Privacy Policy

1. Who we are

This Privacy Policy explains how wya ("we", "us", "our") processes personal data in connection with the wya consumer mobile app (iOS and Android), the organisation web application, and related services (together, the "Services"). The data controller responsible for your personal data is:

Lars Schlageter
Wollmatingerstraße 50A
78467 Konstanz
Email: contact@wya.social

For any question about how your personal data is handled, including requests to exercise the rights set out in section 8, contact us at contact@wya.social.

2. What data we collect

The data we process depends on which product you use. The wya mobile app is for consumers ("you"/"users"), and the web app is for organisations. We describe each below.

2.1 wya mobile app (consumers)

Account & profile

• Your phone number, which you use to sign in with a one-time code sent by SMS.
• A unique account identifier we generate for you.
• Profile details you provide: display name, an optional description/bio, and an optional profile photo.
• Authentication tokens, stored securely on your device to keep you signed in.
• Your privacy preferences (for example, who can see your profile picture and event attendance).

Contacts (only if you allow it)

• If you grant contacts access, the app reads the phone numbers in your device address book and sends them to us so we can show you which of your contacts already use wya and suggest groups. Contact display names remain on your device.
• You can decline or revoke this permission at any time in your device settings; the app works without it.

Location (only if you allow it)

• If you grant location access, we use your device's approximate/precise location (while the app is in use) to show nearby parties and events and to improve location search. We do not track your location in the background.
• When you search for or select a place, we send those coordinates or search terms to our geocoding service to resolve addresses.

Camera & photos (only if you allow it)

• Photos and videos you choose to capture or select — for your profile picture, stories, and event media — are uploaded to our media storage.

Content & social activity

• Stories you post (image or text, optional location, chosen visibility) and reactions to stories.
• Events you create or are invited to, your invitations, and your attendance.
• Groups you create or join, including their members.
• Messages you send in conversations/chats within the app.

Notifications

• If you allow notifications, we register a device push token (via Firebase Cloud Messaging) so we can deliver notifications about relevant activity.

Device & technical data

• Log data such as IP address, app version, device type, and timestamps, used to operate and secure the Services.
• Install-referrer information from the app store, used to understand how the app was installed.
• On-device preferences (for example, theme and locale) and locally cached data.

2.2 Organisation web app

Account data

• Organisation name and, where you sign in with Google, your Google account email address and name.
• Email address and a securely hashed password (for email/password sign-in).
• Authentication tokens, which are stored in your browser to keep you signed in.

Verification data

• The address and location (latitude/longitude) you submit to verify your organisation.
• Information provided during Google Business verification, where you choose to use it.

Content you create

• Public events you publish, including titles, descriptions, dates, images, and attendance data.

Technical data

• Log data such as IP address, browser type, and timestamps, processed to operate and secure the Services.
• Locally stored preferences (for example, your theme choice).

3. Device permissions (mobile app)

The mobile app asks for the following device permissions only when a related feature needs them. Each is optional, and the app remains usable if you decline. You can change these at any time in your device settings:

• Contacts — to find friends already on wya and suggest groups.
• Location (while in use) — to show nearby parties and improve location search.
• Camera & photo library — to add a profile picture, stories, and event media.
• Notifications — to deliver push notifications about relevant activity.
• Calendar — to add events you choose to your device calendar.

4. How we use your data

• To create and manage your account and authenticate you (phone number for consumers; email/Google for organisations).
• To provide core social features: stories, events, invitations, attendance, groups, and in-app conversations.
• To match your contacts against wya users and suggest groups, where you have granted contacts access.
• To show nearby parties and events and resolve places, where you have granted location access.
• To verify organisations and enable location-based features such as public events.
• To send service-related and push notifications about activity relevant to you.
• To operate, secure, troubleshoot, and improve the Services.
• To comply with our legal obligations.

5. Legal bases for processing (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to provide the Services you sign up for.
• Legitimate interests (Art. 6(1)(f)) — to secure, maintain, and improve the Services, and to prevent abuse.
• Consent (Art. 6(1)(a)) — where we ask for it, for example for access to your contacts, location, camera/photos, and push notifications. You may withdraw consent at any time through your device settings.
• Legal obligation (Art. 6(1)(c)) — where processing is required by law.

6. Sharing and processors

We do not sell your personal data. Content you post is shared with other users according to the visibility settings you choose. We otherwise share data only with service providers who process it on our behalf and under contract, including:

• Our own server in France, which we operate ourselves, runs the Services and stores your data and uploaded media; the facility it is housed in is provided by a hosting company under contract.
• Google, where you use Google Sign-In or Google Business verification.
• Firebase Cloud Messaging, to deliver push notifications.
• The SMS gateway that delivers your one-time sign-in code.
• The geocoding service our server queries to resolve places you search for or select.
• The map tile server and the weather service the app contacts directly when it shows a map or a forecast.
• The app stores (Apple, Google), which may provide us with install and delivery information.

Some providers may process data outside the European Economic Area. Where they do, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

7. Data retention

We keep personal data for as long as your account is active and as needed to provide the Services. When you delete your account, we delete or anonymise your personal data unless we are required to retain it to comply with legal obligations or to resolve disputes.

8. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure of your data.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at contact@wya.social. You also have the right to lodge a complaint with your local data protection supervisory authority.

9. Data security

We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), hashed passwords, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children

The Services are not directed at children under the age required by applicable law in your country, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the "Last updated" date above. Material changes will be communicated where required by law.

12. Contact us

If you have any questions about this Privacy Policy or how we handle your data, contact us at contact@wya.social.