToot uses essential cookies and similar storage to keep you signed in, protect the service, support form flows and remember some basic interface state. The site is not designed around behavioural advertising or selling personal information.

TootyToot uses hosted infrastructure and service providers to run the website, store data, authenticate members and send operational emails. Those providers only get the access needed to deliver those functions.

Stripe handles voluntary contribution checkout, card processing, recurring billing and the billing-management portal. TootyToot does not receive or store full card details. It keeps only the minimum customer mapping, contribution or subscription status and provider event identifiers needed for reconciliation, support and fraud prevention.

Live account and community information is kept while your account is active and for as long as it is needed to run the service. Some moderation, support and security records may be retained longer where there is a clear operational or legal reason.

Deleted-account continuity records may be kept for a limited period so a returning member can restore basic continuity if they rejoin with the same email address.

Detailed pilot activity events are normally deleted after 90 days. Longer-lived summary dates, such as the first contribution date or most recent active date, may remain with the account while it is active. Authentication dates such as account creation, email confirmation and last sign-in are read from the authentication service rather than copied into a separate raw log.

You can update parts of your profile, remove your own content where the product allows it, and request account deletion. You can also contact TootyToot if you need help understanding, correcting or deleting information relating to you.