Privacy Policy

1Introduction

This policy explains what personal data we process about you in the Amista mobile app and on the related websites (the “Service”), why we process it, who we make it available to and what rights you have in relation to it.

Amista is an app for communities and events. It lets you create a profile, start or join communities, organise and attend events, share posts and photos, talk in chat and find events near you.

We do not sell your personal data. We do not show advertising. We do not track you across other apps or websites, and we do not use any third-party advertising or analytics tracking tools.

This policy supplements the Terms of Service (amista.app/terms-en), which govern the rules for using the Service and the content in it.

2Controller and contact

The controller within the meaning of Art. 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”) is:

We are not required to have a data protection officer (DPO) under Art. 37 GDPR and have not appointed one. For all data protection matters, contact us at the e-mail address given above.

3What data we process

3.1Data you provide to us directly

Account data. When you register with an e-mail address, we process your e-mail address and password (the password is stored only as a cryptographic hash, never in readable form). At registration we also ask for your year of birth to verify the minimum age of 16 (Section 9); it is not shown to anyone. If you sign in with Google or Apple, we receive your identifier, e-mail address, name and, where applicable, profile photo from the provider. If you use the “Hide My Email” feature when signing in with Apple, we receive only a forwarding address from Apple, not your real address.

Profile. Username, display name, profile photo, a short description (“bio”) and links to your Instagram, Facebook or X profiles, if you add them.

Content you create. Communities (name, description, categories, images, links), events (name, description, date and time, location including geographic coordinates, images, categories), posts, comments and GIFs, polls and your votes in them, photos, chat messages including attachments and reactions, your responses to invitations (going / interested) and pinned items.

Social connections and visibility settings. Friend requests and friendships, community memberships and requests to join, invitations, blocked users, hidden communities and people, the default audience for your content, the visibility of your calling card and whether you can be found in search.

Discovery preferences. Your interests and your home area (how it was set, the place name, the geographic coordinates of its centre and the search radius). This data is strictly private — it is not shown to any other user and is used only to choose what we show you on the map and in Discovery.

Reports and support. If you report content, a user or a community, we process the reason for the report, your free text, the identification of the reported content and your identification as the reporter. If you contact us, we process the content of your message and the contact details you include in it. Messages sent through the contact form on the website (topic, name, e-mail, text, additional details and attached files) are stored in our database; only our team can see them, in the Service's administration, and we reply to them by e-mail at the address you provided. The legal basis is our legitimate interest in handling your request and, for requests under the GDPR, compliance with our legal obligation.

3.2Data other users provide about you

Some data about you does not arise from your own activity but from the activity of others. This includes in particular:

• invitations — who invited you to an event or a community and how you responded to the invitation;
• friend and membership requests that someone sends you;
• blocking and hiding — if another user blocks or hides you, we process this connection so that we can respect their decision;
• reports — if someone reports you or your content, we process the reason for the report and the free text they wrote with it;
• content from others — posts, comments, chat messages and photos in which someone mentions you or in which you may appear.

The extent of such data is limited by the way the Service is built: only people who already have an Amista account can be invited, the app does not allow people to be tagged in posts and it does not sync the address book on your phone. We therefore do not process the contact details of people who do not use the Service.

Your responsibility. If you publish content that shows other people — for example a photo from an event — you are also processing their personal data. You are responsible for having their consent or another legal ground for doing so, and for respecting their privacy. If anyone believes that content in the Service infringes their rights, they can report it directly in the app or contact us at the address given in Section 2.

3.3Special categories of personal data

Special categories of data under Art. 9 GDPR — data concerning health, religious or philosophical beliefs, political opinions, racial or ethnic origin, sexual orientation or trade union membership — are not required by us; we do not ask for them and we do not use them to select the content we show you.

Such data may nevertheless arise in the Service through what you yourself write or upload to it. Membership of a community alone can reveal such data — for example, if the community has a religious, political, health-related or LGBTI+ focus. Your profile description, a post or a photo may contain it too.

In that case we process this data solely because you chose to publish it, and within the audience you selected. The legal basis is your explicit consent under Art. 9(2)(a) GDPR, which you give by the act of publishing itself; where the content is published publicly, Art. 9(2)(e) GDPR applies (data manifestly made public by the data subject). You can withdraw your consent at any time by removing the content or changing its visibility setting.

So consider carefully what you publish and to whom — the visibility settings are described in Section 5.1.

3.4Data generated by your use of the Service

Technical and operational data. Each call to our API is recorded in the server logs with the IP address, the client type and version, and the time and result of the request. This serves operation, error diagnosis and security.

Error reports. When the app crashes or runs into an error, it sends a report to Sentry: technical data about the error and about what preceded it in the app, the device model, the operating system and app versions, and your user identifier, so that we can link the error to your support request. We do not send your name, e-mail or the content you have in the app in these reports, and no screenshots are taken. For a portion of app launches we also send data about the app's speed (for example, how long the launch took).

Device data for notifications. The device registration token for Firebase Cloud Messaging, the device platform (Android / iOS), the time of last use and the app language, so that notifications arrive in the right language.

In-app state. Read markers (e.g. which photos or sections of an event you have already seen), a record of the event reminders sent, so that you do not receive the same reminder twice, and your notification settings by category.

3.5Location

We read your device's precise location (GPS) only when you ask us to — when setting your home area or with the “My location” button on the map. The system asks you for permission to do so, and you can revoke this permission at any time in your operating system's settings.

We do not store your device's precise location or track it in the background. Only the centre and radius of the home area you set (which are private) and the coordinates of an event's venue, which you enter yourself as the organiser and which form part of the event, reach our server.

3.6Payments and subscriptions

The paid plans Amista+ and Amista Pro are bought as in-app purchases through the App Store or Google Play. Payment is processed exclusively by Apple or Google — we do not receive or store payment card numbers or any other payment details. Through RevenueCat we receive only the purchase identifier, the type and status of the subscription, its period and expiry date and, for each payment, its amount and currency, so that we know which plan you have active and can keep our accounting records.

What others can see of your plan. The name of your plan (for example “Amista+”) is shown on your calling card to everyone who can open it — just like your name and photo. Only you can see how much of your plan's limits you are using. The free plan is not shown on the calling card.

When a plan ends. If, after a plan downgrade, you own more communities than the new plan allows, we record the deadline by which you are choosing which ones stay, what you chose, and which communities are locked and when they will be deleted (Terms, Article 11.4). We notify both you and the members of the affected communities of the locking and the upcoming deletion. Photos from a locked community are downloaded through a link that is valid for 24 hours and tied to your account; we put the archive together only when the link is opened and do not keep it on our servers.

3.7Visitors without an account

Links to invitations, events and communities (go.amista.app) open a web page that can also be viewed by someone who does not have an Amista account. During such a visit, the server logs record the IP address, the browser type, the time and which link was opened. We process this data on the basis of our legitimate interest in the operation and security of the Service and keep it for as long as other logs (Section 8). No account or profile is created as a result, and we do not link such visits to any person.

3.8What we do not keep on our servers

Some data stays only on your device and never reaches our servers: the local copy of your chats (so that you can read the history offline too), the image cache, a saved copy of the most recently displayed content for a faster start, and local settings (e.g. the app theme). Uninstalling the app removes this data from the device.

4Purposes and legal bases of processing

Where the legal basis is consent, you can withdraw it at any time — withdrawal does not affect the lawfulness of processing before it was withdrawn. You can revoke the location, photo and notification permissions in your operating system's settings; you can unsubscribe from news e-mails via the link in the footer of each such message. We do not send marketing e-mails to anyone who has not signed up for them themselves — service e-mails necessary for your account to work are sent on the basis of the contract and cannot be unsubscribed from.

Where the legal basis is our legitimate interest, you have the right to object to such processing (see Section 10).

5Who we make data available to

5.1Other users

Amista is by nature a social app — some data is visible to others, to the extent determined by your settings:

• Your profile (username, name, photo, description, links to social networks) is visible to people who can open your calling card; you control the extent through the visibility setting of your calling card and whether you can be found in search.
• Content you create (posts, comments, photos, events, polls, chat messages) is visible to the audience you choose when creating it — for example only community members, friends or only those invited to an event.
• Your reactions (attending an event, interest, poll votes, chat reactions) are visible to the same audience as the content they belong to.
• Your home area, interests, settings, blocked and hidden users and your reports are never shown to anyone else. A reported user never finds out who reported them.

Bear in mind that anyone you have made content available to can read it, save it or take a photo of it — we cannot technically prevent this.

5.2Service providers (processors)

We use vetted providers who process data solely on our instructions and under a contract pursuant to Art. 28 GDPR:

5.3Public authorities and other third parties

We make data available to public authorities where required by law or on the basis of a lawful request (for example, to law enforcement authorities or a court). We assess each such request and disclose only the data reasonably requested in it.

We may also disclose data where this is necessary to avert an imminent threat to life or health, or to exercise or defend our legal claims.

In the event of a sale of the business, a merger or a similar transaction, data may pass to the acquirer; in that case we will inform you in advance, and the acquirer will be bound by at least the same level of protection.

We do not sell your personal data or provide it to third parties for advertising purposes.

5.4Aggregated and anonymised data

We publish or provide to third parties (for example, to investors or in communications about the Service) aggregate statistics — for example, the number of users, communities or events. Such data is aggregated and does not allow any specific person to be identified; it is therefore not personal data, and this policy does not apply to it once aggregated.

6Messages, chat and content moderation

We think it is right to say this plainly, because it also concerns your private conversations.

Chat in Amista is not end-to-end encrypted. Communication between the app and our servers is encrypted in transit (HTTPS/TLS), but messages are stored on our servers in readable form. Technically, therefore, access to them exists.

Nobody reads them as a matter of course. Access to the production database is limited to a small group of authorised persons (currently the founders of the Service) and is used for operation, bug fixing and moderation — not for reading conversations.

Reported content is reviewed by a human. When someone reports a message, post, comment, photo, profile or community, an authorised person views the reported content solely for the purpose of handling that report and to the extent necessary for doing so. This also applies to content in a private community or an event chat of which we are not members — otherwise the report could not be assessed.

After repeated reports, content is hidden automatically (when three different people report it within 7 days) and awaits manual review. Content reported as concerning a minor is hidden after the very first report and preserved for law enforcement authorities. These are temporary, reversible measures; every permanent action — removal of content or suspension of an account — is always decided by a human, never by the system alone.

The reporter remains anonymous. A reported user never finds out who reported them.

The legal basis for this processing is our legitimate interest in protecting users and the security of the Service (Art. 6(1)(f) GDPR); where there is a threat to life or health, also vital interests (point (d)); and where the law requires us to act, a legal obligation (point (c)).

7Data transfers outside the EU

The database and authentication (Supabase) run in the eu-west-1 — Ireland region, i.e. within the European Union. Error reports (Sentry) are stored in a data centre in the European Union.

The other providers listed in Section 5.2 may also process data outside the European Economic Area, in particular in the United States of America. In that case the transfer is safeguarded by one of the instruments under Chapter V GDPR — standard contractual clauses approved by the European Commission or, where the provider is certified under it, an adequacy decision (the EU–U.S. Data Privacy Framework).

On request to the contact address given in Section 2, we will provide you with a copy of the safeguards used.

8Retention periods

When these periods expire, we delete the data or irreversibly anonymise it.

8.1Account deletion and how long it takes

You can delete your account at any time directly in the app under Settings, or on our website under Account after signing in. Deleting your account removes your account, profile, preferences, settings, social connections and the content tied to the account, including the photos and images you have uploaded.

Grace period. After you request deletion, your account is hidden and suspended for 7 days. If you change your mind, simply sign in during this period and cancel the deletion. Once the period has expired, the deletion begins. We will delete a suspended account upon a request sent to the address given in Section 2.

How long it takes. Once deletion has begun, removing the data from our operational systems can take up to 90 days. Copies remain for some time in backup systems used for disaster recovery — these are overwritten on their own cycle, within a further 90 days at the latest. We do not read data from the backups or use it for any other purpose.

Please note two exceptions:

1. Communities with other members. If you own a community that also has other members, deleting your account would also remove their community. In that case we will therefore refuse the deletion — first hand the community over to another owner or close it.
2. Messages held by recipients. Messages you have sent may remain stored in the local copy of the chat on the other participants' devices until they remove it themselves.

In exceptional cases we may retain data even after the account is deleted, where this is necessary to comply with a legal obligation, to handle a pending report or to exercise or defend legal claims — and only to the extent necessary for that purpose.

9Children

The Service may only be used by people who have reached the age of 16. The Slovak Republic has set the age at which a child can consent in relation to information society services at 16, and the Service is not intended for younger people.

If we find out that we have processed the data of a person under 16, we will close their account and delete the data without undue delay. If you believe that a child under 16 is using the Service, contact us at the address given in Section 2.

10Your rights

Under the GDPR you have the following rights in relation to your personal data:

• Right of access (Art. 15) — to find out whether and what data we process about you, and to receive a copy of it.
• Right to rectification (Art. 16) — to have inaccurate data corrected and incomplete data completed. You can correct most data directly in the app.
• Right to erasure (Art. 17) — to have your data erased; you can also delete your account yourself in Settings (see Section 8.1).
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20) — to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller.
• Right to object (Art. 21) — to object to processing based on our legitimate interest. Unless we demonstrate compelling legitimate grounds that override your interests and rights, we will stop the processing.
• Right to withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint with a supervisory authority (Art. 77).

You can exercise your rights by e-mail to the address given in Section 2. We will reply within one month of receiving your request; in justified cases we may extend this period by up to two further months, and we will let you know if we do. Handling your request is free of charge; for manifestly unfounded or excessively repetitive requests we may charge a reasonable fee or refuse the request.

If we have reasonable doubts about your identity, we may ask for additional information to verify it.

Supervisory authority: Office for Personal Data Protection of the Slovak Republic Hraničná 12, 820 07 Bratislava 27 statny.dozor@pdp.gov.sk · www.dataprotection.gov.sk

11Automated decision-making and profiling

We do not carry out automated decision-making, including profiling, that would have legal effects on you or similarly significantly affect you within the meaning of Art. 22 GDPR.

The order of the content you see in the feed and in Discovery is put together automatically — based on your memberships, friendships, chosen interests and home area. It serves solely to show you relevant content and has no legal consequences for you.

The temporary hiding of repeatedly reported content (Section 6) also works automatically. It is a reversible protective measure pending manual review — every permanent decision is made by a human, and you can object to it at the address given in Section 2.

12Security

We take appropriate technical and organisational measures to protect your data, in particular:

• encryption in transit (HTTPS/TLS) for all communication between the app and our servers,
• storing passwords only in the form of a cryptographic hash,
• access to data at database level restricted by row-level rules and by server-side authorisation — the client app never holds privileged access keys,
• private images (e.g. photos from communities and chat) delivered only through signed links with limited validity,
• access to production systems restricted to the persons for whom it is essential.

No measure, however, provides absolute protection. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you of it and notify the supervisory authority in accordance with Arts. 33 and 34 GDPR.

13Cookies and similar technologies

The Amista mobile app does not use cookies or advertising identifiers. It stores data only in your device's local storage, and only for the app to work (sign-in, the offline copy of your chats, the image cache and settings) — see Section 3.8.

On our websites we use only strictly necessary cookies, which do not require your consent. The website remembers your chosen language in your browser. We load fonts from Google Fonts and the animation library for the home page from cdnjs (Cloudflare); in doing so, these services see your device's IP address. When you sign in on the Account page, the sign-in is stored only in the browser's session storage (sessionStorage) and is cleared when you close the tab or sign out. The Google and Apple sign-in scripts are also loaded on this page so that you can sign in with your account with them; these services may process technical data in doing so in accordance with their own policies.

14Changes to this policy

We may update this policy if the Service or legal requirements change. The current version is always available at this address, together with its effective date and version number.

If a change is material, we will let you know in advance — in the app or by e-mail — within a reasonable time before it takes effect. By continuing to use the Service after a change takes effect, you acknowledge the amended version; where processing requires consent, we will ask for it separately.

15Contact

Please send questions, requests to exercise your rights and comments on the protection of personal data to:

Fellow Labs s. r. o.
Karpatské námestie 7770/10A
831 06 Bratislava – mestská časť Rača
privacy@amista.app

Versions of this document

• Version 1.1 · effective from 30 September 2026 · in force — amista.app/privacy-1-1-en
• Version 1.0 · effective from 29 September 2026 — amista.app/privacy-1-0-en

Back to top ↑