Privacy policy
Version 1, effective from 11/8/2026
Draft for approval. This text has not yet been approved by the operator or a lawyer and is not final.
This policy explains which personal data the Popby app (for Android and iOS), its server and this website process, why, who receives it and what rights you have. Popby shows when your mutual contacts are free and where they are, so you can meet up without arranging anything in advance. The app contains no advertising and no third-party analytics tools.
Controller and contact
The controller of personal data is WebPro Czech s.r.o.. For questions about personal data, requests under the GDPR or reports about content, write to support@popby.eu or use the Contact page. The same contact serves as the point of contact for users and authorities under the Digital Services Act.
Which data we process
- Account and profile: e-mail address (verified with a code), password (only as a hash, see “Sign-in and app lock”), Google or Apple account identifier, date of birth and country of residence (for the age check), nickname, public note and city, the policy version you agreed to and the time of consent.
- Devices and sessions: installation identifier, platform and device model, time of last activity, sign-in tokens (stored only as a hash) and the registration token for notifications. On Android also the result of the app and device integrity check (Google Play Integrity) as a signal against abuse through multiple accounts.
- Contacts: mutual contacts and contact requests, your private nicknames for contacts, tags, blocks and reports (with a snapshot of the reported nickname, note and city).
- Schedule and slots: see “Schedule and slots”.
- Location: see “Precise location”.
- Notifications: the in-app inbox and notification settings, see “Notifications”.
- Purchases: see “Purchases”.
- Operational data: IP address (shortened in operational logs) and time of requests to the server, verification codes sent by e-mail (stored only as a hash, valid for a short time).
Precise location
The app sends your precise location to the server only after you tap to share it, and only while a slot is active. You share it only with the contacts you choose. The server keeps only the latest point, with a short validity; sharing ends when the slot ends or when you tap “Hide me”. Location is not stored in backups, is not written to operational logs and is not part of notification text. The app asks for location permission only “while using the app” and does not use location in the background. On Android the map is drawn by the Google Maps SDK; the app does not pass your contacts’ locations to it (the terms will be verified before approval).
Purposes and legal bases
- Providing the service: running your account, contacts, slots and showing who is free — performance of a contract (Art. 6(1)(b) GDPR).
- Sharing precise location: your consent (Art. 6(1)(a) GDPR), which you give by tapping to share and can withdraw at any time by ending the sharing.
- Security, protection against abuse and handling reports: legitimate interest (Art. 6(1)(f) GDPR).
- Age verification, answering data subject requests and recording incidents: compliance with a legal obligation (Art. 6(1)(c) GDPR) and Art. 8 GDPR.
We do not sell your data and do not use it for advertising or profiling.
Recipients and processors
Data is received only by the following services, each to the extent necessary for its purpose:
- Hosting and backup storage in the EU (both platforms): the server database and backups without location data. The provider is chosen by the operator before release.
- Availability monitoring (both platforms): checks only public server addresses and receives no personal data.
- Transactional e-mail provider (both platforms): your e-mail address, verification codes and e-mail notices, for example the reasons for a measure after a report.
- Google — Firebase Cloud Messaging (Android and iOS): the device registration token and the content of notifications (without location). On iOS the notification continues from Firebase through Apple.
- Google — Sign in with Google (Android): Google account identifier and e-mail. We do not store the name or photo from your Google account.
- Google — Maps SDK (Android): drawing the map on the device.
- Google — Play Integrity (Android): the result of the app and device integrity check and the installation identifier, used to protect registration against abuse.
- Apple — Sign in with Apple (iOS): Apple identifier, e-mail (including Apple’s private relay address) and an encrypted token used only to revoke the sign-in when the account is deleted.
- Apple — Push Notification service (APNs) (iOS): delivery of notifications sent through Firebase.
- Google Play and the Apple App Store: distribution of the app and payment for in-app purchases (Google Play Billing, StoreKit).
- Leaked-password check (Pwned Passwords): when you set a password, only a short prefix of its hash is sent, never the password or e-mail.
- Other Popby users: see what you allow them to see (see “Public profile”, “Precise location” and “Schedule and slots”).
- Public authorities, where the law requires it.
Transfers outside the EEA
Hosting and backups are in the European Union. Google and Apple services may also process data outside the European Economic Area, notably in the USA. Transfers rely on the European Commission’s adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses; the operator will add the specific legal basis for each service once the contracts with processors are concluded.
How long we keep data
- Account, profile, contacts, schedule and settings: until the account is deleted.
- Location: only the latest point, while a slot is active and briefly after it ends (minutes).
- Ended slots: 30 days after they end.
- Notification inbox: 30 days.
- Database backups: 14 days. A deleted account may remain in a backup for that long; after a restore from a backup, deleted accounts are deleted again from a record that contains only a random account identifier and the time of deletion.
- Operational logs: 14 days; IP addresses in them are shortened and invitation links have the secret part removed.
- Reports: remain even after the reporting or reported account is deleted (including the snapshot of nickname, note and city) so that an objection can be handled; the retention period will be set by the operator before the policy is approved.
- Purchase records: after the account is deleted they are anonymised, that is, detached from the account.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interest. You can withdraw consent to location sharing at any time. You can exercise most rights directly in the app (editing your profile, data export, account deletion); send other requests to support@popby.eu. We do not use automated decision-making with legal effects.
Account deletion and data export
You can delete your account in the app under account settings, or without the app on the Delete account page after verifying a code sent to the account’s e-mail address. Deletion is free and irreversible: sign-in stops working immediately and the other data is removed, with the exceptions listed under “How long we keep data”. You can get a copy of your data in a machine-readable format through the data export in the app.
Minimum age
Popby may be used only by someone who has reached the age for independent consent to data processing in online services in their country. In the Czech Republic this is 15 years; the app shows the thresholds of other countries during registration and checks them against your date of birth. We do not allow younger users to register. Users under 18 can be found by nickname only if they allow it themselves.
Right to lodge a complaint
If you believe we handle your data in breach of the rules, you have the right to lodge a complaint with a supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (www.uoou.gov.cz); you may also contact the authority in your own country.
Sign-in and app lock
- E-mail and password: we verify your e-mail with a code we send you. The server stores the password only as an irreversible hash and the operator does not know it. You recover a forgotten password by e-mail.
- Google and Apple: from the sign-in we receive only the account identifier and e-mail (for Apple also the relay address). The name from your Google or Apple account is never shown to other users.
- App lock: you can lock the app with a fingerprint, face or device PIN. Only your phone performs the verification; the app receives just the result. The server and the operator receive no data about your fingerprint or face.
Public profile and search
The nickname, public note and city are public to other users of the app. Others can find you by nickname (a nickname does not have to be unique and the number of searches is limited). Your e-mail is never shown to other users. A private nickname you set for a contact is visible only to you.
When text is saved, the app automatically rejects inappropriate words. This is a technical check at saving time, not a decision with legal effect; it is part of the terms of use for public texts. You can report an inappropriate profile; we handle reports manually within 7 days at the latest and tell you the outcome.
Schedule and slots
Your schedule (the weekly grid, imported events and one-off adjustments) is personal data stored on the server and synchronised between the devices of your account. Only you can see it; other users see only the slots you publish according to your visibility settings. The server computes candidate free slots from the schedule. The schedule is part of the data export and is removed when the account is deleted. The secret calendar link (for example from a school timetable) is stored only in the secure storage of your device and the server never receives it; the app processes an imported calendar file on the device.
Notifications
We deliver notifications through Google Firebase Cloud Messaging (and on iOS onward through Apple). Notification content contains no location. The in-app inbox keeps notifications for 30 days; you choose notification modes in the app. By e-mail we send only verification codes and notices about a measure after a report; the address in the sending queue is kept only until it is sent.
Purchases
Extra contact capacity can be bought through Google Play Billing (Android) or StoreKit (iOS). The store processes the payment; we receive no payment details. The server records the purchase or transaction identifier, product, time and status and verifies them with the relevant store. The records are part of the data export and are anonymised when the account is deleted.