Campfire Privacy Policy

Effective date: October 28, 2026

The short version

This summary is here to help you read the policy. It isn’t legally binding; the full policy below is.

• Campfire is built on the Authenticated Transfer (AT) Protocol, an open network for social apps. Posts, profiles, follows, likes, blocks, camp memberships and merit are public, and anyone can see them, on Campfire and elsewhere.
• We keep information about your activity and interests on Campfire, such as the camps and posts you view and engage with. We use it to run and improve Campfire, to choose which ads you see, for analytics, and to build future data products.
• We use AI models from several providers to sort public posts by topic, rank content and catch spam. We may also use your content and activity on Campfire to train AI models.
• We choose ads based on your activity and interests on Campfire, never on what you do in other apps or websites, and never on sensitive topics such as health or religion. We’ll never sell your private information without your permission, but we may license public posts, camp memberships and merit to other companies. Any data products we build will use only public data, data that can’t reasonably identify you, or data you’ve chosen to share.
• You can delete your account at any time in the app.

1. About this policy

This policy explains how Campfire Commons, Inc. (“Campfire,” “we” or “us”) collects, uses and shares information when you use the Campfire apps, the website at campfirechat.co and related services (the “Service”). It also covers public posts from the AT Protocol network that appear on Campfire. It’s part of our Terms of Service.

2. What’s public and what’s private

Campfire is built on the Authenticated Transfer (AT) Protocol, an open network that many social apps use, including Bluesky. Much of what you do on that network is public by design.

Public information can be seen, copied and stored by anyone, including other apps and services on the network that we don’t control.

Your account, posts and profile are stored on a Personal Data Server (PDS) run by your hosting provider, under that provider’s own privacy policy. If you created your account in Campfire, your hosting provider is Bluesky Social PBC, unless you chose a different provider during sign-up. If you signed in with an existing account, it’s whoever already hosts that account. We plan to run our own PDS in the future. We’ll update this policy before we host any accounts, and we won’t move your account to a different hosting provider without your permission.

3. Information we collect

From the AT Protocol network. When you sign in, we receive your decentralized identifier (DID), your handle and your public profile. We can also see your public activity on the network, such as posts, follows, likes and blocks. We collect public posts from the network to build camps and feeds.

If you create an account in Campfire. New accounts created in the Campfire app are hosted on a Personal Data Server run by Bluesky Social PBC by default, or by another hosting provider you choose (section 2). To set up your account, we pass the information you enter, such as your email address, handle, password and birth date, to that provider. Bluesky stores it under its Terms of Service and AT Protocol Network Services Privacy Notice. Campfire doesn’t keep your password or birth date. If you choose a handle ending in cmpfr.social, we keep a record linking it to your account’s identifier so the handle works.

Bluesky’s sign-up check. When you create an account hosted by Bluesky, Bluesky asks you to complete an hCaptcha check to show you’re human. hCaptcha collects information about your device and how you interact with the check. Bluesky and hCaptcha handle that information under their own privacy policies, including hCaptcha’s. Campfire doesn’t receive it.

Information you give us.

• Your confirmation that you’re 18 or older. We don’t keep your birth date.
• The camps you join and leave, the feeds you create or follow, the interests you tell us about, and your settings.
• Invite codes you use or share, and who invited you.
• Reports, appeals and messages you send us.
• Your email address, if you give it to us, for example to join a waitlist or get support.

Your contacts. If you choose to upload or sync contacts from your device, we use them to find people you know on Campfire, suggest people to follow, tell you when your contacts join, and help you invite them. We keep hashed copies of their phone numbers and email addresses, linked to your account. You can delete them at any time in the app’s settings.

Information we create.

• Topic labels for public posts, and which camps those posts belong in.
• Interest profiles: the topics and camps we think you’re interested in, based on your activity.
• Merit scores, calculated from votes, contributions, moderation and invites.
• Recommendations of camps, posts and people.

Information collected automatically.

• Your activity on Campfire, such as the camps and posts you view, how long you spend on them, what you search for, and what you tap, like or vote on.
• Your IP address, device type, operating system, app version and crash reports.
• A push notification token, if you turn on notifications.

From your app store or device. We may receive an age-range signal from Apple, Google or your device. We use it only to enforce our 18+ rule.

We don’t use advertising code from other companies in our app, and we don’t track you across other companies’ apps or websites.

4. People who don’t use Campfire

Campfire shows and organizes public posts from the AT Protocol network, including posts by people who haven’t signed up for Campfire. For those people, we process public network data, such as their identifier, handle, profile and public posts, plus the topic labels we give their posts. We label their posts by topic, but we don’t build profiles of them or make inferences about them, such as about their health, politics, religion or sexuality. We may also use their public posts to train AI models we use ourselves. We don’t license their posts to others.

If a Campfire user uploads contacts that include you, we keep a hashed copy of your phone number or email address linked to that user’s account, so we can tell them if you join. We contact you only if that user chooses to invite you.

When someone deletes a post or an account on the network, we remove it from Campfire, generally within 72 hours.

If you don’t use Campfire and don’t want your public posts to appear on it, email privacy@campfirechat.co with your handle. We’ll stop showing and processing your posts. We’ll keep only your identifier, on a do-not-process list, so that we can keep honoring your request. You can also ask us to delete your phone number or email address from contacts that Campfire users have uploaded.

5. How we use information

• To run Campfire: signing you in, setting up your account if you create one in the app, showing camps and feeds, sending what you post to your hosting provider for publishing, and sending the notifications you’ve turned on.
• To sort, rank and personalize: labeling posts by topic, placing them in camps, calculating merit, and recommending camps, posts and people based on your activity and interests.
• To connect you with people you know: matching contacts you upload against Campfire accounts, suggesting people to follow, telling you when your contacts join, and helping you invite them.
• To show ads: choosing which ads and sponsored posts to show you based on your activity on Campfire, the camps you’re in and the interests we infer, and measuring how ads perform. We don’t use information from other companies’ apps or websites, or sensitive topics, to choose your ads (section 8).
• To keep Campfire safe: enforcing our Terms, preventing spam and abuse, reviewing reports and appeals, and enforcing our age limit.
• To understand and improve Campfire: analyzing how Campfire is used, fixing bugs and learning which features work.
• To build new products: developing new features and products, including data products (section 7).
• To support research: studying how online communities work, and sharing information with outside researchers (section 7).
• To talk with you: replying to your messages and sending important notices about Campfire. We may also send you marketing emails about Campfire, which may include messages from sponsors. You can unsubscribe at any time using the link in any email.
• To follow the law and protect rights.

6. How we use AI

We use AI to sort public posts into camps by topic, help rank and recommend content, and catch spam and abuse. We use models from several AI providers and will add or change models over time, which may include models we run or build ourselves. When an outside provider runs a model for us, it processes the data as our service provider, and our agreement doesn’t allow it to use that data to train its own models.

We may use public posts, including yours, and information about your activity on Campfire to develop and train AI models, including models we build ourselves. We may offer those models, or tools built with them, to other companies and developers. Public posts made in other apps, by you or by people who don’t use Campfire, are used only for models we use ourselves, such as the ones that sort posts into camps.

7. How we share information

• Publicly, on the network. When you post, join a camp, earn merit, like, follow or block, that activity is public (section 2).
• With your hosting provider. If you create an account in Campfire, we send your hosting provider (Bluesky by default) the information needed to set it up (section 3). When you post through Campfire, we send the post to your hosting provider for publishing. We may also share reports about content or accounts with your hosting provider or with moderation services.
• With service providers. We share information with companies that help us run Campfire, such as providers of hosting, AI models, analytics, crash reporting, email and customer support. They may use it only to provide services to us, and they must protect it at least as well as this policy does.
• With advertisers. We give advertisers reports on how their ads performed, such as how many people saw or engaged with them and the general interests of those people. These reports combine information about many people and don’t include your name, handle or email address. If you choose to share information with an advertiser, for example by filling in a form in an ad, we send it to them.
• With researchers. We may share information with vetted academic and nonprofit researchers studying topics such as online communities, safety and the public interest. They must sign an agreement that limits how they use the information, requires them to protect it, and forbids them from sharing it further or trying to re-identify anyone. Before we share information about your activity on Campfire, we remove details that directly identify you, such as your name, handle and email address, unless you’ve agreed to take part in a study.
• Licensed public data. We may license public posts made through Campfire, camp memberships, topic labels and merit scores, including the handles they’re linked to, to companies and researchers. They may use this data for AI training, research and analytics. They must honor deletions: when you delete a post or your account, we’ll tell them, and they must remove it. We don’t license your private information.
• In data products. We may offer data products in the future, such as statistics about which topics are popular or how camps relate to each other. They’ll be built only from public AT Protocol data, from information that’s aggregated or de-identified so it can’t reasonably be linked to you, or from information you’ve chosen to share. We won’t try to re-identify de-identified information, and we’ll require anyone who receives it not to try either. We’ll describe each data product in this policy before we launch it.
• For legal reasons and safety. See section 10. As the law requires, we report child sexual abuse material to the National Center for Missing & Exploited Children.
• If the company changes hands. If Campfire is part of a merger, acquisition or sale of assets, information may be transferred in that deal. The new owner must keep the promises in this policy for information collected under it, or ask for your permission to change them.
• With your permission.

8. What we don’t do

• We’ll never sell your private information without your permission. That covers your activity, interests, votes, contacts and messages. We may license public posts and public camp and merit information (section 7).
• We don’t choose your ads based on what you do in other companies’ apps or websites, and we don’t give your personal information to data brokers or ad networks.
• We don’t use sensitive information to choose your ads. Sensitive information includes health, religion, political views, sexual orientation, race and ethnicity, along with camps and interests about those topics.
• We don’t track you across other companies’ apps or websites. So there’s nothing for Do Not Track or Global Privacy Control signals to turn off: we treat everyone as if they’d opted out.

9. How long we keep information

We may keep information longer if the law requires it, or to preserve evidence of serious harm, such as child exploitation.

10. Government and law enforcement requests

We share information with law enforcement or government agencies only in response to valid legal process, such as a subpoena, court order or warrant, unless there’s an emergency involving a risk of death or serious injury. We require a warrant before handing over any private content.

We review every request and push back on requests that are too broad or improper. We’ll tell you before we disclose your information, unless the law forbids it or there’s an emergency. We delete server logs, including IP addresses, after 30 days. We’ll publish a yearly report on the government requests we receive.

11. Your choices and rights

• See and download your data. Email privacy@campfirechat.co and we’ll send you a copy of the information Campfire holds about you.
• Correct it. Change your profile, interests and settings in the app. Your profile is stored by your hosting provider, so changes you make in Campfire are saved there.
• Delete it. You can delete your account only in the Campfire app’s settings. Deleting your Campfire account deletes the data Campfire holds about you within 30 days, except as described in section 9, and removes your camp memberships and merit from public view. If you created your account in Campfire, you can also choose to delete your whole AT Protocol account; we’ll ask your hosting provider to delete your account, posts and profile, following its own process. If you have a cmpfr.social handle, it stops working when you delete your Campfire account. If you signed in with an existing account, delete that account through your hosting provider. We’ll also tell companies we’ve licensed public data to, and they must remove your content.
• Remove contacts. You can delete contacts you’ve uploaded at any time in the app’s settings.
• See why you see an ad. Tap any ad to see the information we used to choose it.
• Leave camps. You can leave any camp at any time, which removes it from your public list of camps.
• Cut off our access. If you signed in with an existing account, you can revoke Campfire’s access at any time in your hosting provider’s settings.
• Stop messages. Turn off notifications in your device settings, and unsubscribe from emails using the link in any email.

We offer these rights to everyone, wherever you live in the US, and we’ll respond within 45 days. We won’t treat you differently for using them. You can also have an authorized agent make a request for you; we may ask for proof that they’re acting on your behalf.

12. Security

We use reasonable safeguards, including encryption in transit, access controls and limits on which team members can see data. No system is perfectly secure. If a breach affects your information, we’ll notify you as the law requires. We store data in the United States.

13. Adults only

Campfire is only for people 18 and older. We don’t knowingly collect information from anyone under 18, and if we learn that we have, we’ll delete it. If you think someone under 18 is using Campfire, email privacy@campfirechat.co.

14. United States only

Campfire is offered only in the United States, and we don’t offer it in the European Union or the United Kingdom. Because the network is global, public posts from people in other countries may still appear on Campfire. Anyone can use the opt-out in section 4 to keep their posts off Campfire.

15. Changes to this policy

If we make a material change to this policy, we’ll tell you in the app or by email at least 30 days before it takes effect. We’ll ask for your permission before we use information we’ve already collected in a way that’s materially different from what we said when we collected it. The effective date at the top shows when this policy last changed.

16. Contact

Questions or requests about privacy: privacy@campfirechat.co

Campfire Commons, Inc., 1083 59th St, Oakland, CA 94608