Privacy Policy
Introduction
Effective 12 June 2026 Frendis is operated from Barcelona, Spain. This Privacy Policy explains what personal data we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).
DATA CONTROLLER
Frendis · Barcelona, Spain · hello@frendis.app
1. DATA WE COLLECT
Account data — your name, email address, and profile photo, received from Google when you sign in via Google OAuth. Profile data — display name, bio, interests, languages, goals, and profile photo that you add to your Frendis profile. Location — the city you select (currently Barcelona). We do not collect your GPS coordinates. Activity venues are stored but are shared only with approved participants; other users see only the approximate neighbourhood until they join and are approved. Activity data — activities you create or join, RSVP and attendance records, chat messages, and reviews you write. Technical logs — server logs including IP addresses, request identifiers, and timestamps, retained for up to 90 days for security and debugging purposes.
2. HOW WE USE YOUR DATA
To operate the Service — matching you with activities and people nearby in Barcelona. To send notifications — in-app, by email, and optionally via Telegram. To keep the platform safe — moderating content and investigating reports of abuse. To comply with legal obligations — under Spanish and EU law. We do not sell your data, share it with advertisers, or use it for profiling beyond operating the Service.
3. DATA SHARING
Other Frendis users see your public profile (display name, photo, interests, rating, and year of joining). Exact venue addresses are shown only to approved participants. We engage the following processors under data processing agreements: — Supabase (database and authentication, EU-based servers) — Resend (transactional email delivery) No other third parties receive your personal data except where required by law.
4. YOUR RIGHTS
Under GDPR you have the right to: — Access the personal data we hold about you — Correct inaccurate or incomplete data — Delete your account (app: Profile → Danger zone → Delete account; web: Profile → Edit profile → Danger zone → Delete account) — deletion takes effect immediately and the identifying data on the deleted records is anonymised within 30 days; section 5 lists what is kept after that — Receive a copy of your data in a portable format — Object to or restrict certain processing — Withdraw consent at any time (where processing is based on consent) — Lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es To exercise any right, contact us at hello@frendis.app. We will respond within 30 days.
5. DATA RETENTION
Personal data is kept for as long as your account is active. When you delete your account, deactivation is immediate: your profile, the activities you created and your participation in other people’s activities stop being visible to anyone in Frendis, the push-notification tokens of your devices are deleted outright, and you are signed out. Within 30 days an automated job anonymises the identifying data on those records: your name is replaced with “Deleted user”; your bio, profile-photo link, neighbourhood and approximate location are cleared; the email address, phone number and sign-in identifier on our account record are replaced with anonymous placeholders; and the link between your account and product-analytics events is removed. Account deletion does not erase everything. We keep: messages you already sent, which stay visible to the other participants of those chats (shown as written by “Deleted user” after the 30-day step); reviews you left for other people, your reactions, saved activities and block list; the activities you created (hidden from everyone, but not physically erased); the photo files you uploaded; your date of birth, languages, goals and interests, your public profile handle and, if you linked the Telegram bot, your Telegram chat ID; and the sign-in identity held by our authentication provider (Supabase). Reports and moderation records are kept for up to 90 days from when they were created, and server logs for up to 90 days, for security and to comply with the law. Analytics events are kept without any link to your account (see section 14). If you want any of the retained data erased, email hello@frendis.app — we will consider the request under the GDPR and reply within 30 days. The step-by-step description of deletion is on the account-deletion page.
6. COOKIES
We use one strictly necessary session cookie to keep you signed in. This cookie is essential for the Service to function and does not require your consent. We do not use advertising, tracking, or analytics cookies.
7. CHILDREN
Frendis is not directed at anyone under 18. We do not knowingly collect personal data from people under 18. If you believe someone under 18 has registered, contact us at hello@frendis.app and we will delete their account.
8. SECURITY
We use industry-standard measures to protect your data, including encrypted connections (HTTPS), access controls, and row-level security on our database. No method of transmission is 100% secure; we cannot guarantee absolute security.
9. CHANGES TO THIS POLICY
We will notify you of material changes to this Policy by email or in-app notice at least 14 days before they take effect.
10. CONTACT
Privacy questions: hello@frendis.app Data protection supervisory authority: Agencia Española de Protección de Datos (AEPD) · www.aepd.es
Language
In case of any discrepancy between this translation and the Spanish original, the Spanish version prevails.
14. ANALYTICS
When you consent to analytics, we collect: pages you view, features you interact with, your device and browser type, and your city (derived from your IP address — the IP address itself is not stored). Analytics runs on our own self-hosted server — data is never shared with third-party analytics companies. Before you sign in, we identify visits using a hash that rotates daily; we do not use cookies for analytics. After you sign in, analytics events are linked to your internal account ID (a UUID) — never your name or email. Tracking only starts if you agree. You can withdraw your consent at any time using the controls on this page. If you delete your account, the link between these events and your account is removed within 30 days; the events themselves are kept, with no link to you, and are used only for aggregate statistics.
CITY EXPANSION WAITLIST
If you join our city-expansion waitlist from the landing page, we collect your email address and the city you name. We use this only to email you once when that city opens on Frendis — nothing else. This is the only personal data we collect before you create an account. We keep waitlist entries for up to 24 months, after which they are automatically and permanently deleted. To have your entry removed sooner, email us at hello@frendis.app.