1Introduction
This policy explains what personal data we process about you in the Amista mobile app and on the related websites (the “Service”), why we process it, who we make it available to and what rights you have in relation to it.
Amista is an app for communities and events. It lets you create a profile, start or join communities, organise and attend events, share posts and photos, talk in chat and find events near you.
We do not sell your personal data. We do not show advertising. We do not track you across other apps or websites, and we do not use any third-party advertising or analytics tracking tools, except for the app's error and performance reports (Sentry, Section 3.4).
This policy supplements the Terms of Use (amista.app/terms-en), which govern the rules for using the Service and the content in it.
2Controller and contact
The controller within the meaning of Art. 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”) is:
| Company name | Fellow Labs s. r. o. |
|---|---|
| Registered office | Karpatské námestie 7770/10A, 831 06 Bratislava – mestská časť Rača |
| Company ID (IČO) | 57 844 062 |
| Registration | Commercial Register of the Bratislava III Municipal Court, Section Sro, Insert No. 204220/B |
| Data protection e-mail | privacy@amista.app |
| Telephone | +421 911 505 133 |
We are not required to have a data protection officer (DPO) under Art. 37 GDPR and have not appointed one. For all data protection matters, contact us at the e-mail address given above.
3What data we process
3.1Data you provide to us directly
Account data. When you register with an e-mail address, we process your e-mail address and password (the password is stored only as a cryptographic hash, never in readable form). At registration we also ask for your year of birth to apply the minimum age of 16 (it is your own declaration, we do not verify it; Section 9); it is not shown to anyone. If you sign in with Google or Apple, we receive your identifier, e-mail address, name and, where applicable, a link to your profile photo from the provider. A profile photo from a Google account is shown to others directly from Google's servers, so Google sees the IP address of whoever views it when it loads (Section 5.2). If you use the “Hide My Email” feature when signing in with Apple, we receive only a forwarding address from Apple, not your real address.
Profile. Username, display name, profile photo, a short description (“bio”) and links to your Instagram, Facebook or X profiles, if you add them.
Content you create. Communities (name, description, categories, images, links), events (name, description, date and time, location including geographic coordinates and location details, images, categories, capacity, agenda, event updates, and price and currency, which are for information only), posts, comments and GIFs, polls and your votes in them, photos (Moments), chat messages including attachments, reactions and mentions (@), your “hearts” on posts and comments, your responses to invitations (going / interested), your subscriptions to recurring events and courses and your opt-outs from their individual dates, and pinned items.
Social connections and visibility settings. Friend requests and friendships, community memberships and requests to join, invitations, blocked users, hidden communities and people, the default audience for your content, the visibility of your calling card and whether you can be found in search.
Discovery preferences. Your interests and your home area (how it was set, the place name, the geographic coordinates of its centre and the search radius; how we determine it is described in Section 3.5). They are used to choose what we show you on the map and in Discovery. Your interests and the coordinates are not shown to any other user; the place name only if you turn it on for your calling card (Section 5.1).
Reports and support. If you report content, a user or a community, we process the reason for the report, your free text, the identification of the reported content and what it looked like at the time of the report, and your identification as the reporter. If you contact us, we process the content of your message and the contact details you include in it. Messages sent through the contact form on the website (topic, name, e-mail, text, additional details and attached files) are stored in our database; only our team can see them, in the Service's administration, and we reply to them by e-mail at the address you provided. The legal basis is our legitimate interest in handling your request and, for requests under the GDPR, compliance with our legal obligation. If you write to us directly from the app (the “Write to us” feature), we process the type of feedback (bug, idea, other), its text, the screen you sent it from, and the app version, platform and operating system version.
3.2Data other users provide about you
Some data about you does not arise from your own activity but from the activity of others. This includes in particular:
- invitations — who invited you to an event or a community and how you responded to the invitation;
- friend and membership requests that someone sends you;
- blocking and hiding — if another user blocks or hides you, we process this connection so that we can respect their decision;
- reports — if someone reports you or your content, we process the reason for the report and the free text they wrote with it;
- content from others — posts, comments, chat messages and photos in which someone mentions you (including an @mention in chat) or in which you may appear.
The extent of such data is limited by the way the Service is built: only people who already have an Amista account can be invited, the app does not allow people to be tagged in posts and it does not sync the address book on your phone. We therefore do not process the contact details of people who do not use the Service.
Your responsibility. If you publish content that shows other people — for example a photo from an event — you are also processing their personal data. You are responsible for having their consent or another legal ground for doing so, and for respecting their privacy. If anyone believes that content in the Service infringes their rights, they can report it directly in the app or contact us at the address given in Section 2.
3.3Special categories of personal data
Special categories of data under Art. 9 GDPR — data concerning health, religious or philosophical beliefs, political opinions, racial or ethnic origin, sexual orientation or trade union membership — are not required by us; we do not ask for them and we do not use them to select the content we show you.
Such data may nevertheless arise in the Service through what you yourself write or upload to it. Membership of a community alone can reveal such data — for example, if the community has a religious, political, health-related or LGBTI+ focus. Your profile description, a post or a photo may contain it too.
We do not ask you for such data and we advise you not to include it. If you yourself manifestly make it public in public content, we process it under Art. 9(2)(e) GDPR (data manifestly made public by the data subject); in content for a closed audience, we process it only to the extent necessary to show the content to that audience and for moderation. You can remove the content or change its visibility setting at any time.
So consider carefully what you publish and to whom — the visibility settings are described in Section 5.1.
3.4Data generated by your use of the Service
Technical and operational data. For each call to our API, our server records the method and address of the request (without parameters), its result and the time. It uses the IP address only in working memory to limit the number of requests, and our code does not store it. Our hosting (Railway) and database (Supabase) providers keep their own technical logs, including the IP address — Supabase, for example, records the IP address when you sign in. Railway keeps them for no more than 30 days and Supabase for no more than 28 days; these periods are set by the providers according to the plan we have with them (Section 8). This serves operation, error diagnosis and security.
Time of last activity. We record when you last used the Service. Our team uses it for statistics on the use of the Service.
Error reports. When the app crashes or runs into an error, it sends a report to Sentry: technical data about the error and about what preceded it in the app, the device model, the operating system and app versions, and your user identifier, so that we can link the error to your support request. We do not send your name, e-mail or the content you have in the app in these reports, and no screenshots are taken. For a portion of app launches we also send data about the app's speed (for example, how long the launch took).
Device data for notifications. The device registration token for Firebase Cloud Messaging, the device platform (Android / iOS), the app version and build, a random installation identifier that the app creates once per installation (so that the token cannot be claimed by someone else's account), the time of registration and of last use, and the app language, so that notifications arrive in the right language. We remove this data when you sign out, when the notification service rejects the token as invalid, and when your account is deleted.
In-app state. Read markers (e.g. which photos or sections of an event you have already seen and up to which message you have read a chat), visit markers (which event and community you last opened, so that we can mark what is new for you), in-app notifications (the bell), a record of the event reminders sent, so that you do not receive the same reminder twice, and your notification settings by category.
3.5Location
Permission. The system asks you for location permission only when you tap a feature in the app that needs your location. On Android we ask for both precise and approximate location, on iOS for location “while using the app”. You can revoke the permission at any time in your operating system's settings.
When we determine your location. If you grant permission, the app determines the device's location when you open the map and then about every 7 minutes while you are using the app. We do not determine your location in the background — when the app is closed or in the background, the location is not read.
What we do with it. We send your location to our server so that we can show you communities and events near you on the map and in Discovery. We store the first location determined on our server as the centre of your home area (precise coordinates), together with a place name, and we also store it on your device.
Legal basis. Determining the device's location is based on your consent (the system permission). Storing your home area, which the map and Discovery use to choose content for you, is part of performing the contract (Section 4). You change the stored home area by determining your location again or by choosing a place in Settings; revoking the system permission does not delete it — it is deleted when you delete your account, or on request to privacy@amista.app.
Who sees it. Other users do not see the coordinates of your location or of your home area. You can show the place name of your home area on your calling card — in the “Who sees you” setting (by default, nobody sees it).
Who we send it to. Your device also sends the coordinates to the Photon service (komoot) so that it can name the place, and, when you search for an event venue, together with the search term, so that nearer places are listed higher. We load base maps from MapTiler — for the area you are viewing and, in advance, for the surroundings of your home area, even before you open the map. Both services see your device's IP address in doing so (Section 5.2).
Event venue. The coordinates of an event's venue, which you enter as the organiser, form part of the event and are seen by those who can see the event.
3.6Payments and subscriptions
The paid plans Amista+ and Amista Pro are bought as in-app purchases through the App Store or Google Play. Payment is processed exclusively by Apple or Google — we do not receive or store payment card numbers or any other payment details. Through RevenueCat we receive only the purchase (transaction) identifier, the product and the store, the type and status of the subscription, its period and expiry date, for each payment the amount and currency paid and the time of purchase, on cancellation its reason, and whether it was a test or a live purchase — so that we know which plan you have active, can handle a complaint and can keep our accounting records.
Every time the app starts, it initialises the RevenueCat library, even if you have not bought anything. RevenueCat receives an anonymous identifier and technical data about the device and operating system in doing so. RevenueCat keeps its own customer record (the anonymous identifier and the purchase history), which is not deleted when you delete your Amista account; RevenueCat keeps it under its own rules. On request to privacy@amista.app we will arrange for it to be deleted at RevenueCat.
Refunds by bank transfer. If we refund an App Store purchase by bank transfer (Terms, Articles 11.5 and 16.3), we process your name and IBAN, which you send us for that purpose, and only to make the refund. The legal basis is the performance of a contract and a legal obligation (Art. 6(1)(b) and (c) GDPR); as part of our accounting records we keep them for 10 years (Section 35 of Act No. 431/2002 Coll. on Accounting).
What others can see of your plan. The name of your plan (for example “Amista+”) is shown on your calling card only to those who can see its “Friends, communities & events” part (the “Who sees you” setting, Section 5.1); others do not see your plan. Only you can see how much of your plan's limits you are using. The free plan is not shown on the calling card.
When a plan ends. If, after a plan downgrade, you own more communities than the new plan allows, we record the deadline by which you are choosing which ones stay, what you chose, and which communities are locked and when they will be deleted (Terms, Article 11.4). We notify both you and the members of the affected communities of the locking and the upcoming deletion. Photos from a locked community are downloaded through a link that is valid for 24 hours and contains the photos you are allowed to see. Anyone who has the link can open it during those 24 hours — so do not send it to anyone. We put the archive together only when the link is opened and do not keep it on our servers.
3.7Visitors without an account
Links to invitations, events and communities (go.amista.app) open a web page that is provided by our server and can also be viewed by someone who does not have an Amista account. During such a visit, our server records which link was opened, the result and the time; it uses the IP address only to limit the number of requests and does not store it. Our hosting provider (Railway) keeps its own technical logs, including the IP address (Section 3.4). The page may show profile photos stored with Google; Google sees the device's IP address in doing so. We process this data on the basis of our legitimate interest in the operation and security of the Service and keep it for as long as other logs (Section 8). No account or profile is created as a result, and we do not link such visits to any person.
3.8What we do not keep on our servers
Some data stays only on your device and never reaches our servers: the local copy of your chats (so that you can read the history offline too), the image cache, a saved copy of the most recently displayed content for a faster start, and local settings (e.g. the app theme). A copy of your home area and interests is also stored on your device.
Device backups. On Android, the app's data is not backed up. On iOS, the app's documents folder is excluded from backup, but the app's settings (including the coordinates of your home area and your interests) are part of the device backup in iCloud or on a computer, if you have it turned on. On iOS the app stores your sign-in (session) in the Keychain for this device only, so it is not carried over into a backup.
Uninstalling the app removes this data from the device; copies in a device backup remain until you overwrite or delete the backup. The iOS Keychain entry stays on the device after uninstalling; the app deletes it straight away on the next installation.
4Purposes and legal bases of processing
| Purpose | Categories of data | Legal basis |
|---|---|---|
| Setting up and maintaining your account, signing in | Account data, profile | Performance of a contract — Art. 6(1)(b) GDPR |
| Applying the minimum age of 16 | Year of birth | Performance of a contract — Art. 6(1)(b) |
| Providing the Service: communities, events, posts, photos, chat, invitations, friendships | Content, social connections, visibility settings | Performance of a contract — Art. 6(1)(b) |
| Storing your home area and showing relevant content and events near you | Interests, home area | Performance of a contract — Art. 6(1)(b) |
| Showing content that contains a special category of data | Content you publish yourself | For public content, data manifestly made public — Art. 9(2)(e); for content for a closed audience, see Section 3.3 |
| Determining the device's location, naming the place and the map of your surroundings | Device location | Consent — Art. 6(1)(a) (OS permission) |
| Access to the camera and photo library | Selected photos | Consent — Art. 6(1)(a) (OS permission) |
| Push notifications about activity in the Service | Device token, language, notification settings | Consent — Art. 6(1)(a) (OS permission); for service notices, performance of a contract — point (b) |
| Service e-mails (verification code at sign-up, password reset code) | E-mail address | Performance of a contract — Art. 6(1)(b) |
| Operation, security, prevention of abuse and spam, error diagnosis | Technical and operational data | Legitimate interest — Art. 6(1)(f) (a secure and functioning Service) |
| Content moderation, handling reports, suspending accounts | Reports, reported content, account status | Legitimate interest — Art. 6(1)(f) (protection of users); legal obligation — point (c) where imposed by law |
| Averting an imminent threat to life or health | Depending on the nature of the situation | Vital interests — Art. 6(1)(d) |
| Aggregate statistics on the use of the Service | Time of last activity; aggregated data that no longer identifies a person | Legitimate interest — Art. 6(1)(f) |
| Managing subscriptions to the Amista+ and Amista Pro plans | Identifier, product, status and period of the purchase; amount and currency of the payment | Performance of a contract — Art. 6(1)(b) |
| Handling complaints and keeping accounting records of payments | Payment records (Section 3.6) | Legitimate interest — Art. 6(1)(f); legal obligation — point (c) |
| Refunds by bank transfer | Name, IBAN, amount refunded | Performance of a contract — Art. 6(1)(b); legal obligation — point (c) |
| In-app feedback (“Write to us”) | The text of the feedback and the technical data sent with it | Legitimate interest — Art. 6(1)(f) (improving the Service) |
| Exercising, establishing and defending legal claims | Depending on the nature of the dispute | Legitimate interest — Art. 6(1)(f) |
| Complying with obligations under the law (accounting, responses to authorities) | Depending on the nature of the obligation | Legal obligation — Art. 6(1)(c) |
Where the legal basis is consent, you can withdraw it at any time — withdrawal does not affect the lawfulness of processing before it was withdrawn. You can revoke the location, photo and notification permissions in your operating system's settings. We do not send marketing e-mails. By e-mail we routinely send you only the codes necessary for your account to work (at sign-up and for a password reset), on the basis of the contract.
Required and optional data. To create an account we need an e-mail address (or a Google or Apple account), a password when you register by e-mail, a username, a name, your year of birth and at least one interest; without them an account cannot be created. All other data (photo, bio, links, location, notifications, camera) is optional; without it the relevant feature will not be available. No law requires you to provide the data.
You can object at any time to processing based on legitimate interest — see Section 10.
5Who we make data available to
5.1Other users
Amista is by nature a social app — some data is visible to others, to the extent determined by your settings:
- Your profile (username, name, photo, links to social networks) is visible to people who can open your calling card. You control whether you can be found in search in your settings.
- Calling card. For individual parts of your calling card you choose, in the “Who sees you” setting, whether everyone, only friends or nobody sees them: your description (bio), the name of your home area (by default nobody) and the list of your friends, communities and the events you attended. The name of a paid plan (Amista+ or Amista Pro) is visible on the calling card only to those who can see its “Friends, communities & events” part.
- Content you create. Posts and polls are seen by all members of the community, and when publishing them you can also share them with your friends. An event is seen by people according to the access mode the organiser chooses (public, members only, private — invited people only). Comments, GIFs, photos and chat messages are seen by those who can see the post, event or chat they are in.
- Going and interested. The full list of people going to an event is seen by the community's members, the organiser, invitees and those going; others see only their own friends on it and the total number. Interest (“Interested”) is shown to others only as a number.
- Polls are anonymous — others see only the vote counts, not how you voted.
- Hearts and reactions. When you give a post or comment a heart, its author finds out it was you. Chat reactions are seen by the chat's participants.
- Chat. The chat's participants see who has already seen a message — including your name once you have read it. When you mention someone in a message (@), they receive a notification about it.
- The coordinates of your home area and your location, your interests, settings, blocked and hidden users and your reports are never shown to anyone else. A reported user never finds out who reported them.
Bear in mind that anyone you have made content available to can read it, save it or take a photo of it — we cannot technically prevent this.
5.2Service providers and other recipients
We use vetted providers. For each one we state where it processes the data and, for a country outside the European Economic Area, which safeguard protects the transfer (Section 7): DPF — the company is certified under the EU–U.S. Data Privacy Framework; SCC — standard contractual clauses approved by the European Commission.
a) Processors. They process data for us, solely on our instructions and under a contract pursuant to Art. 28 GDPR:
| Provider | Role | What data reaches them | Country / safeguard |
|---|---|---|---|
| Supabase | Database, authentication, sending service e-mails | All data stored in the Service | Data in the EU (Ireland); Supabase, Inc. is based in the USA — SCC |
| Railway | Hosting of our application server | Data passing through the API, server logs including IP address | The server may also run in the USA; Railway Corporation, USA — DPF |
| Cloudflare (R2 and Workers) | Storing and delivering images | Uploaded images, IP address when they are loaded | Global network; Cloudflare, Inc., USA — DPF |
| Google (Firebase Cloud Messaging, Firebase Installations) | Delivering push notifications | Device token, Firebase installation identifier and notification content | USA — DPF |
| RevenueCat | Managing subscription status | User identifier and purchase data (no payment details); at every app launch, even without a purchase, an anonymous identifier and technical data about the device and operating system | USA — SCC |
| Sentry (Functional Software, Inc.) | App error and performance reports | User identifier, device data and technical data about the error | Data in the EU; company in the USA — DPF |
| Websupport | Hosting of the amista.app website and our mailboxes | IP address when you visit the website; e-mails you send us | Slovakia (EU) |
b) Independent recipients. These services process data as independent controllers under their own policies — your device connects to them directly, or you have your own relationship with them (a Google or Apple account, an app store):
| Recipient | Role | What data reaches them | Country / safeguard |
|---|---|---|---|
| Apple (Sign in with Apple, Apple Push Notification service, App Store) | Signing in with an Apple account, delivering notifications to iOS devices, in-app purchases | Account identifier, device token and notification content, purchase data | USA — SCC |
| Google (Sign in with Google, Google Play) | Signing in with a Google account, in-app purchases | Account identifier; purchase data | USA — DPF |
| Google (profile photos) | Showing a profile photo from a Google account directly from Google's servers | IP address of the device of whoever views the photo | USA — DPF |
| komoot GmbH (the Photon service) | Naming a place from its location and place search | Geographic coordinates, search term and device IP address | Germany (EU) |
| MapTiler AG | Base maps | Device IP address, the area of the map you are viewing and the surroundings of your home area (loaded in advance) | Switzerland — adequacy decision |
| KLIPY (Kikliko, Inc.) | GIF search | Search term (sent by our server, not your device); when the GIF itself is loaded, it sees your device's IP address | USA — SCC |
Google profile photos, Photon, MapTiler base maps and the GIFs themselves from KLIPY are loaded by your device directly from these services. In doing so they see your device's IP address and also process it under their own policies.
5.3Public authorities and other third parties
We make data available to public authorities where required by law or on the basis of a lawful request (for example, to law enforcement authorities or a court). We assess each such request and disclose only the data reasonably requested in it.
We may also disclose data where this is necessary to avert an imminent threat to life or health, or to exercise or defend our legal claims.
In the event of a sale of the business, a merger or a similar transaction, data may pass to the acquirer; in that case we will inform you in advance, and the acquirer will be bound by at least the same level of protection.
We do not sell your personal data or provide it to third parties for advertising purposes.
5.4Aggregated and anonymised data
We publish or provide to third parties (for example, to investors or in communications about the Service) aggregate statistics — for example, the number of users, communities or events. Such data is aggregated and does not allow any specific person to be identified; it is therefore not personal data, and this policy does not apply to it once aggregated.
6Messages, chat and content moderation
We think it is right to say this plainly, because it also concerns your private conversations.
Chat in Amista is not end-to-end encrypted. Communication between the app and our servers is encrypted in transit (HTTPS/TLS), but messages are stored on our servers in readable form. Technically, therefore, access to them exists.
Nobody reads them as a matter of course. Access to the production database is limited to a small group of authorised persons (currently the founders of the Service) and is used for operation, bug fixing and moderation — not for reading conversations.
Reported content is reviewed by a human. When someone reports a message, post, poll, comment, photo, event, profile or community, an authorised person views the reported content solely for the purpose of handling that report and to the extent necessary for doing so. This also applies to content in a private community or an event chat of which we are not members — otherwise the report could not be assessed.
After repeated reports, content is hidden automatically (when three different people report a post, event, comment, chat message or photo within 7 days; only reports from accounts older than 3 days whose reports have not been excluded for misuse count) and awaits manual review. Content reported as sexual content involving a minor is hidden after the very first report and locked against deletion (a legal hold) — it is preserved even if its author deletes it or their account, until we release the hold. Where we suspect a criminal offence involving a threat to the life or safety of a person, in particular the sexual abuse of a child, we report it to law enforcement authorities without delay (Art. 18 DSA). A reported profile or community is not hidden automatically — we review it as a priority. These are temporary, reversible measures; every permanent action — removal of content or suspension of an account — is always decided by a human, never by the system alone.
Prohibited-words filter. We automatically check usernames, community names and event titles against a list of prohibited terms; the Service does not accept a name that contains such a term.
Suspended account. While an account is suspended, it cannot write or post anything, it is signed out, and its content (posts, events, chat messages, comments, Moments photos) and calling card are hidden from others.
The reporter remains anonymous. A reported user never finds out who reported them. A community's admins find out that content in their community was reported, but not who reported it. The reporter receives a confirmation that the report was received and, once it has been reviewed, a notice of what we decided about the reported content (removed, hidden or no action), whether we used automated means in doing so, and what redress is available; we do not tell them about measures taken against the author's account.
The legal basis for this processing is our legitimate interest in protecting users and the security of the Service (Art. 6(1)(f) GDPR); where there is a threat to life or health, also vital interests (point (d)); and where the law requires us to act, a legal obligation (point (c)).
7Data transfers outside the EU
The database and authentication (Supabase) run in the eu-west-1 — Ireland region, i.e. within the European Union. Error reports (Sentry) are stored in a data centre in the European Union.
The other providers and recipients may also process data outside the European Economic Area, in particular in the United States of America. Where each of them processes the data and which safeguard protects the transfer is given in the “Country / safeguard” column of the tables in Section 5.2: for companies certified under the EU–U.S. Data Privacy Framework (DPF), it is the European Commission's adequacy decision (Art. 45 GDPR); for the others, standard contractual clauses approved by the European Commission (SCC, Art. 46(2)(c) GDPR); Switzerland has an adequacy decision.
On request to the contact address given in Section 2, we will provide you with a copy of the safeguards used.
8Retention periods
| Data | How long |
|---|---|
| Account, profile, preferences, settings | For as long as the account exists |
| Content you have created (posts, polls, comments, events) | Until you delete it, until the community is deleted or until the account is deleted |
| Event photos (Moments) | For as long as the event and the community exist, unless you delete them earlier; they can be uploaded until 7 days after the event ends |
| Event chat — messages, reactions and photos sent to the chat | It can be written in until 7 days after the event ends and read until 14 days after (for a recurring event, after the end of that date; for a course, after the end of the last session); then we delete it, also from the local copy in the app. Messages under an open report or a legal hold are kept, hidden, for moderation. Event photos (Moments) are not deleted by this |
| Community chat | For as long as the community exists |
| A message you unsend (possible within 2 days of sending) | It disappears for others at once; we delete its content together with the whole chat |
| A community closed by its owner | 3 days during which it can be restored; then we delete it with all its content |
| A community locked after its owner's plan was downgraded, including members' content | 30 days from locking, then we delete it (Terms, Article 11.4) |
| An account you have asked to delete | Hidden and suspended for 7 days so that you can cancel the deletion in the app; then we delete it (Section 8.1) |
| In-app notifications (the bell) and visit markers | Until the account is deleted; we do not delete them automatically |
| Our server's logs (without IP address) and the technical logs of Railway and Supabase (including IP address) | No more than 30 days (Railway) and no more than 28 days (Supabase) — these periods are set by the providers according to the plan we have with them; longer only if we need a record to investigate a specific security incident |
| Error reports (Sentry) | No more than 90 days |
| Device tokens for notifications and the related device data | Until you sign out or the notification service rejects them as invalid, at the latest until the account is deleted |
| Contact form messages, including attachments | Until we have dealt with them; then 12 months, or 3 years for GDPR requests, appeals, security and legal matters (to demonstrate how we dealt with them). We will delete them earlier on request |
| In-app feedback (“Write to us”) | 24 months from when it was sent; then we delete it together with the notice to our team that quotes its beginning. When the account is deleted, we remove the link to you from it straight away |
| Reports | While being handled; 12 months after closure we remove from them who submitted them and their text; 3 years after closure we delete them entirely, including the captured version of the reported content |
| Our team's records of moderation steps and internal moderation notes | 3 years from when they were made, then we delete them |
| Hidden content (automatically or in moderation) | Stays hidden until we have reviewed it |
| Content removed in moderation | 30 days (so that it can be restored after an appeal), then we delete it. A removed profile picture or community image is deleted at once, unless it is subject to an open child-safety report or a legal hold |
| Content under a legal hold (for example, reported sexual content involving a minor) | We preserve it — even if its author deletes it or their account — until we have reviewed it and, if the suspicion is confirmed, for as long as an investigation or cooperation with law enforcement authorities requires; until then we also postpone the deletion of such an account or community |
| A permanently suspended account | It stays suspended (hidden and signed out), with its data, until we delete it — at your request to privacy@amista.app or by our team's decision; we do not delete it automatically |
| Payment records (transaction identifiers, product, store, amount and currency paid, time of purchase, cancellation reason, test or live purchase) | We delete each record 3 years after the later of the payment date and the end of the period paid for, but not earlier than 3 years after the subscription ended. When the account is deleted, we remove the link to your profile and your RevenueCat identifier from them; we keep only the amount, currency, product, dates and the store's transaction identifiers, for handling complaints and for accounting and tax purposes |
| The customer record at RevenueCat (anonymous identifier, purchase history) | Under RevenueCat's rules; it is not deleted when you delete your account — on request to privacy@amista.app we will arrange for it to be deleted |
| Name and IBAN for a refund by bank transfer | 10 years as part of our accounting records (Section 35 of Act No. 431/2002 Coll. on Accounting) |
| Accounting and tax records | For the period laid down by law (usually 10 years) |
When these periods expire, we delete the data or irreversibly anonymise it.
8.1Account deletion and how long it takes
You can delete your account at any time directly in the app under Settings, or on our website under Account after signing in. If you signed up with Apple and cannot sign in on the website, write to us at the address given in Section 2 from the e-mail address on your account, and we will delete it.
What is deleted. Your account, profile, preferences, settings, social connections and the content tied to the account, including the photos and images you have uploaded and your chat messages. Events you organised are deleted in full — including their chat, the participants' responses and the photos, including those uploaded by others. Reports you have filed are kept without your identity, and payment records without a link to your profile (Section 8). The customer record kept by RevenueCat is not deleted with your account; we will arrange for it to be deleted on request (Section 3.6).
Grace period. After you request deletion, your account is hidden and suspended for 7 days. If you change your mind, simply sign in to the app during this period and cancel the deletion — it cannot be cancelled on the website. Once the period has expired, the deletion begins. We will delete a suspended account upon a request sent to the address given in Section 2.
Subscription. Unused time of a paid plan is forfeited when the account is deleted, except where you terminate the contract because of a change that worsens your position (Terms, Article 17). Deleting the account does not cancel a subscription in the App Store or Google Play — cancel it in the store, otherwise it will keep renewing.
How long it takes. Once deletion has begun, removing the data from our operational systems can take up to 90 days. Copies remain for some time in backup systems used for disaster recovery — these are overwritten on their own cycle, within a further 90 days at the latest. We do not read data from the backups or use it for any other purpose.
Please note three exceptions:
- Communities with other members. If you own a community that also has other members, deleting your account would also remove their community. So before deleting your account, hand the community over to another member or close it — both in its settings in the app; the app reminds you of this when you delete your account.
- Messages held by recipients. Messages you have sent may remain stored in the local copy of the chat on the other participants' devices until they remove it themselves.
- Legal hold. If your content is under a legal hold (for example, after a report of sexual content involving a minor), we preserve it and postpone the deletion of your account until we release the hold — that is, until we have reviewed the content and, if the suspicion is confirmed, for as long as an investigation or cooperation with law enforcement authorities requires.
In exceptional cases we may retain data even after the account is deleted, where this is necessary to comply with a legal obligation, to handle a pending report or to exercise or defend legal claims — and only to the extent necessary for that purpose.
9Children
The Service may only be used by people who have reached the age of 16. The Slovak Republic has set the age at which a child can consent in relation to information society services at 16, and the Service is not intended for younger people.
If we find out that we have processed the data of a person under 16, we will close their account and delete the data without undue delay. If you believe that a child under 16 is using the Service, contact us at the address given in Section 2.
10Your rights
Right to object (Art. 21 GDPR). On grounds relating to your particular situation, you can object at any time to processing based on legitimate interest (e.g. statistics, feedback, security records, moderation) at privacy@amista.app. We will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims.
Under the GDPR you have the following rights in relation to your personal data:
- Right of access (Art. 15) — to find out whether and what data we process about you, and to receive a copy of it.
- Right to rectification (Art. 16) — to have inaccurate data corrected and incomplete data completed. You can correct most data directly in the app.
- Right to erasure (Art. 17) — to have your data erased; you can also delete your account yourself in Settings (see Section 8.1).
- Right to restriction of processing (Art. 18).
- Right to data portability (Art. 20) — to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller.
- Right to object (Art. 21) — to processing based on our legitimate interest, as described above.
- Right to withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of prior processing.
- Right to lodge a complaint with a supervisory authority (Art. 77).
You can exercise your rights by e-mail to the address given in Section 2. We will reply within one month of receiving your request; in justified cases we may extend this period by up to two further months, and we will let you know if we do. Handling your request is free of charge; for manifestly unfounded or excessively repetitive requests we may charge a reasonable fee or refuse the request.
If we have reasonable doubts about your identity, we may ask for additional information to verify it.
Supervisory authority: Office for Personal Data Protection of the Slovak Republic Hraničná 12, 820 07 Bratislava 27 statny.dozor@pdp.gov.sk · www.dataprotection.gov.sk
11Automated decision-making and profiling
We do not carry out automated decision-making, including profiling, that would have legal effects on you or similarly significantly affect you within the meaning of Art. 22 GDPR.
The order of the content you see in the feed and in Discovery is put together automatically — based on your memberships, friendships, chosen interests and home area. It serves solely to show you relevant content and has no legal consequences for you.
The temporary hiding of repeatedly reported content and the prohibited-words filter for usernames and for community and event names (Section 6) also work automatically. Hiding is a reversible protective measure pending manual review — every permanent decision is made by a human. You appeal a decision about your content or account at appeals@amista.app (Terms, Article 7.5); you exercise your rights under the GDPR, including objecting, at privacy@amista.app (Section 10).
12Security
We take appropriate technical and organisational measures to protect your data, in particular:
- encryption in transit (HTTPS/TLS) for all communication between the app and our servers,
- storing passwords only in the form of a cryptographic hash,
- access to data at database level restricted by row-level rules and by server-side authorisation — the client app never holds privileged access keys,
- private images (e.g. photos from communities and chat) delivered only through signed links with limited validity,
- access to production systems restricted to the persons for whom it is essential.
No measure, however, provides absolute protection. We will notify a personal data breach to the Office for Personal Data Protection of the Slovak Republic within 72 hours if it is likely to result in a risk to your rights; if it is likely to result in a high risk, we will also inform you without undue delay (Arts. 33 and 34 GDPR).
13Cookies and similar technologies
The Amista mobile app does not use cookies or advertising identifiers. It stores data only in your device's local storage, and only for the app to work (sign-in, the offline copy of your chats, the image cache and settings) — see Section 3.8. The app carries its fonts inside it and does not download them from the internet.
Third-party libraries in the app do use the following identifiers:
- RevenueCat — an anonymous identifier that the library creates at first launch and sends at every launch, even if you have not bought anything (Section 3.6);
- Firebase Installations — the Firebase installation identifier for delivering notifications (Section 3.4);
- Sentry — error and performance reports from the app with your user identifier (Section 3.4).
Our websites set no cookies and use no analytics or advertising tools. The website remembers your chosen language in the browser's storage (localStorage). We load fonts from our own server. The home page loads libraries for animation and the QR code (GSAP, ScrollTrigger, qrcode-generator) from cdnjs (Cloudflare); Cloudflare sees your device's IP address in doing so.
When you sign in on the Account page, the sign-in is stored only in the browser's session storage (sessionStorage) and is cleared when you close the tab or sign out. The Google sign-in script is also loaded on this page so that you can sign in with your Google account; the Apple sign-in script is loaded only when Apple sign-in on the website is turned on. These services may process technical data in doing so in accordance with their own policies.
The link pages for invitations, events and communities (go.amista.app) are provided by our server. They use the device's system fonts and may show profile photos stored with Google (Section 3.7).
14Changes to this policy
We may update this policy if the Service or legal requirements change. The current version is always available at this address, together with its effective date and version number.
If a change is material, we will let you know in advance — in the app or by e-mail — within a reasonable time before it takes effect. By continuing to use the Service after a change takes effect, you acknowledge the amended version; where processing requires consent, we will ask for it separately.
15Contact
Please send questions, requests to exercise your rights and comments on the protection of personal data to:
Fellow Labs s. r. o.
Karpatské námestie 7770/10A
831 06 Bratislava – mestská časť Rača
privacy@amista.app
+421 911 505 133
Versions of this document
- Version 1.1 · effective from 30 September 2026 · in force — amista.app/privacy-1-1-en
- Version 1.0 · effective from 29 September 2026 — amista.app/privacy-1-0-en