Privacy policy

1. Who is responsible for your information

Go A Foot ApS is the data controller for the Go a Foot service described here. Contact us about privacy, your account or this policy at info@goafoot.eu, or through goafoot.com.

This policy covers our handling of information. Apple, Google and other services you choose to use may also handle information under their own privacy notices.

2. Information we handle

Most information comes from you, your use of the service, or a sign-in or purchase provider you choose. We can also receive information about you from other users, for example when they invite you, message you, make a family-link request or submit a safety report. Avoid including sensitive personal information about yourself or anyone else in posts or messages.

3. Why we use information and our legal bases

• Providing the service: creating and securing your account, displaying your profile and content, finding relevant people and plans, handling invitations and delivering messages. We rely on performance of our agreement with you, or steps you ask us to take before entering it (GDPR Article 6(1)(b)). Details required for an account or action must be provided for that feature to work; profile extras and optional posts are your choice.
• Protecting people and the service: applying privacy settings, detecting abuse, handling reports, controlling unauthorised access, investigating errors and maintaining reliability. We rely on legitimate interests in operating a safe and reliable community and protecting users and our systems (Article 6(1)(f)), subject to your rights and interests.
• Understanding service operation: measuring app activity and usage limits, identifying failures and improving reliability. We rely on the same legitimate interests in maintaining and improving the service. The current app does not include an advertising-tracking SDK or build a cross-app advertising profile.
• Optional permission-based features: where consent is the applicable basis, we rely on your consent (Article 6(1)(a)). You can withdraw it through the relevant device or app setting. Permission to access a device feature does not mean that every related processing activity has consent as its legal basis.
• Support and legal obligations: responding to you, managing disputes and complying with applicable duties. Depending on the request, the basis is performance of our agreement, legitimate interests in resolving issues, or a legal obligation (Article 6(1)(c)).

4. Who can receive your information

Other users. The service shares profile details, posts, plans and interactions according to the feature and your settings. Messages and group content are available to their participants. A public event location or information you deliberately publish can be seen by its audience. Other people may save or copy information they can access; removing it from Go a Foot does not remove their independent copies.

Authorised service personnel. Access may be needed to operate the service, investigate errors, respond to support or safety reports and meet legal obligations. Messages are not end-to-end encrypted, so do not treat them as inaccessible to the service operator.

Service and platform providers. Our current and optional integrations include:

• Hetzner: hosting the core API, authentication, database and media storage in Finland. Supabase software runs on that infrastructure.
• Email delivery services: sending account confirmation, recovery and service messages to your email address, with the associated delivery metadata.
• Apple and available sign-in providers: authenticating the sign-in options you choose and providing the corresponding account identifiers.
• Expo and Apple/Google notification services: optional device-token registration and, when activated, notification routing. See the notification section below.
• Apple StoreKit and purchase-verification services: transaction verification and refund handling when paid products are enabled.
• api.video: legacy video processing or delivery where previously used. New video publishing is disabled in the current release.
• Expo EAS and Apple TestFlight/App Store services: app building, signing and distribution. If you use TestFlight, Apple also handles beta-installation, diagnostic and feedback information under its own terms and privacy notice.

We may disclose information where required by law, to respond to a valid legal request, or where necessary to establish, exercise or defend legal claims. We do not sell your personal information.

5. Location, photos and device permissions

Location helps find nearby people and plans. With your permission, the app can send precise device coordinates to our server while the app is in use. Selecting area-level sharing is a visibility choice: it does not mean that our server never receives precise coordinates. Exact location is shared with other users only through features and choices that disclose it, such as an exact event location.

You can choose no location sharing in the app and revoke location permission in your device settings. Nearby discovery may then be limited. Changing a preference does not automatically remove a location already included in an earlier post or event; edit or remove that content or contact us.

Photos or camera access are used for images you choose to upload. Revoke access in your device settings at any time. Uploading a photo can also disclose details visible in the image.

If you use Face ID or another device biometric unlock, the operating system performs the check. Go a Foot does not receive your biometric template. The app stores its local lock settings and PIN verification information on your device.

Optional AI writing help

Where writing help is available, you can choose to send keywords or a draft to OpenAI to suggest text for a bio, post, plan, community, event, comment or message. We ask for your agreement in the writing screen before sending it. Only the text shown in that screen, the selected type of writing and tone are sent; we do not automatically attach photos, location, profile records or conversation history. Avoid including sensitive information or other people's private details.

You can edit or discard every suggestion. Suggestions are not posted or sent automatically. We do not separately save your keywords or suggestions as AI conversation history. Text you choose to publish or send is handled like other app content. We keep limited request counters to control abuse and costs.

OpenAI processes the submitted text to provide the suggestion. We request that responses are not stored as retrievable response history. This does not remove all provider retention: standard abuse-monitoring logs may be retained for up to 30 days. API content is not used to train OpenAI models by default. Processing may take place outside the EEA; see OpenAI's API data controls and the international processing section below. You can stop using writing help at any time and write your own text instead.

6. Notifications and commercial features

Current release: server delivery of message push notifications and paid commercial products are disabled. If you explicitly enable notifications in the app, device registration can still contact Expo and store a routing token with our service, even while server delivery is off.

When message delivery is activated, notification routing uses Expo and Apple APNs on iOS or Google FCM on Android. The notification payload is designed to use generic message text and a conversation identifier rather than the message body or sender name. Routing tokens and delivery metadata still relate to your device or account. You can disable notifications in the app or device settings.

When paid commercial features are activated, purchases made through Apple are linked to your Go a Foot account so that we can verify and apply the purchased entitlement and handle refunds. Publishing a company event makes the event details available to the audience shown by that feature. This policy does not describe the purchase of physical event tickets; those payments are not implemented in the current release.

7. Safety checks and family information

When enabled, automated safety checks use OpenAI to classify text in shared posts, comments, profile names and bios, community descriptions, plans and company events, and images attached to shared posts. Submitted writing requests and discovery searches are also checked. The checks look for violent, sexually explicit and hate-related material and can be inaccurate. Our new automated review queue excludes private messages and their images.

Potentially harmful content is flagged for authorised administrators to review. A flag alone does not establish intent or automatically ban an account. Review evidence is limited to categories, account and content references, timestamps and a text excerpt of up to 400 characters. Flagged post images are accessed through temporary links when an authorised reviewer requests them, and that access is logged. Automated review evidence normally expires after 30 days and temporary processing jobs after one day; operational outages may delay deletion. Existing user reports follow the retention described elsewhere in this policy.

We do not use the general moderation service to process known or suspected child sexual abuse material. Reported or suspected images are routed to dedicated human safety review. These checks are not a substitute for specialist child-safety detection or emergency response. See OpenAI's moderation documentation and API data controls for provider processing information.

Automated rules can inspect submitted text, flag potential abuse and prevent certain actions. Screen-time rules can also limit access to content while keeping messaging available. Relevant information can be stored with reports, risk indicators and moderation records. These checks can make mistakes: contact info@goafoot.eu to ask us to review a restriction or decision affecting you.

Family features can store adult/minor account labels, guardian-link requests, responses, contact approvals and usage limits. An account label or accepted guardian link is not proof of age or legal guardianship. If you believe a child's information has been provided without appropriate authorisation, contact us so we can review the situation and take appropriate steps. Do not use family settings as a substitute for supervision or age-appropriate safeguards.

8. Where information is processed

The core application is hosted on the configured Hetzner server in Finland. External sign-in, email, notification, distribution and purchase providers can handle information outside the EU/EEA. EU hosting of our core service does not mean every processing activity stays in the EU.

Provider processing locations, retention and transfer arrangements depend on the service used. Contact us for current recipient and transfer information and details of any applicable safeguards. We will update this notice when integrations or their processing arrangements materially change.

9. Retention and account deletion

We retain account and profile information while your account is active and as needed to provide the service. Posts, plans, conversations and their metadata remain available until removed through an applicable feature, account deletion or moderation. Removing something from a screen is not necessarily the same as deleting its underlying record.

Security, diagnostic, moderation and support records are retained according to the time needed to investigate faults or abuse, resolve a request or dispute, protect the service and meet applicable legal obligations. We do not promise a fixed automatic deletion period for every category. Ask us for the retention information relevant to your request.

Operational backups are held separately for recovery and release rollback. They may retain information after it has been removed from the live service, until those backups are removed or replaced when no longer needed for those purposes. Backup access is restricted; backups are not active user profiles. If recovery requires restoring a backup, deletion requests must be taken into account.

To delete your account, open You → Delete account in the app, or email info@goafoot.eu. The in-app process removes the account and its associated profile/content records and owned Supabase uploads. Legacy external video copies, another user's saved copies, and information retained for legal or security reasons may require separate handling. Contact us about those cases.

If automatic Apple authorisation revocation cannot be completed during deletion, the app will tell you that you can also remove Go a Foot from your Apple Account sign-in settings.

Trips, presence and optional phone calendars, when available

You can choose a meeting window of up to four hours, including a future window, and close it at any time. Closing a window withdraws pending automatic invitations while keeping gatherings you already accepted. For planner generation we send the selected area label, dates, timezone, shared interest, group limit and conversation atmosphere to OpenAI through our server-only integration. Map coordinates, participant identities, venue proposals, private trip titles and phone calendar contents are excluded. The model chooses a conversation format from a fixed list; the app supplies the displayed wording and does not generate exact venue recommendations.

Expressing interest reserves a place in a small group but does not confirm attendance. An interested participant may volunteer a public meeting-place proposal. Each person, including the proposer, separately approves that exact proposal before their attendance counts toward confirmation. A changed proposal clears previous approvals. We store the proposal, proposer, version and each participant's approval so the app can distinguish interest from agreement to the current place. These records are private to the service and follow the gathering cleanup period. The current proposed place is shown to eligible people considering that opportunity. Proposer names follow profile-preview consent. Public-place status is declared by the participant; Go-A-foot does not verify the venue or guarantee its safety, opening hours or availability. Users can withdraw and report concerns; safety reports follow their separate retention rules.

Your private social preference lets you choose meeting new people, finding communities around your interests, or both. Choosing communities stops pending automatic meetup invitations and keeps gatherings you already accepted. Changing back does not reopen a meeting window. Community suggestions use your saved interests and chosen map area; joining or requesting membership always requires your action.

You choose whether people considering a gathering can see your name, profile photo and username before accepting. Unshared profiles and individual decline responses are not displayed. Arrival signals are visible to accepted participants. Feedback about group size is private, not a public rating of other people. Meeting again requires an explicit opt-in and a fresh invitation with a new acceptance from each person. Meeting windows are removed after expiry and gathering/feedback records after 30 days by the enabled planner worker; outages or disabling that worker can delay cleanup.

Maps use Apple Maps on iOS and OpenStreetMap tiles with Leaflet on Android and web. Map services receive requests for the area you view and connection information such as your IP address; Leaflet assets are loaded from the unpkg CDN on Android and web. Choosing a map area does not require GPS access.

Trip planning stores your chosen destination, dates, interests and invitations. Private trips are shared with invited people; accepting an invitation adds you to the trip. Choosing to publish a separate public event shares that event's details and destination, without publishing your private trip or travel crew. Shared single-use invitation links contain the trip name, destination and dates and expire after seven days. Email invitations open a draft in your mail app for you to send.

Interest matching is optional and starts off. Each participant chooses for themselves whether their trip destination, dates and interests may be used to suggest activities with other opted-in adult travellers. Suggestions use coarse destinations and overlapping dates, not continuous GPS monitoring. We show a shared-interest signal only when at least three other distinct opted-in adults overlap; we do not disclose their identities or itineraries. You can turn matching off for a trip at any time. Trip matching alone does not authorise automatic invitations. For Go-A-foot planner, you explicitly choose a temporary meeting window, area, interests, group-size preferences and optional conversation preferences. The default is a group of three to six; one-to-one meetings require a separate choice. Automatic gatherings never exceed eight people, including invited friends. Browsing does not authorise proactive invitations. Proposals become confirmed only after enough people approve the current meeting place; you can decline or cancel. Declining pauses automatic invitations for that window.

If you connect your phone calendar, you choose the calendars shown beside your Go a Foot plans. Phone calendar event details are read and displayed on your device only; they are not uploaded to Go a Foot, sent to AI or used for traveller matching automatically. You can choose a phone event date, confirm an area on the map and explicitly create a separate Go a Foot presence plan for matching. The original phone event title, notes and attendees are not copied. Disconnecting clears these events from the app's calendar view; device access can also be revoked in Settings. Adding or editing a phone calendar entry opens the system calendar editor for your confirmation. This is not automatic two-way synchronisation.

10. Local storage, website use and security

The app uses device storage to keep your sign-in session, notification preferences and local lock settings. Signing out or deleting the app affects local information; it does not itself delete your server account. The current public website and this policy page do not use advertising cookies or a third-party website analytics script.

We use HTTPS connections, account authentication, access controls and private media storage to protect information. No internet service or device can be guaranteed completely secure. Protect your login details and your device, and contact us if you suspect unauthorised access.

11. Your rights and how to contact us

Depending on the circumstances and applicable law, you can request access to your personal information, correction, erasure, restriction of processing or a portable copy of eligible information. You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw that consent without affecting the lawfulness of earlier processing.

Email info@goafoot.eu with your request. We may need to verify your identity before releasing or changing account information. We normally respond within one month; if a permitted extension is needed, we will explain it. These rights can be subject to legal exceptions.

You can complain to Datatilsynet, the Danish Data Protection Agency, or your relevant supervisory authority. You can contact us first so we can try to resolve your concern.

12. Changes to this policy

We will publish updates on this page and revise the date above. Material changes affecting how we use your information will be communicated through an appropriate service notice or other suitable channel. Where a change requires consent, an updated notice does not replace that consent.