The short version
- We read your location only while the app is open, and keep just your latest position — never a history of where you've been.
- Every message, in rooms and direct chats, is deleted automatically 24 hours after it's sent.
- Other users see your username and avatar. They never see your email.
- No ads, no advertising trackers, no selling or sharing of your data.
- You can delete your account from the app at any time.
1.Who we are
kvoroom ("the Service", "we") is a location-based chat app operated by an individual based in Bosnia and Herzegovina. For the purposes of the EU General Data Protection Regulation (GDPR), the data controller can be reached at info@kvoroom.app.
2.What we collect
Account data
- Your email address, used to sign in through Firebase Authentication.
- The username you choose when you register. It's permanent — self-service renaming is not available.
- Your avatar. It's an illustration, not a photo: a compact description of the style choices you pick (hair, eyes, skin tone, outfit and so on), not an uploaded image.
- When you accepted these policies at sign-up.
- Your notification preferences, and a push notification token for your device if you allow notifications.
- A count of the messages you've sent, shown to you in Settings.
Location
- While the app is open, we use your device location to show rooms within about 1.5 km of you, and to check that you're inside a room's radius when you join it, send a message or react.
- While the app is open, we also store your latest position and when it was recorded, updated at most every couple of minutes. Each update replaces the previous one. We use it only to notify you when someone creates a room within 100 m of you.
- We do not read your location while the app is in the background, and we do not keep a history of where you've been.
Chat content
- The messages you send in rooms and direct chats.
- Photos you choose to attach to a message.
- Reactions, replies, and the message a room owner has pinned.
- Which rooms you're currently in, and your direct chats and chat requests.
Moderation data
- If someone reports one of your messages, we store the report together with a copy of the reported message, so it can still be reviewed after the original is deleted.
- If you block someone, or someone blocks you, we store that so it can be enforced.
- If your account is temporarily banned, we store when the ban ends.
Technical data
- Standard server logs (IP address, time, requested address), kept briefly for security and abuse prevention.
- When you were last active, used to tell active accounts from inactive ones.
3.What we don't collect
- No background location and no location history.
- No access to your contacts, calendar, microphone or photo library — only the photos you deliberately pick, one at a time, through the system photo picker.
- No advertising, no third-party trackers, and no analytics or crash-reporting tools that build profiles of users.
4.How we use your data
- To run the Service — sign you in, deliver messages, show nearby rooms, enforce room rules such as distance and capacity, and send the notifications you've turned on.
- To keep it safe — hide messages that several people have reported, review reports, and restrict accounts that break our Terms.
- To keep it working — fix bugs and monitor availability.
- To comply with the law — respond to valid requests from competent authorities.
We don't use your data for advertising, and we don't sell, rent or share it with marketers.
5.Legal basis
Where the GDPR applies, we rely on:
- Performance of a contract — to provide the Service you signed up for: your account, rooms, messages and chats.
- Consent — for location access and push notifications, which you grant through your device's permission prompts and can withdraw at any time in your device settings.
- Legitimate interests — to keep the Service secure and to moderate abuse.
- Legal obligation — where the law requires us to keep or disclose data.
6.Where your data is stored
| Provider | What it handles | Location |
|---|---|---|
| Our own servers, hosted by Hetzner Online | Accounts, profiles, rooms, messages, chats, reports and blocks | Germany |
| Cloudflare (R2 storage) | Photos attached to messages | Not restricted to a specific region |
| Google Firebase Authentication | Sign-in (email and password) | Google infrastructure |
| Google Firebase Cloud Messaging | Delivering push notifications | Google infrastructure |
These providers process data on our behalf and only for the purposes above. Google does not store your messages, rooms or profile.
7.Who can see what
- People in the same room see your username, your avatar and the messages you post there. They never see your email.
- Your direct chat partner sees the same, plus the messages you send them.
- kvoroom administrators can see your email, when your account was created, your role, any ban, and reports about you. They access this only for moderation, support or legal compliance.
- Nobody else. We don't sell, rent or share your data.
8.How long we keep it
| Data | Kept for |
|---|---|
| Room messages | 24 hours from sending. Regular rooms are deleted one hour after they're created, taking their messages with them. |
| Direct chat messages | 24 hours from sending. The chat itself stays until both people have left it. |
| Your latest location | Until it's replaced by a newer one, or your account is deleted. |
| Reports and blocks | As long as they're needed for moderation. |
| Account data | While your account exists, then permanently erased (see below). |
| Server logs | Briefly, typically 30 days or less. |
Deleting your account: go to Settings → Remove account in the app. Deletion takes effect 14 days later, in case you change your mind; after that your account and the personal data tied to it are permanently erased. If you can't access the app, email info@kvoroom.app from your registered address.
9.Your rights
If you are in the EU/EEA, or anywhere similar rights apply, you can:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to how we process it;
- receive a copy of your data in a portable format;
- withdraw consent (for location or notifications) at any time;
- lodge a complaint with your data protection authority.
To exercise any of these, email info@kvoroom.app from the address tied to your account. We respond within 30 days.
10.Children
kvoroom is only for people aged 18 or older, and you must confirm your age when you sign up. If you believe someone under 18 has created an account, contact us and we'll remove it.
11.Security
All traffic between the app and our servers is encrypted (HTTPS/TLS). Passwords are handled by Firebase Authentication and never stored by us. Passwords for locked rooms are stored only as bcrypt hashes.
12.Changes to this policy
If we change this policy in a way that affects you, we'll tell you in the app and update the effective date at the top of this page.
13.Contact
Questions, requests or complaints: info@kvoroom.app.