This is an English translation. If it differs from the Hungarian version, the Hungarian version prevails.

This policy describes what personal data the Swipr mobile application (the "App") collects, for what purposes it uses that data, with whom it shares it, how long it stores it, and what rights users have. This policy is based on the European Union's General Data Protection Regulation (GDPR).

1. The data controller

• Name: Sun Mark egyéni vállalkozó
• Registered address: 5900 Orosháza, Könd utca 78. A épület 1. emelet 4. ajtó
• Tax number: 92371457-1-26
• Data protection contact: dev.sunmark@icloud.com

Questions and requests about data protection can be sent to us at the email address above.

2. Who may use the App

The App is intended only for persons aged 18 or over. At registration, users must declare that they are aged 18 or over; registration cannot continue without it. If we become aware that an account belongs to a person under 18, we delete the account and the data associated with it.

3. What data we process

Account and profile data

• Email address (for registration and sign-in; we do not use passwords; sign-in is done with a one-time code sent by email, or with a Google or Apple account. When signing in with a social account, we receive and store the account's unique identifier and the email address from that provider)
• The name shown on the profile and the unique username (@handle)
• The declaration that the user is aged 18 or over, and when it was made
• Birth year and gender, both optional, given at registration or later in the profile. We use them so that organisers can also specify by age and gender who their event is for: users see the events whose audience they belong to. Birth year and gender are not shown on the profile and other users cannot see them
• Profile picture(s), which the user selects from the phone's gallery (the App has no access to the camera and can only access the selected images)
• Background picture, bio, interests (interest tags), and up to 3 additional uploaded images

Location data

• Precise (GPS) location data, only while the App is in use and with the user's permission. We use it to show the user's location on the map and to calculate the distance of nearby events.
• We do not share the user's location with other users.
• To find events nearby, the App sends the precise location to the server; we use it only to work out the answer, do not store it, and filter it out of the logs. We do not collect location data in the background, outside the use of the App.
• We store only the most recent location, rounded to about 1 km, so that we can notify the user about new events created near them (within about 10 km) that match their interests; we only send such a notification if the stored location is no older than 7 days. It is updated when a list of events loads (even if nearby-event notifications are turned off), when the rounded location changes, and otherwise at most once a day; it overwrites the previous value, and is deleted when the account is deleted.

Events and activity

• Data of the events created by the user (name, description, approximate venue, time, tags, cover image)
• Swipes, applications, answers given when applying to the organiser's question, approvals
• Friend requests, liked events
• Ratings of past events (1–5); events rated 4 or 5 are highlighted on the user's profile, the rating itself is not visible to others
• Invitations: whom the user invited to an event and who invited them; the event's participants and organiser can see who invited whom
• The state of the fuel tank (the application limit) and the chosen fuel, whose rocket is visible to everyone on the profile
• Search history (searches made in the App), so that you can quickly return to earlier searches. The last 10 searches are stored only on the phone and are not sent to the server; they can be deleted one by one or all at once in the search screen, and other users signing in on the same phone do not see them
• Saving to the calendar: on request, the App opens the phone's own calendar editor; on iOS, the phone may ask for calendar access for this, and for contacts access for place suggestions. Calendar and contacts data stay on the phone and are not sent to us

Messages

• Event chat messages, and how far the members have received and read them (from which the chat shows the sender that their message was read)
• Who is in the chat right now: the chat's members see how many members are present
• The setting if the user mutes a chat
• Private messages between friends

Safety and moderation data

• Reports of other users, events or chat messages (the chosen reason and the text written with the report), blocks
• When a sign-in code is requested or entered, the IP address and an encoded form of the email address, for at most an hour, to protect against overload and code guessing. If someone starts registering with a new email address but doesn't finish, we keep the email address for at most 30 minutes
• If the organiser removes someone from their event, we record it, and the organiser sees it with a later application

Feedback and enquiries

• Feedback sent from the App: the chosen category (bug, idea or other) and the text of the message, the App's version, the phone's operating system and its version, and the App's language. We store the feedback linked to the account and forward it to ourselves by email, so that we can reply to the account's email address.
• If the user writes us an email from the App, the email also contains the App's version, the phone's operating system and the user's @username. The user sends the email from their own mail app and can change it before sending.

Technical data

• Push notification token, which we use to send notifications (e.g. a new application, an approval, a new message, a friend's new event).
• Settings: the notification settings; the App's language, in which we send notifications and emails; and the phone's time zone, so that quiet hours follow the user's local time.
• Error reports and operational logs: when an error occurs in the App or on the server, and to monitor the server's performance, we record technical data (e.g. the description of the error, the device type and operating system version, the address and time of the request, the user's identifier). Location data, sign-in codes and tokens are filtered out of them; text typed into the people search may get into the logs, though. The App's error tracking also collects data about the App's performance (e.g. loading times).
• We do not use advertising identifiers or usage or advertising analytics. For push notifications we use the phone's push identifier.

"Suggested by Swipr" events

• We collect these events from public sources (for example organisers' websites) and publish them with the real organiser's name and a link to the source. For the search we use Anthropic's service, which only receives the area searched, no user data.

We do not currently process payment data. If paid features are added to the App, we will update this policy beforehand.

4. Purposes and legal bases of processing

• Providing the service (account, profile, events, swiping, applications, chat, friends, map): performance of a contract (Article 6(1)(b) GDPR).
• Use of precise location data: the user's consent (Article 6(1)(a)), which can be withdrawn at any time in the phone's settings. Without consent, the map and distance calculation do not work, or work only to a limited extent.
• Safety, handling of abuse, moderation: legitimate interest (Article 6(1)(f)), namely protecting users and the security of the platform.
• The declaration of being at least 18 years old and its time: legitimate interest (Article 6(1)(f)), namely ensuring and being able to demonstrate that only adults use the App.
• Keeping reports and reported content until the case, and any proceedings by an authority, are closed: legitimate interest (Article 6(1)(f)), namely protecting users, establishing, exercising or defending legal claims, and cooperating with authorities; where the law or a request from an authority requires keeping or handing over the data, compliance with a legal obligation (Article 6(1)(c)).
• Error reports and operational logs: legitimate interest (Article 6(1)(f)), namely keeping the App secure and reliable, identifying and fixing technical errors, and monitoring the system's performance.
• Backups: legitimate interest (Article 6(1)(f)), namely being able to restore the data after an outage or data loss.
• Notifications (e.g. a new application, a friend's new event): performance of a contract; push notifications can be turned off in the phone's settings.
• Service emails (sign-in and account deletion codes; notices of significant changes to the terms of use or to this notice, of removed content or of a deleted account): performance of a contract (Article 6(1)(b)); where the law requires the notice, compliance with a legal obligation (Article 6(1)(c)).
• Handling feedback and enquiries (replying, investigating reported bugs, improving the App): legitimate interest (Article 6(1)(f)), namely answering users' questions, and fixing and improving the App.
• Handling user requests (e.g. providing a copy of the data, deleting data, confirming an account deletion): compliance with a legal obligation (Article 6(1)(c)).
• "Recommended by Swipr" events (the event's publicly published details, the organizer's name and the source link, collected from public sources rather than from the person concerned): legitimate interest (Article 6(1)(f)), namely informing users about public events in their area. The organizer can object to this as described in section 9.

5. Who can see the data

Other users

• The profile (name, @username, profile picture, background picture, bio, interest tags) is visible to other users. The up to 3 additional images uploaded to the profile are visible only to the user's friends by default; the user can make them visible to everyone when editing their profile. The profile also shows which events the user has organised and which they rated 4 or 5; this list is visible to all users, but only the event's name and a small image are shown, without venue, time or other details. The profile also shows the chosen rocket, the number of events organised and attended and the number of friends, and to the viewer the number of mutual friends and of events attended together. A user's friends list is visible to their friends.
• Created events appear in the feed and on the map. The organiser can choose to make the exact address and the description visible only to approved participants. Only approved participants see the full list of participants; the event's card shows everyone the number of participants and the name and profile picture of up to 3 of them.
• The event chat is visible to the approved participants of the event. Private messages are visible only to the two parties involved.
• Users can also forward an event with a share link. The link points to a unique address that cannot be guessed and is not indexed by search engines, so only the people it was sent to can see it. Anyone who opens it can see, even without the app, the event's name, cover image, time, tags, age range, the organiser's @username, the number of participants and the spots left, as well as – unless the organiser has made them private – the venue and the description, and also the name of the person who sent the link. The link does not show the list of participants.

Data processors (external service providers) We use the following service providers to operate the App; they process the data solely on our behalf:

• Server, database and image storage: RackForest Zrt. (1132 Budapest, Victor Hugo utca 11. 5. em. B05001.; the data is in Hungary)
• Email sending (sign-in and account deletion codes, and forwarding feedback to us): Resend, Inc. (United States)
• Push notifications: Firebase Cloud Messaging (Google LLC, United States) and Apple Push Notification service (Apple Inc., United States)
• Map: Mapbox, Inc. (United States)
• Address search when creating an event: Google Places (Google LLC, United States); the address or place name typed in is sent to it
• Searching the web for "Suggested by Swipr" events: Anthropic, PBC (United States); no user data is sent to it
• Error tracking: Sentry (Functional Software, Inc., United States); server monitoring: Laravel Nightwatch (Laravel Holdings Inc., United States); it stores the data in the European Union, for at most 90 days

Data is transferred to the service providers based in the United States (except Laravel Nightwatch, where the data stays in the European Union) under the EU–US Data Privacy Framework where the provider is certified under it, and otherwise under the European Commission's standard contractual clauses. On request, we provide information about these and a copy of them at dev.sunmark@icloud.com.

We do not sell the data and do not share it with third parties for advertising purposes. We do not send newsletters or marketing emails; we use the email address only to send sign-in and account deletion codes, to respond to user enquiries (including confirming an account deletion and sending a requested copy of the data), and for important notifications about the service (e.g. a significant change to the terms of use or to this policy, or the removal of content or deletion of an account for breaking the rules).

6. How long we store the data

• Event chat messages: deleted automatically 24 hours after the event ends, except for reported messages (see reports below).
• Events: the data of the event (name, description, cover image, venue, time, participants) is kept after the event has ended, because past events can be viewed on the user's profile and in the App's calendar. We keep these even after the organiser's account is deleted, without the organiser's personal data. The organiser can cancel an event that hasn't ended yet; all data of a cancelled event is permanently deleted after 30 days. Reported events are kept until the case is closed.
• Notifications: the notifications shown in the App are deleted automatically after 90 days; the user can delete them earlier.
• Pictures: the profile picture, the background picture and uploaded images can be replaced or deleted at any time; an event's cover image can be replaced. Sent chat messages cannot be deleted individually.
• Profile picture, profile data: until the account is deleted.
• Private messages between friends: they stay in the conversation; if the sender deletes their account, their messages remain with the other party as coming from a "deleted user" with no personal data.
• Location data: the precise location is not stored; the rounded most recent location is kept until its next update, at most until the account is deleted.
• Error reports, operational logs: for as long as needed to investigate the errors, at most 90 days; they are then deleted automatically.
• Backups: we keep database backups for at most 30 days, after which they are deleted automatically, so deleted data disappears from the backups within 30 days at the latest.
• Reports and reported messages: we keep the report and the reported chat messages until the case and any official proceedings are closed, even after the event chat has been deleted.
• Feedback: until the account is deleted; it is deleted together with the account. The copy forwarded to us by email and the correspondence with the user are kept until the enquiry is closed.
• Account deletion: when a user's account is deleted, we permanently delete their personal data (profile, email address, images, location, applications, connections, notifications, invitations, feedback). In place of the account, a "deleted user" with no personal data remains: the messages they sent, the past events they organised and their ratings stay linked to it and can no longer be connected to their name; their events that haven't ended yet are taken over by an approved participant or cancelled. Details: https://swipr-app.com/delete-account.

7. Reports and moderation

Users can report other users and events, and can block other users. After a block, the two users don't see each other anywhere: not their profiles, not their created events, not among an event's participants and not their chat messages, and they cannot apply to each other's events or send each other private messages. The blocked user is removed from the blocker's events (they are notified of the removal, not of the block), and the blocker leaves the blocked user's events; their friendship (or friend request) also ends. If both take part in a third person's event, they don't see each other there either, but for safety we notify the blocker that the blocked user is there too. Reports are investigated personally by the operators. During the investigation we may view the reported profile, event and the content related to the report. We may delete accounts that violate the terms of use.

8. Data security

• Communication between the App and the server is encrypted (HTTPS).
• We do not store passwords; sign-in is done with a one-time email code, or with a Google or Apple account.
• Only the operators and the necessary service providers have access to the data.

9. Users' rights

Under the GDPR, the user has the right to:

• access the data stored about them,
• request the rectification of their data,
• request the erasure of their data,
• request the restriction of processing,
• object to processing based on legitimate interest,
• request their data in a portable format,
• withdraw their consent at any time.

Requests can be sent to dev.sunmark@icloud.com. On request, we collect a copy of the data and send it as a file to the email address associated with the account.

A complaint can be lodged with the Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information, NAIH, 1055 Budapest, Falk Miksa utca 9-11., www.naih.hu), or with the data protection authority of the user's EU country of residence.

10. Deleting the account and data

The account and the personal data associated with it (as described in section 6) can be deleted:

• in the App: in the side menu or on the Profile page, under Settings, with the Delete account button,
• also without the App, on the following page: https://swipr-app.com/delete-account, or by email at dev.sunmark@icloud.com.

11. Changes to this policy

We may change this policy, for example when introducing new features. In the case of a significant change, we will notify users at least 15 days before it takes effect, by email. The version currently in effect is always available on this page.

12. Contact

Sun Mark egyéni vállalkozó, dev.sunmark@icloud.com