Privacy Policy

1. Who is responsible?

The data controller for varyAlive (app and website) is:

2. What data do we store?

Here's exactly what we store and why.

2.1 Account data

• First name, last name, email address: So you can sign in and your friends can find you when sending a friend request.
• Sign-in: In the app, you can sign in via Apple Sign-In, Google Sign-In (OAuth 2.0), or email and password. With Apple/Google, we receive a unique provider ID along with your name and email address — authentication is handled by Apple or Google. With email sign-in, your password is stored encrypted. The organizer dashboard on the website supports email and password login.
• Notification settings: Which push notifications you want to receive (e.g. messages, friend requests, meetings).
• Profile image: You can upload a profile picture. It is stored in Supabase Storage and is publicly accessible (e.g. visible to your friends and within the app).
• Cities: You can specify one or more cities where you are active. This is voluntary and is not derived from your location — you choose the cities yourself.

2.2 Friendships and contacts

• Connections: Who is friends with whom, so you can plan activities together.
• Friend requests: Pending requests between users.
• Reminders: If you set a reminder to stay in touch with a friend, we store the interval and last contact time.
• Organizer follows: If you follow an organizer, we store this association so you can be notified about new activities.
• Friend-of-friend introductions: You can allow a specific friend to introduce you to one of their own friends by sharing your contact details with them. This only happens if you explicitly grant that permission for that friend, and you can review and revoke it at any time in the app. Revoking it stops future introductions through that friend, but we keep a record that a share already took place — this record is not deleted when you revoke the permission.

2.3 Messages

• Direct messages: Text messages between you and your friends. Only sender and receiver can read them.
• Group messages: Messages in groups. Only group members can read them.

2.4 Activities and matching

• Interests: Your selected interests (e.g. sports, cooking, photography), so we can suggest activities that match you and your friends.
• Swipes: Which activities you swiped right or left on with which friend. When both sides are interested, a match is created.
• Group swipes: Votes within groups about shared activities.
• Bonus swipes: When you and a friend swipe through all 10 daily activities without a match, you can unlock 5 additional activities. We store whether and when these bonus swipes were granted.
• Activity share links: When you share an activity via link, we create a one-time share token. We store who created the link.

2.5 Meetings and memories

• Meeting proposals: Date and title of proposed meetups between you and friends or in groups.
• Meetings: Start and end time, participants, and the associated activity. After a meeting ends, it becomes a memory.
• Memories: Timestamps, title, and a snapshot of the activity at the time of the meetup. Only participants can access them.

2.6 Photos

• Memory photos: Photos you upload to a memory are stored in protected storage. Only meeting participants can view, upload, and delete them.

2.7 Social Battery

• Battery levels: Your self-reported social energy level. Your current level is shown to your friends. Older levels are stored for your personal statistics.

2.8 Invitations

• Invite links: When you create an invite link, we store who created it and whether it was used.

2.9 Feedback

• In-app feedback: When you submit a bug report or feature request through the app, we store the content, the type of feedback (bug, feature request, general), and the processing status. Feedback is linked to your account so we can follow up if needed.

3. Data for organizers

If you register as an organizer, we additionally store:

• Organization data: Name, description, category, logo, and banner of your organization.
• Contact details: Email, phone, website, and address of your organization.
• Activities: Title, description, pricing, images, and all details of the activities you create.
• Statistics: How often your activities are viewed and clicked (view and click counts).

Organizers only see aggregated, anonymized data about their activities — no personal data of individual users.

4. What do we use your data for?

• Provide the app: So you can sign in, find friends, and plan activities.
• Suggest activities: Based on your interests, we show you relevant activities.
• Send notifications: About new messages, friend requests, and meeting invitations — only if you allow it.
• Preserve memories: So you can revisit past meetups and photos.
• Improve the platform: To find bugs and make the app better.

5. Legal basis

• Contract performance (Art. 6(1)(b) GDPR): Most data is needed for the app to work — to provide the service you signed up for.
• Consent (Art. 6(1)(a) GDPR): For push notifications and camera access, we ask for your permission first. You can revoke it any time in your device settings.
• Legitimate interest (Art. 6(1)(f) GDPR): For improving the platform (usage statistics from existing data, see section 11) and securing your account.

6. Who else processes your data?

We do not sell your data, and we do not share it with commercial third parties. Sharing between users of the app happens only where described in this policy and only with your explicit permission — for example, the friend-of-friend introductions described in section 2.2. We use the following services as data processors. One exception is noted in section 6.7 below, where the transfer is a disclosure to a third party rather than data processing under contract:

6.1 Supabase (database and backend)

• What: All your data (account, messages, photos, etc.) is stored with Supabase.
• Where: EU region (Frankfurt). Your data does not leave the EU.
• Security: SOC 2 Type II certified. A data processing agreement (DPA) under GDPR is in place.
• Encryption: All data is encrypted in transit (HTTPS/TLS). Data is also encrypted at rest by Supabase. Access is protected by authentication and row-level security, so you can only see your own data.

6.2 Firebase Cloud Messaging (push notifications)

• What: To send you push notifications, we use Firebase Cloud Messaging (FCM) by Google.
• Data: A device token and the notification content.
• Where: Google (USA). Data transfer is secured by EU Standard Contractual Clauses.
• More info: Firebase Privacy

6.3 EmailJS (contact form)

• What: When you use the contact form on the website, your message is forwarded to us via EmailJS.
• Data: Your name, email address, and your message.
• Where: EmailJS (USA). Data transfer is secured by EU Standard Contractual Clauses.
• More info: EmailJS Privacy

6.4 Anthropic (AI text suggestions)

• What: In the organizer dashboard, an AI (Claude by Anthropic) helps you write activity and organization texts.
• Data: Only the text you enter (e.g. keywords about the activity). No personal user data from the app is transmitted.
• Where: Anthropic (USA). Data transfer is secured by EU Standard Contractual Clauses. Anthropic does not use the content to train its models.
• More info: Anthropic Privacy

6.5 Together.ai (AI image generation)

• What: In the organizer dashboard, you can have images generated by AI for your activities and your organization. We use Together.ai for this.
• Data: Only the image prompt (text) generated by you or from your input. No personal user data from the app is transmitted.
• Where: Together.ai (USA). Data transfer is secured by EU Standard Contractual Clauses.
• More info: Together.ai Privacy

6.6 united-domains (web hosting)

• What: Our website is hosted with united-domains. When you visit the website, united-domains processes technically necessary server log data.
• Data: IP address, time of access, page accessed, and browser information — to deliver the website and defend against technical attacks.
• Where: united-domains AG, Gautinger Str. 10, 82319 Starnberg, Germany. The servers are located in Germany; your data does not leave the EU.
• More info: united-domains Privacy

6.7 OpenStreetMap Foundation / Nominatim (address geocoding)

• What: We use Nominatim, the geocoding service of the OpenStreetMap Foundation (OSMF), to turn address or place text into coordinates. This happens in two ways: (1) Organizer website — when an organizer creates or edits an activity with an address, the organizer's browser sends the city provided and, optionally, a street to Nominatim (for the map display and the activity's country, including currency display). (2) App / meetups — when a meetup has a meeting point stored as text and that text must be turned into coordinates for meetup features (in particular arrival detection when sharing location), our servers send that meeting-point text to Nominatim. The app call is server-side, typically once per meetup and only when needed — not preemptively for every meetup.
• Data: Only the address or meeting-point text in question. No account identifiers, email addresses, or other identifiers from the app are transmitted. On the organizer path, Nominatim also sees — as a technical consequence of the request — the IP address of the device saving the activity; on the app path, the IP address of our servers (not those of the participants).
• Note: Unlike the other services listed in this section, OSMF is not a data processor under Art. 28 GDPR — the public Nominatim instance offers no corresponding contract. This is a disclosure to a third party under Art. 6(1)(b) GDPR (contract performance — publishing an activity with a location, or providing meetup features that require address geocoding, is part of the service), not data processing under contract.
• Where: OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom (company no. 05912761). Transfers to the United Kingdom are covered by an adequacy decision of the European Commission under Art. 45 GDPR, so no additional safeguards such as Standard Contractual Clauses are required.
• More info: OSMF Privacy Policy

7. How long do we keep your data?

• Account data, messages, interests, swipes, Social Battery: As long as your account exists. When you delete your account, this data is permanently removed.
• Friendships: Fully deleted when you delete your account.
• Memories: Remain accessible to other participants even after you delete your account. Your name is removed.
• Memory photos: Deleted when you remove them yourself. When you delete your account, your photos are removed from the database association. The image files in storage are deleted as part of regular cleanup — this may take a short time.
• Profile image: Removed when you delete your account.
• Organizer data: Completely removed when you delete your organizer account, including all activities.

8. Delete your account

You can delete your account at any time:

• App users: In the app under Settings.
• Organizers: In the dashboard under Account Settings.
• Without the app: Via our web deletion page.

When you delete your account, all your personal data is permanently removed. If something doesn't work, email us at kontakt@varyalive.de and we'll delete your account manually.

9. Your rights

Under the GDPR, you have the following rights:

Email us at kontakt@varyalive.de — we'll respond within 4 weeks.

You also have the right to file a complaint with a data protection supervisory authority. The authority responsible for us is:

10. App permissions

The app asks for your permission before accessing features on your device:

• Camera: For scanning QR codes (invite links, meeting codes) and taking photos for memories. No images are saved or transmitted without your action.
• Photos: To select images from your photo library or save photos there.
• Calendar: To add meetups directly to your device calendar. varyAlive only reads which hours are taken in your calendar. Titles, locations and attendees are never read and never stored. This permission is optional and can be revoked at any time.
• Notifications: For push notifications about messages, requests, and meetings.

You can revoke any permission at any time in your device's system settings.

11. Cookies, tracking and usage statistics

We use no tracking cookies and no third-party analytics tools. On the website, only technically necessary cookies are used for signing in to the organizer dashboard. The app sets no cookies, and it does not record which screens or tabs you open.

Usage statistics from existing data. To understand which features are used and where meetups don't come about, we count, on our server, data that is created anyway when you use varyAlive: for example how many swipes, matches, proposals, plans, meetups, memories, messages, cost entries and groups there are per week or month. We collect no additional data for this and read nothing from your device. We do not analyse content such as messages, comments or photos for this.

The result is only totals and shares, for example per month, feature or group size, without names and without user IDs. Because varyAlive still has few users, such a figure can be small and concern only a few people. We do not use the statistics to trace what individual people do, and they lead to no decision about you. Only we as the operator have access.

Purpose: improving varyAlive.
Legal basis: our legitimate interest in improving the app (Art. 6(1)(f) GDPR). The data was collected to provide the app; analysing it in the form of totals is compatible with that purpose (Art. 6(4) GDPR).
Retention: no new data about you is created. The counted data is deleted as described in section 7; when your account is deleted, it is also removed from the statistics.
Objection: you can object at any time to your data being included in these statistics (Art. 21 GDPR), informally by email to the address in section 1. Your data will then no longer be counted.

12. Minimum age

varyAlive is intended for people aged 16 and over. If you are under 16, you may only use the app with the consent of your parent or guardian.

13. How do we protect your data?

• Encrypted transmission of all data (HTTPS/TLS)
• Encrypted storage in the database (encryption at rest)
• Passwords are stored hashed
• Row-level security: at the database level, you can only access your own data
• Memory photos in protected, private storage — only meeting participants can access them. Profile images are stored in public storage.
• Regular security updates

14. Changes to this policy

If we change this privacy policy, we will notify you at least 4 weeks in advance — via an app update or email.

15. Questions?