Effective 6 November 2026
Closby is a hyperlocal social app that lets people who are physically near each other — at the same café, park, gym, museum or event — see one another in a proximity feed, set an intent and start a conversation. Closby is for adults 18 and over. This policy explains what we collect, why, our legal bases under the EU General Data Protection Regulation (GDPR), how long we keep data, who we share it with, and the rights you have.
The data controller is VAEVI TECHNOLOGIES SP. Z O.O. (NIP 5213949908), ul. Puławska 12/3, 02-566 Warszawa, Poland. For any privacy question or to exercise your rights, contact hello@closby.org. This address is also our single point of contact under the EU Digital Services Act (DSA) for users and authorities, and is monitored by a person (not automated-only).
We are reviewing whether a formal Data Protection Officer is required for Closby; until one is appointed the contact above handles all data-protection matters.
To improve the app and to find, reproduce and fix problems faster, we record:
These records are linked to your account by its internal ID. They never contain the text of your messages or searches, your coordinates, your phone number or your photos. We use them only to improve the app and to find, reproduce and fix problems. They are kept for 30 days, stored only on our own servers in Germany, and never sold, never used for advertising, never shared with anyone and never used to track you across other companies’ apps or websites.
The current app does not send app usage events. The app version that starts sending them will also add a control to turn them off, and we will update this policy before it is released. Our servers keep their own logs of the requests your app makes (the server logs and server errors described above, including security events such as refused sign-in attempts and rate limits), because the service cannot be run securely without them.
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and run your account, the nearby feed, statuses, check-ins and chat; deliver your SMS sign-in code | Performance of a contract — Art. 6(1)(b) |
| Show you people and places nearby using your approximate location | Your consent (the device location permission) — Art. 6(1)(a) — plus Art. 6(1)(b) |
| Send push notifications | Your consent (the notifications permission) — Art. 6(1)(a) |
| Suggest checking in when you arrive at a venue (“Are you at this venue?”), including while the app is closed | Your consent — Art. 6(1)(a) — given twice over: the iOS “Always” location permission and the Check-in suggestions switch in Settings → Notifications, either of which turns it off on its own |
| Keep the service and its users safe: block/hide/report, anti-abuse, rate-limiting, single-active-device, moderation of reported content | Our legitimate interest in user safety and platform integrity — Art. 6(1)(f) |
| Confirm you are 18 or older | Compliance with a legal obligation and our legitimate interest — Art. 6(1)(c)/(f) |
| Security, fraud/abuse prevention, and responding to lawful requests | Legitimate interest and legal obligation — Art. 6(1)(f)/(c) |
| Improve the app and find, reproduce and fix problems: server logs, errors, performance records and app usage events (see “Diagnostics and app usage”) | Our legitimate interest in a working, reliable service — Art. 6(1)(f) |
Closby has a dating mode. If you choose to signal that you are open to dating, or otherwise share information in your profile that could reveal your sexual orientation, that is special-category data under GDPR Art. 9. You provide it voluntarily, and by adding it you give your explicit consent for us to use it to operate the features you have chosen. You can remove it or withdraw consent at any time by editing your profile.
Location is read only while you are sharing. With “While Using the App” that means only while Closby is open. With “Always” — which is optional, and which you can withdraw in iOS Settings at any time — iOS additionally sends a coarse update when you have moved roughly 500 m, even with the app closed.
We use location for three things and nothing else: to show you nearby people and places, to place you in a venue if you check in, and — only if you granted “Always” and left Check-in suggestions on — to ask whether you have arrived at a venue. That suggestion names a venue only when you are inside that venue’s own check-in area — the same area a manual check-in uses — and your phone reports your location precisely enough to tell. If you are inside the check-in areas of two venues at once, or the location is not precise enough, we say nothing rather than guess, and it never checks you in by itself. Others only see that you are around or at a venue — never your exact position, distance or address. Turn location sharing off at any time to disappear completely; some discovery features simply stop working. We never sell your location and never share it with advertisers or data brokers.
Your exact location, distance, precise last-seen time, date of birth, age and phone number are never shown to other users. Other people see the profile details you choose to share. Your profile is visible to people near you while you are sharing location, and it can also be opened by anyone who already has a link to it or who searches your exact @username — searching by username works regardless of distance, so treat your profile as visible to any Closby user who knows your handle.
We use a small number of processors strictly to run the app, each acting only on our instructions: Twilio (sends your SMS sign-in code), Apple (delivers push notifications, and receives the sender name and a short message preview in order to display them, and — when you open the places map — renders it, which means Apple receives the map area you are looking at and your own position shown on it) and Hetzner Online GmbH (hosts our servers in Germany). Logs, crash and error diagnostics and app usage events stay on our own servers in Germany — no third-party analytics or error-tracking service receives them. Photos, messages and profiles are kept on our own servers (self-hosted object storage) — not a third-party storage provider. We do not use advertising SDKs, we do not sell your data, and we do not share it with data brokers. We may disclose data where legally required (e.g. a valid court order) or to protect people from serious harm.
Our servers are in the European Union (Germany), so your data is stored in the EU. Two processors are US-incorporated: Twilio and Apple. Where they process data outside the European Economic Area, the transfer is protected by the European Commission's Standard Contractual Clauses and/or the processor's EU–US Data Privacy Framework certification.
Under the GDPR you may: access your data; correct it; delete it (right to erasure); restrict or object to processing; receive it in a portable format; and withdraw any consent at any time (without affecting prior processing). You can delete your account at any time in the app (Account → Settings → Delete account). This erases your profile, photos, avatar, highlights, statuses, location, check-ins, saved contacts, devices, and the blocks, restrictions and reports you made, and your profile disappears from Closby immediately. Blocks, restrictions and reports that other people made about you are kept — they exist to protect those people, and deleting them would let an account clear them by deleting and signing up again. Your phone number is released when you delete your account: signing up with it again creates a new, empty account. One exception: if your account was suspended or hidden after reports when you deleted it, we keep the number, so that deleting and signing up again cannot be used to escape that safety measure; a new account on that number starts with the same restriction. Messages you already sent also survive: they remain in the other person's conversation, because they are that person's copy of a conversation they took part in. If you want those removed as well, email us and we will handle it manually. To exercise any other right, email hello@closby.org; we respond within one month.
If you believe we have mishandled your data you can lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa (uodo.gov.pl). If you live elsewhere in the EEA you may complain to your local data-protection authority.
We order the nearby feed and may automatically hide a profile from view when several people report it, pending human review. Every photo you upload — profile picture, highlight or chat photo — is checked automatically by software running on our own servers that rejects sexual imagery; if the check cannot complete, the upload is refused rather than allowed through. We also refuse a photo you have already uploaded before, and refuse a bio containing contact details or links. We do not make solely-automated decisions that produce legal or similarly significant effects about you without a way to reach a human: if content of yours is restricted you will be told why and can appeal by emailing hello@closby.org.
Messages are encrypted at rest, sign-in codes are never stored, access is limited to a single active device per account, and our servers are in the EU. We apply industry-standard safeguards (GDPR Art. 32), though no system is perfectly secure.
Closby is strictly for people aged 18 or older. We do not permit anyone under 18 and do not knowingly collect their data; a date-of-birth gate rejects under-18 sign-ups.
We may update this policy; material changes will be notified in the app and reflected here with a new effective date.
VAEVI TECHNOLOGIES SP. Z O.O. · NIP 5213949908 · hello@closby.org