Privacy Policy
Last updated: 7 September 2026
This policy describes what data the Vyrazíme app (the “app”) collects, what we use it for and what rights you have. The app is operated by Jiří Praus, an individual based in the Czech Republic (contact: ahoj@vyrazime.app), who is the data controller within the meaning of Regulation (EU) 2016/679 (GDPR).
1. What data we collect
1.1 When you register and use a full account
•
Email address — for signing in and notifications.
•
Name — shown to other participants of an event.
•
Profile photo (optional) — stored in Supabase Storage.
1.2 Guest access (without registration)
If you open an invitation without creating an account, we create an anonymous session for you. We only store the name you entered yourself and your activity within the invitation. We do not ask for an email address.
1.3 Content you create in the app
•
Events (name, date, place, description, cover photo)
•
Date and place proposals
•
Chat messages and attachments
•
Availability information (when you can’t make it)
1.4 Technical data
•
Push token — an anonymous device identifier used to deliver notifications.
•
Authentication token — stored locally in the device’s secure storage.
•
Diagnostic data — minimal error logs used to fix problems.
We do not collect any advertising identifiers, we do not use third-party analytics cookies and we do not track you across other apps or websites.
2. What we use the data for
•
Running the app — authentication, storing and displaying your events.
•
Delivering invitations and notifications (emails, push notifications).
•
Communication with other participants of your events.
•
Fixing bugs and improving the app.
•
Meeting legal obligations (e.g. keeping records of consent).
3. Who we share data with
We do not sell your data or share it with advertising networks. We share it only to the extent necessary with the following processors:
•
Supabase (Supabase, Inc., USA / Frankfurt EU region) — database hosting, authentication, file storage.
•
Resend (Resend, Inc., USA) — sending email notifications.
•
Expo Push (Expo, USA) — delivering push notifications to APNs (Apple) and FCM (Google).
•
Vercel (Vercel, Inc., USA) — hosting the web version of the app.
•
Cloudflare (Cloudflare, Inc., USA) — DNS and domain management.
•
Anthropic (Anthropic, PBC, USA) — AI features (place suggestions): only after your consent, we send the event’s place and dates, the number of people and children’s ages without names, the event description, your request and the names of places in the event; never your name, email or messages.
•
Google Places (Google LLC, USA) — verifying suggested places on the map (place names only, no personal data).
We have a data processing agreement (DPA) in place with each processor. Data stored in Supabase is located in the EU (Frankfurt) region. Transfers to the USA (Resend, Expo, Vercel, Cloudflare, Anthropic, Google Places) are based on the standard contractual clauses approved by the European Commission.
3.1 Sharing with other participants
When someone invites you to an event, the other invited participants can see your name, avatar, chat messages, proposals and your availability within that event. Only the event organizer can see your email address.
4. How long we keep data
•
Active account — for as long as you use the app.
•
After account deletion — we immediately delete all your personal data, except for anonymized records that may remain in backups for up to 30 days.
•
Diagnostic logs — 30 days at most.
•
Deleted events and messages — immediately, with no way to restore them (except backups for up to 30 days).
5. Your rights
Under the GDPR you have the following rights, which you can exercise by writing to ahoj@vyrazime.app:
•
Access — to know what data about you we process.
•
Rectification — we will correct or complete inaccurate data.
•
Erasure — the “right to be forgotten”; you can delete your account yourself in Profile or ask us by email.
•
Restriction of processing — we will temporarily suspend processing.
•
Data portability — we will export your data in a machine-readable format (JSON).
•
Objection — to processing based on legitimate interest.
•
Complaint — with the Czech Office for Personal Data Protection (uoou.cz) if you are not satisfied with how we handle your data.
6. Security
All communication runs exclusively over HTTPS (TLS 1.2+). We never see your password — Supabase Auth stores it as a bcrypt hash. Authentication tokens are stored in the app in the system’s secure storage (iOS Keychain / Android Keystore).
7. Children
The app is not intended for children under 13. If we learn that we have collected personal data from a child under 13 without verifiable parental consent, we will delete it without undue delay.
8. Changes to this policy
If we make material changes to this policy, we will announce them in the app at least 14 days in advance. The current version is always available at vyrazime.app/en/privacy.
9. Contact
Anything regarding data processing: ahoj@vyrazime.app
Jiří Praus, Czech Republic
This is a translation of the Czech policy at vyrazime.app/privacy. In case of any discrepancy, the Czech version prevails.