Privacy Policy

Last updated: 04.08.2026

Zquady is an app that lets people aged 18 and over arrange things to do together in their area — we call these arrangements “Zquads”. Because people meet here in real life, we handle your data as sparingly as possible: in the app and in the browser version we use no analytics, tracking or advertising services, we do not sell data, and we do not embed any external crash reporting system. The only exception is a cookieless visitor count on this website, which does not recognise anyone — what it collects is set out under 2.10. This page sets out what we do need, why, and who gets to see it.

Scope: This policy applies to the Zquady app (iOS and Android), to the website zquady.com including the link preview pages at /z/… and /u/…, and to the browser version app.zquady.com. Where something applies to only one of these, it is stated expressly.

1. Data controller

The controller for the processing of personal data in the Zquady app, on the website zquady.com and in the browser version app.zquady.com is:

Samuel Schwaninger «Street and number» «Postal code and city» Austria

Legal form: sole proprietorship (Einzelunternehmen)
Phone: +43 664 99216386
Email: privacy@zquady.com

Data protection officer: «bestellt ja/nein — falls ja, Name und Kontakt eintragen»

2. Which data we process

We only process data that you give us yourself or that arises technically when the app is operated. In detail:

2.1 Account and sign-in

• Your email address and your password (the password is only ever stored as a cryptographic hash, never in plain text).
• If you sign in via another provider: the link to that account and the data the provider transmits to us in the process (as a rule the email address and a provider identifier; with Apple, on request, only a relay address). All three sign-in options are enabled: Apple, Google and Discord.
• Your date of birth and the confirmation that you are of full age. Both are stored permanently with your account, not merely checked once.
• Your language selection, so that emails from us arrive in your language.
• If you switch on two-factor authentication: the associated security factor and your recovery codes. We store the codes exclusively as hashes — we cannot show them to you again.
• Your sign-in session is stored on your device in the protected system storage (iOS keychain or Android keystore) so that you stay signed in.

2.2 Profile

• Your username. You do not type it in freely but choose from generated suggestions — that keeps names clean and anonymous. We also store when you last changed it, because a change is only possible every 30 days.
• Your avatar: either an emoji, an abstract image derived from your account, or a photo you upload yourself. An uploaded photo is resized to 400 × 400 pixels and stored in our file storage.
• Your bio, if you write one.
• Your privacy settings (who may see your profile picture and your bio and who may message you) and whether you have enabled “presence at the venue” (off by default).
• The total of thumbs up and thumbs down you have received as a host.

2.3 Location

We only request your location if you grant the permission, and only while the app is in the foreground. We deliberately use a medium accuracy (roughly 100 metres) and prefer your device's last known position.

Your coordinates are stored neither on your device nor in our database. They only exist in the app's working memory for the duration of the session. Distances to Zquads (“1.2 km away”) are calculated by your phone itself.

Nevertheless, your coordinates do leave the device in three places, and you should know about it:

• To display the place name in the header, we use them to query the Nominatim service of OpenStreetMap.
• For the personalised “For you” feed we pass them to our own server function as a calculation input. «Bitte serverseitig prüfen und hier ergänzen: werden die übergebenen Koordinaten in Datenbank- oder Funktions-Logs geschrieben?»
• When you open the map, your device loads map sections from a map server; that server thereby learns which section you are viewing, and your IP address.

In addition: if you tap “use current location” when creating a Zquad, exactly that point becomes the address of the meeting place — it is stored permanently and is visible on the map to all signed-in users.

2.4 Content you create

• Zquads with title, description, tags, category, cost information, time and duration, number of places, and location including coordinates.
• Your memberships in Zquads and the time you joined.
• Messages in group chats and direct messages including read status, and reactions to messages.
• Join requests including the personal message you can write to the host, as well as invitations and waiting list entries.
• Your rating of a host after a meet-up (thumbs up or down). The host only sees the overall total, never your individual vote.

2.5 Connections and personal lists

• Who you follow and which topics (tags) you follow. Both are visible to signed-in users and control what is shown to you.
• Saved and hidden Zquads, your block list, your chat settings (pinned, muted, cleared, hidden, marked as unread), your read states and saved searches. These lists are visible only to you.

2.6 Notifications

• If you allow push notifications, we store the device identifier for delivery (push token) and the platform (iOS, Android or web).
• Your settings on which kinds of notifications you want to receive and which sound is played.
• The notifications themselves, so that you can read them again in the app.

2.7 Technical data and error reports

When an error occurs in the app, we send an error report to our own database: the error message, the technical stack trace, the place in the program, your operating system, the app version and your user identifier. At most 25 such reports are possible per session, identical errors are only reported once, and nothing at all is sent before sign-in. We deliberately do not use an external crash reporting service for this.

As with every internet service, technical connection data arises at our service providers when content is retrieved, in particular the IP address, the time, the address called up and the device/browser identifier. «Aufbewahrungsdauer der Server-, Authentifizierungs- und Funktions-Logs bei den unter Punkt 4 genannten Dienstleistern — bitte dort nachsehen und eintragen.»

In the app and in the browser version we use no analytics or advertising services, no usage tracking and no advertising IDs. The cookieless visitor count described under 2.10 runs on the website zquady.com only.

2.8 Security

• Failed attempts to re-enter your password or to redeem a recovery code are counted (after five failed attempts within 15 minutes there is a short block).
• The time of your last email or password change, because both are only possible once every 24 hours.

2.9 Support and reports

• If you write to us via the support form, we transmit your username, your email address, your user identifier as well as the category, subject and text of your enquiry by email to our mailbox.
• If you report a person, a Zquad or a message, we store the type and target of the report, a label of the reported content (such as the username), your reason for reporting and your user identifier. We take your identifier from your valid sign-in so that reports cannot be forged.
• We count how many emails our system sends in order to monitor the quota of our sending service and to limit abuse.

2.10 Visits to our website and link previews

For the website zquady.com — including the page you are reading right now — you do not need an account and do not have to sign in. When the page is called up, the usual server logs arise at the web host: IP address, time, address called up, referring page and browser identifier. We use them to deliver the pages and to fend off attacks; the legal basis is our legitimate interest in a functioning, secure web presence (Art. 6(1)(f) GDPR). «Aufbewahrungsdauer der Server-Protokolle beim Webhoster (united-domains AG) eintragen.»

If someone shares a Zquad or profile link, it leads to a preview page at zquady.com/z/… or zquady.com/u/…. If such a link is pasted into a messenger or a social network, that provider's server retrieves the page on its own in order to generate the preview card — the provider thereby learns the address called up, and thus that this link has been shared. The preview page only fetches the public key details of the Zquad or the profile from us; it shows neither chats nor contact details and does not require a sign-in.

The website sets no cookies and embeds no advertising services. We serve the typeface and images from our own web space, and no request is made to Google or any other provider.

There is one exception: we count visits using Cloudflare Web Analytics. For this, every page loads a small counting script from static.cloudflareinsights.com; in doing so Cloudflare learns your IP address, the address called up, the referring page and your browser identifier. The service works without cookies and stores no identifier in your browser — it therefore does not recognise you on a later visit and builds no profile. We ourselves only ever see totals: how many page views there were, from which countries and via which referring pages. The legal basis is our legitimate interest in learning whether and how our site is found (Art. 6(1)(f) GDPR). Because nothing is stored on or read from your device in the process, we do not ask for consent and show no cookie banner. «Bitte anwaltlich bestätigen, dass Cloudflare Web Analytics mangels Speicherung bzw. Auslesen im Endgerät nicht unter § 165 Abs. 3 TKG 2021 bzw. Art. 5 Abs. 3 ePrivacy-Richtlinie fällt und damit einwilligungsfrei ist. Zusätzlich eintragen: Auftragsverarbeitungsvertrag mit Cloudflare sowie die Rechtsgrundlage für die Übermittlung in die USA (Standardvertragsklauseln bzw. Data Privacy Framework).»

The website stores your language and theme choice locally in your browser (localStorage); this information never leaves your device.

2.11 Storage on your device

Besides what is held on our servers, the app stores a few things directly on your device:

• Your sign-in session in the protected system storage (iOS keychain or Android keystore) so that you stay signed in — see 2.1.
• Your display settings in ordinary app storage: chosen appearance (system, light, dark), chosen language and the last sort order selected on the home screen.
• Two markers: that the introduction was already shown to you on first launch, and which Zquads you have already sent a join request to (so the button does not jump back to “request”).

Nothing more is stored: no advertising identifiers, no analytics values, no profiling. All of it serves exclusively functions you requested yourself — your sign-in and your own settings. «Bitte anwaltlich bestätigen, dass diese Speicherung als technisch erforderlich im Sinne von § 165 Abs. 3 TKG 2021 bzw. Art. 5 Abs. 3 ePrivacy-Richtlinie gilt und damit keine Einwilligung braucht.»

You get rid of all of it by uninstalling the app.

The browser version at app.zquady.com places the same things in your browser's storage (localStorage) instead of in system storage: your sign-in token, your chosen appearance and — as soon as you set a place or share your location — the place you last used, including its coordinates, so that the map does not jump back to the start after a reload. This information stays in your browser; there it is read only by the application itself. The browser version embeds no analytics or advertising services — the visitor count described under 2.10 runs on the website zquady.com only, not in the application. You remove all of it by signing out or by deleting the website data for app.zquady.com.

3. Purposes and legal bases

Performance of a contract, Art. 6(1)(b) GDPR — everything that is necessary for the app to do what you installed it for: your account and your sign-in, your profile, creating and finding Zquads, joining and requests, group and direct chats, ratings and the associated notices in the app.

Consent, Art. 6(1)(a) GDPR — processing that only takes place with your express permission and that you can withdraw at any time: access to your location, push notifications, access to your photos when uploading a profile picture, adding an appointment to your calendar, and the voluntary presence indicator “I'm already there”. You can withdraw these permissions in your device's system settings and in part directly in the app; the withdrawal takes effect for the future.

Legitimate interests, Art. 6(1)(f) GDPR — security and abuse prevention: limiting sign-in and change attempts, the blocking and reporting functions, handling reports, error reports for the stability of the app, and the restriction on username changes. Our interest is a safe service on which strangers can actually meet each other without danger.

Legal obligations, Art. 6(1)(c) GDPR — «falls einschlägig eintragen, z. B. Aufbewahrungspflichten oder Auskunftspflichten gegenüber Behörden».

We process the age information because Zquady is intended exclusively for adults. «Bitte anwaltlich festlegen, ob dies auf lit. b oder lit. f gestützt wird.»

4. Recipients and services used

We do not pass on data for advertising purposes and we do not sell data. We do, however, use service providers without which the app would not work. For each of them the following applies: «Sitz des Unternehmens, Serverstandort, Auftragsverarbeitungsvertrag abgeschlossen ja/nein, bei Übermittlung außerhalb der EU/des EWR die Rechtsgrundlage (z. B. Standardvertragsklauseln) — bitte je Dienst prüfen und eintragen.»

• Supabase — our backend: accounts and sign-in, database, file storage for profile photos, realtime connection for chats, and server functions. Practically all of the data listed under point 2 is held here. Our project runs in the Ireland region; the database, authentication and file storage are therefore located within the EU/EEA, so no transfer to a third country takes place for them.
• Cloudflare — placed in front of our programming interface; it also hosts the browser version at app.zquady.com. In doing so, Cloudflare processes the technical connection data of all requests. In addition, Cloudflare Web Analytics counts visits to the website zquady.com — cookieless and without recognition; details under 2.10.
• Expo — sending push notifications. Important and easily overlooked: the notification text is transmitted in plain text. For a direct message that is the sender's name and roughly the first 120 characters of the message; in a group chat additionally the Zquad title; for join requests an excerpt of your personal message. From Expo, delivery continues to Apple (APNs) on iOS or Google (FCM) on Android. If you do not want that, switch off the relevant notifications in the app or in your system settings.
• Expo/EAS Updates — on launch the app checks whether a new program version is available. Technical details such as the IP address, platform and app version are transmitted in the process; no account data.
• Resend — email delivery: confirmation and recovery codes to you, support enquiries and abuse reports to our mailbox, and an internal daily report containing purely aggregate figures to «Empfängeradresse des internen Statistikberichts».
• Nominatim (OpenStreetMap Foundation) — converting coordinates into place names, and place search. Your coordinates or your search term and your IP address are transmitted.
• OpenFreeMap and map data by OpenStreetMap contributors — map background in the app.
• Sign-in providers (Apple, Google, Discord) — only if you sign in via them. The provider concerned thereby learns that and when you sign in to Zquady.
• united-domains AG, Germany (united-domains.de) — hosting of the website zquady.com with the legal texts and the link previews. «Full company address and data processing agreement to be added.»
• CARTO — map background in the browser version at app.zquady.com. When the map loads, map tiles are fetched directly from basemaps.cartocdn.com; CARTO thereby receives your IP address, your browser identifier and — from the map section requested — the area you are currently looking at.
• unpkg.com (Cloudflare) and Fontshare — loading a program library for the map and the typeface respectively in the browser version. Both receive the IP address and browser identifier. «Empfehlung an die Entwicklung: Bibliothek und Schrift vom eigenen Server ausliefern, dann entfallen diese beiden Empfänger ersatzlos.»

Two particularities that are not classic service providers:

• If someone inserts a link to an image or GIF into a chat, your app loads that image directly from the third-party server. That server thereby learns your IP address. We have no influence over this.
• If you tap “open in maps”, your device passes the address of the meeting place to your maps app (Apple Maps or Google Maps). If you add a Zquad to your calendar, the entry initially stays on your device — if your calendar syncs with an online service, it ends up there as well.

5. Storage period and deletion

The principle: we store your messages, your Zquads and your profile for as long as your account exists. Fixed retention periods apply to the remaining categories; once they expire, the data is deleted automatically:

Notifications

90 days.

Error reports

90 days.

Counter of our email dispatch

90 days.

Reports about users

12 months after the report has been dealt with.

Counted failed sign-in attempts

2 days.

Messages, Zquads and profile

for as long as your account exists — what happens on deletion is set out in point 5.1.

5.1 What happens when you delete your account

You can delete your account yourself at any time in the profile settings. Deletion takes effect immediately and cannot be undone — there is no waiting period and no recycle bin. Deleted in the process are your sign-in data including linked sign-in providers, your profile, your messages (including those in other people's group chats and both sides of your direct chats), your memberships, requests, lists, settings and push tokens. Your email address is immediately available again for a new registration afterwards.

Important for others: Zquads you created disappear entirely — together with the group chat and the memberships of the other participants.

5.2 What survives deletion

Not everything disappears with the account. What remains is listed here in full — and for each item it is stated whether it still has a link to you.

• Abuse reports are retained so that deleting an account does not become a tool for covering tracks. If you filed the report yourself, your identifier is removed from it. The label of the reported content — a username, for instance — remains stored in plain text; so if you were reported, the report can continue to name you. Legal basis: legitimate interest in investigating breaches (Art. 6(1)(f) GDPR). Reports are deleted automatically 12 months after they have been dealt with.
• Error reports are retained; the user identifier is removed from them. The text of an error report is technical in nature but may in individual cases contain remnants of a program run. Error reports are deleted automatically after 90 days.
• An uploaded profile photo currently remains in the file storage — the deletion routine does not touch the file storage. The file is held under a path derived from your user identifier, so it can still be attributed to you. If you do not want that, remove your photo in the profile settings before you delete the account. «HANDLUNGSBEDARF: Das ist eine Lücke, kein gewollter Zustand. Empfehlung: den Löschvorgang um das Entfernen der Datei ergänzen — danach diesen Punkt in beiden Sprachfassungen streichen.»
• The counter of our email dispatch retains the user identifier of the account an email was sent for. This entry therefore also remains personal data, even though it consists only of a timestamp, an occasion and an identifier. It is deleted automatically after 90 days. «HANDLUNGSBEDARF: ebenfalls eine Lücke. Empfehlung: die Kennung beim Löschen mitentfernen oder gar nicht erst speichern — danach diesen Punkt in beiden Sprachfassungen streichen.»

«Sicherungskopien: Wie lange bewahrt der Backend-Anbieter Backups und Wiederherstellungspunkte auf? Eine gelöschte Zeile kann darin nachwirken — bitte Dauer eintragen.»

6. Your rights

Under the GDPR you have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on our legitimate interests (Art. 21). You can withdraw consent you have given at any time with effect for the future (Art. 7(3)).

You can exercise much of this directly in the app: change your profile, bio and avatar, adjust visibility settings, switch off individual notification types, review and withdraw permissions, block people, clear chats, delete your account.

For data portability there is a file export in the profile settings. It contains your account key details, your profile, the Zquads you created, your memberships and the topics you follow. Not included are, among other things, messages, notifications, blocks, saved searches and reports — for those, please write to us at privacy@zquady.com and we will compile the remaining data for you. «Alternativ den Export erweitern und diesen Absatz anpassen.»

If you believe that we are processing your data incorrectly, you can lodge a complaint with a supervisory authority. The competent authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), dsb.gv.at.

7. Specifics of Zquady

The following points appear in no standard template, but they are the most important ones for you.

7.1 What others see of your location

Other users do not see your location. What they see is the meeting place of a Zquad — that is, the place the host entered when creating it. That place is stored with coordinates and is visible on the map to everyone who is signed in, whether or not they are taking part.

Hence this note for hosts: if you choose “use current location”, you make the place you were at that moment public. Better to give a meeting place you would also name publicly.

The presence indicator is voluntary and off by default. If it is switched on, your phone itself decides whether it is close to the meeting place and transmits only a yes or a no. Your coordinates do not leave the device in the process, and the other members only see a number — never who is there, and never exactly where.

«ABZUGLEICHEN: Der Berechtigungstext im App Store sagt derzeit, der Standort werde niemals gespeichert, geteilt oder anderen angezeigt. Nach Punkt 2.3 werden Koordinaten an den Ortsdienst und an unsere Serverfunktion übermittelt. Entweder der Store-Text wird präzisiert oder diese Erklärung bleibt maßgeblich — beides zugleich geht nicht.»

7.2 Who sees your profile

Your username is visible to everyone who is signed in; it deliberately contains no real name. For your profile picture, bio and direct messages you can set individually who may see them: everyone, only people from shared Zquads, only people you follow, or nobody. Your initials always remain visible. The setting for direct messages is enforced directly in the database: someone who is not allowed cannot even create a message to you.

Who you follow and which topics you follow is visible to signed-in users.

«OFFENZULEGEN ODER TECHNISCH ZU SCHLIESSEN: Hochgeladene Profilfotos liegen derzeit in einem öffentlich lesbaren Dateispeicher unter einem aus der Nutzerkennung ableitbaren Pfad. Die Einstellung „Wer sieht mein Profilbild?“ wirkt auf dem Weg über die App zuverlässig, nicht aber gegenüber jemandem, der die direkte Datei-Adresse kennt. Empfehlung: auf signierte Adressen umstellen; bis dahin muss dieser Absatz in beiden Sprachfassungen genau so stehen bleiben.»

7.3 Chats, blocking and deleting

Group chats can only be read by the members of the respective Zquad and by the host; direct messages only by the two people involved. If you block someone, their messages disappear for you and they can no longer reach you; this too is enforced in the database, not merely in the display.

“Clear history” only hides the history for you — the messages remain for the other people involved. If you delete your account, by contrast, your messages are removed everywhere.

Messages are not end-to-end encrypted. They are encrypted in transit and are held in our database; technically they can be viewed in the course of troubleshooting and when handling reports. «Bitte eintragen, welche Personen Zugriff auf die Verwaltungsoberfläche der Datenbank haben.»

And once more, because it is easily overlooked: if push notifications are switched on, an excerpt of the message text is transmitted to the delivery service and to Apple or Google respectively (see point 4).

7.4 Being of full age, and your date of birth

Zquady is exclusively for people aged 18 and over, because strangers meet here in real life. Before an account is created we ask for your date of birth; if it is under 18, the account is not created, or a sign-up already in progress is ended immediately.

This is a self-declaration. We do not check identity documents and do not use any age verification service. Your date of birth remains stored with your account so that the confirmation is traceable and does not have to be requested again at every sign-in.

8. Minors

The app is not directed at people under 18, and we do not knowingly process data of minors. If you notice that a minor has created an account, please report it to us via the reporting function in the app or to privacy@zquady.com. We will delete such an account together with the associated data.

9. Changes to this policy

As we keep developing the app, this policy may change as well. The version published here is the one that applies in each case; the date at the top shows you when it was last changed. In the case of changes that materially affect you, we will inform you «Art der Information festlegen, z. B. Hinweis in der App oder E-Mail».

10. Contact

For questions about data protection or to exercise your rights, you can reach us at privacy@zquady.com or by phone at +43 664 99216386. In the app you will also find a support form under Profile › Help.

Postal address:

Samuel Schwaninger «Street and number» «Postal code and city» Austria