Skip to main content

Commonspace User Privacy Policy

Last Updated: March 26, 2026

1. Introduction

Welcome to Commonspace. This Privacy Policy explains how Commonspace Platforms, Inc., a Delaware corporation ("Commonspace," "Company," "we," "us," or "our"), collects, uses, discloses, and protects your personal information when you use our websites (including common.space and all related subdomains), our mobile applications for iOS and Android (the "Mobile App"), our APIs, and any related services (collectively, the "Services").

Commonspace is a community platform and social network that enables you to create a Profile, post content, follow other users, join community Spaces, and connect with others. This Privacy Policy applies to all users of our Services.

BY USING THE SERVICES, YOU CONSENT TO THE COLLECTION, USE, AND DISCLOSURE OF YOUR INFORMATION AS DESCRIBED IN THIS PRIVACY POLICY. IF YOU DO NOT AGREE, PLEASE DO NOT USE THE SERVICES.

This Privacy Policy is incorporated into and subject to our User Terms of Service.

2. Information We Collect

The information we may collect in the course of you using the Services may include, but is not limited to, the following:

2.1 Information You Provide

Account Registration:

  • Email address (required, for login and communications)
  • First name and last name (required)
  • Birthdate (required, not publicly displayed on your Profile, used for age verification and regulatory compliance. Shared with Space Owners when you join their Space as a Member, as described in Section 4.1)
  • City (required, not publicly displayed on your Profile, used for regulatory compliance. Shared with Space Owners when you join their Space as a Member, as described in Section 4.1)
  • Password (stored securely using industry-standard encryption)
  • Preferred language

Social Login: You may register or log in using a third-party account from the following providers: Google, Facebook, Apple, or X (Twitter). When you authenticate via social login, we receive only the minimum information needed to create or verify your account — typically your email address and name. We do not import or store your profile photo, contacts, or other profile data from the social login provider. After initial authentication, you may disconnect your social login at any time. Each provider's privacy policy governs their handling of your data:

Profile Information:

  • @username (unique identifier, publicly visible)
  • Profile image and background image
  • Display name and pronouns
  • Bio and about section
  • Social media links (X/Twitter, Instagram, Facebook, TikTok, LinkedIn, Twitch, website)
  • Featured links and "Top 8" connections

Content You Create:

  • Profile Posts you publish to your Profile
  • Posts, comments, and messages in Space Channels
  • Images, videos, documents, and media you upload (up to 128MB per file)

Space Membership Information:

  • Answers to Member Questions created by Space Owners
  • Your Membership and Item purchase history

Transaction Information:

  • Purchase history and Membership status
  • Payment method details (processed and stored by Stripe, NOT by Commonspace)
  • Billing address

Communications:

  • Support requests and correspondence with us
  • Feedback and survey responses

2.2 Information Collected Automatically

When you use our Services, including the Mobile App, we automatically collect at least the following:

Device and Browser Information:

  • Device type, operating system, and version
  • Browser type (for web access)
  • IP address
  • Device identifiers (including mobile advertising identifiers)
  • Screen resolution and language settings
  • App version (for Mobile App)

Usage Information:

  • Pages and features accessed
  • Time spent on pages and interaction patterns
  • Posts viewed and engaged with in your Feed
  • Spaces visited and joined
  • Users you follow and interact with
  • Search queries within the platform
  • Referring URLs and exit pages

Location Information:

  • General location derived from IP address
  • Timezone information
  • The Mobile App does not collect precise GPS location. We may use general or approximate location information derived from your IP address or city setting for regulatory compliance and service delivery.

Mobile Advertising Identifiers and App Tracking Transparency:

As noted above, we collect device identifiers including mobile advertising identifiers. Specifically:

  • On iOS devices, this includes your Identifier for Advertisers (IDFA). In accordance with Apple's App Tracking Transparency (ATT) framework, we will request your permission before using your IDFA for tracking purposes. You can change this preference at any time under Settings → Privacy & Security → Tracking on your iOS device.
  • On Android devices, this includes your Google Advertising ID (GAID). You can reset or opt out at any time under Settings → Google → Ads on your Android device.

We do not sell your mobile advertising identifier to third parties. We may share it with analytics providers (such as those listed in Section 4.3) solely to measure app performance and improve your experience.

Security and Fraud Prevention Data:

We use Google reCAPTCHA Enterprise to protect the Services from automated abuse. reCAPTCHA may collect and analyze interaction data (such as mouse movements, scrolling behavior, and typing patterns), your IP address, and browser information to determine whether you are a human user.

Two-Factor Authentication:

If you enable SMS-based two-factor authentication, we collect and share your phone number with Twilio, Inc. for the purpose of sending verification codes. Your phone number is used solely for authentication and is not used for marketing purposes.

Local Storage on Mobile Devices:

The Mobile App stores authentication tokens and user session data locally on your device using encrypted secure storage (Keychain on iOS, Keystore on Android). This data is only accessible to the Commonspace app and is used to maintain your login session. This data remains on your device and is not transmitted to our servers except as part of normal authentication. If you uninstall the Mobile App, this locally stored data is removed.

2.3 Information from Third Parties

We may receive information from:

  • Stripe: Payment and identity verification information
  • Social media platforms: If you link accounts
  • Space Owners: Information about your membership and activity in their Spaces
  • App stores: Basic installation and crash data

3. How We Use Your Information

We use your information to provide, operate, maintain, and improve the Services, including in connection with customer support, security, and legal compliance.

Providing and Operating the Services:

  • Creating and managing your Account
  • Displaying your Profile and Content
  • Generating your Feed of posts from users you follow and Spaces you've joined
  • Processing transactions and facilitating payments
  • Enabling community features (following, Channels, Member Directories)
  • Delivering experiences including on the Mobile App
  • Improving and developing new features

Media Processing:

When you upload images or videos, we process them on our servers to optimize quality and performance. This includes resizing images to multiple sizes for different display contexts and converting videos to standardized formats (MP4). Original files may contain embedded metadata such as timestamps, device information, and location data (e.g., EXIF GPS coordinates). We recommend removing sensitive metadata before uploading if you do not wish it to be stored.

Communications:

  • Sending account-related emails (verification, security alerts)
  • Delivering push notifications through the Mobile App
  • Notifying you about activity (new followers, posts, etc.)
  • Enabling Space Owners to communicate with Members
  • Responding to support requests

Safety and Security:

  • Detecting and preventing fraud, abuse, and security threats
  • Enforcing our Terms of Service and Community Guidelines
  • Age verification for age-appropriate content

Legal and Compliance:

  • Complying with legal obligations
  • Responding to legal requests

4. How We Share Your Information

We do not sell your personal information.

4.1 With Space Owners

When you join a Space, the Space Owner receives:

  • Your name and email address
  • Your Profile information (based on your settings)
  • Your city/location and birthdate (for regulatory compliance and age verification)
  • Your answers to Member Questions
  • Your purchase history and activity within their Space

Space Owners must protect your data per our Space Owner Agreement. When you leave a Space, the Space Owner no longer has access to your current data. If you delete your Account, Space Owners cannot access your previous data.

4.2 With Other Users

Based on your settings:

  • Your Profile and Profile Posts may be publicly visible
  • Your posts appear in the Feeds of your followers
  • Your posts in Space Channels are visible to other Members
  • You may appear in Member Directories (based on Space settings)

4.3 With Service Providers

We share Personal Data with the following categories of service providers in order to operate and improve the Services:

Payments and Identity Verification:

Stripe, Inc.: Payment processing and identity verification for Space Owners (KYC). Stripe receives payment card details, billing address, and identity verification information. We do not store payment card information on our systems. See https://stripe.com/privacy

Cloud Infrastructure:

Amazon Web Services (AWS): Cloud hosting, data storage (Amazon S3), and database infrastructure. All uploaded content (images, videos, documents) and platform data is stored on AWS in the United States (us-west-1 region). See https://aws.amazon.com/privacy/

Content Accessibility: Content you upload to the Services is stored in two ways depending on its nature and visibility:

  • Publicly accessible content — Content that is intended to be publicly visible (such as Profile images, Space logos, and other content you publish to public areas of the platform) is served via direct URLs without additional authentication. This means anyone with the URL can access the content, consistent with its public nature.
  • Access-controlled content — Content that is behind a paywall, restricted to Space Members, or otherwise not intended to be publicly available (such as paid downloads, Member-only media, and Benefit-gated content) is served via time-limited, authenticated URLs that require valid authorization to access. These URLs expire automatically and cannot be shared or reused after expiration.

Communications:

SendGrid (Twilio Inc.): Transactional and marketing email delivery. SendGrid receives email addresses and email content. In the event that SendGrid is temporarily unavailable, a backup email service (Google Gmail SMTP) may be used to ensure delivery of essential communications. See https://www.twilio.com/legal/privacy

Twilio, Inc.: SMS-based two-factor authentication. If you enable SMS 2FA, your phone number is shared with Twilio for verification purposes. See https://www.twilio.com/legal/privacy

Push Notifications:

When you enable push notifications in the Mobile App, a push notification token is generated and sent to our backend servers after login. Our backend stores this token and controls when and what notifications are sent. The notification delivery chain works as follows:

  • Expo (650 Industries, Inc.): Provides the push notification SDK and manages token registration. Expo receives push notification tokens and device identifiers. See https://expo.dev/privacy
  • Google Firebase Cloud Messaging (Google LLC): On Android devices, Expo routes push notifications through Firebase Cloud Messaging (FCM) for delivery. Firebase receives device tokens and notification payloads. See https://policies.google.com/privacy
  • Apple Push Notification Service (Apple Inc.): On iOS devices, Expo routes push notifications through Apple's APNs for delivery. Apple receives device tokens and notification payloads. See https://www.apple.com/legal/privacy/

You may disable push notifications at any time in the Mobile App settings or your device settings, which will stop notification delivery. Push notification tokens are deleted when you delete your account or uninstall the Mobile App.

Security and Fraud Prevention:

Google reCAPTCHA Enterprise (Google LLC): Bot and fraud prevention. reCAPTCHA analyzes interaction data (such as mouse movements and typing patterns) and your IP address to verify you are human. See https://policies.google.com/privacy

Analytics:

Google Analytics (Google LLC): We use Google Analytics to understand how users interact with the Services and improve performance. Google may receive usage data including your IP address, device information, and pages visited. You can learn more at policies.google.com/privacy and opt out at tools.google.com/dlpage/gaoptout.

Other Google Services:

Google Fonts (Google LLC): Font files are loaded from Google servers when rendering Space themes. Google may receive your IP address and browser information. See https://policies.google.com/privacy

Google Maps (Google LLC): Location autocomplete during account setup. Google receives your search input and IP address. See https://policies.google.com/privacy

Real-Time Communications:

We use WebSocket connections to deliver real-time notifications and activity updates to you while you are actively using the web application. These connections are encrypted over TLS (wss://) and are used solely to push notifications (such as new messages, follows, and Space activity) to your browser in real time. Notification data is temporarily processed through an in-memory messaging layer on our servers and is not persisted after delivery.

4.4 With Third-Party Integrations (Space Plugins)

Space Owners may enable optional third-party integrations ("Plugins") within their Spaces, such as video conferencing, messaging, e-commerce, or other supported services. If a Space you join has Plugins enabled, you will be prompted to connect or authorize access the first time you attempt to use that Plugin. Your data is only shared with a Plugin service after you opt in.

Data shared with Plugin services may include your display name, profile information, and any content you submit through the integration. Each Plugin service has its own privacy policy, and we encourage you to review it before opting in. Currently known or planned Plugins include, but are not limited to:

The list of available Plugins may change over time and is maintained at https://help.common.space/legal/plugins. Space Owners are responsible for informing their Members about which Plugins are active in their Space. Commonspace does not control the privacy practices of Plugin services and is not responsible for their handling of your data once shared.

4.5 For Legal Reasons

We may disclose information to comply with law, respond to government requests, protect our rights, or prevent harm.

4.6 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or substantially all of our assets, your personal information may be transferred to the acquiring entity as part of that transaction. If you are located in the EEA, UK, or Switzerland, we will ensure any such transfer complies with applicable data protection law, including by notifying you as required under GDPR where there is a material change to how your personal data is processed.

5. Data Retention

We keep your information only for as long as needed:

  • Account information: deleted or anonymized within 90 days of account closure
  • Transaction records: kept for 7 years as required by tax and financial regulations
  • Content: kept until you delete it or close your account, then removed within 90 days
  • Usage and log data: kept for up to 12 months, then aggregated or anonymized

When you delete your account, we begin the deletion process promptly. Some information may be retained longer where required by law or needed to resolve an active dispute.

For questions about your data, contact us at privacy@common.space.

6. Your Rights and Choices

You can update your personal information at any time through your Commonspace account settings. You may also manage your communication preferences there. Please note that essential account-related communications cannot be opted out of.

Depending on your location, you may have certain rights regarding your personal information, including:

  • Access the personal information we hold about you
  • Correct inaccurate or incomplete information
  • Request deletion of your personal information
  • Request a copy of your information in a portable format
  • Object to or restrict certain processing
  • Withdraw consent where processing is based on consent

To exercise these rights, contact us at privacy@common.space. We may need to verify your identity before responding. We will respond to your request within 30 days of receipt (or within 45 days as required under applicable California law). We may extend this period by up to 60 additional days in complex or numerous cases; if we do so, we will notify you within the initial 30-day period and explain the reason for the extension. There is no fee for submitting a request unless it is manifestly unfounded or excessive.

Some requests may be limited where required by law or where the information is necessary for us to provide the Services.

7. Additional Rights for EEA, UK, and Swiss Users

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following additional terms apply to our processing of your personal data under the General Data Protection Regulation (GDPR) and applicable local law.

7.1 Lawful Bases for Processing

We process your personal data on the following legal bases:

  • Performance of a contract (Article 6(1)(b)): to provide you with our Services, process your account registration, and fulfill our obligations to you.
  • Legitimate interests (Article 6(1)(f)): to operate and improve the platform, prevent fraud, and ensure security, where those interests are not overridden by your rights.
  • Consent (Article 6(1)(a)): for optional features such as marketing communications and non-essential cookies, where you have given your consent. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
  • Legal obligation (Article 6(1)(c)): where processing is necessary to comply with applicable law.

7.2 Your Data Subject Rights

Subject to applicable law, you have the following rights regarding your personal data:

  • Right of access (Article 15): you may request a copy of the personal data we hold about you.
  • Right to rectification (Article 16): you may request correction of inaccurate or incomplete data.
  • Right to erasure (Article 17): you may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
  • Right to restriction of processing (Article 18): you may request that we limit processing of your data in certain circumstances, such as while you contest its accuracy.
  • Right to data portability (Article 20): you may request that we provide your personal data in a structured, commonly used, machine-readable format.
  • Right to object (Article 21): you may object to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

7.3 How to Exercise Your Rights

To exercise any of the rights above, please submit a written request to: privacy@common.space. We will respond within 30 days of receiving your request. We may ask you to verify your identity before processing your request. There is no charge for submitting a request unless it is manifestly unfounded or excessive.

7.4 Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection supervisory authority (Article 77 GDPR). A list of EEA supervisory authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en. UK users may contact the Information Commissioner's Office (ICO) at ico.org.uk.

7.5 International Data Transfers

Commonspace Platforms, Inc. is based in the United States. When we transfer your personal data outside the EEA or UK, we do so on the basis of Standard Contractual Clauses approved by the European Commission (EU Commission Implementing Decision 2021/914) or another valid transfer mechanism under Article 46 GDPR. You may request a copy of the applicable transfer safeguards by contacting us at privacy@common.space.

8. Information for California Residents (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

Categories of Personal Information We Collect

As described in this Privacy Policy, we may collect the following categories of personal information (as defined under California law):

  • Identifiers (such as name and email address)
  • Personal information described in Cal. Civ. Code § 1798.80
  • Commercial information (such as purchase history)
  • Internet or network activity information (such as usage data)
  • General geolocation information
  • Inferences drawn from the information above

Your California Privacy Rights

Subject to certain limitations under applicable law, you have the right to:

  • Know what personal information we collect and how we use it
  • Request deletion of your personal information
  • Request correction of inaccurate personal information
  • Opt out of the sale or sharing of personal information (we do not sell personal information)
  • Not be discriminated against for exercising your privacy rights
  • Limit the use of your sensitive personal information to purposes necessary to provide the Services

To exercise any of these rights, please contact us at privacy@common.space. We may verify your identity before responding, as required by law.

8A. Information for Users in Japan (APPI)

If you are located in Japan, the following additional terms apply under the Act on the Protection of Personal Information (APPI), as amended.

Business Operator

Commonspace Platforms, Inc. is the business operator responsible for the handling of your personal information. For inquiries regarding personal information, contact us at privacy@common.space.

Categories of Personal Information

We collect and handle the following categories of personal information as described in this Privacy Policy: name; email address; birthdate; city; profile information; content you create; transaction and purchase history; device and usage information; and communication records.

Purpose of Use

We use your personal information for the purposes set forth in Section 3 of this Privacy Policy. We will not use your personal information beyond the scope necessary to achieve these purposes without your prior consent.

Provision to Third Parties

We may provide your personal information to third parties as described in Section 4, including Space Owners (when you join a Space), service providers listed in Section 4.3, and as required by law. By using the Services and joining Spaces, you consent to such provision.

Cross-Border Transfer of Personal Information

Your personal information is transferred to and processed in the United States by Commonspace Platforms, Inc. The United States is not recognized by the Personal Information Protection Commission (PPC) as providing an equivalent level of protection to Japan's APPI. We implement appropriate safeguards to protect your personal information, including encryption in transit and at rest, access controls, and contractual obligations on service providers. By using the Services, you consent to this cross-border transfer.

Your Rights Under APPI

You have the right to request: (i) notification of the purpose of use of your retained personal data; (ii) disclosure of your retained personal data; (iii) correction, addition, or deletion of your retained personal data if it is inaccurate; (iv) suspension of use or erasure of your retained personal data if it was obtained improperly or is no longer necessary; and (v) suspension of provision of your retained personal data to third parties.

To exercise any of these rights, contact us at privacy@common.space. We may ask you to verify your identity. We will respond in accordance with APPI requirements.

Complaints

If you have concerns about our handling of your personal information, you may contact the Personal Information Protection Commission (PPC) of Japan at https://www.ppc.go.jp/en/.

9. Cookies and Tracking

We use cookies and similar technologies to operate and improve the Services.

Types of Cookies We Use

Essential cookies — These are strictly necessary for the operation of the Services, including authentication, session management, security (such as CSRF protection), and core functionality. These cookies cannot be disabled without impairing the Services. Essential cookies include: AUTH_COOKIE (session authentication), ACCESS_TOKEN (JWT bearer token, valid 1 day), REFRESH_TOKEN (refresh token, valid 7 days), and CSRF tokens for security. These cookies are HTTP-only and are not accessible to client-side JavaScript.

Functional cookies — These remember your preferences and settings, such as language selection and display preferences, to provide a more personalized experience.

Analytics cookies — These help us understand how users interact with the Services and measure performance. We use Google Analytics, which sets cookies to collect usage data including pages visited, time on site, and referring URLs. See Section 4.3 for more information about Google Analytics.

Your Cookie Choices

Browser controls: You can manage or delete cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that blocking essential cookies may prevent you from using the Services.

EEA, UK, and Swiss users: If you are located in the EEA, UK, or Switzerland, we will obtain your consent before placing non-essential cookies (functional and analytics) on your device, in accordance with the ePrivacy Directive and applicable local law. You may withdraw your consent at any time through the cookie preferences available on the platform.

Do Not Track: Some browsers offer a "Do Not Track" (DNT) setting. We currently do not respond to DNT signals, as no uniform standard for handling DNT has been adopted.

10. Children's Privacy

The Services are intended for users who are at least 18 years of age (in the United States) or the age of majority in their jurisdiction (outside the United States). We do not knowingly collect personal information from anyone who does not meet these age requirements. We do not permit individuals below the applicable age threshold to create an Account or use the Services.

If we become aware that we have collected personal information from a person who does not meet the applicable age requirement, we will take steps to delete that information promptly and may suspend or terminate the associated account.

If you believe that someone below the applicable age has provided personal information to us, please contact us immediately at privacy@common.space.

11. Data Security

We take the security of your personal information seriously and implement reasonable administrative, technical, and physical safeguards designed to protect it. These measures include:

  • Encryption of data in transit (TLS) and at rest, using Fernet symmetric encryption (AES-128-CBC with HMAC authentication) as a minimum standard, with comparable or stronger encryption methods used as needed or as required by applicable law
  • Secure password hashing
  • Access controls limiting access to personal information
  • Regular security assessments and monitoring
  • Ongoing employee training on data protection and security practices

We do not store sensitive payment information on our systems. Payment details are transmitted directly to Stripe and are handled in accordance with Stripe's security standards.

While we work to protect your information, no method of transmission over the internet or electronic storage is completely secure. Accordingly, we cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials, including your password, and for restricting access to your account. We encourage you to use a strong, unique password and to notify us promptly at security@common.space if you suspect unauthorized access to your account.

Data Breach Notification:

In the event of a security breach affecting your personal information, we will notify you without undue delay and in accordance with applicable law. Where required (such as under GDPR Article 33), we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. We will notify affected users where the breach is likely to result in a high risk to their rights and freedoms, as required under GDPR Article 34 or other applicable law.

Data Protection Officer:

Given the current scale and nature of our processing activities, we have not appointed a Data Protection Officer (DPO) under GDPR Article 37. We keep this assessment under regular review and will appoint a DPO if required by the nature or scale of our processing. For all data protection inquiries, please contact privacy@common.space.

Automated Decision-Making:

We do not use automated decision-making, including profiling, that produces legal effects or similarly significant effects on you (as described in GDPR Article 22). Our content Feed is chronological and is not driven by algorithmic profiling. Content moderation may involve automated tools to detect clearly prohibited content (such as spam or illegal material), but material enforcement actions (account suspension, content removal) involve human review.

12. International Users

Commonspace is operated from the United States and currently supports users in the United States and Japan.

If you access or use the Services from outside the United States, your personal information may be transferred to, stored in, and processed in the United States or other countries where we or our service providers operate.

We take appropriate steps designed to ensure that your personal information is treated securely and in accordance with this Privacy Policy and applicable data protection laws.

By using the Services, you acknowledge and consent to the transfer and processing of your personal information as described in this section.

13. Third-Party Links

Our Services may include links to third-party websites or services, such as social media platforms linked in user Profiles. We do not control these third parties, and this Privacy Policy does not apply to their practices.

We encourage you to review the privacy policies of any third-party sites or services you choose to visit.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our Services, legal requirements, or business practices.

When we make changes, we will update the "Last Updated" date at the top of this Policy. If we make material changes, we may also provide additional notice, such as by email or through the Services.

Your continued use of the Services after any update means you accept the revised Privacy Policy.

15. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or your personal information, you can contact us using the details below:

Commonspace Platforms, Inc.
Privacy Inquiries: privacy@common.space
General Legal: legal@common.space
Security Issues: security@common.space
Website: https://common.space
Help Center: https://help.common.space
Address: 6121 Sunset Blvd, Los Angeles, CA 90028, United States

16. Summary of Key Points

To help you better understand our approach to privacy, here are the key takeaways from this Privacy Policy:

  • Your birthdate and city are collected for regulatory purposes and are kept private
  • We do not sell your personal information
  • Your Feed is chronological and not driven by advertising algorithms
  • When you join a Space, certain information is shared with the Space Owner as described above
  • Payments are processed securely by Stripe; we do not store your payment details
  • You can manage, update, or delete your information through your Account settings
  • We comply with applicable privacy laws, including GDPR and CCPA

BY USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY.