Privacy Policy

Draft. This text shows which sections the privacy policy will have, not its final wording. Until legal review is complete, only the actual technical commitments of this website apply (e.g. no cookies, section 8).

1. Data controller

The controller responsible for processing your data is Varatharajan Solutions, sole proprietorship, Am Mattenhof 2b, 6010 Kriens, Switzerland (UID CHE-437.293.198). Contact for privacy questions: support@anyup.app.

2. Overview: what data we process

anyup processes personal data to provide the product at all: in particular for account and sign-in, identity and age verification, your profile, activities and participation, the group chat, reporting and blocking, and support. Which data we process for each purpose, and on which legal basis, is set out in the paragraphs below and in section 3.

• Account, sign-in, and identity/age verification
• Profile (first name, age, gender, photos, spoken languages, your interests if you add them and, if you choose, your nationality), see below
• Location: foreground only, only on your tap, never leaves the device
• Activities, participation and invitations
• Messages in the activity chat
• Reporting and blocking
• Support cases and appeals against measures, see below
• App updates: a check on every start, see below
• Protecting sign-in: device attestation, see below

We deliver bug fixes without you having to download anything from the store. To do that, the app asks our service provider Expo (650 Industries, USA) on every start whether a newer version is available. This request contains your IP address, the platform, the app and operating system versions, your device's language setting, the channel, and a random identifier of your installation that Expo needs to count active installations. It contains no account data and nothing that names you as a person; the identifier has no link to your account and is gone once you uninstall the app. There is no switch for this, because without the check, security fixes would not reach you. The legal basis is our legitimate interest in a secure, working app (Art. 6(1)(f) GDPR).

When you sign in with your email address, the app proves that the request comes from the genuine anyup app on a genuine device. This protects sign-in, and other people's inboxes, from automated requests. On iPhone we use Apple App Attest, on Android Google Play Integrity. Your device has Apple or Google (both based in the USA) confirm that the app and the device are genuine, and sends them information about the device and the app for this; they do not learn your email address. On our side we store, for iPhones, the identifier of a device key, the public key and a counter, with no link to your account, your email address or your IP address. If the key is not used for six months, we delete it. We only evaluate Google's result and do not store it. Because the key is not linked to any account, we cannot match it to you in response to an access request without collecting additional data about you (Art. 11 GDPR). If your device cannot provide this proof, we show a short hCaptcha task instead. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

With your ID you confirm your identity through Stripe Identity. To do this, you take a photo of your ID and of yourself at Stripe, and Stripe compares your selfie with the photo in your ID. In this comparison Stripe processes biometric data. We only receive the result, a general reason, the verified date of birth, the timestamp and a reference number from Stripe, never your ID image, your selfie or the name on your ID. The legal basis for the comparison is your explicit consent (Art. 9(2)(a) GDPR; Art. 6(7)(a) FADP). You give it in the app before the check, and we record when and in which version. The consent is voluntary, because anyup also works without an ID: through the path “confirmed by people”. Once five hosts who have verified their own ID confirm, after five different activities with you, that you are the person on your profile, you may send requests and chat. Only hosting requires the check with your ID. We have Stripe delete the selfie and the ID image after every completed check; at Stripe this can take up to four days. You can withdraw your consent at any time under “Account & Privacy”. Your account then stays verified, because the check up to that point was lawful. We cancel a running check and have Stripe delete whatever is still held there from your checks, which can also take up to four days. A new check only starts after a new consent. We keep the proof of your consent (version, time it was given and of any withdrawal) until your account ends, and for six months after that.

If Stripe reports that you are under the age of majority, we store only this fact and the timestamp, no text from Stripe. Your account remains; a further ID check is no longer possible for it. The purpose: we avoid further paid checks that Stripe would decline anyway, and enforce the minimum age for hosting. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). The note appears in your data export, our moderation team can view it, other users never. It is deleted when your account ends; afterwards the check result without personal reference remains for six months. If the check finds a verified age under 18, your account ends immediately and permanently. What remains is the non-reversible fingerprint of your ID with its status, the check result without personal reference, and your consents as proof, each for six months.

Our moderation team reviews main photos. If you remove your main photo while its review is still open, it is invisible to everyone else immediately, and you no longer see it either. Moderation keeps it until it has decided, for at most 30 days. The purpose: the photo review should not be avoidable by removing a photo in time. With the decision, this exception ends. The legal basis is our legitimate interest in the safety of the platform (Art. 6(1)(f) GDPR).

In your profile you state which languages you speak. This is required: at least one and at most five from a fixed list, no free text. Which ones you name is up to you. The purpose: people who meet you should know which language you can use with each other. Your languages are visible to anyone who may see your profile, including the host when you request to join an activity. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).

You can choose up to five interests from a fixed list if you like, such as hiking or board games, no free text. The purpose: people who look at your profile should be able to tell whether you are a good match, including the host when you request to join an activity. Your interests are visible to anyone who may see your profile. Interests you share are shown first; the app compares them on the viewer's device, and we store nothing about it. You can change your selection or remove it entirely at any time. The list contains no entries on religion, beliefs, politics, trade unions, health, sex life or origin. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).

You can state your nationality voluntarily, up to two countries. We store it because you enter it (consent, Art. 6(1)(a) GDPR), and you can remove it at any time. Others only see it if you turn on the switch “Show on my profile”. It is off by default; then only you see it. Because a nationality can allow conclusions about your origin, turning the switch on is your explicit consent (Art. 9(2)(a) GDPR, Art. 6(7) FADP). We record every change with its time. You withdraw your consent by turning the switch off or by removing all countries; the withdrawal takes effect immediately.

We use neither languages, interests nor nationality for any filter, search, ranking or access rule of an activity. They are not included in error reports. They appear in your data export, your interests with their names and the time of the last change, your nationality together with the state of the switch and your consents. We delete them with your account, like your first name, once the deletion becomes final after seven days; during those seven days nobody else sees them. If your account ends because the check finds an age under 18, we delete them immediately.

Through support in the app you can ask a question, report a problem, or file an appeal against a measure we have imposed on your account. This also works if your account is restricted or suspended. For a support case we store the type of request, your messages (up to 2000 characters each), our team's replies and the times. For an appeal we link the case to the measure and record its type, reason and period in the case. Only you and our team can see the case. When viewing a case, the team sees the case with its history, for an appeal also the current status of the measure, and from your account your first name and the state of your account, for example whether it is suspended, plus its internal ID. The view shows no other data about you, such as reports or chats. A decision on an appeal is always made by a person. If the team rejects it, it tells you the reason for the measure and explains why your appeal does not change it. When the team replies, you get a notification that says “Support has replied”, never the content of the reply. Your messages are free text: write only what we need for your request, and leave out details about health, religion, political opinions or sexual orientation unless they are necessary for it. A case is deleted together with its history six months after it is closed. If you delete your account, we close your open cases immediately; once the deletion becomes final after seven days, we delete all your cases. Our internal admin log records for twelve months who in the team replied to a case, linked it to an earlier case or closed it, and when. The entry contains the IDs of your account and of the cases, and when a case is closed also a reason the team must give, but never the text of the messages. These entries remain for the twelve months even if you delete your account. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).

3. Legal bases

We state the legal bases under the EU General Data Protection Regulation (GDPR). The Swiss Federal Act on Data Protection (FADP) does not require a legal basis for processing; where it requires explicit consent, we obtain it (Art. 6(7) FADP). For the paragraphs in section 2, the legal basis is given there.

Performance of our contract with you (Art. 6(1)(b) GDPR). Without this data we cannot offer anyup:

• Account and sign-in: your email address, the sign-in method (Apple, Google or email) with its user ID, the state of your account, the time you registered, and your session. When you sign in by email, we send you a one-time code; it is valid for ten minutes and we only store it as a non-reversible hash.
• Identity and age verification apart from the selfie comparison: the result, a general reason, the verified date of birth, the timestamp and a reference number from Stripe. anyup is only open to verified adults.
• Profile: first name, date of birth, gender, photos, languages and interests. Others see your first name, age, gender, languages, interests, whether you are verified and since when you have been a member. Nobody but you sees your exact date of birth or your email address. Your main photo is visible to the host and accepted participants of shared activities until seven days after they end, to your friends, and to the host of an activity you request to join.
• Activities: title, description, category, languages, time, places, and the meeting point as an exact address with a note for the group. Before the host accepts someone, that person only sees a neighbourhood label and a map point shifted by 200 to 500 metres. Only people the host has accepted see the exact address.
• Map: our server receives the map area you are looking at, so that we can show you the activities in it. We do not store a history of your map areas.
• Requests, participation and invitations: your request with its state and timestamps, your participation, and invitations you receive or send. The host sees your request; they do not see withdrawn requests.
• Chat: the wording of your messages (up to 2000 characters), replies, reactions and one read marker per chat. Others only see a number from the read marker, never a name and never a time. That someone is typing is shown but never stored. We do not analyse the content. What you write is free text: leave out details about health, religion, political opinions or sexual orientation if you do not want to share them. If you delete your account, your messages remain, but without your name, so that the conversation stays readable for the others.

Your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time; the withdrawal takes effect immediately:

• Push notifications: we store a push identifier of your device and its language, no device name, no model, no operating system version and no IP address. A notification names the type of event, the title of the activity and the first name of the person involved, never the wording of a message and never a photo. It is not encrypted towards the delivery services: Expo, Apple and Google see the text. You allow notifications per category, and we record when you give and withdraw consent.
• Location: only when you tap for it, and only while the app is in the foreground. It centres the map and is used to calculate distances on your device; your position never goes to our server. The app also works without your location.
• Main photo while exploring: with the switch “Show photo to people exploring”, people outside the circle above see it too, including people who have not yet confirmed their identity. It is off by default.
• Error reports through Sentry: only after your consent, off by default. They contain your user ID, but no email address, no tokens and no codes.

Our legitimate interest (Art. 6(1)(f) GDPR), above all in the safety of our users:

• Abuse prevention: we count actions such as sign-in attempts, code requests, checks, new activities, requests, invitations, messages and reports per account and time window, and at sign-in also per IP address and email address. If someone reaches a limit, we record this as a security event.
• Reporting: we store the type and ID of the reported target, one of seven fixed reasons, your optional note (up to 500 characters) and the time. We also freeze a copy of the reported content, for a message together with up to five messages before and after it, including messages from people not involved. Only moderation reads the note; do not put details about health, religion, origin, sexuality or political opinions in it. The reported person learns neither that a report was made nor by whom, because telling them would remove the protection of the person who reported (Art. 14(5)(b) GDPR, Art. 20(3) FADP).
• Blocking: we store who blocked whom and when. The blocked person is not told.
• Moderation: our team sees reported content only for the case at hand, not as a searchable collection. A person reviews main photos against the photo rules, without technical face recognition and without comparing them to the selfie from the identity check; our team never sees that selfie. We calculate indications of conspicuous behaviour, which only trigger a review by a person. Every measure against an account is decided by a person; there is no automated decision within the meaning of Art. 22 GDPR.
• Late withdrawal: if you give back a confirmed place less than six hours before the start, we record your account, the activity and the time. The note is not shown to anyone.
• Confirmation by hosts: which host confirmed, after which activity, that a person is the person on their profile. We only store the yes.
• Backups: we back up the database daily so that we can restore it after an outage.
• This website: our host logs technically necessary requests with IP address, time and the path requested.

Proof (Art. 6(1)(c) and Art. 7(1) GDPR): we record when you gave or withdrew which consent and when you confirmed that you are at least 18, each with the version of the terms and the privacy policy.

4. Recipients and processors

We use service providers who process data on our behalf (among others for hosting, identity verification, email delivery, error diagnostics, and app update delivery). We do not sell data and do not use advertising networks. Working on our behalf are:

• Supabase: database, sign-in and files, including your photos. The data is stored in Zurich, Switzerland. The provider is based in the USA.
• Stripe: identity and age verification. Your ID image, selfie, name and date of birth are held by Stripe. Based in the USA, processing worldwide.
• Resend: sending the sign-in emails with your email address and the code, from Ireland. Based in the USA.
• hCaptcha (Intuition Machines): protecting sign-in when device attestation does not succeed, with your IP address and browser and device signals. Based in the USA, processing worldwide.
• Expo (650 Industries): delivering push notifications with the push identifier and the text, and delivering app updates (section 2). Based in the USA.
• Vercel: running this website and our admin tools. The servers are in Frankfurt, Germany; pages are delivered from locations worldwide, each close to you. Based in the USA.
• Sentry: error reports, only after your consent. The data is stored in Germany. Based in the USA.
• Mapbox: map and place search, see below.

For some steps, Apple and Google are responsible themselves: when you sign in with them (email address and user ID), when they deliver notifications to your device (Apple Push Notification Service, Firebase Cloud Messaging), and for device attestation (Apple App Attest, Google Play Integrity, section 2). Their own privacy policies apply to this, for example apple.com/legal/privacy. Both are based in the USA.

Map and place search: The map and place search in the app are provided by Mapbox. When you use the map or search for an address, the map area, your search term, your IP address and device signals go directly from your device to Mapbox, without passing through our server. Mapbox processes this data on our behalf. We have switched off the usage and diagnostics telemetry of the map SDK; Mapbox only receives what is needed for map tiles and search. Mapbox stores the data in the USA and keeps IP addresses for 30 days. Mapbox also uses request data in anonymised, aggregated form to improve its services.

5. International transfers

Your app data is stored in Switzerland, in Zurich. For people in the EU this needs no further safeguards, because the European Commission has found that Switzerland offers an adequate level of protection. Some service providers from section 4 process data in other countries. We disclose data to these countries:

• Ireland (Resend) and Germany (Sentry, Vercel's servers). Under Swiss law, both countries offer an adequate level of data protection.
• USA (Stripe, hCaptcha, Expo, Vercel, Mapbox, Apple and Google). The USA does not offer a generally adequate level of data protection. Mapbox and Expo are certified under the Data Privacy Framework between the EU, Switzerland and the USA and have also agreed the European Commission's standard contractual clauses with us. Stripe relies on the Data Privacy Framework and standard contractual clauses, hCaptcha and Google on the Data Privacy Framework, Vercel and Apple on standard contractual clauses.
• Belarus: Mapbox uses a group company in Belarus as a subprocessor. Mapbox is liable for it under its contract with us. The current list is at mapbox.com/legal/subprocessors.
• Other countries: Stripe and hCaptcha process data worldwide, Mapbox and Vercel deliver through caches in many countries, and Apple and Google deliver notifications worldwide. We cannot name these countries one by one.

6. Retention periods

• Check result without personal reference: six months after the account ends
• Proof of consent after the account ends: six months
• Fingerprint of your ID against bypassing a suspension: six months after the account is deleted
• Moderation cases: until closed, then six months
• Internal admin log: twelve months, without the text of your messages
• Removed main photo with an open review: until moderation decides, at most 30 days
• Backups of our database: seven days; anything we delete is gone from the backups after that (photos are not part of them)
• Account and profile: until you delete your account; the deletion can be undone for seven days, after that it is final
• Removed photos: within 24 hours; if a report about the photo is open, until the case is closed
• Rejected photos: 30 days, longer only in an open moderation case
• Previous first names: six months
• One-time sign-in code: ten minutes
• Meeting point and host's note: three months after the activity ends
• Link between an activity and its host: twelve months after it ends; after that, title, category, area and times remain without personal reference
• Requests and invitations that did not lead to participation: three months after the activity ends
• Participations: twelve months after the activity ends
• Note about a late withdrawal: six months
• Chat messages: three months after the activity ends
• Confirmations by hosts: twelve months from when they are given, then a fingerprint without the host's ID for another twelve months
• Measures against an account: six months after they expire or are lifted
• Support cases: six months after they are closed
• Push identifier of your device: until you sign out or delete your account, otherwise six months after the last successful delivery
• Abuse counters: 24 hours
• Security events: six months
• Sign-in device key on iPhone: six months after it was last used
• Error reports: 30 days
• Access logs of this website at our host: one day

We keep the fingerprint of your ID after a deletion so that a suspension cannot be bypassed with a new account. It is non-reversible and only exists if you verified your identity. A moderation case, for example about a report concerning you, remains even if an account involved is deleted; this way, a report does not come to nothing. In the internal admin log we record what our team did in the admin tools to your account or to your cases in support, so that it stays traceable who in the team did what. These entries remain for the twelve months even if you delete your account. For the fingerprint and for moderation cases, the legal basis is our legitimate interest in the safety of our users (Art. 6(1)(f) GDPR).

Where the list gives no period of its own for data of your account, we keep it as long as your account exists. If you delete it, the process in section 7 applies. If your account ends because the check finds an age under 18, we delete immediately and permanently; section 2 lists what remains after that.

7. Your rights

Depending on the applicable law, you have the right to access, rectification, erasure, restriction of processing, data portability, objection, and to lodge a complaint with a supervisory authority. You can delete your account, export your data, and manage your consents directly in the app.

In the app, you delete your account under “Account & Privacy”. You are signed out immediately, and from then on your account is invisible to others and anonymised. For seven days you can undo the deletion by signing in again; after that, it is final. Restoring brings back your account with your profile, photos and settings, along with blocks in both directions. Your relationships with others (participations, requests, invitations, friendships, reviews) and your cancelled activities do not come back. A confirmed business profile does not come back either. All notifications are off afterwards until you turn them back on yourself. Section 6 lists what is kept longer after a deletion.

If you can't use the app, for example because your account is suspended, request the deletion by email to support@anyup.app from the address your account is signed in with. The request only counts once you have confirmed it from that inbox; from then on, processing takes no more than 30 days. We delete your account the same way as in the app, so this deletion can also be undone for seven days. A suspension stays in place. To find your account, our team searches the admin tools only for the exact address; there is no list and no partial search. The search leaves no entry, and the address searched for is not recorded anywhere. Only the deletion itself goes into the internal log, with your account's ID and the reason, without your address. The email with your request stays in our support inbox until the request is completed and is deleted 30 days after that.

If you ask whether others have reported you, we tell you the number and general status of these reports, but no names and no content, so that the people who reported stay protected (Art. 15(4) GDPR, Art. 26(1)(b) FADP). We answer requests about your rights within 30 days. The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. If you live in the EU, you can contact the supervisory authority of your country of residence.

8. This website: no cookies, no tracking

This website (anyup.app) sets no cookies, loads no tracking and no analytics, and makes no requests to third parties. Fonts and images are served by the site itself. That’s why there is no consent banner here: there is nothing to consent to. This is a commitment about this website only, not about the app.

9. Data security

We protect your data with technical and organisational measures (Art. 32 GDPR, Art. 8 FADP):

• The database itself enforces who may see which data, with rules per row (Row Level Security), not only the app. Automated tests check these rules, including that they turn away people without access.
• Photos are kept in private storage and can only be retrieved through time-limited addresses.
• We store sign-in codes only as a hash, and your ID only as a non-reversible fingerprint. We never store your ID image or your selfie.
• Our team signs in to the admin tools with a second factor and has one of two roles, admin or moderation. We record every action with extended rights in the internal log.
• This website and our admin tools can only be reached encrypted over HTTPS.
• Against abuse, we limit actions per account and time window (section 3).
• We back up the database daily and keep the backups for seven days.

10. Changes to this policy

We may update this policy. The current version always lives at this URL; there are no separate, versioned addresses for older versions.

11. Contact

Send privacy questions to support@anyup.app.