Privacy Policy

Last updated: 27.10.2026

Zquady is an app that lets people aged 18 and over arrange things to do together in their area — we call these arrangements “Zquads”. Because people meet here in real life, we handle your data as sparingly as possible: in the app we use no analytics services, and we do not sell data. Ad measurement only happens if you expressly agree to it (2.15) — without your consent there is no tracking. The app only sends crash reports – to us and to the crash reporting service Sentry – if you expressly agree to them, and solely to notice and fix crashes (details under 2.7 and section 4); you can change your choice at any time in the settings. This page sets out what we do need, why, and who gets to see it.

Scope: This policy applies to the Zquady app (iOS and Android), to the website zquady.com including the link preview pages at /z/… and /u/…. Where something applies to only one of these, it is stated expressly.

1. Data controller

The controller for the processing of personal data in the Zquady app and on the website zquady.com is Samuel Schwaninger, as owner of the registered sole proprietorship Zquady e.U.:

Zquady e.U. Linzer Straße 17 4100 Ottensheim Austria

Legal form: registered sole proprietorship (eingetragenes Einzelunternehmen), FN 687516 d, Regional Court Linz
Phone: +43 664 99216386
Email: privacy@zquady.com

Data protection officer: not appointed; we are not legally required to appoint one.

2. Which data we process

We only process data that you give us yourself or that arises technically when the app is operated. In detail:

2.1 Account and sign-in

• Your email address. To sign in, we send you a one-time code by email. A password is optional; if you set one, it is only ever stored as a cryptographic hash, never in plain text.
• If you sign in via another provider: the link to that account and the data the provider transmits to us in the process (as a rule the email address and a provider identifier; with Apple, on request, only a relay address). Google and Discord additionally transmit the name you have stored there and the address of your profile picture there; both are held with your sign-in account, and Zquady does not show or use them anywhere. All three sign-in options are enabled: Apple, Google and Discord.
• If you create a passkey: its public key, an identifier, a device name that the app takes from the name of your device, and when you created it. The private key never leaves your keychain or password manager.
• Your date of birth and the confirmation that you are of full age. Both are stored permanently with your account, not merely checked once. From your date of birth our server also works out your age group for Zquads with an age limit (2.13).
• Your language selection, so that emails from us arrive in your language.
• If you switch on two-factor authentication: the associated security factor and your recovery codes. We store the codes exclusively as hashes — we cannot show them to you again.
• Your sign-in session is stored on your device in the protected system storage (iOS keychain or Android keystore) so that you stay signed in.
• For each sign-in session, our authentication service stores when you signed in and when the app last renewed the session (it does this by itself while you use it), together with the IP address and the device or browser identifier from the sign-in or the last renewal. It also stores the time of your last sign-in. Under Profile › Settings › Sign-in and security › Signed-in devices, the app shows you your sessions: the type of device, derived from the stored identifier (such as “Apple device”, “Android device” or “Browser”), since when it has been signed in, when the session was last renewed and which of them belongs to this device – never the IP address and never the name of your device. There you can also log out on all other devices. If you sign out, the session is deleted; at the latest it is deleted with your account.
• Your acceptance of the Terms: which version of the Terms you accepted, in which language and when (on registration and for later changes, section 14 of our Terms), and when we sent you the contract confirmation – for as long as your account exists.
• The contract confirmation: after you register, we send a confirmation of your user agreement to your email address, with the date of the Terms and their full text as an attachment, links to the Terms and the Privacy Policy, and the information on your right of withdrawal (section 12a of our Terms).
• Your withdrawal: if you withdraw from the agreement within the first 14 days, we record your statement with the details you give and the time, and confirm receipt to you by email with the date and time. We then delete your account as described in 5.1. We keep the record of your withdrawal even after the deletion (5.2).

2.2 Profile

• Your username. You do not type it in freely but choose from generated suggestions — that keeps names clean and anonymous. We also store when you last changed it, because a change is only possible every 30 days.
• Your profile picture: either your initials (taken from your username, nothing extra is stored) or a photo you upload yourself. You choose it in your system’s photo picker; the app needs no permission to access your photos for this and only receives the picture you select there. An uploaded photo is resized to 400 × 400 pixels and stored in our file storage. If you replace or remove it, we delete the previous photo straight away. If someone has reported your profile or we have taken action against your account, a secured copy of it is kept as evidence; if we remove your photo ourselves because of a violation, we move it to a secured storage for this purpose (2.9; how long: 5.2). If anything is left behind, for instance because the connection drops, a daily clean-up run removes it after roughly two days at most.
• Your bio, if you write one.
• Your interests (topics), if you state any. They are visible to signed-in users.
• Your answers to conversation starters (up to three questions you choose yourself), if you answer any.
• If you like, your Instagram and/or Discord profile. What we store, who can see it and how confirmation works is set out under 2.12.
• Confirmations: whether and since when your phone (2.14) and your linked profiles are confirmed.
• Your badges. We calculate them from your confirmed activity, for example Zquads that took place, ratings received, places visited or how long you have been a member. Only you see all your badges with their level and count. Others see at most three badges that you choose yourself, with their level.
• Your privacy settings (who may see your profile picture, your bio, your linked profiles and your online dot, who may message you and who sees which Zquads you take part in, 7.2; whether and for whom you show your gender and your age group in your profile, set to no one by default, 2.13), whether you have enabled “presence at the venue” (off by default) and whether we may suggest regular Zquads to you (on by default, 2.18).
• The online indicator. While the app is open in the foreground, it reports roughly every ninety seconds that you are active. For this we store only the time of your last activity; once an hour we delete all times that are older than an hour. Others only see a green dot if you were active within the last three minutes, never the time. You choose who sees the dot under Profile › Settings › Privacy: “Everyone”, people from shared Zquads and/or people you follow, or “No one”. The default is people from shared Zquads and people you follow. People you have blocked never see your dot. In an open direct chat, the other person additionally sees whether you currently have the chat open, unless you have chosen “No one” for your online status; this passes through a protected channel only for the two of you and is not stored.
• The total of thumbs up and thumbs down you have received as a host.
• Your gender (woman, man, non-binary or “prefer not to say”) — asked at registration; “prefer not to say” is a valid answer. You can switch to “prefer not to say” yourself at any time, and between woman, man and non-binary only via support. So that you can set a gender yourself once, we also store only whether you have ever stated woman, man or non-binary, not when. What we need it for and who sees it is explained in 2.13.
• Your age group (18–25, 26–35, 36–50 or 51+). It is not stored but worked out from your date of birth whenever it is needed. You see your group and your date of birth in your profile under Profile › Settings. Others never see your date of birth, and they only see your age as a group if you show it in your profile yourself. If you turn off “Use age group”, we only store this choice and when you made it, until you turn it back on; your date of birth stays unchanged. What we need the group for and how you can show it or turn it off is explained in 2.13.

2.3 Location

We only request your location if you grant the permission, and only while the app is in the foreground. We deliberately use a medium accuracy (roughly 100 metres) and prefer your device's last known position; that position can be more precise if another app determined your exact location shortly before. There is one exception: if you tap “use current location” when creating a Zquad and the location fix is coarser than about 200 metres, the app requests your exact position once (GPS, usually accurate to about 10 metres). That point then becomes the meeting place (last paragraph of this section).

As a rule, we store your GPS coordinates neither on your device nor in our database. They only exist in the app's working memory for the duration of the session. Distances to Zquads (“1.2 km away”) are calculated by your phone itself. It is different only if you save a place yourself: if you set your place in the header, the app remembers that place, including its coordinates, on your device until you switch back to your current location. If you choose a place from the place search in a filter and save the filter, we store that place, including its coordinates, with the filter in your account until you delete it. If you choose “Use current location” in the filter (it then shows “My location”), we only remember that choice, without an address and without coordinates; when the filter is applied, the app calculates on your device with your location at that moment. A search agent (2.5) never receives your location: it always calculates a radius around a town or city, and for this we only store its name and its public centre point. For the meeting place of a Zquad, the last paragraph of this point applies.

Nevertheless, your coordinates do leave the device in four places, and you should know about it:

• To display the place name in the header, the app sends them, rounded to about 100 metres, to our server, which uses them to query the Nominatim service of OpenStreetMap (section 4). So that the same question does not go to Nominatim again and again, our server keeps the answer for this rounded point for at most seven days, without any link to you: no account, device or IP address.
• For the personalised “For you” feed we pass them to our own server function as a calculation input. There they are used only for the calculation and are not stored permanently.
• So that the app can show you the Zquads near you under “Home”, it asks our server for the Zquads within 200 kilometres of a point rounded to roughly ten kilometres — your location or the place you set in the header. We do not store this point; because it is part of the address called up, however, it may appear in our service providers’ connection logs (2.7).
• When you open the map, your device loads map sections from a map server; that server thereby learns which section you are viewing, and your IP address.

In addition: if you tap “use current location” when creating a Zquad, exactly that point becomes the address of the meeting place — it is stored permanently; who sees it is set out at the end of this paragraph. If the app pre-fills the creation form itself — with the “Tonight” and “Weekend tour” templates or with the suggestion when a search finds nothing —, it only fills in the town or city from the header and its public centre point as the place, never your location; you set the meeting place yourself. For an in-person meeting place, “Show the exact meeting point only once accepted” is selected by default. We then store the exact point separately; it can only be seen by you, your co-hosts and the members. Everyone else sees the town and a point rounded to roughly one kilometre. If you switch the option off, the meeting place is visible on the map to all signed-in users.

2.4 Content you create

• Zquads with title, description, tags, category, cost information, time and duration, number of places, and location including coordinates (with the option “Show the exact meeting point only once accepted” stored separately and only visible to those in the Zquad, see 2.3).
• The sentence telling people how to recognise you at the meeting point (for example “Olive beanie, by the entrance on the left”), if someone enters it when creating or editing a Zquad. We store it separately from the Zquad; only the host, the co-hosts and the members can see it, in the Zquad and in the reminder shortly before the start, which also arrives as a push notification (section 4).
• Your memberships in Zquads and the time you joined.
• Messages in group chats and direct messages including read status, and reactions to messages. If you reply to a specific message, we only store a reference to it with your reply, not its text; the content of the original message is only seen by people who may read it anyway. In the group chat, your profile picture appears next to your messages — as a photo only for those your “Who can see my profile picture?” setting shows it to, otherwise your initials. If someone sends a link to a Zquad in a chat, the app shows it as a card and loads it with the rights of the person reading the chat; anyone who may not see the Zquad only sees “Not available”.
• Sharing Zquads within Zquady: if you send a Zquad to others via the “In Zquady” share option — at most ten people at a time —, each of them receives an ordinary direct message with the title, date, public place and link; the link contains no identifier of yours. Suggestions come from your Zquads and your recent chats. So that nobody appears in the selection whom you cannot message, our server first checks whom you may write to; nothing is stored in the process.
• Join requests including the personal message you can write to the host, as well as invitations and waiting list entries. A request can be seen and answered by the host and their co-hosts (the organising team); we do not show a co-host any requests from people they have blocked or who have blocked them. We notify the host and their co-hosts of a new request in the app and, where they have switched on push notifications for it, also by push — including an excerpt of your message (section 4); a co-host who has blocked you or whom you have blocked is not notified. We store when a request was decided and who in the organising team made the decision. Only the organising team sees who decided, never the person who sent the request. The app shows you the status of your request (“Accepted” or “Not this time”) for up to seven days after the decision, at most until the date of the meet-up. Once the Zquad is over or cancelled, an open request can no longer be accepted and no longer appears in any list — if the host moves a past Zquad to a new date, it reappears. A request that was not accepted nevertheless remains stored, including your message, until 90 days after the Zquad ended or was cancelled (section 5), at most until the Zquad or your account is deleted.
• Queued requests: if a Zquad is full, you can queue your request together with your message. As soon as a place becomes free, we send all queued requests for this Zquad to the host as requests at the same time — in no particular order; we first check each of them again under the same rules as a request. They are decided like any request: by the host or a co-host, not automatically. You can withdraw a queued request at any time; if you send a request yourself, it takes the place of the queued one. It also ends if it is no longer possible under these rules, if the Zquad is cancelled or counts as having taken place, and when the Zquad or your account is deleted.
• So that the organising team can decide in an informed way, the app shows it, for every open request, some details about the person asking that it may see anyway: their number of meet-ups (the same as in their profile), how often they have already been at a Zquad with the host or co-host, together with the title of the last one, one member of the Zquad who knows them from an earlier meet-up — never anyone whom they have blocked or who has blocked them —, whether their phone number is verified, whether they follow the host or co-host, and “New to Zquady” if they have not yet been to any meet-up and their account is less than 30 days old. We do not show their gender, their age or any rating or ranking of the person, and none of this is stored.
• Invitation suggestions: when the host or a co-host invites people, the app suggests people they have already been with at meet-ups that took place, together with the number of shared meet-ups, at most 30. Not suggested are members, suspended accounts, people between whom and the inviting person or the host there is a block, and anyone who has declined the invitation to this Zquad. If a Zquad is restricted to one gender or to age groups, only people from equally restricted earlier Zquads are considered; we do not evaluate anyone’s gender or age for this. Nothing is stored for it.
• Co-hosts: if a host makes you a co-host, we notify you in the app and, if you have switched on push notifications for “Request accepted”, also by push, each time with the host’s username and the Zquad’s title (section 4). The group chat then shows “@Host made @Name a co-host”; if you give up the role yourself, it shows “@Name gave up the co-host role”. People you have blocked or who have blocked you do not see these notices; the first one is also hidden from people who have a block with the host.
• Your rating of a host after a meet-up (thumbs up or down). The host only sees the overall total, never your individual vote.
• Memory photos: after a Zquad has taken place, you can upload a photo — one per Zquad — and replace it any time. You choose it in your system’s photo picker; the app needs no permission to access your photos for this and only receives the picture you select there. They are resized to at most 1600 pixels wide, stored in our file storage, and are visible only to the members and the host of that Zquad — never publicly. The exception is people you have blocked or who have blocked you: we do not show them your photos, and you do not see theirs — even if they are the host. Anyone who can see your photo can also save it on their device. Only upload photos you have the rights to, and be considerate of the people shown. You can replace or delete your photos at any time; they are also deleted when your account or the Zquad is deleted. Any photo can be reported by the other members directly in the photo viewer; we review reported photos and remove them if they violate our rules.
• Public questions to a Zquad and the answers to them. They are visible to all signed-in users, together with your username. The exception is people you have blocked or who have blocked you — they do not see your questions or the answers to them, and you do not see theirs. The host still sees all questions on their own Zquad, so that they can answer or delete them. Who in the organising team wrote an answer is recorded internally; it is not shown anywhere. We only need it so that our statement of reasons reaches the right person if we remove an answer (section 9 of our Terms; legal basis Art. 6(1)(c) GDPR in conjunction with Art. 17 DSA). The record disappears with the answer, the question or that person’s account.
• Polls in the group chat, including date polls, together with your vote. The vote is stored with your user identifier; in the app we only show the totals, but technically the other members can retrieve the individual votes.
• Notices the app posts in a group chat when you trigger them — for example “has joined”, “is on the way”, “is here” or “started your regular Zquad” with your username. You can report “I’m here” from half an hour before a meet-up starts until it ends. From these notices we also count how many people are on the way or already there; anyone who has switched on the live countdown also sees the initials of up to three of them on their lock screen (2.6).
• The typing indicator: while you are writing, the others in the chat briefly see that you are typing. This only passes through a protected channel that only the members of the Zquad or the two people in a direct chat can receive, and is not stored.
• Series: if a host repeats a Zquad, we automatically create the next date as a separate Zquad and add the members of the previous date again; they are notified and can leave at any time.
• The “Your month” recap: the app shows you how many Zquads you took part in during a month and whom you met there for the first time. It is calculated for you alone each time you open it, from memberships you can see anyway; nothing is stored on our server for it, and people you have blocked or who have blocked you do not appear in it. If you share it as an image, our server creates the image only with your sign-in; it shows only the month, your numbers and a pattern — no names and no photos.
• The “Your year” recap: the app shows you how many Zquads you took part in during a year, in how many places and with how many people, whom you met there for the first time, where you went most often and which month was your busiest. Like “Your month”, it is calculated for you alone each time you open it; nothing is stored on our server for it, and people you have blocked or who have blocked you do not appear in it. The small map of your places only shows the public meeting places, averaged per place and rounded to roughly 100 metres — with “Show the exact meeting point only once accepted”, therefore only the rounded point. Your device loads the map sections for it from OpenFreeMap (section 4). If you share the recap as an image, our server creates the image only with your sign-in; it shows only the year, your numbers and your pattern — no names, no photos and no places.
• Your regular Zquads: fixed groups you start from recurring meet-ups, together with their name and your reply; details under 2.18.
• The word filter (section 8 of our Terms): the app sends the title, description, cost details and tags of a Zquad, the sentence telling people how to recognise you, your bio, your interests, your answers to conversation starters, questions and answers, and the name of a regular Zquad to our server while you are still typing, and the server compares them against a word list. Nothing is stored in the process.

2.5 Connections and personal lists

• Who you follow and which topics (tags) you follow; both control what is shown to you. Who you follow is only seen by you and the person you follow. Others only see how many people follow you. Which topics you follow is visible to signed-in users.
• Saved and hidden Zquads, your block list, your chat settings (pinned; muted, optionally only until a set time or until the meetup — then only messages stay silent —; cleared, hidden, archived, marked as unread), your read states and saved searches, that is, saved filters and search agents. These lists are visible only to you.
• Search agents: if you switch on “Notify me as a search agent” for a saved filter, the search agent takes the whole filter with it: categories, tags, online, times of day, time period, “No cost”, “Slots open”, which genders the filter allows and which age groups it excludes (a preference for the audience of a Zquad, not your own gender or age; it never excludes your own age group, not even after a birthday), “Familiar faces”, “Followed hosts” and the place. A radius always applies around a town or city — that of the chosen place, otherwise the town in the header. We then store only its name and its public centre point, never your location; the app requests the centre point from Nominatim through our server (section 4), using only the name of the town. With every new Zquad we compare it against the search agents — for “Familiar faces” against the people you have already been with at a meet-up, for “Followed hosts” against those you follow. If it matches, you get a notification in the app, not a push notification. You can create at most 20 search agents.
• Search: when you search in Home, the app sends the words of your search to our server from two characters on, without your location; it works out days and times such as “tomorrow” or “in the evening” itself on the device. The server uses the words to search the title, description, place, town, tags and category of the Zquads you are allowed to see. We do not store your search; because the words are part of the address called up, however, they may appear in the connection logs of our service providers (2.7).
• Searching for people and short codes: when you search for a person, for example for a new chat, an invitation or to share a Zquad via “In Zquady”, the app sends what you type to our server from two characters on. The server searches usernames with it and returns at most 20 results; anyone who has blocked you is not among them. If you type a Zquad’s short code into the search in Home (it appears, for example, on the image for sharing, 2.10), the app sends only the code to our server to open the matching Zquad. In both cases what you type is in the body of the request, not in the address called up, and we do not store it.
• “Your code”: a QR code with the link to your profile that you can show, for example, at a meet-up. Anyone who scans it has this link and can follow you (7.2). If you scan a code yourself in the app, it only uses the camera while the scanner is open: on iPhone via the iOS scanner once you have allowed camera access, on Android via the code scanner of Google Play services, for which the app needs no camera permission – but only if you want it: before the first scan, the app asks whether you want to scan with the Google scanner or use your camera app. If you choose the camera app, the app does not start the Google scanner; you then scan the code with your device’s camera app, which opens the link to Zquady. The camera images are analysed only on the device and are not stored; the app only receives the content of the recognised code and only opens Zquady profiles. According to Google, Google stores neither images nor results in the process; Google Play services do, however, send technical details such as device model, operating system and app version, an installation identifier and performance metrics to Google for diagnostics and usage analytics. The legal basis for the Google scanner is your consent given with this choice (section 3).

2.6 Notifications

• Before the app sets up push notifications, it asks you itself whether you want them and lists what we send them for: when someone joins your Zquad, new messages in the chat, a reminder shortly before the start and, after the meet-up, a short question about how it went. This also applies on Android up to version 12, where the system itself does not ask. Only after you say yes – on iPhone and from Android 13 additionally after the permission in the system – does the app create a delivery identifier and report it to us.
• If you allow push notifications, we store the device identifier for delivery (push token) and the platform (iOS, Android or web); on Android also the delivery identifier from Firebase Cloud Messaging, through which our server sends notifications directly to Google (section 4).
• Your settings on which kinds of notifications you want to receive, which sound is played and whether the live countdown (below) is on.
• The notifications themselves, so that you can read them again in the app.
• If the host changes the date or place of a Zquad, the notification in the app, the push notification and the group chat state the new date or the new place. We never store a meeting point that is only visible to those in the Zquad (2.3) in the notification: the app looks it up when displaying it and only shows it there as long as you belong to the Zquad, and the push notification then only says that the meeting point has changed. If the host switches on this protection later, we also remove the previous place from older notifications. The meeting point does appear in the group chat, which only those in the Zquad can read.
• The weekly summary: only if you switch it on yourself, you receive a notification once a week about how many new Zquads there are near you and on the topics you follow — and only if there are any. It is off by default. We determine “near you” without your location: our server takes the centre point (median) of the places of the Zquads you are a member of and counts new Zquads within 50 km. This centre point is only formed for the calculation and is not stored. You switch the weekly summary on in the notification settings and can switch it off again at any time. We record every time you switch it on or off with your account – with the time, the version and language of the notice text, the place in the app where you made the choice and the platform – so that we can demonstrate your consent (Art. 7(1) GDPR).
• Buttons in notifications: you can accept or decline a join request or an invitation, and reply to a message, directly in the notification, even when the app is closed. For this, every such notification carries a one-time code that our server signs with a secret key: it is valid for seven days, only for you and only for that one request, invitation or chat. A join request reaches the host and their co-hosts, each with their own code (2.4); once one of them has decided, the others' buttons no longer have any effect. When you tap a button, your device sends the code — when replying, together with your text — to our server, which carries out the action in your name under the same rules as in the app; your reply is an ordinary message. This only works as long as your account exists, is not suspended and you are signed in on at least one device. So that each code only works once, after it has been redeemed we store its random identifier together with your user identifier, the type (request, invitation or chat) and its expiry. On iPhone, the buttons first require Face ID or your device passcode; on Android, your device’s settings for notifications on the lock screen apply.
• The live countdown before the meetup: you switch it on in the notification settings; it is off by default. When it is on, about an hour before a meet-up at which you are host or member, your device shows an ongoing display with a countdown — on iPhone as a Live Activity on the lock screen and in the Dynamic Island, on Android as an ongoing notification. It shows the title, place and time of the meet-up, how many people have reported “on the way” or “here” (2.4), and for up to three of them the initials from their username on a coloured background, as in a profile picture without a photo — no photos, no names. If you block someone or someone blocks you, neither of you appears in the other’s display. Because the display is on the lock screen, anyone who sees your device can see it. On iPhone you can also switch off Live Activities for Zquady in the system settings.
• So that we can start the live countdown and keep it up to date even when the app is closed, we store the identifiers your iPhone issues for this: one per running display and, from iOS 17.2, a start identifier per device. With them, our server sends the title, place, start and end of the meet-up as well as the numbers and initials directly to Apple (APNs); on Android, the same details go to Google via Firebase Cloud Messaging, for in-person meet-ups also the exact meeting point with address and coordinates for the “Directions” button – even if the host has chosen “Show the exact meeting point only once accepted”, because only the host and members get the display. We note that we have started the display for a meet-up so that it only starts once. We delete the identifier of a display when the display ends — as a rule about 15 minutes after the meet-up ends, and earlier if it is cancelled or moved or you are no longer taking part. We delete the start identifier when you sign out or once your device has not reported it for 45 days; after you switch the countdown off, the app no longer reports it. If you switch the countdown off, the app ends running displays and we start no new ones.

2.7 Technical data and error reports

If you have agreed to crash reports (below), we send an error report to our own database when an error occurs in the app: the error message, the technical stack trace, the place in the program, your operating system, the app version and your user identifier. At most 25 such reports are possible per session, and identical errors are only reported once. Before sign-in, the app sends nothing by this route. If it crashes and the report no longer gets through – for example because nobody is signed in yet or there is no connection –, it remembers the last crash (error message, technical stack trace and time) on your device and reports it on the next launch as soon as an account is signed in, then with that account’s user identifier.

Since 12 August 2026 we additionally use Sentry as a crash reporting service (see section 4). The reason: the route above needs an existing sign-in and runs in the JavaScript part of the app. Crashes in the native part therefore never reach it, and crashes before sign-in only on the next signed-in launch — and those are precisely the worst ones. What goes to Sentry is the error message with its technical stack trace, details about device and app, and the most recent network requests before the error; the specifics are in section 4. The app only sends either – reports to our database and to Sentry – with your consent. It asks you once “Send crash reports?”, with two equivalent buttons “Send” and “Don’t send” – for a new account as the last page of registration, otherwise shortly after you sign in; if you close the question after signing in, that counts as “Don’t send”. Until you say yes, the app sends no reports, does not start Sentry and does not remember any crash. You can change your choice at any time with the “Send crash reports” switch under Profile › Settings › Privacy. When it is off, the app sends no reports from your device to Sentry, nor any by our own route above; it then does not remember a crash either, and one already remembered is deleted.

As with every internet service, technical connection data arises at our service providers when content is retrieved, in particular the IP address, the time, the address called up and the device/browser identifier. We do not evaluate these logs ourselves; the providers delete them again according to their own schedules.

In the app we use no analytics services. Events to Meta and your device's advertising ID only exist if you agree to ad measurement (2.15); without your consent there is no tracking.

2.8 Security

• We record attempts to re-enter your password, to redeem a recovery code or to enter a code we email you before you change your email address or password or delete your account, with time and outcome, for two days; after five failed attempts within 15 minutes there is a short block. For the same period we record when we sent you such a code, so that we can limit how often they are sent.
• The time of your last email or password change, because both are only possible once every 24 hours.
• If you change your email address or your password or delete your account, you confirm this with your password or with a code that we send to your email address; if two-factor authentication is switched on, this is only possible after the second factor. The exception is deleting your account directly at registration, as long as no profile has been created yet (7.4). Accounts that only sign in via Apple, Google or Discord confirm a deletion without a password or code; their email address is managed by the respective provider. For a new email address we also send a code to the new address; with it, you confirm in the app that the address belongs to you; only then do we switch over. If you confirm the change with a code sent to your current address, that email also names the new one. If the new address already belongs to another account, we refuse the change. We only accept a code for up to 15 minutes and only for the purpose for which we sent it. For this we store with your account a check value, which we compute with a secret key from the purpose and the code — for a new address also from the address —, together with the time; we do not store the address or the code themselves for this. We delete the entry as soon as you use the code; the next code replaces it, otherwise we delete it after two days at most.
• If your password was not set via “Change Password” in the app but, for example, via “Forgot password?”, we record this with the time. To protect your account, such a password then does not count as confirmation, for instance when you want to change your email address; instead, you confirm with a code that we send you by email. The record is removed as soon as you set a new password via “Change Password”, at the latest when your account is deleted.
• So that nobody messages strangers en masse, we limit new direct chats (20 a day, 5 in the first 24 hours after registration), join requests (30 a day) and new Zquads (10 a day) per account. For this our server only counts what is stored anyway.

2.9 Support and reports

• If you write to us via the support form, we transmit your username, your email address, your user identifier as well as the category, subject and text of your enquiry by email to our mailbox.
• If you report a person, a Zquad, a message, a question on a Zquad or a memory photo, we store the type and target of the report, a label of the reported content (such as the username), your reason for reporting, your description if you write one, and your user identifier. We take your identifier from your valid sign-in so that reports cannot be forged. The report is also sent with the same details by email to our support mailbox.
• With every report we secure a copy of the reported content so that we can still review the case later (section 9a of our Terms). Messages from chats are only included as a forwarding by you, that is, only as you see them in your own chat. Depending on the type, this is the reported message with up to 20 preceding and up to 20 following messages and the username and email address of the person who wrote it; the profile of the reported person including email address and sign-in identifiers, when they last signed in and until when any suspension applies, the status of their linked profiles (platform, name, whether confirmed) and the fingerprint of their confirmed phone number (2.14) and — if you report a person — their profile picture, the last up to 200 direct messages between you – but only if you tick the box “Include our chat history” when reporting; it is not ticked in advance – and the up to 50 most recent Zquads in which you are both host or member, with title, date, place and exact meeting point; for a Zquad its details including the exact meeting point and the host’s username and email address, with the member list and — only if you are its host or a member yourself — the last 50 messages of the group chat; for a question the question with its answer and the username and email address of the person who asked it and of the host; for a photo the file itself and the username and email address of the person who uploaded it. We do the same before we remove content – including individual profile content such as a profile picture, bio or answers to conversation starters – or suspend an account; we do not copy direct messages or a Zquad’s group chat in that case. Photos and profile pictures we remove are moved to a secured storage for this purpose. The copies are kept separately, only we have access, and we use them only to investigate, to defend or enforce claims, and to pass them on to authorities. How long they are kept is set out in point 5.
• We count how many emails our system sends in order to monitor the quota of our sending service and to limit abuse.
• If we suspend an account (section 9 of our Terms), our authentication service records until when the suspension applies; we store the time and reason of the suspension with the account. The app shows you the suspension and, while you are still signed in, also its reason. We also send you the statement of reasons by email, unless an authority has prohibited us from doing so or we cannot reach you. We delete the account’s push tokens in the process. This information stays with your account and is deleted with it at the latest.
• So that a suspension cannot be circumvented with a new account, when we suspend an account we store check values of its email address, its confirmed phone number and its sign-in identifiers (for example with Apple, Google, Discord or Instagram) on a block list. We compute the check values with a secret key; we do not store the details themselves for this. For email addresses we align simple variants (upper and lower case, additions after a plus sign, dots for Gmail). If someone wants to create a new account with one of these details or confirm a number or profile with it, we refuse. If we lift the suspension, we delete the entries.
• When we decide on a report or restrict content or an account, we tell the people concerned by email: the reporting person the outcome, and the person whose content or account is affected the measure, the reasons and how they can challenge it (section 9 of our Terms).
• Our administration log: when we work with your account in our administration, we record when we did what and for what reason – for example when we open your account details, display your email address, compile a data access report, delete your account at your request, change your gender at your request, correct your date of birth at your request or take action after a report, that is, view secured copies, remove content or suspend an account. The entry states the type of action, your user identifier and the reason, but no content of messages or photos. This lets us demonstrate that we handle your data correctly. We delete the log after 12 months, even if your account was deleted before then (5.2).

2.10 Visits to our website and link previews

For the website zquady.com — including the page you are reading right now — you do not need an account and do not have to sign in. When the page is called up, the usual server logs arise at the web host: IP address, time, address called up, referring page and browser identifier. We use them to deliver the pages and to fend off attacks; the legal basis is our legitimate interest in a functioning, secure web presence (Art. 6(1)(f) GDPR). The servers are operated on behalf of united-domains by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur (server location Germany); according to the provider, it stores the logs with a shortened IP address for up to eight weeks and deletes them afterwards.

If someone shares a Zquad or profile link, it leads to a preview page at zquady.com/z/… or zquady.com/u/…. If such a link is pasted into a messenger or a social network, depending on the service either its server or the sender's app retrieves the page and the preview image in order to generate the preview card — the provider thereby learns the address called up, and thus that this link has been shared. The preview image is delivered by our backend (Supabase, via Cloudflare), where the usual connection data arises. The preview pages do not require a sign-in; anyone who has the link sees:

• for a Zquad: title, date, city (or “Online”), category, whether it has been cancelled, the number of members and places, and, in the preview image, the host's username. If someone opens a Zquad link in the app without being signed in, the app shows these key details too, without the host. We do not show Zquads that are restricted to one gender or to age groups in either place.
• for a profile: username, month of registration, rating as a percentage (only from five ratings), whether the phone is confirmed, the number of Zquads that took place which the person hosted or attended (not counting Zquads restricted to one gender or to age groups), up to three badges they chose themselves and, in the preview image, their pattern. Profile picture, bio, tags, conversation starters, linked profiles, gender and age never appear there.

If you share a Zquad as an image, for example in your Instagram story, our server creates that image with the title, date, city, category, the host's username and the short code, depending on the format also with the beginning of the description, the occupancy and a QR code with the link. Where you share the image is up to you; from then on the terms of the platform in question apply. Anyone who knows the Zquad's identifier, for example from a shared link, can retrieve the image — except for Zquads that are restricted to one gender or to age groups.

If you share your profile as an image, our server creates it when you choose to share. It only shows what the link preview of your profile shows as well: your initials (never your profile picture), your username, the month you registered, the number of Zquads you hosted or attended, your pattern and a QR code with the link to your profile. Like the preview, anyone who knows your profile's identifier can retrieve it.

The legal basis for the previews and images is our legitimate interest in shared links being understandable (Art. 6(1)(f) GDPR); you can object as set out in 6.1.

If you choose “Share on @zquadycom” when creating a Zquad, we send the share image (above) to ourselves by email for approval. If we approve it, we publish it via Instagram as a story on our account @zquadycom — with the title, the beginning of the description, date, city, category, short code and your username, publicly visible to everyone on Instagram. Instagram shows a story for 24 hours. This is only possible for Zquads that are restricted neither to one gender nor to age groups. The legal basis is your consent (Art. 6(1)(a) GDPR); if you withdraw it, we will no longer publish the story or will delete it.

We count how often our pages are visited ourselves, without cookies, without any script in your browser and without third-party services: when your browser requests a page, our web server counts it. For this it only uses which page was requested and – if your browser sends it – the name of the website you came from (such as google.com or instagram.com, without the exact address there). It sorts this into broad groups (which page; origin such as search engine, Instagram, Facebook or direct; phone or computer, based on the browser identifier) and only increases a counter for that day in our backend (Supabase). We do not store your IP address, browser identifier, the time or any identifier for you; the numbers do not reveal who visited a page. The page count serves only to see which pages are used and how visitors find the website, so that we can run and improve it. Separately, our server counts how often the short links and QR codes on our promotional material are opened (such as zquady.com/ig or the QR code on a sticker), only as a number per item and day; this shows us how our promotional material is received. The legal basis in each case is our legitimate interest in this (Art. 6(1)(f) GDPR).

The website sets no cookies and embeds no advertising or analytics services of other providers. We serve the fonts, images and videos from our own web space; the website does not load content from Google or any other provider. On iPhone and iPad, Safari may on its own show a banner pointing to our app once it is available in the App Store; Safari fetches the details for it, such as the app’s icon and name, directly from Apple, not from us, and Apple’s terms apply to this.

The website stores your language and theme choice locally in your browser (localStorage). If you close the bar pointing to our app on your phone, it also stores there when you did so, so that it does not show the bar again for 14 days. Only for the duration of your visit, the page remembers in the browser’s session storage (sessionStorage) whether the short opening animation has already played. This information never leaves your device.

2.11 Storage on your device

Besides what is held on our servers, the app stores some things directly on your device — exclusively for functions you use yourself:

• Your sign-in session in the protected system storage (iOS keychain or Android keystore) so that you stay signed in — see 2.1.
• Your settings in ordinary app storage: appearance (system, light, dark), language, sort orders, radius, vibration, in-app sounds, your answer to the question about crash reports and whether they are sent, and your choice on ad measurement (which is also kept on our server as proof, 2.15).
• Markers, so that the app does not ask twice or repeat the same notices — for example whether you have already seen the introduction, which questions on a Zquad you have already read, which steps of setting up your profile you skipped, which Zquads you have already sent a join request to, and which buttons in notifications you have already used. So that buttons work for the right account even when the app is closed (2.6), the app also remembers which account is signed in; it deletes this when you sign out.
• For the home screen widget “Next meetup”, the details of your next meet-up: title, place, start and end, shortly before the meet-up the number of people who are on the way or already there, and a pattern that the app calculates from the Zquad’s identifier. The app keeps them in storage that only it and its widget can read — even if you have not set up a widget. The widget itself only reads this storage and sends nothing. If it is on your home screen, anyone who sees your screen can see it. When you sign out, the app deletes these details.
• For the live countdown (2.6): whether it is on, on iPhone the device’s start identifier and, while a display is running, its details, the identifiers of the displays and which ones you have swiped away — on Android including the exact meeting point for the “Directions” button. The app deletes this as well when you sign out.
• A place you chose yourself, including its coordinates, if you choose a place from the search in the header (see 2.3) — not if you choose your current location there.
• For the calendar subscription (2.17), the secret link in the protected system storage and the last known status of the connection, which the app forgets when you sign out. It removes the link when you disconnect the subscription, create a new link or the link is no longer valid.
• For Zquads you have added to your calendar (4), which entry belongs to which Zquad, with the start, title, place and duration as they appear in the entry. That way the app does not add an appointment twice and can update one that has moved. This stays when you sign out, just like the entry in your calendar.
• For “from your Zquads”, whom you have already met at past Zquads — user identifier and username from the member lists of those Zquads. With this, the app can show you straight away whom you already know at other Zquads, and the “Familiar faces” filter finds Zquads where one of them is taking part; it never shows people you have blocked or who have blocked you. When you sign out, the app deletes this list.
• For your saved filters, when you last tapped each one, so that the app can show how much is new since then. The app deletes this when you sign out.
• A cache so that content appears faster: for example your own profile, as well as images and map sections you have viewed — including photos of other people. If you have exported your data, the export file is also kept there until the system clears the cache.
• Only if you have agreed to crash reports (2.7): for Sentry, a random installation identifier and, if the app crashes, the crash report until it is sent on the next launch (see 4).
• For our own error report, the last crash (error message, technical stack trace and time) until it has been reported (see 2.7) — only while “Send crash reports” is on.
• A random installation identifier for program updates: it is sent to Expo with every check for a new program version, and Expo also uses it to count how many devices use a program version (see 4). In addition, after you say yes to push notifications, random identifiers for push delivery (Expo, on Android additionally Firebase; see 2.6 and 4).
• If you confirm a date of birth under 18 when registering (7.4), an “under 18” marker: only this information and the time, only in app storage. It makes it harder to create an account with a different date of birth on the same device straight afterwards. The app never sends it and deletes it after 30 days.
• The sign-in method you used last – only the kind (Apple, Google, Discord, email, passkey or password), no address and no identifier – so the start screen can mark it “Last used”. The app never sends it. It stays when you sign out, because it is there for your next sign-in, and is deleted when you delete your account in the app.
• A Zquad you have started but not yet created, as a draft per account, so that it survives an app restart. The app deletes it as soon as you create the Zquad or discard the draft, and when you sign out.
• The details of the Zquad you created most recently, including its meeting place, as a template for “Run it again”.
• Whether you have already dismissed the “Your first meetup?” hint.

Advertising identifiers and data of the Meta SDK only arise on your device if you agree to ad measurement (2.15). The app stores no analytics values.

You get rid of all of it by uninstalling the app. Exception on iPhone: entries in the keychain — your sign-in session and the link of your calendar subscription — can survive the deletion of the app. If you sign out beforehand, the session is gone; if you disconnect your calendar subscription beforehand, so is the link.

2.12 Linked profiles on Instagram and Discord

You may voluntarily store your Instagram and/or Discord profile in your Zquady profile. Nothing depends on it — the app works fully without these details. Facebook and TikTok profiles cannot be linked.

We store the profile name and, for Discord, additionally the account identifier from which the app builds the profile address. We only show a link to others once you have confirmed it — while unconfirmed, nobody but you sees it. This is how confirmation works:

• Instagram: the app shows you a short code, which you send us as a direct message to our Instagram account. We compare the sender against the stored name and then set the check mark; this can take up to 48 hours. The message itself sits in your inbox and ours at Meta; their terms apply to it. What we log about it is set out under 2.16.
• Discord: you briefly sign in with Discord and allow it there to confirm your username and your account identifier to us. We request nothing more: we receive no password, no messages and no contacts, and we use the access key only for this one request and do not store it.

For each confirmation we store the profile name, the status and the time, for Instagram additionally the code. If you later change or remove the profile name, the confirmation is deleted automatically. If someone taps a link, the platform in question opens — from that moment their privacy terms apply.

Who sees your linked profiles is additionally up to you in your privacy settings: “Everyone”, “No one”, people from shared Zquads and/or people you follow. There is no default: when you confirm a link for the first time, the app asks you who may see your linked profiles. The decision is made on our server, not only when displaying on the device.

A profile name can only ever be linked to a single Zquady account. If you delete your account, the link and the confirmation go with it and the name is immediately free again — unless your account was suspended (block list, 2.9).

2.13 Gender, age and restricted Zquads

When you register we ask for your gender (woman, man, non-binary or “prefer not to say”). We ask because a Zquad can be limited to one gender; if you choose “prefer not to say”, you only see Zquads without a gender limit and cannot set one yourself. Whoever creates a Zquad can decide which genders can take part — their own is always included, for example “women only” or “women and non-binary”. A Zquad restricted in this way is invisible to everyone else everywhere: not in the lists, not on the map, not via a link, not via an invitation and not via search agents; this also applies to the follow-up dates of a series. Our database enforces this, not just the app.

We only show your gender to others if you show it in your profile yourself (below), and then only there — never in member lists, requests or chats. Our server evaluates it to decide which Zquads you see and whether you can send a request, and for the join hint and asking together (below). An inference cannot be ruled out entirely: in small Zquads, the join hint can reveal which gender the members do not have.

Join hint and asking together: if you request to join an open Zquad in which nobody of your gender has joined so far, the app tells you beforehand (“So far there are no women here”). This hint names no individual person, is shown only to you and is suppressed as soon as even one member has not stated a gender. You can then “ask together”: your request is held back until a second person of your gender asks, and is then sent to the host together with theirs. Until then the host learns nothing; for this we temporarily store your request together with your gender in a waiting list, which is deleted when the request is sent or when you withdraw it, and after 30 days at the latest. The host and co-hosts then see that the two requests were made together; from this it can be inferred that you both have a gender that has so far been missing from the Zquad.

We do not (yet) verify this information. Gender is a self-declaration; no verification via ID document or other procedures currently takes place. False statements can be reported (2.9) and lead to measures under our Terms. If others can infer your gender from your username, your linked profiles, your photos, your chats or how you appear at meet-ups, that is beyond our control — what you reveal is your decision.

You can see this information in your profile. You can switch to “prefer not to say” yourself at any time (Profile › Settings); after that you only see Zquads without a gender limit and cannot set one yourself. You can only switch between woman, man and non-binary via support (Profile › Settings › Support and feedback or support@zquady.com), so that the restriction to one gender cannot be circumvented by switching. If you have never stated woman, man or non-binary, you can do so yourself once. If support changes your information, we record this in our administration log without the old and new value (2.9). When your account is deleted, the information and the log entry are deleted with it.

Zquads for age groups. Whoever creates a Zquad can also decide which age groups can take part: 18–25, 26–35, 36–50 and 51+. The chosen groups are adjacent, for example “Ages 26–35 only” or “Ages 18–35 only”. Whoever sets or changes the age groups must fall into one of them themselves. For series and regular Zquads, we keep the groups unchanged, even if the host has since moved into another group. Widening is possible at any time; narrowing only as long as nobody apart from the organising team has joined, has sent a request or has been invited. Queued requests and places on a waiting list (including when asking together) do not prevent narrowing: if the person did not fall into the new groups on the day such an entry was created, it ends at that point without a notification; the host and co-hosts are not told either. We use fixed groups rather than freely chosen limits so that a narrow range does not reveal an exact age. Gender and age can be combined (“Women only, 26–35”). A Zquad with an age limit is invisible everywhere to all other age groups: not in the lists, not on the map, not in search, not via a link, not via an invitation, not via search agents and not in the weekly summary; this also applies to the follow-up dates of a series and to the next meet-up of a regular Zquad. This too is enforced by our database, not just the app.

Our server works out your age group each time from the date of birth you gave when you registered (7.4), in completed years according to the calendar day in Vienna; the group is not stored. It can change on your birthday. For a request, invitation, queued request or place on a waiting list that already exists, the group on the day it was created counts. If a queued request or a place on the waiting list (when asking together) turns into a request, the request keeps that day; for this we store the day separately from the request, the host and co-hosts do not see it, and it is deleted together with the request. That way none of them lapses because of a birthday, and the host and co-hosts cannot work out a birthday from it. If you no longer fall into the chosen groups after a birthday, however, you will only see the Zquad itself again once you have joined. Anyone who has already joined stays in — including for the follow-up dates of a series —, even if they have since moved into another group; the host and the members always see their Zquad. For the next meet-up of a regular Zquad, we only deliver the invitation to people who fall into the chosen groups on the day it is planned (2.18); for everyone else, what is said below about undelivered invitations applies. Without a stored date of birth, or as long as you have turned off “Use age group” (Profile › Settings › Profile details › Age), you only see Zquads without an age limit and cannot set one yourself; where you have already joined, you stay in. As long as the switch is off, we do not use your age group anywhere in the app; open requests, queued requests, places on a waiting list and invitations to Zquads with an age limit lapse if a decision is made on them during that time. You can turn the switch back on at any time. We can add a missing date of birth at your request via support.

Other people never see your age or your date of birth, unless you show your age group in your profile yourself (below); then they only see that group, never your date of birth. We do not show either in member lists, requests or chats; you yourself see them in your profile. Our server evaluates your age group only to decide which Zquads you see (including via your search agents), whether you can send a request, queue a request, create a Zquad with an age limit or set or change the age groups of a Zquad, whether your queued request or place on a waiting list remains when the groups are narrowed, and whether we deliver an invitation to you. An inference cannot be ruled out entirely: the label of such a Zquad (for example “Ages 26–35 only”) is seen by everyone who may see the Zquad, and because whoever sets the groups must include their own, the label reveals which of the groups shown the host fell into at that time — with a single group, exactly theirs. Anyone who is with you in a Zquad with an age limit only learns from this that you fell into one of the chosen groups when you joined. If you invite someone as host or co-host, the following applies: if an invited person does not fit the age groups, we do not deliver the invitation; to you it looks like an unanswered invitation. If you yourself are invited in this way, you get no notification, see neither the invitation nor the Zquad and cannot accept it; it is stored like any other invitation. So an invitation alone does not reveal whether someone fits the groups. We do not deliver such an invitation later either, even if you have since moved into the groups or the host widens them; as long as it exists, you cannot be invited to this Zquad again. If you then send a request yourself, the host and co-hosts see your request next to the unanswered invitation; in rare cases this may suggest that you did not fall into the groups when you were invited but do now. If an invited person does not fit in terms of gender or there is a block, the person inviting only learns that the invitation is not possible, without a reason.

We do not verify age either: the date of birth is a self-declaration (7.4); no verification via ID document or other procedures takes place. An age limit is therefore no guarantee of who will actually turn up. You can report a wrong age (2.9, reason “Wrong age”); false statements lead to measures under our Terms. If someone seems to be a minor, choose “Seems to be under 18” (8).

You can only change your date of birth via support, so that an age limit cannot be circumvented by entering a new one. If you made a typo when you registered, we correct it at your request (Profile › Settings › Support and feedback or support@zquady.com), wherever it is stored with your account, including the details from your registration. If the correct date means you are under 18, we do not correct it but proceed as set out in point 8. We record a correction in our administration log without the old and new date (2.9). When your account is deleted, the date of birth and the log entry are deleted with it.

Showing your gender and age group in your profile. You decide yourself whether others see your gender and your age group in your profile, separately for each: under Profile › Settings › Privacy › Visibility, in the “Gender” and “Age group” rows. The options are “No one” (the default), “Shared Zquads” (people from shared Zquads, as for your profile picture and bio) and “Everyone” (everyone who is signed in and can see your profile); when you switch it on, the app first suggests “Shared Zquads”. This is voluntary; the app works just the same without it. Only woman, man or non-binary and the age group (18–25, 26–35, 36–50 or 51+) are shown, never your age in years or your date of birth. We always show your current group, so after a birthday the new one, without any notice. If you have chosen “prefer not to say”, turned off “Use age group” or no date of birth is stored, there is nothing to show, and the setting is locked.

The information is only visible in your profile when someone opens it in the app, as a small line marked “Self-declared”. We never show it in lists, search results, member lists, requests, chats, notifications or on the map, and never on the website, in link previews or in images for sharing (2.10). Zquady has no filter or search for people by gender or age; anyone who opens your profile sees the information there as far as your setting allows – with “Everyone”, that means everyone who is signed in. To prevent mass retrieval, we limit how many such details one account can retrieve per day (rate limit); only the number is counted, not whose profile, and the counter is deleted after two days at the latest. People without an account and people you have blocked or who have blocked you never see it. If a host or co-host opens your profile, for example from your request, they see it if your setting includes them. What others have once seen, they can remember, pass on or photograph; we cannot prevent that, and switching it off only takes effect for the future. We do not verify the information (above), so do not rely on it for other people either.

The legal basis for this display is your consent (Art. 6(1)(a) GDPR), for “non-binary” your explicit consent (Art. 9(2)(a) GDPR), because this information may in individual cases allow conclusions about a variation of sex development or about your gender identity. You give it when you switch the display on, and again before more people can see the information (from “Shared Zquads” to “Everyone”): each time, the app first shows you what becomes visible and to whom; for “non-binary” you also confirm explicitly that others should see that you have stated “non-binary”. This consent is in addition to the one you give when you state “non-binary” (section 3). You can withdraw it at any time by setting the row to “No one”; this takes effect immediately and for the future. We record every change to this setting with your account – with the time, the level you chose, the version of the notice text your consent is based on, including its language (when you reduce or switch off, a separate marker instead), and the platform – so that we can demonstrate your consent (Art. 7(1) GDPR); we delete this record with your account. If your gender information changes – via support, with “prefer not to say” or when you then state a gender yourself – we set the visibility of your gender to “No one”; if your date of birth changes or is newly stored or removed, for example through a correction via support, or if you turn off “Use age group”, we do the same for your age. We record this in the same way. You then decide again: if you turn “Use age group” back on, your age group stays hidden until you show it again with fresh consent.

2.14 Verifying your phone number via WhatsApp

You can voluntarily confirm a phone number of your own by sending a code generated by the app to our number via WhatsApp. Meta transmits your phone number to us as the sender. We do not store the number in plain text, only a fingerprint calculated with a secret key (HMAC) that lets us ensure one number verifies only a single Zquady account. Others see only that and since when your phone is verified, never the number. We do not store the message in our database; our log keeps only the code and the outcome and is deleted after 60 days. Like any WhatsApp chat, however, the message remains in our WhatsApp Business account until we delete it there. Meta (Meta Platforms Ireland Ltd.) processes the verification message on our behalf via the WhatsApp Cloud API; WhatsApp’s terms apply to the WhatsApp app itself. If you use a username in WhatsApp, Meta sends us an identifier instead of your number. We then ask you in WhatsApp to share your number with a button. We only store the identifier as a check value calculated with a secret key, until the verification is complete, for one day at most; we never store it in plain text. You can remove the verification in your profile at any time; we then delete the fingerprint. If you delete your account, it is deleted as well. The legal basis is your consent (Art. 6(1)(a) GDPR).

2.15 Ad measurement with the Meta SDK

Zquady advertises on Instagram and Facebook. To learn whether an ad led to an install or sign-up, the Meta SDK is built into the app. Only with your consent does it send events to Meta Platforms Ireland Ltd.: app installed, app opened, sign-up completed, Zquad created, join requested, phone verified, plus how long you use the app — each with device model, OS version, app version, language, time zone, time, a random identifier of the SDK and your IP address, for a created Zquad additionally its category and for sign-up the sign-in method. On iPhone the app only sends anything if you additionally choose “Allow tracking” in the system dialog — and then also with your device’s advertising ID; on Android the advertising ID is included with your consent unless you have deleted it in the Android settings. No chat contents, no locations, no names. If you consent, the SDK also switches on its own crash and error reports to Meta; they contain technical details about errors in the SDK, your device and the app. Meta uses the data to measure and deliver our ads. We are joint controllers with Meta (Art. 26 GDPR) only for collecting the data in the app and transmitting it to Meta; the agreement on this is at facebook.com/legal/controller_addendum. What Meta does with the data afterwards — for example measuring and delivering the ads or improving its own advertising systems — is Meta’s sole responsibility (cf. CJEU, judgment of 29 July 2019, C-40/17, Fashion ID). What Meta does with the data, what Meta bases this on and how you exercise your rights towards Meta is set out in Meta’s Privacy Policy (facebook.com/about/privacy). Meta is responsible for access, rectification, erasure, restriction and portability of the data that Meta stores after the transmission; you can also contact us (Art. 26(3) GDPR). Meta also transfers the data to Meta Platforms, Inc. in the USA; the basis is the Data Privacy Framework, under which Meta Platforms, Inc. is certified (section 4). We ask you once during registration or after your first sign-in; you can change your consent at any time in the settings under Privacy › Ad measurement, on iOS also in the system settings under Tracking. Without consent the app reports no events to Meta and reads no advertising ID. The legal basis is your consent (Art. 6(1)(a) GDPR).

The app also stores your choice — yes or no, the time, which notice text you saw (in which language and version) and the platform (iOS or Android) — with your account on our server. This allows us to demonstrate that you consented (Art. 7(1) GDPR); the legal basis for this is that obligation to demonstrate consent (Art. 6(1)(c) GDPR). We keep this record for as long as your account exists and for three years after its deletion, so that we can still prove your consent if claims are made afterwards (limitation period, § 1489 ABGB); for this period we additionally rely on our legitimate interest in defending against claims (Art. 6(1)(f) GDPR).

2.16 Our profiles on Instagram and Facebook; contact via WhatsApp

Zquady has its own profiles on Instagram and Facebook (Meta Platforms Ireland Ltd.), and the website and the app link to them. These are plain links: as long as you don’t click, nothing is loaded from these providers and nothing is sent to them.

If you visit one of our profiles, the respective provider processes your data under its own terms, even if you don’t have an account there or aren’t logged in. From these visits, the platforms create aggregated statistics for us, for example on reach and interactions; we cannot identify individual people from them. Meta and we are joint controllers for the statistics on our Instagram and Facebook profiles (Art. 26 GDPR). Meta takes primary responsibility, including for handling your rights (facebook.com/legal/terms/page_controller_addendum). If you write to us or comment on one of our profiles, we see your profile name and your message and use them only to reply to you. We log every direct message to our Instagram account or our Facebook page with the identifier that Meta transmits to us for the sender, in order to detect duplicate deliveries and to match confirmation codes (2.12); for code messages on Instagram also with your Instagram name. We do not store the text of the message in the process, and we delete the log after 60 days. The legal basis is our legitimate interest in making Zquady known and answering questions where the people Zquady is made for spend their time (Art. 6(1)(f) GDPR).

You can message us directly via the WhatsApp link. The message is sent through WhatsApp (Meta Platforms Ireland Ltd.); we see your phone number, your WhatsApp name and your message and use them only to handle your request. The legal basis is answering your request (Art. 6(1)(b) or (f) GDPR). If you’d rather not use WhatsApp for this, you can reach us just the same at support@zquady.com.

2.17 Calendar subscription

Under Profile › Settings › Connect calendar you can connect your calendar to Zquady. All Zquads at which you are host or member then appear in your calendar on their own; if someone moves or cancels a meet-up, the entry changes with it. The calendar subscription is voluntary; the app works just the same without it.

• What your calendar receives: the title, start, end and place of the Zquads from the last twelve months and of all upcoming ones, not cancelled ones, plus for each date a technical identifier by which your calendar recognises it. With “Show the exact meeting point only once accepted”, the place is the exact meeting point, which you see anyway as host or accepted member. Names, descriptions and members are not included.
• What we store: the app creates a secret link for you, which your calendar subscribes to and then retrieves from us regularly. We do not store the link itself, only a check value calculated from it, together with the assignment to your account, when you created the link, when a calendar last retrieved it and when it was disconnected, as well as a counter of retrievals in the current hour that we use to curb abuse. Because the link is part of the address your calendar retrieves, it may, however, appear in the connection logs of our service providers (2.7). On your device the link is kept in the protected system storage (2.11). Anyone who knows the link can see the title, time and place of your Zquads — so do not pass it on.
• Who receives the dates: the calendar you choose. With Apple Calendar your iPhone retrieves the link, and with a subscription via iCloud also Apple’s servers; with Google Calendar, Google’s servers fetch it directly from us; with another calendar app, its provider. These services process the dates as controllers in their own right under their own terms (section 4). When the link is retrieved, the usual connection data arises at our service providers (2.7).
• Disconnecting: with “Disconnect” you end the subscription; with “Create a new link” you invalidate all previous links. Links are disconnected automatically: the links of your other devices when you log out on all other devices, change or reset your password or switch on two-factor authentication; a link that no calendar has retrieved within 7 days of its creation; and, as soon as you have more than five links, the one unused for longest. While your account is suspended, the link delivers an empty calendar.
• After disconnecting: a disconnected link delivers an empty calendar so that the dates disappear from your calendar as well — after an error message, many calendars would leave the old entries in place. We delete the assignment to your account immediately; for a link created only shortly before, at the latest two days after its creation, because that is how long we count how many links you create in a day. What then remains — check value and timestamps, no longer tied to you — we delete as soon as no calendar has asked for it for a year, and a link that no calendar ever retrieved already 7 days after it was disconnected. You remove the “Zquady” calendar itself in your calendar app.

The legal basis is performance of the contract (Art. 6(1)(b) GDPR): you expressly request the calendar subscription, and it cannot be provided without this processing. We base the protective measures — the retrieval limit, automatic disconnection and the empty calendar while an account is suspended and after disconnecting — on our legitimate interest in a secure service and in dates disappearing from the calendar after disconnecting (Art. 6(1)(f) GDPR).

2.18 Regular Zquads

If you keep meeting in the same line-up, you can turn it into a regular Zquad of your own: with its own name, and a button that plans the next meet-up.

• Detection: as soon as a Zquad counts as having taken place, our server compares who was there — host and members — with the other Zquads of these people that took place. If exactly the same line-up of at least three people met three times within 120 days, Zquady asks whether you want to start a regular Zquad. For this we only use details that are stored anyway: host, memberships, date and status of the Zquads. If anyone in the line-up has blocked another person in it, we do not ask. With the “Suggest regular Zquads” switch in the settings under Privacy — on by default — you can switch this off at any time: we then leave you out of the detection and no longer ask open questions whose line-up includes you.
• Question: the question appears as a notice in the group chat of the last of these meet-ups, which all members of that Zquad can see, and when you wrap up the Zquad. The notice names nobody; the card that goes with it, with usernames and profile pictures — photos only where the person in question shows them to you — is seen only by the people in the line-up. If someone chooses “Later”, we ask one last time at the next meet-up in the same line-up. For this we store the line-up, the meet-ups that led to the question, when it was asked and who chose “Later” and when.
• Starting and replying: if someone in the line-up starts the regular Zquad, we store its name — initially the title of the meet-up; everyone who has said yes can change it —, who started it and when, which Zquads belong to it and, for each person in the line-up, whether and when they said yes or no. We do not add anyone who is blocked with the person starting the regular Zquad. The group chat shows “@Name started your regular Zquad”. Only people who say yes themselves belong to the regular Zquad: only they are shown to the others in the regular Zquad by name, people who have not replied yet only count as a number, and people who said no do not appear at all. “Not for me” and leaving are possible at any time.
• Next meet-up: anyone who has said yes can create the next meet-up with a tap and a confirmation: a copy of the regular Zquad’s last meet-up that this person attended, with them as host. If “Show the exact meeting point only once accepted” was chosen there, the copy only takes over the exact meeting point if the person planning was the host of that meet-up themselves; otherwise it only takes over the town and the rounded point, and the new host sets the exact meeting point themselves. In the copy, too, it is only visible once accepted. The others who have said yes are invited, provided they may see and join this Zquad and are not blocked with the person planning it. This uses the normal invitation with a notification; nobody becomes a member automatically. Age is the exception: if someone does not fall into the Zquad’s age groups on the day of planning, we still create the invitation but do not deliver it — the person gets no notification and sees neither the invitation nor the Zquad; to the person planning, it looks like an unanswered invitation (2.13).
• Storage period: the regular Zquad and the entries of its people remain as long as it exists. A “no” stays on record so that the same line-up is not asked again and you can still say yes later. Once everyone has said no or left, the regular Zquad dissolves and we delete it together with all entries. A question that did not lead to a regular Zquad, or whose regular Zquad has dissolved, we delete together with the line-up 12 months after it was last asked or after the regular Zquad was started. What happens when you delete your account is set out in 5.1 and 5.2.

The legal basis for the detection and the question is our legitimate interest in making it easier for people who meet regularly anyway to see each other again (Art. 6(1)(f) GDPR). We only use existing details for this, show the question only to those who were together anyway, and nobody becomes part of a regular Zquad without saying yes themselves. You can object at any time with the “Suggest regular Zquads” switch or as set out in 6.1. For the regular Zquad itself — starting, replying, renaming, planning and inviting — the legal basis is performance of the contract (Art. 6(1)(b) GDPR). You can obtain access to your regular Zquads and questions as set out in section 6.

2.19 Wallet pass

If you are the host or a member of a Zquad with a fixed date that is not over and not cancelled, you can add the meet-up to your wallet as a pass: on iPhone to Apple Wallet, on Android to Google Wallet. This is voluntary and only happens when you tap it; the app works just the same without a pass.

• What the pass shows: the title, the date with start and end, the place and town — for meet-ups on site the meeting point including its coordinates; with “Show the exact meeting point only once accepted”, the exact meeting point, which you see anyway as host or accepted member —, how many people are going and how many spots there are, the short code, a QR code with the link to the Zquad and an image with the Zquad’s pattern and the date. Names, profile pictures, the description and who is taking part are not on it. The texts of the pass appear in the language of your app.
• Apple Wallet: we create and sign the pass on our server, with a certificate that Apple issues to us for this purpose. Your iPhone downloads it directly from us, via a link that is valid for two minutes and works only once; Apple does not receive the content from us. To keep the pass up to date, the wallet on your device registers with us — with an identifier it creates for this purpose and a push identifier (push token); per pass we store this for up to ten devices. If anything on the pass changes, we send an empty message via Apple (APNs) to these devices, and your device fetches the new version from us. In doing so, it identifies itself with a secret key contained in the pass; we only store a check value of it. If your device reports technical errors in the process, we only record their number and length, not their content. If your iPhone syncs Wallet with your other devices via iCloud, Apple’s terms apply to that.
• Google Wallet: as soon as you tap “Add to Google Wallet”, our server transmits the content of the pass to Google via the Google Wallet interface — even before you confirm saving it with Google —, together with a random serial number by which we recognise the pass. Google loads the image with the pattern and our logo itself from our server. If you save the pass, Google assigns it to your Google account. We do not evaluate whether you save it there or remove it again: if anything changes, we update it at Google for as long as we hold it (below); if a change does not get through because of a disruption, we keep trying until two days after the change. Google processes the pass as a controller in its own right under its own terms (section 4).
• Before the meet-up: shortly before the start — for meet-ups on site, near the meeting point — your iPhone can show the pass on the lock screen by itself, for example with the time, place and short code; anyone who sees your device can then see it. Google Wallet can remind you before the start and near the meeting point, depending on your settings there. Whether you are nearby is determined by your device or by Google; we do not learn your location in the process.
• When something changes: if the title, date, place, meeting point, short code, spots or the number of members change, the pass is updated. If the meet-up is cancelled or no longer has a fixed date, the pass only shows the title and the reason. If you are no longer taking part, your account is suspended, there is a block between you and the host, or the Zquad is deleted, the pass no longer applies to you: it receives only the title and the reason one last time — without date, place, short code, numbers or QR code — and no further changes after that, until you take part again.
• What we store: for each pass a random serial number, the Zquad, your user identifier, platform and language, for Apple the check value of the key, when the pass was created, when its content last changed and which version Google last received, for a pass that no longer applies to you since when and the title at that moment, and the one-time identifier of the download link, which expires after two minutes; for Apple, for each registered device, the identifier of its wallet and the push identifier with timestamps. Each account can create at most 30 passes per hour and hold 200 valid ones at a time.
• Storage period and deletion: we delete the entry together with the registered devices 30 days after the end of the meet-up, a pass that no longer applies to you 30 days after that, and at the latest 180 days after it was created, unless the meet-up is still to come. A device drops out earlier if you delete the pass there or Apple reports its push identifier as invalid. You remove the pass itself in your wallet; it stays there even if you delete the app. In Apple Wallet it expires twelve hours after the end of the meet-up. At Google it expires at the same time, and Google Wallet then shows it as expired until you remove it there. How long Google stores the pass data beyond that is governed by Google’s terms; we cannot delete them there, only overwrite them. What happens when you delete your account is set out in 5.1 and 5.2.

The legal basis is performance of the contract (Art. 6(1)(b) GDPR): you expressly request the pass, and it cannot be provided without this processing — including the transmission to Google. We base the protective measures — the one-time link, the limits per account and per pass, and the pass no longer applying once you no longer take part, are suspended or are blocked with the host — on our legitimate interest, and that of everyone in the Zquad, in a secure service and in the date and meeting point only reaching those who take part (Art. 6(1)(f) GDPR). If you no longer want a pass, delete it in your wallet; with Apple, your device then deregisters from us.

3. Purposes and legal bases

Performance of a contract, Art. 6(1)(b) GDPR — everything that is necessary for the app to do what you installed it for: your account and your sign-in, the record of which version of the Terms you agreed to and when (2.1), your profile including the badges you show, creating and finding Zquads including series, saved filters and search agents, joining, requests and queued requests including the decision by the host and co-hosts and the status shown to the person asking, invitations, group and direct chats including the typing indicator, replies with quotes, sharing Zquads within Zquady and the “I’m on my way” and “I’m here” notices, the buttons in notifications, ratings, the “Your month” and “Your year” recaps, the “from your Zquads” display, the calendar subscription (2.17), starting, joining, renaming and planning in regular Zquads including the invitations (2.18), the wallet pass (2.19), the home screen widget, the weather forecast for meeting places, the associated notices in the app, including about changed dates and places, and the emails we send you about them.

Consent, Art. 6(1)(a) GDPR — processing that only takes place with your express permission and that you can withdraw at any time: access to your location, push notifications (2.6), access to the camera to scan a code and, on Android, scanning with the Google scanner including the diagnostic data it sends to Google (2.5), error and crash reports to us and to Sentry (2.7), adding an appointment to your calendar, the voluntary presence indicator “I'm already there”, the live countdown before the meetup and the weekly summary (2.6), and linking your Instagram or Discord profile including its confirmation (2.12), verifying your phone number via WhatsApp (2.14), ad measurement with the Meta SDK (2.15), publication on our Instagram account if you choose “Share on @zquadycom” (2.10), the gender “non-binary” (below), the display of your gender and age group in your profile (2.13) and people you choose seeing which Zquads you take part in (7.2); for “non-binary”, both for stating it and for displaying it, and for who sees your Zquads, this is explicit consent under Art. 9(2)(a) GDPR. You can withdraw these permissions in your device's system settings and in part directly in the app; the withdrawal takes effect for the future.

Legitimate interests, Art. 6(1)(f) GDPR — security and abuse prevention: limiting sign-in and change attempts, confirming changes to your email address or password and the deletion of your account with your password or a code, including the code emails, also to a new email address (2.8), sign-in sessions with IP address and device identifier, the blocking and reporting functions, handling reports including the copy of reported content, suspending accounts including the block list, the word filter, the limits on new direct chats, join requests and Zquads per account (2.8) and on retrieving gender and age group from profiles (rate limit, 2.13), the protective measures of the calendar subscription (2.17) and of the wallet pass (2.19), and the restriction on username changes. Our interest is a safe service on which strangers can actually meet each other without danger. We also base the online indicator (2.2), so that others can see who is reachable at the moment, the link previews, the server logs and the visitor counts of the website (2.10), the detection of regular Zquads including the question to the line-up (2.18), the details the host and co-hosts see about a join request together with the record of who among them decided — so that the organising team can decide in an informed and coordinated way — and the invitation suggestions from shared meet-ups, which make it easier to meet again (2.4), on legitimate interests. The same applies to the log of our access and actions in the administration, with which we demonstrate that we handle your data correctly (2.9, Art. 5(2) GDPR), and to keeping the record of a withdrawal (2.1). We keep copies of reported content or content we removed even if you request their deletion, for as long as we need them to establish, exercise or defend legal claims or for proceedings (Art. 17(3)(e) GDPR). You can object as set out in 6.1.

Legal obligations, Art. 6(1)(c) GDPR — for example, information provided to authorities on the basis of statutory duties, reporting a suspicion of criminal offences that threaten the life or safety of people to the police or public prosecutor (Art. 18 Digital Services Act; section 9a of our Terms), carrying out orders from authorities, for example to remove terrorist content (section 9a of our Terms), the contract confirmation after registration together with the record of when we sent it, and the confirmation of a withdrawal by email under the Austrian Distance and Off-Premises Contracts Act (Fern- und Auswärtsgeschäfte-Gesetz, 2.1), the record of your choice on ad measurement, on the weekly summary and on showing your gender and age group in your profile (2.15, 2.6, 2.13), and compliance with statutory retention obligations where they apply to us. The reporting obligation under Art. 18 DSA applies in the EU. If such a case only concerns countries outside the EU, for example Norway, Iceland, Liechtenstein or Switzerland, we base the report on the protection of vital interests (next paragraph) or on our legitimate interest in preventing and investigating criminal offences against people’s life and safety (Art. 6(1)(d) or (f) GDPR), and for people in Switzerland on Art. 31 FADP.

Vital interests, Art. 6(1)(d) GDPR — only in an emergency and only if no other legal basis applies: if someone’s life or health is in danger, for example because someone is missing after a meet-up, we give the police, rescue or emergency services the details they need to help, for example when and where the meet-up took place and who was there.

We process the age information because Zquady is intended exclusively for adults. The legal basis for this is performance of the contract (Art. 6(1)(b) GDPR): being of age is a prerequisite of the user agreement. From your date of birth we also work out your age group: to show you Zquads that are open to your age group, so that you can request to join them and create such Zquads yourself (2.13). The legal basis for this, too, is performance of the contract (Art. 6(1)(b) GDPR): age limits are among the functions we promise you in the user agreement (section 5 of our Terms). Using the date of birth we already hold for this purpose is compatible with the purpose for which we collected it (Art. 6(4) GDPR): both purposes concern access to Zquads by age; we only derive a broad group, do not store it, show it to nobody but you for this purpose and use no other data for it.

We only process your gender if you state woman, man or non-binary: to show you Zquads that are restricted to your gender, and so that you can create such Zquads. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). With “prefer not to say” you use all Zquads without a gender limit. For the join hint and asking together (2.13), our server also evaluates the information of the members of a Zquad, without showing it to anyone. We base this on our legitimate interest and that of the people asking not to end up unexpectedly as the only person of their gender in a group of strangers (Art. 6(1)(f) GDPR). You can object as set out in 6.1, most easily with “prefer not to say”. Because “non-binary” may in individual cases allow conclusions about a variation of sex development, we only process this information with your explicit consent, which you give when you choose it (Art. 9(2)(a) GDPR). You withdraw it by choosing “prefer not to say”.

If you show your gender or your age group in your profile yourself, that is a separate purpose: the legal basis is your consent (Art. 6(1)(a) GDPR), for “non-binary” your explicit consent (Art. 9(2)(a) GDPR). You can withdraw it at any time with “No one” (2.13).

Mandatory information. For an account we need your email address (or sign-in via Apple, Google or Discord), your date of birth, an answer on gender (“prefer not to say” included) and a username; without them we cannot conclude a user agreement with you. Everything else is voluntary.

No automated decisions. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The “For you” feed sorts Zquads by the topics and people you follow, the Zquads you have saved, your memberships and the distance — that is an order, not a decision about you. Whether you see a Zquad with a gender or age limit follows from the limit the host has set and from your own information — that is not a decision about you either. The word filter (2.4) only rejects individual texts and neither warns nor suspends anyone. Suspensions are always decided by a human.

4. Recipients and services used

We do not sell data. For advertising purposes, something only goes to Meta with your consent (2.15). We do, however, use service providers without which the app would not work. Where a service processes data on our behalf, it does so under a data processing agreement pursuant to Art. 28 GDPR. For each service we state where it is based, whether data goes to a country outside the EU or the EEA in the process, and what we base such a transfer on (Art. 13(1)(f) GDPR). In this context:

• Data Privacy Framework: the recipient in the USA is certified under the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of protection (adequacy decision, Art. 45 GDPR). You can check whether a certification exists at dataprivacyframework.gov. Where the contracts with the provider additionally contain standard contractual clauses, these apply if the certification or the adequacy decision ceases to apply.
• Standard contractual clauses: the transfer is safeguarded by the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). You can obtain a copy of the clauses we have agreed ourselves on request at privacy@zquady.com.

Equivalent protection. We oblige service providers who process your data on our behalf, in a data processing agreement (Art. 28 GDPR), to process it only on our instructions and to protect it at least as well as this policy and the GDPR require. Recipients who receive data as controllers in their own right – for example Meta for ad measurement (2.15), Google Wallet, Nominatim, OpenFreeMap or MET Norway – are themselves bound by the GDPR or are located in a country for which the European Commission has found an adequate level of protection; with Meta, this is additionally governed by the joint controllership arrangements (Art. 26 GDPR, 2.15 and 2.16). What these recipients do with the data under their own responsibility is set out in their privacy notices. We only pass your data on to other third parties if this policy says so.

The services in detail:

• Supabase (Supabase Pte. Ltd., Singapore, with Supabase, Inc., USA, for operations and support) — our backend: accounts and sign-in, database, file storage for photos, realtime connection for chats, and server functions; the app also uses it to check whether an internet connection is available. Practically all of the data listed under point 2 is held here. Our project runs in the Ireland region; the database, authentication and file storage are therefore located in the EU. Access by the provider from Singapore and the USA, for example for operations and support, cannot be ruled out. Basis: standard contractual clauses that form part of our data processing agreement with Supabase; Supabase is not certified under the Data Privacy Framework, and there is no adequacy decision for Singapore.
• Cloudflare (Cloudflare, Inc., USA) — placed in front of our programming interface. In doing so, Cloudflare processes the technical connection data of all requests, including in the USA. Cloudflare Pages also hosts the technical helper page mta-sts.zquady.com, from which mail servers retrieve the rules for encrypted delivery to us, and our internal administration interface, protected with Cloudflare Access. We use it, among other things, to handle reports together with the reported content; the data displayed passes through Cloudflare. Basis for transfers to the USA: Data Privacy Framework.
• Expo (650 Industries, Inc., USA) — sending push notifications to iPhones and to Android devices that we do not reach directly via Google (see Apple and Google). Important and easily overlooked: the notification text is transmitted in plain text, on the direct route via Google as well. For a direct message that is the sender's name and roughly the first 120 characters of the message; in a group chat additionally the Zquad title; for join requests an excerpt of your personal message (this notification goes to the host and their co-hosts, 2.4); for changes to a Zquad the new date or the new place — never a meeting point that is only visible to those in the Zquad —, and for the reminder shortly before the start the sentence telling people how to recognise you at the meeting point (2.4). In addition, there are technical identifiers the app needs to open the notification — for example those of the Zquad or the message, and your user identifier — and, for notifications with buttons, the one-time code (2.6). You can switch this off with the “Preview in notifications” switch in the notification settings (on by default): we then send notifications about messages and join requests without an excerpt of the text, and that text does not go to Expo, Apple or Google either. For push delivery, your device registers once directly with Expo (the device's push identifier, a random installation identifier, IP address). From Expo, delivery continues to Apple (APNs) on iOS or Google (FCM) on Android. On Android, Google’s Firebase Cloud Messaging is built into the app for this: it creates a delivery identifier for your device (push token) and sends it to Google Ireland Ltd. together with technical details such as device model, operating system version and IP address – only after you have allowed push notifications in the app (2.6). Google Analytics for Firebase is not included. If you do not want that, switch off the relevant notifications in the app — then we do not send them in the first place. If you only switch them off in your system settings, they are still transmitted but not displayed. Basis for transfers to Expo in the USA: Data Privacy Framework; for Google see below.
• Expo/EAS Updates (650 Industries, Inc., USA) — on launch the app checks whether a new program version is available. Technical details such as the IP address, platform, app version and a random installation identifier are transmitted in the process; no account data. Expo also uses the installation identifier to count how many devices use a program version. Basis: Data Privacy Framework.
• Apple and Google (Apple Distribution International Ltd. and Google Ireland Ltd., both Ireland) — delivery of push notifications: on iOS via Expo to Apple (APNs), on Android as a rule directly from our server via Firebase Cloud Messaging (FCM), with the same content as described above for Expo. Where that is not possible — for example with older app versions or if FCM rejects a delivery — the notification goes via Expo. For delivery via Firebase Cloud Messaging, Google processes the notifications on our behalf. According to Google, it also uses operational data of the service for its own purposes and is itself responsible for that. Our server sends the details of the live countdown (2.6) directly to Apple or Google. For the wallet pass (2.19), our server only sends Apple (APNs) an empty message to the devices on which the pass is stored; Apple does not receive the pass itself from us. Also sign-in with Apple or Google if you choose it, on Android the code scanner of Google Play services if you choose it (2.5), and distribution of the app through their stores. Transfers to the parent companies in the USA are possible. Basis: for Google the Data Privacy Framework, under which Google LLC is certified; Apple bases transfers to Apple Inc. on standard contractual clauses.
• Google Wallet (Google LLC, USA; Google Wallet and your Google account are provided by Google Ireland Ltd., Ireland) — only if you tap “Add to Google Wallet” (2.19): via the Google Wallet interface, our server transmits to Google the title, date, place and town, for meet-ups on site the meeting point including its coordinates — with “Show the exact meeting point only once accepted”, the exact one —, the number of people going and of spots, the short code, the link to the Zquad and a random serial number; Google loads the image with the pattern and our logo itself from our server. If you save the pass, Google assigns it to your Google account. Google processes these data as a controller in its own right under its own terms; under those terms, Google may also use them to provide and improve its services. Google’s controller-to-controller data protection terms apply to the transmission. Basis of the transfer: Data Privacy Framework, under which Google LLC is certified.
• Resend (Resend, Inc., USA) — email delivery: sign-in, confirmation and recovery codes (including for confirming a new email address, a new password or the deletion of your account), the contract confirmation after registration (which is also our welcome email) and the confirmation of a withdrawal (2.1), security notices to you (for example for a new passkey, a new password or a changed email address), the acknowledgement of your support enquiry, the confirmation of an account deletion to your previous address, the statement of reasons when we remove content of yours or suspend your account, the outcome of your reports; in addition, support enquiries, abuse reports and approval requests for “Share on @zquadycom” go to our mailbox. If you change your email address, a code also goes to the new address before it takes effect; if you confirm the change with a code to your previous address, that email names the new address. The images in our emails (logo and icons) are hosted on zquady.com and are only loaded once your mail program displays images; our webspace provider then sees your IP address and the time. These addresses contain nothing that identifies you — every email loads the same image. We additionally publish our logo via the BIMI method in our domain's directory so that some mail programs show it next to the sender; the image file is held in our own storage. Resend also receives on our behalf the aggregate reports that other mail providers send us about messages dispatched in our name (DMARC and TLS reports): IP addresses of sending servers and counts, no content and no recipients; we do not request failure reports on individual messages. We evaluate the reports ourselves to detect misuse of our sender address and delivery problems, and delete them after 180 days (legitimate interest in secure email delivery, Art. 6(1)(f) GDPR). Basis for transfers to the USA: Data Privacy Framework (for people in Switzerland: standard contractual clauses, see section 6).
• Microsoft 365 (Microsoft Ireland Operations Limited, Ireland) — all our mailboxes are hosted with Microsoft, for example support@, info@, privacy@, legal@, report@ and presse@zquady.com, as well as the internal mailboxes through which we handle confirmations and approvals (for example verification@ and instagram-story@zquady.com). Emails to us and enquiries from the support form arrive there. Our daily backups are stored there as well (SharePoint), encrypted with AES-256 beforehand so that Microsoft cannot read their content. Our account is based in Austria; for accounts in the EU, Microsoft stores and processes the contents within the European Union under the EU Data Boundary. Access by Microsoft Corporation in the USA, for example for operations and support, cannot be ruled out. Basis: Data Privacy Framework, under which Microsoft Corporation is certified.
• Nominatim (OpenStreetMap Foundation, United Kingdom; adequacy decision of the European Commission) — converting coordinates into place names, place search, and the public centre point of a town or city for a search agent or a pre-filled place when creating a Zquad (2.3, 2.5). The app asks our server, and only our server asks Nominatim; Nominatim therefore sees our server's IP address, not yours. Your coordinates rounded to about 100 metres, or your search term or the name of the town, are transmitted. So that the same question does not go to Nominatim again, our server keeps the answers without any link to you, meaning no account, device or IP address: for a point at most seven days, for a search term or town name at most 30 days. If our server cannot be reached or you are not signed in, the app asks Nominatim directly; your device then transmits the same information together with your IP address.
• OpenFreeMap (Hyperknot Software Kft., Hungary) and map data by OpenStreetMap contributors — map background in the app, also for the small map in the year recap (2.4). The requested map section and your IP address are transmitted. OpenFreeMap delivers the map sections, including the map’s fonts and symbols, via the network of Cloudflare, Inc. (USA); Cloudflare therefore also sees the section and your IP address. OpenFreeMap chooses this route itself; Cloudflare acts for OpenFreeMap here, not for us.
• MET Norway (Meteorologisk institutt, the Norwegian Meteorological Institute, a government agency; Norway is part of the EEA, so the data does not leave the EEA) — weather forecast for the meeting place of a Zquad. The app asks our server, and only our server asks MET Norway; MET Norway therefore does not see your IP address but that of our server. Only the coordinates of the meeting place are transmitted, rounded to about one kilometre — neither the date nor your own location. There is no direct route from your device to MET Norway. So that the same question does not go to MET Norway again, our server keeps the forecast for this rounded point without any link to you: without account, device or IP address. If the point is no longer requested, we delete it after three days at the latest.
• Sentry (Functional Software, Inc., USA) — crash and error reports, so that we notice crashes without anyone having to report them to us. Transmitted are: the error message with its technical stack trace, device model and operating system version, app and build version, language setting, a random installation identifier for your device, and the app's most recent network requests before the error, but for each of them only the type of request, the address called without its query part, and the result. The address may contain identifiers, for example your user identifier or that of a Zquad — no search terms, no coordinates, no names, no email addresses, no message contents, no passwords. From the IP address Sentry derives a coarse location on receipt (country, region and city); the IP address itself is not stored. Our Sentry project runs in the EU region with servers in Germany; access by the provider from the USA, for example for operations and support, cannot be ruled out. Performance and usage measurement is switched off. Basis for access from the USA: Data Privacy Framework. Reports to Sentry are only sent with your consent; you can withdraw it at any time with the “Send crash reports” switch (2.7).
• Meta (Meta Platforms Ireland Ltd., Ireland) — only if you use the function in question: ad measurement with the Meta SDK (2.15, joint controllership), phone verification via WhatsApp (2.14, there as our processor), confirmation of your Instagram profile by direct message (2.12), publication on our Instagram account if you choose “Share on @zquadycom” (2.10), and contact via WhatsApp or our profiles (2.16). Meta also transfers data to Meta Platforms, Inc. in the USA; basis: Data Privacy Framework, under which Meta Platforms, Inc. is certified.
• Discord (Discord Inc., USA) — sign-in with Discord if you choose it, and confirmation of your Discord profile (2.12). Discord thereby learns that you are signing in to Zquady or confirming a profile. Basis for transfers to the USA: Data Privacy Framework.
• united-domains GmbH, Germany (united-domains.de) — hosting of the website zquady.com with the legal texts and the link previews. Address: Gautinger Straße 10, 82319 Starnberg, Germany. The servers are operated on its behalf by IONOS SE, Montabaur, Germany (see 2.10).

Two notes on services that are not classic service providers:

• The app does not load links in chat messages, for example to images, GIFs or pages from other providers; they only appear as text in the chat. No third-party content is fetched.
• If you tap “open in maps”, your device passes the address of the meeting place to your maps app (Apple Maps or Google Maps). If you add a Zquad to your calendar, the entry initially stays on your device — if your calendar syncs with an online service, it ends up there as well. If the Zquad changes, the app updates the entry as soon as you open the Zquad – only if you have already allowed it to access your calendar; if it is cancelled, the app puts “Cancelled:” in front of the title. If you connect your calendar via a subscription (2.17), your calendar — depending on your choice, your device or the servers of your calendar service, for example Apple (iCloud) or Google — retrieves the title, time and place of your Zquads directly from us. The calendar service processes them as a controller in its own right under its own terms; with Apple and Google, transfers to the parent companies in the USA are possible (basis as above under “Apple and Google”).

Other users see what this policy states for each function, above all your profile according to your settings (7.2). They only see your gender and your age group if you show them in your profile yourself, and only the people you choose for this: people from shared Zquads or everyone who is signed in (2.13).

We only transmit data to authorities and courts, in particular law enforcement authorities, where a law obliges or permits us to do so — for example in the case of a suspected criminal offence that threatens the life or safety of people (Art. 18 Digital Services Act), or on the basis of a court or official order. In an emergency, we give the police, rescue and emergency services the details they need to help (section 3, vital interests). We only disclose details to other third parties if a law obliges us to, for example section 13(3) of the Austrian E-Commerce Act: under it, we must disclose a person’s name and address, insofar as we have them, to someone who credibly shows that they need them to pursue a specific infringement of rights.

5. Storage period and deletion

The principle: we store your messages, your Zquads and your profile for as long as your account exists. The following periods apply to the remaining categories; after that, we delete the data, usually in a daily run, so a period may be extended by up to one day:

Notifications

90 days.

Error reports

90 days.

Crash reports at Sentry

90 days at most.

Counter of our email dispatch

90 days.

Log of our access and actions in the administration (2.9)

12 months.

Record of a withdrawal from the agreement (2.1)

up to three years after the withdrawal (three-year limitation period under Austrian law, § 1489 ABGB), even if the account has since been deleted.

Reports about users

12 months after the report has been dealt with.

Copies of reported content or content we removed (evidence)

12 months after our review has been completed; if proceedings before authorities or courts are ongoing, until they end.

Entries on the block list

for as long as the suspension lasts, three years at most.

Logged password and code attempts, and the times confirmation codes were sent

2 days.

Check values of open codes for changing your email address or password and for deleting your account

until you use the code or request a new one, otherwise after two days at most; for confirming, a code is valid for 15 minutes at most.

Note that your password was last set other than via “Change Password” (for example via “Forgot password?”)

until you set a new one in the app under “Change Password”, at the latest until the account is deleted.

Time of your last email or password change

until the next change, otherwise after two days at most.

Open codes for phone verification, for WhatsApp usernames including the check value of the identifier

1 day.

Time of last activity (online indicator)

roughly two hours at most.

Requests held back when asking together

until they are sent or withdrawn, 30 days at most.

Queued requests including the message

until they are sent to the host as a request, you withdraw them or you send a request yourself, at the latest until the Zquad is cancelled, counts as having taken place or is deleted.

Join requests that were not accepted, including the message and status

until 90 days after the Zquad ended or was cancelled; if the host moves the date beforehand, they remain valid. If you withdraw an open request or delete your account, immediately.

Record of who decided on a join request

at the latest 30 days after the meet-up, for Zquads without a date 90 days after the decision; if you delete your account, we remove you from it immediately.

Support enquiries and emails to us

for as long as needed to handle them and for possible follow-up questions, at most three years after completion (three-year limitation period under Austrian law, § 1489 ABGB).

Log of direct messages to our profiles and of confirmations via WhatsApp

60 days.

Accounts created without a profile (abandoned registration)

7 days.

Sign-in sessions with IP address and device identifier

until you sign out, at the latest until the account is deleted.

Push tokens, on Android including the Firebase delivery identifier

until you sign out on the device, at the latest until the account is deleted. We also delete the tokens of your other devices when you log out on all other devices, change or reset your password or switch on two-factor authentication. An identifier drops out earlier if Expo or Google reports it as invalid when we send a notification, for example because you deleted or reinstalled the app.

Live countdown identifiers

those of a running display until it ends, as a rule about 15 minutes after the meet-up; a device’s start identifier until you sign out there, at the latest 45 days after the device last reported it.

Note that the live countdown was started

3 days after the meet-up starts.

Redeemed one-time codes from notifications

1 day after the code expires; a code is valid for 7 days.

Saved filters and search agents

until you delete them, at the latest until the account is deleted.

Calendar links

as long as the subscription is connected. After disconnecting, we detach a link from your account immediately, one created only shortly before at the latest two days after its creation; we delete the rest, which is no longer tied to you, as soon as no calendar has asked for it for a year, and never-retrieved links 7 days after disconnecting (2.17).

Regular Zquads and your yes or no

as long as the regular Zquad exists; if it dissolves, we delete it immediately.

Questions about a regular Zquad, including the line-up

as long as the regular Zquad exists; if no regular Zquad came about or it has dissolved, 12 months after the last question or after the regular Zquad was started (2.18).

Entries for wallet passes including registered devices

30 days after the end of the meet-up; a pass that no longer applies to you 30 days after that; at the latest 180 days after it was created, unless the meet-up is still to come. A registered device drops out earlier if you delete the pass there or Apple reports its push identifier as invalid (2.19). What is held at Google is governed by Google’s terms.

Record of your choice on ad measurement (yes or no, time, notice text with language and version, platform)

for as long as your account exists and for three years afterwards (2.15).

Record of your choice on the weekly summary (on or off, time, version of the notice text)

for as long as your account exists.

Record of your choice on showing your gender and age group in your profile (on or off, level chosen, time, version and language of the notice text, platform, 2.13)

for as long as your account exists.

Rate-limit counter for gender and age group in profiles (only how many such details an account retrieved on a given day, not whose, 2.13)

after two days at most.

Record of which version of the Terms you agreed to and when, including when we sent the contract confirmation (2.1)

for as long as your account exists.

Accounts not used for 24 months

We write to your email address 30 days beforehand. If you do not open the app with your account by then, we delete it as described in 5.1 (section 12 of our Terms).

Age group (2.13)

not stored, but worked out from your date of birth when needed. The date of birth is kept for as long as your account exists (7.4).

Messages, Zquads and profile

for as long as your account exists — what happens on deletion is set out in point 5.1.

5.1 What happens when you delete your account

You can delete your account yourself at any time in the app under Profile › Settings. The same happens if you withdraw from the agreement within the first 14 days (section 12a of our Terms). If your account is suspended, you cannot sign in; in that case we delete it when you write to us at privacy@zquady.com. Deletion takes effect immediately and cannot be undone — there is no waiting period and no recycle bin. Deleted in the process are your sign-in data including linked sign-in providers, your profile including an uploaded profile photo, your memory photos from past Zquads, your messages (including those in other people's group chats and both sides of your direct chats), your memberships, requests and queued requests, lists, settings, push tokens, live countdown identifiers, the entries for your wallet passes including registered devices, your entries in regular Zquads, your date of birth, the entries in our administration log about a change of your gender or a correction of your date of birth (2.13) and the record of which version of the Terms you agreed to. If you decided on requests as host or co-host, we remove you from the record of who decided. We detach your calendar links from your account; from then on they only deliver an empty calendar (5.2). Your passes in Google Wallet that we still hold at that point are replaced at Google in the same step with an empty, invalid remainder — without title, date or place (5.2). If you signed in with Apple and delete your account in the iPhone app, you confirm this once with Apple at the end; we then also revoke the “Sign in with Apple” link at Apple. On other devices you end it yourself in your Apple ID settings. Your email address is immediately available again for a new registration afterwards — unless your account was suspended (block list, 2.9). If a report about your account or your content is still open, your account is suspended or we need it for ongoing proceedings, we first secure a copy and only then delete (5.2).

Important for others: Zquads you created disappear entirely — together with the group chat, the memberships and the memory photos of the other participants.

5.2 What survives deletion

Not everything disappears with the account. What remains is listed here in full — and for each item it is stated whether it still has a link to you.

• Abuse reports are retained so that deleting an account does not become a tool for covering tracks. If you filed the report yourself, your identifier is removed from it. The label of the reported content — a username, for instance — remains stored in plain text; so if you were reported, the report can continue to name you. Legal basis: legitimate interest in investigating breaches (Art. 6(1)(f) GDPR). Reports are deleted automatically 12 months after they have been dealt with.
• Copies of reported content or content we removed (2.9) are retained even if the account is deleted — including direct messages that a reporting person sent along. They also contain the user ID of the reporting person; if an account is suspended when it is deleted or is needed for ongoing proceedings, a copy of its profile is part of them. They are locked, accessible only to us, and deleted 12 months after our review has been completed, or at the end of any ongoing proceedings before authorities or courts. Legal basis: legitimate interest in investigating breaches and in defending claims (Art. 6(1)(f), Art. 17(3)(e) GDPR); for a report to authorities, our legal obligation (Art. 6(1)(c) GDPR, Art. 18 DSA), outside the EU Art. 6(1)(d) or (f) GDPR (section 3).
• Entries on the block list (2.9) remain after a suspended account is deleted until the suspension expires, three years at most. They only contain check values, not the details themselves. Legal basis: legitimate interest in suspensions not being circumvented (Art. 6(1)(f) GDPR).
• Error reports are retained; the user identifier is removed from them. The text of an error report is technical in nature but may in individual cases contain remnants of a program run. Error reports are deleted automatically after 90 days.
• The counter of our email dispatch is retained as a bare tally line; the user identifier is removed from it when the account is deleted. What remains is only a timestamp and an occasion — with no link to you. These entries are also deleted automatically after 90 days.
• Notices in group chats that the app writes automatically — for example “@Name has joined”, “@Name is on the way”, “@Name is here”, “@Name started your regular Zquad” or “@Host made @Name a co-host” — remain in the history until the Zquad is deleted. They name your username at the time.
• Regular Zquads you started (2.18) remain for the others — with their name and their meet-ups, but no longer tied to you.
• Calendar links (2.17) remain as empty links so that your calendar is emptied at its next retrieval — only a check value and timestamps, no longer tied to you. We delete them as soon as no calendar has asked for them for a year, never-retrieved ones after 7 days.
• Wallet passes (2.19) are stored in your wallet and stay there until you remove them. A pass in Apple Wallet keeps its last version on your device but receives no further changes. In Google Wallet, passes we still held at the time of deletion only remain as an empty, invalid remainder; passes whose entry we had already deleted keep their last version there. At Google, the pass data remain stored under Google’s terms; we cannot delete them there. Passes that others created for Zquads you created then only show the title and “Cancelled”.
• Emails to us, including the automatic copies of your support enquiries and reports, remain in our mailbox according to the periods under point 5. The copy of a report still contains the user identifier of the person who reported.
• The log of direct messages to our Instagram account and our Facebook page (2.16) is kept for up to 60 days — with the identifier Meta transmitted to us for you, and for code messages also with your Instagram name.
• Crash reports at Sentry (point 4) are deleted by Sentry after 90 days at the latest; until then they may contain identifiers from the most recent network requests.
• The log of our access and actions in the administration (2.9) is retained for up to 12 months after each entry, with your user identifier but without content; entries about a change of your gender or a correction of your date of birth are deleted with your account (2.13). Legal basis: legitimate interest in being able to demonstrate that we handle data correctly (Art. 6(1)(f), Art. 5(2) GDPR).
• The record of your withdrawal (2.1), that is, your statement with the time and our confirmation, is retained for up to three years after the withdrawal so that we can prove the withdrawal and its confirmation. Legal basis: legitimate interest in defending against claims (Art. 6(1)(f) GDPR).
• The record of your choice on ad measurement (2.15) is retained for three years after the deletion, with your user identifier, so that we can prove your consent. Legal basis: our obligation to demonstrate consent (Art. 6(1)(c), Art. 7(1) GDPR) and our legitimate interest in defending against claims (Art. 6(1)(f) GDPR).
• Stories on our Instagram account that we published at your request (2.10) are not removed by the account deletion; Instagram shows them publicly for 24 hours. On request, we delete them earlier, including from our archive at Instagram.

Backups: our backend provider creates technical backups daily and usually keeps them for 7 days. In addition, we back up the database ourselves every day, encrypted with AES-256, to our own server in Austria and to Microsoft 365 (section 4). We delete these backups after 28 days at the latest; after that they remain in the Microsoft 365 recycle bin for up to 93 days and in read-only snapshots of our server for up to 30 days. Deleted data can therefore persist in backups for up to about four months. We only use backups to restore data after an outage or error, and to disclose or preserve individual details if a law or an official or court order obliges us to do so (Art. 6(1)(c) GDPR).

6. Your rights

Under the GDPR you have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). You can withdraw consent you have given at any time with effect for the future (Art. 7(3)), for example the display of your gender and age group with the same setting you used to switch it on (2.13). Your right to object is set out separately under 6.1.

You can exercise much of this directly in the app: change your profile, bio and avatar, adjust visibility settings, switch off individual notification types, review and withdraw permissions, block people, clear chats, delete your account. Your date of birth and — between woman, man and non-binary — your gender are corrected at your request via support, so that age limits and single-gender Zquads cannot be circumvented (2.13).

For data portability there is a file export in the settings under Privacy (“Export my data”). It contains your account key details, your profile, the Zquads you created, your memberships, the topics you follow and the status of your calendar subscription. Not included are, among other things, messages, notifications, blocks, saved searches, regular Zquads and reports — for those, please write to us at privacy@zquady.com and we will compile the remaining data for you.

If you believe that we are processing your data incorrectly, you can lodge a complaint with any data protection supervisory authority in the EU or EEA, in particular in the country where you live or work or where the alleged infringement took place (Art. 77 GDPR). The European Data Protection Board keeps a list of the authorities (edpb.europa.eu). Our lead authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

For people in Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies. We base transfers to the USA on the Swiss-U.S. Data Privacy Framework where the provider is certified, and otherwise on the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC), with Swiss adaptations. We also base the transfers at Supabase to Singapore and the USA on these standard contractual clauses (section 4). You can also lodge complaints with the FDPIC (edoeb.admin.ch).

6.1 Your right to object

Where we base processing on our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). This concerns in particular security and abuse prevention including the handling of reports, the online indicator, the evaluation of gender information for the join hint and asking together, the link previews, the server logs of the website, the detection of regular Zquads, the details on join requests for the host and co-hosts together with the record of who decided, and the invitation suggestions. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You can object to the detection of regular Zquads at any time without giving reasons — fastest with the “Suggest regular Zquads” switch in the settings under Privacy. You object to the online indicator most quickly with the “No one” setting, and to the evaluation of your gender with “prefer not to say”. The app only sends crash and error reports (to Sentry and by our own route, 2.7) with your consent anyway; you can withdraw it at any time with the “Send crash reports” switch under Profile › Settings › Privacy. You only receive the weekly summary if you switch it on yourself; you can switch it off at any time in the notification settings. For any other objection, an informal sentence to privacy@zquady.com is enough.

7. Specifics of Zquady

The following points appear in no standard template, but they are the most important ones for you.

7.1 What others see of your location

Other users do not see your location. What they see is the meeting place of a Zquad — that is, the place the host entered when creating it. By default, only the host, co-hosts and members see the exact meeting point; everyone else sees the town and a point rounded to roughly one kilometre. If the host switches off “Show the exact meeting point only once accepted”, the meeting place with its coordinates is visible on the map to everyone who is signed in. Anyone who has been accepted can take the exact meeting point into their calendar with the date, also automatically via the calendar subscription (2.17), or add it to Apple Wallet or Google Wallet as a pass; with Google Wallet, Google then receives the meeting point as well (2.19). If someone taking part has switched on the live countdown on Android, the exact meeting point for the “Directions” button also goes to Google via Firebase Cloud Messaging (2.6). If someone other than the host plans the next meet-up of a regular Zquad, the copy does not take over the exact meeting point, only the town and the rounded point (2.18).

Hence this note for hosts: if you choose “use current location”, the place you were at that moment becomes the meeting place – publicly visible as soon as you switch off “Show the exact meeting point only once accepted”. Better to give a meeting place you would also name publicly — or keep the exact meeting point visible only to people who have been accepted.

The presence indicator is voluntary and off by default. If it is switched on, your phone itself decides whether it is close to the meeting place and transmits only a yes or a no. Your coordinates do not leave the device in the process, and the other members only see a number — never who is there, and never exactly where. We store this yes or no with a timestamp. We keep the first time you were there within the time window for as long as the Zquad and your account exist — it counts as confirmed attendance for your badges. If you switch the indicator off, we delete all your entries, including the first time you were there; it then no longer counts as confirmed attendance for your badges. While the indicator is off, our server accepts no entries from you — our database enforces this, not just the app. This is separate from “I’m here”: you report that yourself with a tap, and everyone in the Zquad sees it with your username in the group chat (2.4).

7.2 Who sees your profile

Your username is visible to everyone who is signed in; it deliberately contains no real name. Anyone who has a link to your profile also sees it without an account, together with the key details listed under 2.10. For your profile picture, bio, linked profiles, online dot and direct messages you set individually who sees them or may message you: “Everyone” (everyone who is signed in), people from shared Zquads and/or people you follow, or “No one”. For your profile picture, bio and linked profiles we ask you when you first upload, write or confirm them, before others see them. For the online dot and direct messages, people from shared Zquads and people you follow are the default; in addition, someone who sends a join request to a Zquad and its host and co-hosts can message each other, unless you have chosen “No one”. Your initials always remain visible. The database enforces this: someone who may not message you cannot create a message to you.

Nobody but you sees your gender or your age, unless you show your gender or your age group in your profile yourself. Then only the people you choose for this see it (with “Shared Zquads” people from shared Zquads, with “Everyone” everyone who is signed in), only in your profile and marked “Self-declared”; never your date of birth or your age in years, and in no list. Anyone who is with you in a Zquad with a gender limit only learns from this that you belong to the admitted genders. Anyone who is with you in a Zquad with an age limit only learns from this that you fell into one of the chosen groups when you joined. How the display in your profile works and what the label of a Zquad reveals about its host is explained in 2.13.

Who is taking part in a Zquad is visible to the other members, the host and the co-hosts. People who have not joined only see the host, the co-hosts and the number of participants in the member list. Whether people you know also see which Zquads you take part in is up to you under Profile › Settings › Privacy: no one (the default), people you follow and/or people you have already been with at a Zquad that took place. Zquad titles can reveal something about you, for example about religion, health or sexuality; with your choice you consent to these people seeing your Zquads including their titles (Art. 9(2)(a) GDPR). You can change this at any time.

Who you follow is only seen by you and the person you follow. Others only see how many people follow you. Which topics you follow is visible to signed-in users. The same applies to your answers to conversation starters, the up to three badges you show (2.2) and your confirmation check marks. Signed-in users also see since when you have been a member, the number of thumbs up and thumbs down you have received as a host, your interests, how many Zquads you have hosted or attended and the next Zquad you are hosting – only an upcoming one without a gender or age limit that they are allowed to see elsewhere in the app anyway; your online dot is only seen by the people you set for it (above). Which Zquads you are a member of is only visible to others under the rules in the previous paragraph. If you send a join request, the app shows the host and the co-hosts some of these details together with your request (2.4).

Uploaded profile photos are held in non-public file storage. Whether someone may see your photo is decided by our server according to your “Who can see my profile picture?” setting. Anyone who may see it receives an image address that is valid for one hour — if they pass it on during that time, others can also retrieve the photo for that long. Only upload photos whose visibility you are comfortable with.

7.3 Chats, blocking and deleting

Group chats can only be read by the members of the respective Zquad and by the host; direct messages only by the two people involved. If you block someone, their messages disappear for you and they can no longer reach you. You can no longer follow each other or request to join each other’s Zquads, you no longer see each other in Zquads or member lists, each other’s public questions on Zquads are hidden from you (the host still sees all questions on their own Zquad), and the blocked person only sees your username on your profile — no longer your profile photo, your bio or your linked profiles. This too is enforced in the database, not merely in the display; only direct messages written before the block remain stored with us and are hidden in the app. The app also hides your memory photos from each other, in both directions and also for the host of a shared Zquad (2.4).

“Clear history” only hides the history for you — the messages remain for the other people involved. If you delete your account, by contrast, your messages are removed everywhere — except for secured copies in the case of open reports (5.2).

Messages are not end-to-end encrypted. They are encrypted in transit and are held in our database. We only look at their content if content or an account is reported to us – then only at the messages the reporting person sent along (2.9) – or if a court or a public prosecutor orders it. For troubleshooting we use identifiers and times, not texts. Access to the administrative interface of the database is limited to the operator.

And once more, because it is easily overlooked: if push notifications are switched on, an excerpt of the message text is transmitted to the delivery service and to Apple or Google respectively (see point 4) – unless you switch off “Preview in notifications” in the notification settings.

7.4 Being of full age, and your date of birth

Zquady is exclusively for people aged 18 and over, because strangers meet here in real life. After you confirm your email address, or after you sign in via Apple, Google or Discord, and before your profile is created, we ask for your date of birth. If your date of birth means you are under 18, we ask once whether the date is correct. If you confirm it, we end the sign-up and delete the account, including the email address, immediately. The app then remembers only “under 18” and the time on your device for 30 days (2.11). If that is not possible straight away, for example without an internet connection, or if a registration is abandoned before a profile has been created, we delete the account automatically after 7 days.

This is a self-declaration. We do not check identity documents and do not use any age verification service. Your date of birth remains stored with your account so that the confirmation is traceable, so that it does not have to be requested again at every sign-in and so that we can work out your age group for Zquads with an age limit from it (2.13). It can only be set once; only we can correct it, at your request via support. You see it in your profile, others never do.

8. Minors

The app is not directed at people under 18, and we do not knowingly process data of minors. If you notice that a minor has created an account, please report it to us via the reporting function in the app or to privacy@zquady.com. We will delete such an account together with the associated data.

9. Changes to this policy

As we keep developing the app, this policy may change as well. The version published here is the one that applies in each case; the date at the top shows you when it was last changed. In the case of changes that materially affect you, we will inform you in the app or by email.

10. Contact

For questions about data protection or to exercise your rights, you can reach us at privacy@zquady.com or by phone at +43 664 99216386. In the app you will also find a form under Profile › Settings › Support and feedback.

Postal address:

Zquady e.U. Linzer Straße 17 4100 Ottensheim Austria