Privacy Policy

Summary

• We collect what we need to run safe, verified Events — and as little else as possible.
• Identity verification is done by our provider, Didit. We keep only the result (such as “verified” and “over 18”) and a keyed hash used to enforce bans — never your ID document or selfie.
• We never record audio or video.
• Messages are deleted after 30 days (1 year if they are part of a report). Server logs are kept for 14 days.
• Direct messages and calls between Connections are only available when both people have agreed to automated safety screening of direct messages.
• We do not sell your data. There are no advertising trackers in the app.
• You can export or delete your data in the app, and contact us at privacy@spareachair.com.

Who is responsible for your data

The controller of your personal data is SUPPORT BULGARIA OOD, Hipodruma, bl. 133, entr. B, fl. 4, apt. 82, Sofia, Bulgaria, company number 200232189 (UIC, Commercial Register of the Bulgarian Registry Agency), telephone +359 888 886 008 (“spareachair”, “we”, “us”).

Contact for all privacy questions and requests: privacy@spareachair.com.

We have not appointed a Data Protection Officer; contact privacy@spareachair.com.

This policy covers the spareachair mobile app and its backend (the “Service”), the website spareachair.com and the pre-launch waitlist.

What we collect

Account

Email address, password (stored only as a secure hash), email verification status, sign-in sessions (with your device’s user agent and, for security, only the network prefix of your IP address — IPv4 /24, IPv6 /48 — never the full address), your app language (so that we send you emails and notifications in that language), notification preferences, and a record of which version of our legal documents you accepted and when (with a hashed — not raw — IP address and your device’s user agent).

Identity verification result

When you verify your identity, the verification provider (Didit) checks your identity or residence document — including the address shown on it, if the document has one — and matches it to a selfie, with a short liveness video that shows a real person is present. Didit processes the document images and the data on them (including that address), the selfie, the liveness video and the biometric data needed for the match as our processor — on our behalf, on our instructions and only for this check — and deletes them 30 days after the verification decision. We receive and store only:

• the verification status (for example approved, declined, expired) and a reference to the verification session;
• whether you are over 18, and the country whose authority issued your document (to confirm it was issued by an EU/EEA authority);
• a keyed hash (HMAC) computed from your document number, issuing country and date of birth using a secret key only we hold. The hash cannot be reversed into those details. We use it to stop one person having several accounts and to stop banned people from signing up again.

We discard your date of birth, document number and all other document data immediately after computing the result and the hash.

Profile

Display name, generated avatar (you cannot upload photos), short bio, occupation category, age band (for example 25–34), and your answers to “perspective prompts” (for example city or countryside) used for matching. Your bio is checked by automated moderation (see Messages); your display name is checked by our own rules only.

Spoken languages (optional and private): you can add the languages you speak to your profile. We use them only to seat people who share a language at the same table at mixed-language Events, and to show Events in your languages first in the Events list. They are never shown to other members. If you don’t add any, we use your app language instead.

Participation and connections

Events you sign up for and attend, the tables you were seated at, “keep in touch” choices, your Connections, and the people you have blocked.

Messages

The text of messages you send at tables and in direct messages, and any flags added by automated moderation. Audio and video are transmitted live through our own media server and are never recorded or stored.

Table chat is checked by automated moderation as part of the Service. Direct messages and 1:1 calls between Connections are only available when both people have agreed to automated safety screening of direct messages; their messages are then checked in the same way before delivery. We ask for this agreement separately, in the app.

How automated moderation works. We first check the text against our own rules. We also send the text of table messages and bios — and, only when both people have agreed to automated safety screening of direct messages, the text of direct messages — to an AI model (Claude) of Anthropic PBC in the USA, which classifies it for harmful content. The provider receives the text only — never your name, user ID or other account details — and processes it as our processor. The provider does not use the text to train its AI models and keeps it only for a limited period under its terms, for example to detect misuse of its service. See International transfers for the transfer safeguards.

Reports and enforcement

Reports you make or that are made about you, including a copy of the last 50 messages of the reported conversation; moderation decisions, statements of reasons and appeals.

Device and technical data

Push notification token (delivered to Apple or Google, see Who we share data with), device type, operating system and app version; IP addresses and request logs on our servers; error and crash reports.

Website and waitlist

If you join the waitlist: your email address and confirmation (double opt-in) record. On the website: cookies and similar technologies, but only those you consent to — see the Cookie Policy.

Counting visits and app use without cookies

To know how many people visit our website, click the App Store or Google Play button, and open or use the app, we count them without cookies or device identifiers and without storing anything on your device. When your browser or the app sends such a request, our server combines your IP address and browser/app identifier (User-Agent) with a random value that changes every day and is deleted at the end of that day, and turns them into a one-way code. These codes are only used to estimate how many different visitors there were that day; they are not stored, we keep only the daily totals (for example “120 visitors on 5 November”), and they cannot be linked to you or to your account. Bots are left out. Legal basis: our legitimate interest in understanding how people find and use spareachair (Art. 6(1)(f) GDPR).

We do not collect your precise location, your contacts or photos.

Why we use your data and our legal basis

Purpose	Legal basis (GDPR)
Creating your account, running Events, matching you to tables (at mixed-language Events, with people who share a language), messaging, calls, Connections, service emails and notifications in your app language	Performance of our contract with you — Art. 6(1)(b)
Checking that you are 18+ and hold a document issued by an EU/EEA authority before you take part	Performance of our contract (eligibility) — Art. 6(1)(b); legitimate interests in keeping the Service adult-only and safe — Art. 6(1)(f)
The biometric selfie match carried out by Didit	Your explicit consent — Art. 9(2)(a) with Art. 6(1)(a). We ask for it separately, in the app, before verification starts
Automated moderation of table chat and bios, handling reports, enforcing our Terms and preventing ban evasion with the keyed hash	Legitimate interests in protecting users and the Service — Art. 6(1)(f); compliance with the Digital Services Act where it applies — Art. 6(1)(c)
Automated safety screening of direct messages between Connections	Your consent — Art. 6(1)(a) and the ePrivacy rules on the confidentiality of communications. Both people in the conversation must agree
Sensitive information you choose to put in your bio or messages	Your explicit consent, if you give it — Art. 9(2)(a). Optional
Statements of reasons, handling notices of illegal content and appeals, responding to lawful requests from authorities	Legal obligation — Art. 6(1)(c)
Recording which legal documents you accepted, in which language	Legitimate interests in being able to show what you agreed to — Art. 6(1)(f)
Security, including the network prefix of the IP address of your sign-in sessions, server logs and error monitoring	Legitimate interests in keeping the Service secure and working — Art. 6(1)(f)
Counting website visits, store-button clicks and app opens without cookies (aggregate daily totals)	Legitimate interests in understanding how people find and use spareachair — Art. 6(1)(f)
Waitlist emails	Consent — Art. 6(1)(a)
Website analytics and advertising measurement	Consent — Art. 6(1)(a) and the ePrivacy rules on cookies
Establishing, exercising or defending legal claims	Legitimate interests — Art. 6(1)(f)

Your consent to the biometric check can be withdrawn at any time by writing to privacy@spareachair.com. Withdrawal works for the future only: the check you already completed stays valid, and we keep its result (verification status, over 18, issuing country, age band) and the keyed hash, which are not biometric data, on the basis of our contract with you and our legitimate interests. We will ask Didit to erase anything it still holds. If you ever need to verify again, you will be asked for your consent again — without it, we cannot verify you by biometric means.

Matching uses your prompt answers, occupation category and age band to seat people with different perspectives together. This is a form of profiling, but it has no legal or similarly significant effect on you. At mixed-language Events, matching also makes sure that everyone at a table shares a language, using your spoken languages (or, if you haven’t added any, your app language) — only as this condition, never to judge your perspectives.

Automated decisions. Automated moderation can block an individual message. We do not take decisions with legal or similarly significant effects on you — such as suspending or banning your account — solely by automated means, and you can always ask for a person to review a decision.

Sensitive information. Other than the biometric check, we do not ask for special categories of data (such as health, religion or political opinions), and we never use them for matching. Your spoken languages are optional; because languages can hint at where someone comes from, we use them only as described in Profile and never show them to anyone else. Such information may still appear in what you choose to write. During sign-up we ask whether you consent to our processing sensitive information you choose to include in your bio or messages. This is optional: if you don’t consent, the app reminds you not to share such information where you write. You can withdraw this consent at any time by writing to privacy@spareachair.com; then stop sharing such information and edit your bio — remaining messages are deleted after 30 days. Either way, please think carefully before sharing such information.

Screening of direct messages. You can withdraw your agreement to the automated safety screening of direct messages at any time by writing to privacy@spareachair.com. Without it, you can still take part in Events and table chat, but you cannot send or receive direct messages or calls.

Where we rely on legitimate interests, we have balanced them against your rights, and you can object (see Your rights).

How long we keep your data

Data	How long
Table and direct messages	30 days, then deleted automatically
Messages copied into a report	1 year
Reports and moderation flags	1 year after the report is closed
Moderation decisions (enforcement records)	While your account exists; after it is deleted, 1 year — or 3 years if the account was permanently banned
Log of moderator actions (audit log)	3 years
Keyed identity hash	While your account exists. If your account was permanently banned, kept after deletion for 5 years — or as long as the ban applies, without a fixed end, for bans for child sexual abuse, credible threats or ban evasion
Identity verification result	While your account exists
ID document images and data, selfie and liveness video (held by Didit, not by us)	30 days after the verification decision
Account, profile, participation and Connections	Until you delete your account; a removed Connection and its messages 30 days after removal
Sign-in sessions (device and app details, network prefix of your IP address)	Until you sign out, or 30 days after you last used the app
Call log (who called whom and when, no content)	1 year
Accounts that never finish sign-up	Deleted 7 days after sign-up if the email is not verified, 30 days after sign-up if identity is not verified
Legal acceptance records	While your account exists; if an enforcement record or the keyed hash is kept after deletion, for the same period (without your email)
Server logs and error reports	14 days
Daily counts of website visits, store-button clicks and app opens	Only the daily totals are kept, which are not personal data; the random value used to count different visitors is deleted at the end of each day
Data export files	7 days
Encrypted database backups	Up to 11 days; data you delete disappears from the backups within that time
Waitlist	Until you unsubscribe or we launch; unconfirmed sign-ups are deleted after 14 days

When you delete your account we permanently delete your data, except the items above that we must or may keep after deletion (the keyed hash of a banned account, and reports and enforcement records needed to handle safety issues or legal claims). Your direct-message conversations are deleted as a whole: if you or a Connection deletes their account, the whole conversation, including the other person’s messages, is removed.

If we must keep data for a legal proceeding (a legal hold), we cannot delete it until the hold ends. If you ask us to delete it, we will tell you that we are required to retain it for a legal proceeding, unless an authority has ordered us not to.

Who we share data with

• Other users see your display name, avatar, bio, occupation category and age band, and the messages you send in conversations they are part of. They never see your email, your spoken languages or your verification details.
• Service providers (processors) that host and run the Service for us under data processing agreements — for example hosting (DigitalOcean), email (Resend), identity verification (Didit), error monitoring (Sentry), app updates (Expo), push notifications on Android (Google Firebase Cloud Messaging) and automated moderation (Anthropic PBC). The full, current list is on our Sub-processors page.
• Apple and Google deliver push notifications to your device: our servers send them directly to the Apple Push Notification service (iPhone) or Google Firebase Cloud Messaging (Android). They receive your device’s push token and the notification (for example the display name of a Connection who wrote to you — never the message text). Apple receives this as an independent recipient under its own terms.
• Authorities, when we are legally required to, for example in response to a valid order or to report a threat to someone’s life or safety.

We do not sell your personal data and we do not share it with advertisers.

International transfers

We host the Service in the EU. Some of our providers are in the US. We rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses, plus additional safeguards where needed. This includes our moderation provider, Anthropic PBC, which receives the text of messages and bios only (see Messages). You can ask us for a copy of the relevant safeguards at privacy@spareachair.com.

Your rights

Under the GDPR you have the right to:

• access your data and get a copy of it;
• rectification — have inaccurate data corrected;
• erasure — have your data deleted;
• restriction — ask us to limit how we use your data;
• data portability — receive the data you gave us in a machine-readable format (JSON);
• object to processing based on legitimate interests;
• withdraw consent at any time, where we rely on consent, without affecting earlier processing;
• lodge a complaint with a supervisory authority — our lead authority is the Bulgarian Commission for Personal Data Protection (https://www.cpdp.bg), and you can also complain to the authority in the EU/EEA country where you live or work.

You can export your data and delete your account directly in the app’s settings. The export is a machine-readable file (JSON) with the data we hold about you, together with information on the purposes, recipients, retention periods, your rights and where the data came from. It does not include other participants’ messages or personal data.

For anything else, email privacy@spareachair.com. We will reply within one month (extendable by two months for complex requests, in which case we will tell you). We may ask you to confirm your identity before acting on a request — with a link to your registered email address or a confirmation in the app. We never ask for a copy of your ID document.

When you ask for a copy of your data, we leave out information whose disclosure would adversely affect the rights and freedoms of others (Art. 15(4) GDPR). For example, we do not reveal who reported you, and we may hold back details of a report while its review is pending.

Security

We protect your data with encryption in transit, access controls, the principle of least privilege, pseudonymised identifiers where possible, and regular backups. No system is perfectly secure; if a personal data breach is likely to put you at high risk, we will tell you.

Children

spareachair is only for adults. We do not knowingly collect data from anyone under 18. If we learn that a user is under 18, we will close the account and delete their data, except the safety records we must keep — reports, enforcement records and, where the account was banned, the keyed hash that stops a new sign-up — for the periods in How long we keep your data. Where a child may be at risk, we notify the competent authorities. If you think a minor is using the Service, please report it in the app or email privacy@spareachair.com.

Changes to this policy

We will update this policy when our processing changes. Each version has a version number and effective date at the top of this page. We will tell you about material changes in the app or by email before they take effect.

Contact

SUPPORT BULGARIA OOD, Hipodruma, bl. 133, entr. B, fl. 4, apt. 82, Sofia, Bulgaria, telephone +359 888 886 008 — privacy@spareachair.com.