Terms of service

1. About these terms

These terms govern your use of Shoal — the messaging service available at app.shoal.chat, the marketing site at shoal.chat, and any related tools or apps we offer (together, the "Service").

The Service is operated by SHOAL MESSAGING LTD, a company registered in England and Wales under company number 17286024, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. In these terms, "Shoal", "we", "us", and "our" refer to SHOAL MESSAGING LTD.

By creating an account, being added as a device to a family, or otherwise using the Service, you agree to these terms. If you don't agree, you should stop using Shoal.

Our privacy policy covers how we handle data; it forms part of these terms by reference.

2. Who can use Shoal

You can hold a Shoal user account on your own if you are at least 18 years old. Younger people can use Shoal in two ways:

• If you are 13 or older (or the equivalent age of digital consent in your jurisdiction), you may register your own user account, with your parent or guardian's awareness.
• If you are younger, a family admin can add you to a family as a device, without an email or password of your own. The admin who adds you is responsible for your use of the Service.

By signing up, you confirm that you meet these requirements.

3. Your account

Your account is identified by your email address. We do not use passwords. You can sign in either with a one-time link or code sent to that email, or by linking a Google or Apple account. If you use Apple's Hide My Email, the private relay address Apple gives us becomes your account email. This means access to your email — and to any Google or Apple account you sign in with — is, in practice, access to your Shoal account, so keep them secure.

You are responsible for what happens on your account. If you suspect your account is compromised, contact us at [email protected] and we will help you secure it.

Don't share your account with anyone else. Each person should have their own user account, or be added as a device.

4. Acceptable use

You agree not to use Shoal to:

• Break any law or facilitate illegal activity
• Harass, threaten, abuse, stalk, or defame any person
• Distribute child sexual abuse material — we treat this as a hard line and will cooperate with law enforcement to the fullest extent the architecture permits (see our security page for what we can and cannot read)
• Spam, phish, or send unsolicited bulk messaging
• Distribute malware, viruses, or other harmful software
• Impersonate another person or misrepresent your relationship to a child you add to a family
• Attempt to circumvent the encryption protections that make Shoal what it is
• Probe, scan, or attack the Service or its users; reverse-engineer the Service except to the limited extent UK or EU law specifically permits
• Use automated systems (bots, scrapers, crawlers) to access the Service without our written permission
• Use the Service for commercial messaging, marketing, or anything other than personal family communication

Violating any of these may result in suspension or termination, depending on severity. For serious matters (CSAM, credible threats of violence, attacks on the Service), we will terminate immediately and notify the appropriate authorities where required by law.

5. Family admins and children

A family admin can add other family members and children to a family, revoke access, rotate keys, and read children's conversations as part of the structural oversight described on our security page.

By becoming a family admin, you confirm that:

• You have lawful authority to add any child you place in the family — typically as a parent, legal guardian, or other person with parental responsibility.
• You will use admin oversight responsibly, in the interests of the children involved and consistent with their evolving privacy as they grow up.
• You are at least 18 years old.

We may limit certain functionality for children to comply with the UK Children's Code and equivalent laws elsewhere. As a child grows older, they may choose to register for their own user account; admins should respect that choice consistent with the child's age, the child's maturity, and any applicable law.

6. Your content, our service

You own the messages, names, profile pictures, and other content you send through Shoal. Because almost all of your content is encrypted before it reaches our servers, we do not — in normal operation — read, analyse, or use it for any purpose beyond delivering it to its intended recipients. (For the architectural caveat on what is technically possible at the operator level, see section 4 of the privacy policy.)

You grant us only the narrow technical licence we need to operate the Service: to store, transmit, and route the encrypted content as part of normal message delivery. We are not asking for, and you are not granting, any licence to read your content, train models on it, serve advertising against it, or share it with third parties beyond our subprocessors (listed in the privacy policy).

You are responsible for the content you send. If we receive a credible report that an account is being used to abuse or harm someone, we may suspend the account while we investigate.

The Shoal name, logo, design, and software are ours (or our licensors'). You can describe Shoal and link to it; please don't use our branding without permission, or imply endorsement we haven't given.

7. Pricing, billing, and what happens when you stop paying

The family is the billable unit

One subscription covers all members of one family and all their devices. Whoever creates a family is the default billing admin for that family. A user can belong to more than one family on a single Shoal account; each family has its own independent subscription, paid by its own billing admin. Joining someone else's family — for example a grandparent invited in — does not create a subscription obligation or trial for the joiner.

90-day free trial

Every new family gets a 90-day free trial, with the clock starting when the family is created. The trial belongs to the family, not to the user who created it — a user who creates more than one family has an independent trial clock for each one, and joining someone else's family does not start a trial for you. No payment information is required to start a trial. We will give clear notice before charging anything when a trial ends, and you remain free to stop using Shoal at any time.

Plans, prices, and taxes

We offer two plans. Prices are in GBP and are VAT-inclusive at point of sale; VAT is shown clearly at checkout.

• Friend — £2.50/month or £27/year (≈10% off). Up to 3 total users (1 child plus up to 2 adults). Full encryption, intra-family chat, cross-family connections, and admin oversight.
• Full — £4.00/month or £38.40/year (20% off). Up to 10 total users in any mix of children and adults. Everything in Friend, plus multiple families per account, family devices, and unlimited cross-family connections.

Family size caps are enforced by total user count. Cross-family connections work across tiers — Friend can connect to Friend, Full, or any combination. The current prices and the included features are also on the pricing page; if there is any conflict, the prices and plan structure published at in-app checkout at the time you subscribe apply.

Payment processing

Payments are processed by Stripe. We do not store full payment card details on our servers. Use of Stripe is subject to their separate terms and privacy notice. We accept card payments (UK and international), Apple Pay, and Google Pay.

Upgrading and downgrading

You can upgrade from Friend to Full at any time; the change takes effect immediately and the remainder of the period is pro-rated. Downgrades from Full to Friend take effect at the next renewal, and require your family to be within the Friend size cap first — if it isn't, you'll need to remove members before downgrading.

Recurring subscriptions and cancellation

Your subscription will automatically renew at the end of your subscription period, either at the end of the current billing month or billing year based on the date you originally subscribed. You can disable automatic renewal at any time from the billing section of the app. You can cancel your subscription at any time, which will take effect at the end of the current billing period.

Pause

Any family admin can pause a paid subscription from in-app settings. Pausing takes effect at the end of the current billing period — you keep full access through the time you've already paid for. While paused, no further charges accrue, the family is in read-only mode (see below), and you can resume by re-subscribing at any time — whoever resumes becomes the billing admin. Pauses can run for up to 12 months; after that, the family enters the standard 30-day deletion runway. Pause is a feature of active subscribers only — trials cannot be paused, and pausing does not extend a trial.

Read-only mode

A family enters read-only mode when:

• The 90-day trial ends without a subscription.
• A subscription is cancelled and the paid period ends.
• A payment fails and dunning retries by Stripe Smart Retries do not succeed.
• A family admin pauses the subscription.

In read-only mode, all existing messages remain readable to family members but no new messages can be sent or received. Incoming messages from connected families bounce back to the sender with a friendly note. Children see an age-appropriate, non-commercial notice that the family is paused; no pricing, subscribe prompts, or commercial UI is ever shown to children's accounts.

Deletion runway

A family stays in read-only mode for 30 days after trial expiry, cancellation, or unresolved payment failure (paused families follow the 12-month pause cap instead). During the read-only window, any adult family admin can rescue the family by subscribing — they become the billing admin immediately on subscription, and the family is reactivated at the same moment.

If no one rescues the family, you will get a clear email and in-app warning 7 days before the end of the 30-day window (that is, on day 23 of read-only mode). At the end of the window, the family and all its associated messages and ciphertext are permanently deleted. Deletion is removal of database rows and ciphertext, not a soft-delete or anonymisation, and there is no recovery once it has happened.

Data export

You can request a one-click HTML archive of the conversations you have access to, at any time during:

• An active subscription.
• The 30-day read-only window after cancellation, trial expiry, or unresolved payment failure.
• A pause.

The export is a browsable HTML archive that needs no Shoal-specific software to read. There is no charge for data export, ever.

Refunds and statutory rights

You are entitled to the statutory consumer rights available in your jurisdiction. In the UK, this includes the 14-day cancellation right for digital subscriptions purchased online under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, subject to the exceptions for digital content and services that have begun to be supplied with your consent. Beyond statutory rights, we do not generally offer refunds for the unused portion of a monthly subscription; for annual subscriptions, contact us if you have an unusual circumstance.

Failed payments

If a card payment fails, Stripe will attempt automatic retries via Stripe Smart Retries. If retries do not succeed, the family enters read-only mode and the standard 30-day deletion runway begins. Your data is not deleted purely because of a single failed payment — suspension is not the same as termination, and any admin can step in and subscribe during the read-only window.

Price changes for existing customers

Where we increase the price of an existing subscription, we will give you at least 30 days' notice. You can cancel before the change takes effect; if you don't, the new price applies from your next renewal.

Hardship

If cost is the only thing standing between you and using Shoal, email [email protected]. We would rather you used Shoal than not.

8. Service availability

We work to keep Shoal available and reliable, but we do not guarantee uninterrupted access. The Service is provided on an "as available" basis. We may need to take parts of the Service offline for maintenance, security work, or to deal with operational problems.

Shoal is not a substitute for emergency communications. Don't rely on it to reach the emergency services.

9. Suspension and termination

You can close your account at any time. Closure triggers deletion of your account record and revocation of all device keys, as described in our privacy policy.

Closing your account is a separate action from a family ending. If you are the sole billing admin of a family, closing your account does not automatically delete the family — another adult family admin can take over billing (see section 7). If you are the only adult admin, the family follows the standard 30-day read-only runway and then permanent deletion described in section 7.

We may suspend or terminate access to your account if:

• You materially breach these terms
• We have reason to believe your account is being used to harm other users
• We are required to do so by law
• You haven't used your account for a sustained period (we'll give notice before doing this)

For severe breaches — including CSAM, credible threats of violence, or attacks on the Service — we may terminate immediately and without prior notice. We will provide notice of any termination in all other cases.

10. Disclaimers and limitation of liability

To the fullest extent permitted by law, the Service is provided "as is" and "as available". We make no warranties beyond those required by law. We do not warrant that the Service will be uninterrupted, error-free, or that messages will always be delivered.

Subject to the final paragraph of this section, our total aggregate liability to you arising out of or in connection with the Service — whether in contract, tort (including negligence), breach of statutory duty, or otherwise — in any 12-month period is limited to the greater of (a) the fees you paid us in that period and (b) £100.

Subject to the final paragraph of this section, we will not be liable for loss of profits, revenue, business, or goodwill, for business losses of any kind (the Service is for personal family use only), or for losses that were not reasonably foreseeable to both of us when you agreed to these terms.

Nothing in these terms excludes or limits our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be excluded or limited under applicable law. If you are a consumer, nothing in these terms affects your statutory rights — including your rights under the Consumer Rights Act 2015 to services performed with reasonable care and skill and to digital content of satisfactory quality, and our liability under that Act if digital content we supply damages your device or other digital content because we failed to use reasonable care and skill.

11. Changes to these terms

We may update these terms from time to time. For material changes, we will give you reasonable advance notice — by email, in-app notice, or both — and update the "Last updated" date at the top of this page. Continued use of the Service after the changes take effect means you accept the new terms.

If you don't accept a material change, you can close your account before the change takes effect. For paid users, a material change that disadvantages you also gives you a right to cancel before it takes effect with a pro-rated refund of unused subscription time.

12. General terms

Severability. Each provision of these terms operates separately. If any court or regulator decides that a provision (or part of one) is unfair, unlawful, or unenforceable, that provision is treated as modified to the minimum extent necessary — or, if that isn't possible, removed — and the rest of these terms continue in full force.

Entire agreement. These terms, together with the privacy policy and the plan details confirmed at checkout, are the whole agreement between you and us about the Service. Nothing in this paragraph limits or excludes any liability for fraud, or affects your statutory rights.

Assignment. We may transfer our rights and obligations under these terms to another organisation — for example if the Service is acquired — and will tell you if that happens; your rights under these terms will not be reduced as a result. You may not transfer your rights or obligations under these terms to anyone else without our agreement.

No waiver. If we don't insist immediately that you do something you're required to do under these terms, or delay taking steps against you for a breach, that doesn't mean we've given up any rights.

Third parties. These terms are between you and us. Except where these terms say otherwise, no one else has any rights to enforce them under the Contracts (Rights of Third Parties) Act 1999.

13. Governing law and disputes

These terms are governed by the laws of England and Wales. Disputes will be resolved in the courts of England and Wales, except that consumers resident in another jurisdiction retain the protection of any mandatory rules of the law of their country of residence.

14. Contact

Legal questions: [email protected]

Privacy questions: [email protected]

General enquiries: [email protected]

By phone: 03330 41 49 49

Postal address: SHOAL MESSAGING LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom