Privacy policy

Last updated 29 October 2026

1. Who we are

John is run by We Are John Ltd, a company registered in England and Wales (company number 17551042), registered office 120 Icarus Avenue, Burgess Hill, RH15 0XX. We are the controller of your information, which means we decide how it's used.

2. What John is for, and what it isn't

John is a place for men aged 18 and over to talk openly about how they're doing. It is not a medical or emergency service. If you are in danger, call 999. Samaritans are free on 116 123, any time.

3. What we keep about you

What	Why	Who can see it
Email address and password (the password is stored scrambled, never readable)	To sign you in, and send sign-up and password codes	Nobody else. Moderators can't see it either
That you passed the 18+ age check, and when	John is for adults only	Nobody else. Your date of birth is not kept. The check happens once, after you've confirmed your email address: our age-check provider looks at where that address has been used before to estimate whether you're over 18. If it can't tell, you take a quick selfie, which the provider uses to estimate your age and then deletes.
When you agreed to the terms and to us using your mental health information	The law needs your explicit agreement (see section 4)	Nobody else
Your profile: Public (your name, bio and, if you add one, a photo) or Anonymous (a made-up name and a drawn shape, never a photo)	So people know who they're talking to, or so you can stay anonymous	Other members. Other members can never see which account is behind an anonymous profile, or link your anonymous and public profiles. Inside John's own systems your profiles are linked to your account, so that bans work and so we can act if someone's life is at risk (section 7)
Posts shared with Everyone: words, photos, videos, plus comments, likes, "Me too", saves and follows	It's what John is	Other members, unless you've blocked each other
Stories: a photo, a video or a few words, shared with Everyone for 24 hours	It's what John is	Other members for 24 hours, then only you, until you delete it. You can see who saw your story (by the name or anonymous name they were using)
Which stories you've seen	So the circles show what's new	The person who posted the story sees that you viewed it
Posts kept to Only me (your private journal)	For you to write things down	Only you. Moderators can't see them and the safety check doesn't read them while they're private. If you share one later, it's checked first (section 5)
Private messages and group chats: words, photos and voice notes	To talk one to one, or in a group of up to 25	The people in that chat. See section 6
A group's name, picture and who's in it	To run group chats	The group's members, and anyone invited to it
Whether your profile is private, and follow requests	So only people you approve see a private profile's posts, stories and journey	Your name, picture and bio still show. Only you see requests to follow you; the person asking sees their own request
Who can message you, journeys (what you're counting days for and since when), blocks	To run these features	Only you, except a journey's day count and topic, which show on your posts and profile
Daily check-ins (mood, what's weighing on you, a note)	For you to look back on	Only you. Moderators can't read them
Saved posts, topics you picked, notification settings	To run your account	Only you
What you read and engage with (likes, comments, Me toos, and posts you look at for 2 seconds or more)	To choose posts for your "For you" feed, and to show you support if you've been reading a lot of heavy posts (section 8)	Only used by the app; not shown to anyone
Points and level	The coloured dot on profiles	Others see only the colour; your points are only shown to you
A random ID for your phone, and a push alert token if you allow alerts	To stop banned people coming back on the same phone; to send alerts	Nobody else
Reports about you that other members make, and moderators' decisions and notes	To keep John safe	Moderators

Photos and videos have their hidden details removed on your phone before they upload, including where and when they were taken.

What you have to give us. An email address, the 18+ age check and your agreement to us using your mental health information are needed to use John: without them we can't run your account safely. Everything else (photos, bio, check-ins, journeys and so on) is up to you.

Where it comes from. Almost everything comes from you. The exceptions are reports other members make about you, the result of the age check from our age-check provider, and moderators' decisions and notes.

4. Our legal reasons for using your information

Your explicit consent for your mental health information (UK GDPR Article 9(2)(a), with Article 6(1)(a)). John is a mental health app, so almost everything you share can say something about your health. You agree at sign-up to John storing and using it to run the app: showing your posts and messages to the people allowed to see them, keeping your check-ins and journeys, choosing posts for your feed, and having what you post and message read by our AI safety check (Claude, made by Anthropic). You can withdraw your consent at any time by deleting your account in Settings > Delete my account, which is as quick as signing up. John can't work without this information, so withdrawing means closing your account. Section 9 says what we still keep after that, and why.
Running the service you asked for (Article 6(1)(b)): your account, sign-in, posts, messages, settings and alerts.
Legitimate interests (Article 6(1)(f)): keeping John safe and fair, through safety checks, moderation, spam limits, phone bans, and keeping moderation records. Our interest is protecting members from harm and abuse. You have the right to object to this. See section 10.
Legal obligations (Article 6(1)(c)): for example, acting on reports of illegal content under the Online Safety Act 2023, and keeping records the law requires.
Keeping people at risk safe (Data Protection Act 2018, Schedule 1, paragraph 18): if someone may be at risk of harm, we can carry on the safety checks and support that protect them, and act on reports about them, even where we can't ask for consent first.

5. Safety checks by Claude (Anthropic)

Every post, story and comment shared with Everyone, every profile photo and every group picture is checked before anyone else sees it. Every private message is checked just after it's sent, including photos in messages. The words, any photos, and up to four still images from a video are sent to Claude, an AI made by Anthropic, which says one of three things:

it can go up (or stay delivered);
it can go up, with support shown to you, if it looks like you may be at risk; or
it should wait for a human moderator, for example abuse or content that encourages self-harm. A message held this way is hidden from the other person.

Claude does not hear the sound on videos, and voice notes in messages are not checked automatically, because Claude can't listen to them. A moderator hears a voice note only if someone reports it. Posts kept to Only me are not checked while they're private.

A post or message that shows someone is struggling is never punished. You're shown where to get help. Removing content, strikes, suspensions and bans are always decided by a person (section 8).

What Anthropic does with it. Anthropic works only on our instructions. By default it does not use what we send to train its AI. It deletes it within 30 days, except that content its own safety systems flag can be kept for up to 2 years, and its safety scores for up to 7 years. Anthropic is in the United States. We protect that transfer with the UK's International Data Transfer Addendum to the Standard Contractual Clauses, which is part of Anthropic's data processing addendum. You can ask us for a copy at hello@wearejohn.com.

6. Private messages

Messages are not end-to-end encrypted. That means John's systems can read them. They are protected in transit and stored securely, but we don't claim that only you and the other person could ever read them.
Our safety check (section 5) reads each message just after it's sent.
Moderators see a chat only if someone reports it, or the safety check holds one of its messages. They then see that chat.
Group chats hold up to 25 people. Anyone in a group can add people and rename it, and set its picture. Only the group's admin can remove people, and anyone can leave. Someone who follows you is added straight in; anyone else gets an invite to accept or decline. Nobody can add you if you've chosen "Nobody" for messages.
Voice notes (up to a minute) and photos can be sent once a chat has started. A first message request is words only.
The John team can always send you a message about your safety or your account, whatever your message setting. It arrives as a request, words only.
Talk to a stranger: pick a topic and be paired with someone else who wants to talk about it. You can join anonymously: the other person then sees a made-up name and drawn face that John keeps for you, never your own profile. It's linked to your account inside John's systems, so blocks, reports and moderation still apply.
You choose who can message you in Settings: people you follow (the starting setting), everyone, or nobody. If you choose everyone, someone you don't follow sends a request first: one message, words only, no links. You can reply (which accepts it), delete it or block them.
If either person in a one-to-one chat deletes their account, the whole chat is deleted for both. In a group, your own messages, photos and voice notes are deleted, and the group carries on for everyone else.

7. Who else handles your information

Supabase stores John's database, photos and videos in London (UK). Supabase's contracting company is in Singapore, and some of its own suppliers may handle data outside the UK. Those transfers are protected by the UK's International Data Transfer Addendum to the Standard Contractual Clauses, in Supabase's data processing addendum. Supabase publishes the list of suppliers it uses on its website.
Anthropic: safety checks (section 5), in the USA.
Expo, and Apple or Google, deliver push alerts. Alerts say who did what (for example "dan_w liked your post") and never include what anyone wrote. Expo is in the USA and is certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), which the UK recognises as giving proper protection.
Resend sends sign-up and password codes by email. It only receives your email address and the code. Resend is in the USA. The transfer is protected by the UK Addendum to the Standard Contractual Clauses in its data processing agreement, and Resend is also certified under the UK-US data bridge.
Our age-check provider checks you're 18 or over, once, at sign-up. It receives your email address and, only if needed, a selfie, and deletes them after the check.

Each of these gives your information the same or equal protection to this policy, under contract with us.

Emergencies and the law. If we believe someone's life is at risk, we may share what's needed with emergency services. We share information with the police or courts when the law requires it. We never share it for any other reason.

We don't sell your information and there are no adverts.

8. Decisions made by the app on its own, and profiling

Your "For you" feed is chosen by the app from the topics you pick and what you like, comment on, say Me too to and read. This is profiling. It only decides the order you see posts in. You can change your topics in Settings, and the Following feed shows people you follow in time order instead.
Support prompts. If you've been reading a lot of posts marked as heavy, the app shows you where to get help. Crisis words in what you type also bring up support straight away. Nothing is blocked or punished.
The safety check (section 5) can hold a post, comment or message until a moderator looks. That's a decision made by a computer, so a person always makes the final call on removing anything.
Spam limits. If you post, comment, follow, report or message much faster than a person normally does, the extra item isn't saved. The first time in any hour this happens, 50 points come off your points automatically. It never affects your account in any other way.
Strikes, suspensions and bans are only ever given by a person.

You can ask a person to look again at anything the app decided, or that a moderator decided: write to hello@wearejohn.com.

9. How long we keep it

Until you delete your account. Then your profiles, profile photos, posts (including private ones), stories, photos, videos, comments, likes, Me toos, messages and chats, check-ins, journeys, saved posts, settings and sign-in are deleted. We keep:

moderation decisions (with your name removed), so the record of what moderators did stays complete, for 6 years;
the phone ID of a banned account, so the ban still works, for 3 years;
reports other members made, for 1 year after they're closed.

Backups of the database are kept for 7 days, then overwritten. Anthropic's own storage times are in section 5.

10. Your rights

Get a copy: Settings > Download my data gives you everything as a file.
Take it elsewhere: the download is in a standard format (JSON) you can give to another service.
Correct: edit your profile and posts at any time, or ask us.
Delete: Settings > Delete my account removes it for good. You can also ask us without the app, on our delete your account page.
Restrict: ask us to stop using your information for a while, for example while we check something you've told us is wrong.
Object: where we rely on legitimate interests (safety checks, moderation, spam limits, phone bans), you can object at hello@wearejohn.com. We'll stop unless we have strong reasons to carry on that outweigh yours, such as keeping other members safe.
Withdraw consent: at any time, by deleting your account (section 4).
A person, not just the app: ask for a human to look again at any automatic decision (section 8).
Complain: tell us first at hello@wearejohn.com. We'll confirm we've received your complaint within 30 days, look into it, and tell you what we found. You can also complain to the Information Commissioner's Office at ico.org.uk.

11. Over 18s only

John is only for people aged 18 and over. Anyone who says they are under 18 at sign-up has their account deleted straight away.

12. Health information on your phone

John doesn't use your health information for advertising and doesn't store it in iCloud. It isn't connected to Apple Health or Google Health Connect.

13. Changes

We'll tell you in the app if this policy changes.