Privacy Policy

1. Who is the controller

The controller is the person or company named on the Contact page. That page also carries the registered address and company number.

Write to support@frinity.app with anything about your data. We have not appointed a data protection officer; we are not required to.

2. What we process

Grouped by why it exists, not by where it is stored.

• Account: e-mail address, username, display name, profile picture, language, whether you have Frinity+ or Frinity++ (including the customer identifier from the payment provider), and which plan you picked after signing up.
• Content: events you create or join — name, description, place name and coordinates, time — and the photos and videos you upload, together with their size, length, dimensions and the caption you write.
• Interactions: reactions to media, the record that you have seen or saved a photo, invitations to events, friendships, crews, the days you marked as free in the calendar, suggestions you hid, blocks and reports.
• Location: while the app is open and you have location sharing on, your current position, so friends can see you on the map. If you also switch on sharing in the background, your position is sent once every five minutes even when the app is closed; a permanent notification shows while it runs and you can switch it off at any time in Settings. Separately, the territory an event took place in, which is what colours your map.
• Verification: when an event is verified, the fact that several people were in one place at one time, plus a device identifier used to stop two accounts verifying from the same phone.
• Device: the push notification token, so we can deliver notifications.
• Usage: anonymous-in-content but account-linked events such as “app opened” or “event created”, used to see which parts of the app people actually use.

3. Why we may process it

• To provide the service you signed up for — account, events, media, friends, notifications about them (Art. 6(1)(b) GDPR, performance of a contract).
• To keep the service safe and usable — moderation, blocking abuse, the shared-device check, rate limits and basic usage statistics (Art. 6(1)(f), legitimate interest). You may object to this; write to us.
• Location sharing with friends — in the background too — and push notifications happen only when you switch them on, and you can switch them off at any time (Art. 6(1)(a), consent).
• Where the law makes us — for example keeping accounting records for a payment, or reporting illegal content (Art. 6(1)(c), legal obligation).

4. How long we keep it

• Full-quality originals of your photos: 14 days from the day the event was created, 30 days with Frinity+ or Frinity++. A nightly job deletes them; the smaller archive version stays.
• The smaller archive version: free for 2 years from the day the event was created. After that it is kept as long as it is paid for with credits (1.25 CZK per gigabyte a month; the first 10 GB are included in Frinity+, 50 GB in Frinity++). When credits run out you get 14 days, then the oldest media are deleted — only as many as it takes for the rest to fit.
• The event itself: for as long as your account exists. It is never deleted for lack of credits, it only loses its files.
• Account data, interactions, notification history and usage statistics: until you delete your account.
• When you delete your account, your profile, the events you own and your media go with it, and it cannot be undone. Media that other people already downloaded to their devices are out of our reach.
• Records we must keep by law — typically accounting documents for a purchase — are kept for the period the law sets, even after the account is gone.

5. Who else sees it

People in an event see the media and names of the others in that event. That is the whole point of the app, and it is not something we can switch off for you — if you do not want to be in a gallery, do not join the event.

Beyond that, your data reaches only the suppliers who run the technical side for us. They act on our instructions and may not use the data for themselves:

• Supabase — database, sign-in and push notification history
• Cloudflare — web hosting, application server and media storage (R2)
• Expo (Expo Push) — delivery of push notifications to the device
• Google (FCM) / Apple (APNs) — platform delivery of push notifications
• Google Play / App Store — payment for Frinity+ and storage credits (only if you buy them)

6. Transfers outside the EU

Some of these suppliers are based in the United States, so your data may be processed outside the European Union. For each of them we rely on the safeguards named on the Contact page — typically the EU–US Data Privacy Framework or standard contractual clauses.

Where the supplier lets us choose, we keep the data in an EU region.

7. Your rights

You may ask us for a copy of your data, for a correction, for deletion, for a restriction on processing, and you may object to processing based on our legitimate interest. Write to support@frinity.app and we will answer within one month.

You can take a copy of your data yourself at any time: in the app under Settings → Download your data.

Where processing is based on your consent, you may withdraw it at any time. That does not make the earlier processing unlawful.

If you think we handle your data badly, you may complain to the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).

8. Children

Frinity is not for children under 15. We do not knowingly process their data, and if we find such an account we close it and delete the data.

If you believe a child under 15 has an account here, write to support@frinity.app.

9. Automated decisions

We do not make decisions about you purely by machine. Verification of an event compares positions in time, but its outcome only decides whether the event gets a badge — nothing about you personally.

From what you do together in Frinity — shared events, invitations, reactions, saved photos, crews and free days in the calendar — we work out how close you are to each friend. The result is only shown to you: your best friends and the order of “People you may know”. Nobody else sees it and it has no legal or similarly significant effect on you.

10. Security

Media are stored privately, not on a public address, and each file is opened only through a short-lived signed link. Access to data in the database is restricted per user at the database level, not just in the app.

If a breach happens that is likely to be a risk to you, we will tell you and report it to the supervisory authority within 72 hours as the law requires.

11. Changes

If we change how we handle your data, we will update this page and, where the change matters, tell you in the app or by e-mail.