Privacy Policy
This Privacy Policy explains what personal data Drop In collects, how we use it, and the rights you have over it.
1. Who we are
Drop In (“the App”, “we”, “us”) is operated by Drop In. We are the data controller responsible for the personal data described in this policy.
If you have any questions or want to exercise your privacy rights, contact us at dropin.app.contact@gmail.com.
2. Data we collect
We collect the following categories of personal data:
- Account data: your phone number (when you sign in by SMS code), or the identifier and email provided by Apple or Google when you use social sign-in.
- Profile data: an automatically generated username, an avatar you select, your gender, and your date of birth.
- Location data: approximate or precise device location, used to show events near you. You can also set a location manually instead. When you choose an area to browse, we store that chosen location and radius so we can notify you about relevant nearby events.
- Content you create: events you host, events you join, and messages you send in event chats.
- Technical data: a push-notification token and basic device information needed to deliver the service and notifications.
- Diagnostic data: when the App crashes or errors, we collect crash reports, error details, device and OS information, and your IP address to diagnose and fix problems. We also record a small sample of app sessions (session replay) to understand and resolve issues; on-screen text and images are masked before these recordings are sent.
3. How and why we use your data
We use your data to create and secure your account, show and let you join nearby events, enable event chats, send notifications you have allowed, prevent abuse, and comply with legal obligations.
Our legal bases under the GDPR are: performance of our contract with you (providing the App); your consent (device location and push notifications, which you can withdraw at any time in your device settings); our legitimate interests (keeping the service safe and functional); and compliance with legal obligations.
4. Who we share data with
We do not sell your personal data. We share it only as needed to run the App:
- Other users: your username, avatar, and the events you host or join are visible to other users; messages you send are visible to members of that event chat.
- Service providers (processors) acting on our instructions: Supabase (database, authentication, and hosting), Apple and Google (sign-in), Expo (push-notification delivery), Google Maps/Places (maps and location search), and Sentry (crash reporting and diagnostics).
- Legal and safety: authorities or third parties where required by law or to protect the rights and safety of our users.
5. International transfers
Some of our service providers may process data outside the European Economic Area. Where they do, the transfer is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
6. How long we keep it
We keep your personal data for as long as your account is active. When you delete your account in the App, we delete or anonymize your profile, messages, and participation data, except where we must retain limited information to meet a legal obligation or resolve disputes.
7. Your rights
Subject to applicable law, you have the right to access, correct, delete, or export your data, to restrict or object to certain processing, and to withdraw consent at any time.
You can delete your account and associated data directly in the App (Profile → delete account). For any other request, contact us at dropin.app.contact@gmail.com. You also have the right to lodge a complaint with your local data-protection authority (in Croatia, AZOP).
8. How we protect your data
Data is encrypted in transit. Your session tokens are stored in your device’s secure keychain/keystore, and database access is restricted per-user by row-level security so you can only reach data you are authorized to see. No system is perfectly secure, but we work to protect your information.
9. Children
The App is not intended for anyone under 18. We do not knowingly collect data from children under 18. If you believe a child has provided us data, contact us and we will delete it.
10. Changes to this policy
We may update this policy from time to time. If we make material changes, we will update the date above and, where appropriate, notify you in the App.
11. Contact
Questions about this policy or your data? Email us at dropin.app.contact@gmail.com.