Privacy Policy

Qvart is an app operated by Sconium d.o.o. The controller of your personal data is:

Company: Sconium d.o.o.

Address: Radnička cesta 20, 10000 Zagreb, Croatia

OIB (tax ID): 09127769488

MBS (commercial court register number): 070116706 (Commercial Court in Zagreb)

Director: Samir Chamae

Contact: info@qvartapp.com

We have not appointed a data protection officer. For any privacy question, write to info@qvartapp.com.

This policy applies to the Qvart app for iOS and Android. It is meant for users in the Republic of Croatia and the European Union, and only people aged 18 or over may use it.

We get data from you, from how you use the app and from your device.

Account and profile: email address, username, first and last name, profile photo, date of birth, bio, city, interests, and gender if you choose to give it (optional)

Sign-in: if you sign in with Apple or Google, we receive the data you approve (usually your email address and name). We never see your password, it is stored only in a form that cannot be turned back into the original text

Two-factor authentication (2FA): the secret for your authenticator app and recovery codes. We store recovery codes only as hashes, and you see the code itself once, when it is created

Location: the home location you choose yourself (coordinates and address), the address and place of activities you create, and, if you allow it, your device location, which we use to work out the distance to activities. A location shared in a chat is seen only by the person or group you send it to

Activities: activities you create or join, join requests, invites, attendance and no-shows, posts in an activity, and the ratings you give and receive

Messages and media: messages in private chats and groups, and the photos, videos and documents you send. Camera, photos and microphone are used only when you choose to add a picture or video

Social connections: who you follow and who follows you, blocked users, muted chats, and reports you submit

Progress: achievements, attendance streaks and a reliability indicator calculated from your attendance and no-shows

Notifications: in-app notifications and a push notification token, if you turn them on

Feedback: the text, category and screenshots you send through Report a problem

Technical data: app version and platform (iOS or Android)

Diagnostics and analytics: only if you turn them on in Settings > Privacy (see section 6)

What other users see: your name, username (@username), photo, bio, city, interests, ratings and achievements, and your activities unless you turned that off. If you turn on Private profile, people who do not follow you see only your name, photo, username, city, the year you joined and your follower counts. Other users never see your date of birth, email address or home location. Your online status is shown, and you see other people's, only if that option is on.

We process data only for the purposes below, under Article 6 of Regulation (EU) 2016/679 (GDPR):

Performance of a contract (Art. 6(1)(b)): opening your account, showing your profile, publishing and joining activities, chats, ratings, followers, activity notifications, and exporting and deleting your data

Legitimate interest (Art. 6(1)(f)): security of the app, preventing abuse and fraud, request rate limiting, handling reports and moderation, keeping a record of measures taken, and defending legal claims

Consent (Art. 6(1)(a)): push notifications, diagnostics and analytics (Sentry and PostHog), and access to the camera, photos, microphone and device location. You can withdraw consent at any time, with no effect on the rest of the app

Legal obligation (Art. 6(1)(c)): acting on lawful requests from authorities and our duties under Regulation (EU) 2022/2065 (Digital Services Act, DSA)

We do not use your data for advertising and we do not sell it.

We make no decisions based solely on automated processing that have legal or similarly significant effects on you. There is one automatic action: when enough different users report the same profile within a short period, the system sends a warning in the app, with no restriction on the account. Suspensions and permanent bans are always decided by a person reviewing reports. The reliability indicator is calculated from attendance and no-shows and is shown on the profile as information for others, it does not block your account.

We do not sell data. We share it only with processors the app cannot work without, and only as far as a feature needs:

Supabase (database, sign-in, sign-in emails, file storage, real-time chat): servers in the eu-west-1 region (Ireland, EU)

Expo, Apple and Google (push notifications): the device token and notification text pass through the Expo push service (USA) and then Apple's or Google's notification service

Google (address search and geocoding through our places-proxy broker, translation of activity titles and descriptions when you request a translation, Google Maps on Android): receives the address query, coordinates, and the activity title and description for translation. iOS uses Apple Maps

Apple and Google (Apple or Google sign-in, if you choose it)

Linear (receiving feedback): receives your text, category, screenshots and account identifier

Sentry (crash diagnostics, servers in Germany, EU) and PostHog (analytics and session replay, EU cloud): only if you turn them on

Other users see your data as described in section 2, and authorities may receive it when we are lawfully required to provide it.

Transfers outside the EU/EEA (Expo in the USA and possible access by providers from the USA) rely on an adequacy decision (EU-US Data Privacy Framework) or on the standard contractual clauses of the European Commission.

We keep data while you have an account, except as listed below.

In-app notifications: deleted after 90 days, except unresolved follow requests

Push notifications that have no in-app record, and delivery receipts: deleted after one day

Request rate limit counters: deleted after 2 days

Address search cache (rounded coordinates and address): deleted after 90 days

Account deletion request: 30 day grace period, see section 7

Sentry, PostHog and Linear keep data under their own retention settings, which we do not fix with a specific number in this policy

Reports, moderation measures and feedback are kept in anonymised form after an account is deleted, for the safety of other users and to defend legal claims

Data we are legally required to keep is kept for as long as the law requires.

Diagnostics and analytics are off until you turn them on. They do not run in the background either. You turn them on in Settings > Privacy > Diagnostics sharing and can turn them off at any time.

When they are on:

Sentry records crashes and errors in the app, with technical device data and an account identifier. Email addresses and tokens are removed from reports before sending

PostHog records basic events (sign-up, creating an activity, joining, sending a message) and screen recordings of the session. On the recordings all text inputs and all images are masked, so your messages and other people's photos are not visible

The legal basis is your consent. If you withdraw it, sending stops immediately.

Push notifications are sent only if you allow them in the system and in Settings > Notifications. You can turn them all off at once or by type.

You delete your account in Settings > Account and security > Delete account. This is how it works:

The account is hidden from other users at once, and upcoming activities you organise are cancelled

For 30 days you can change your mind: sign in and choose Reactivate account, and everything stays as it was

After 30 days the account is anonymised: your profile (name, username, bio, city, interests, photo), date of birth, home location, email address, notification settings, followers, blocked users, group memberships, achievements, reliability indicator, streaks, notifications and recovery codes are deleted. Your profile photos, activity covers and chat media are permanently deleted from storage. Signing in is no longer possible

What remains in anonymised form (without your name, under a deleted user label): messages in private chats and groups, posts in activities, ratings, past activities and participation, and reports and feedback. This keeps other users' conversations and history complete and serves safety and the defence of legal claims

Messages you sent stay visible to the people you talked to.

Under the GDPR you have the following rights:

Access and portability: in Settings > Account and security > Download my data you get a JSON file with your data (profile, activities, messages, ratings, followers, blocked users, reports, feedback, achievements, notifications and links to your chat media that are valid for one hour)

Rectification: you can change your profile in the app at any time

Erasure: Settings > Account and security > Delete account (see section 7)

Restriction and objection: write to info@qvartapp.com

Withdrawing consent: for diagnostics in Settings > Privacy, for push notifications in Settings > Notifications or in your device settings

Complaint to a supervisory authority: the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr

We answer requests within one month. If we cannot satisfy you, you may also go to court.

Qvart is a platform where users publish content, so we act in line with Regulation (EU) 2022/2065 (Digital Services Act).

Reporting: you report a person in the profile menu (Report user), an activity in the activity menu (Report activity), and a message by holding it and choosing Report message. You pick a reason and can add an explanation

Review: every report is reviewed by a person who moderates, not by an automatic system

Measures: a warning, a temporary suspension (the length is set by the moderator, and the account returns by itself when it ends) or a permanent ban. Content that breaks the rules can be removed

Notice: the person affected sees in the app whether the account is suspended or banned and until when, and can ask for the reason and details at info@qvartapp.com. The person who reported gets a notice in the app when any measure follows their report, without saying which

Appeal: you can appeal any measure at info@qvartapp.com. We review the appeal again and you get the answer by email

Recommendations: activities on the home screen are ordered by date, distance or number of free spots, as you choose, and filtered by your selection. We do not use recommendations based on profiling

Point of contact: info@qvartapp.com is the single point of contact for users and authorities under the DSA, in Croatian and English

The connection between the app and the server is encrypted (TLS). Access to data is limited by rules at the database level, so each user reaches only what is meant for them. Chat media and feedback screenshots are in private storage. Your date of birth and home location are kept apart from your public profile and are available only to you. Calls to outside services and sign-ins are limited by request counts to protect against abuse.

If a data breach occurs that could put your rights at risk, we will notify the authority and you within the deadlines set by the GDPR.

Qvart is meant for people aged 18 or over. We check age at sign-up through the date of birth. If we learn that an account is used by someone under 18, we will close it. If you suspect a profile belongs to a minor, report it with the reason Underage or write to info@qvartapp.com.

We may change this policy when the app or the rules change. We will tell you about significant changes in the app or by email at least 14 days before they take effect. The date of the last change is at the top.

Sconium d.o.o., Radnička cesta 20, 10000 Zagreb, Croatia

For any privacy question and to exercise your rights: info@qvartapp.com