Privacy Policy

1. Data Controller

The entity responsible for the processing of personal data in connection with the Joya website and app is:

Joya Social Johannes Burkhart Gewerbepark Neudahn 1/2 66994 Dahn Germany

Email: hello@joya.social

2. Overview

We take the protection of your personal data seriously. This Privacy Policy explains what personal data we process when you visit our website, use the Joya app, create an account, send a VYB request, join a VYB, communicate with other users, or contact us.

Personal data means any information that can directly or indirectly identify you. This includes, for example, your email address, user ID, location data, onboarding answers, VYB activity, chat messages, or technical usage data.

Joya is a service for real-world social experiences. To make the app work, we process certain data to match users into groups based on availability, location, social intention, and personality signals.

Note on app launch: The Joya app is currently in preparation. App-related processing, including VYB requests, matching, location data, chat functions, and push notifications, will only take place once the app is available and you use these features.

3. Data We Process

Depending on how you use Joya, we may process the following categories of data:

Account and login data: This includes your email address, login credentials, technical user ID, and information related to account creation and authentication. You can sign in with Apple, Google, or email and password.

Onboarding and profile data: This includes information such as your age, gender, and personality signals provided during onboarding. We do not collect a profile photo.

Location data: When you send a VYB request, we process location data to match you with nearby VYBs. We use geohash processing with 6-character precision, corresponding to an area of approximately 1.2 × 0.6 kilometres. Your exact GPS coordinates are not stored.

VYB and matching data: This includes information about your VYB requests, availability, social intentions, group suggestions, VYB participation, and related activity data.

Communication data: This includes group chat messages, messages with friends, messages with Eva, and support or contact requests. Group chats are archived 24 hours after the meetup. Messages with friends and Eva remain until you delete your account.

Safety and moderation data: This includes reports, blocks, and information needed to review rule violations, prevent misuse, and protect the community. We do not currently use no-show tracking.

Technical data: This includes IP address, device type, operating system, app version, log data, error reports, and similar technical information needed for operations, security, and troubleshooting.

Website and analytics data: We use Google Analytics on the website only after you have given consent through the cookie banner. Google Analytics may process information such as page views, device and browser information, approximate location, referrer information, and interaction data.

4. How We Use Your Data

We process personal data for the following purposes:

Providing and managing your user account

Authentication via Apple, Google, or email and password

Providing the Joya website and app

Creating and organising VYBs

Matching users based on availability, location, social intention, and personality signals

Considering age, gender, and group composition to create well-balanced and safe groups

Enabling group chats, friend messages, and Eva messages

Sending account, security, system, and VYB-related messages

Sending push notifications where you have enabled them

Handling support requests

Processing reports and blocks

Protecting users, preventing misuse, and enforcing community rules

Technical operations, troubleshooting, and app improvement

Fulfilling legal obligations

Analysing website usage where legally permitted and, where required, with your consent

5. Legal Basis for Processing

We process personal data in accordance with the General Data Protection Regulation (GDPR).

Where processing is necessary to provide the Joya app, your account, authentication, VYB requests, matching, group features, chats, or other core functions, processing is based on Article 6(1)(b) GDPR.

Where we ask for your consent, processing is based on Article 6(1)(a) GDPR. This applies in particular to certain device permissions, push notifications, non-essential cookies, and analytics or tracking tools. You may withdraw your consent at any time with effect for the future.

Where we process data to ensure service security, prevent misuse, analyse errors, improve the app, review reports, or protect our community, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is in maintaining a safe, functional, and trustworthy service for real-world social experiences.

Where we are legally required to process or retain certain data, processing is based on Article 6(1)(c) GDPR.

The applicable legal basis may vary depending on the data category and processing activity. Not all data is used for all purposes.

6. Location Data

Joya only processes location data when you send a VYB request. We do not track your location in the background.

We use GPS to determine your location. The location is converted into a 6-character geohash value, corresponding to an area of approximately 1.2 × 0.6 kilometres. Your exact GPS coordinates are not stored.

You can disable location access at any time in your device settings. Without location access, sending VYB requests is not possible.

7. Onboarding, Social Intentions, and Personality

During onboarding, Joya collects certain information needed to use the app effectively and create well-matched VYBs. This includes your age, gender, and personality signals.

Personality signals are answers that help place you in groups based not only on time and location, but also on social compatibility. This may include your preferences for social situations, how you tend to behave in groups, or what kind of meetup feels natural to you.

Joya uses this information to create better VYBs. The goal is that groups are not random, but matched to your social moment, intention, and personality.

Where this processing is necessary to provide the VYB function, it is based on Article 6(1)(b) GDPR. Where data is additionally used to improve service quality or safety, processing is based on Article 6(1)(f) GDPR, unless separate consent is required.

8. Gender and Group Composition

Joya asks for your gender during onboarding. You may also select “Prefer not to say”.

If you provide a gender, Joya may use this information to create more balanced groups and improve the quality of VYBs. Group composition can affect how natural, comfortable, and safe a meetup feels.

Joya does not display your gender publicly and does not share it automatically with other users unless this is explicitly part of your profile.

Where this processing is necessary for group creation and VYB quality, it is based on Article 6(1)(b) GDPR. Where it serves group balance, safety, or misuse prevention, it may additionally be based on Article 6(1)(f) GDPR.

9. Matching and VYBs

Joya processes your availability, location, social intention, personality signals, age, gender, and other relevant data to create VYBs and place users into compatible groups.

A VYB is a real-world meetup with typically 3 to 6 people. Joya uses this data to suggest or create groups that fit better in terms of timing, location, and social compatibility.

Matching may be automated. Joya generates group suggestions based on available data. However, no automated decision within the meaning of Article 22 GDPR is made that produces legal effects or similarly significantly affects you.

You decide whether to request, accept, or join a VYB. Joya does not make binding decisions about your personal rights, obligations, or legal claims.

10. Communication, Push Notifications, and Support

Joya processes communication data to enable you to use the app, join VYBs, and communicate with other users.

This includes in particular:

System messages related to account creation, login, security, and account management

Messages related to VYB requests, group suggestions, confirmations, changes, or reminders

Group chat messages connected to a VYB

Messages with friends

Messages with Eva

Support and contact requests

Group chats are archived 24 hours after the meetup. Messages with friends and Eva remain until you delete your account.

Joya may send you push notifications, for example about VYB requests, confirmations, changes, reminders, messages, or security-related information. You will only receive push notifications if you have enabled them on your device or in the app. You can disable push notifications at any time in your device settings.

For push notifications, we use Google Firebase Cloud Messaging for Android devices and Apple Push Notification Service for iOS devices. Technical data such as device tokens, app information, and delivery information may be processed in this context.

11. Safety, Reports, and Moderation

Joya processes certain data to protect user safety, prevent misuse, and enforce community rules.

This includes in particular:

User reports

Blocks

Information about potential rule violations

Technical information for reviewing misuse or security incidents

Communication and VYB data where needed to review a report

When you report or block a user, we process the necessary information to review the report, take appropriate action, and protect other users.

Joya does not currently use no-show tracking. We do not systematically record or evaluate whether users attended a VYB.

Processing of safety and moderation data is based on Article 6(1)(f) GDPR. Our legitimate interest is in operating Joya as a safe and trustworthy service for real-world social meetups, preventing misuse, and protecting our community.

12. Website, Cookies, and Analytics

When you visit our website, technical data may be processed that is necessary for the operation, security, and display of the website. This may include IP address, access time, browser type, operating system, pages visited, and server log data.

Our website may use cookies or similar technologies. Technically necessary cookies are required for the website to function and may be used without separate consent.

We only use analytics, marketing, or tracking tools where legally permitted and, where required, after you have given your consent.

We use Google Analytics only after you have given consent through the cookie banner. Google Analytics helps us understand website usage and improve Joya. Google may process usage data on our behalf for this purpose.

Where such tools are in use, you can update your cookie and tracking preferences at any time through the settings provided on the website.

13. Service Providers

To operate Joya, we work with technical service providers who support us with hosting, authentication, database operations, push notifications, and other app functions.

We currently work with the following service providers in particular:

Hetzner Online GmbH, Germany, for hosting and server infrastructure

Supabase Pte. Ltd., Singapore, for authentication, database, and backend functions

Groq, Inc., USA, for AI-assisted processing related to Eva and certain app functions

Google LLC, USA, for push notifications on Android devices via Google Firebase Cloud Messaging

Apple Inc., USA, for push notifications on iOS devices via Apple Push Notification Service

Service providers process personal data only to the extent necessary for their specific function and on a valid legal basis. Where required, we enter into data processing agreements or other appropriate data protection arrangements with our service providers.

We do not share personal data with third parties beyond what is necessary to operate the service, unless you have consented, we are legally required to do so, or we have a legitimate interest such as security or misuse prevention.

14. International Data Transfers

Some of our service providers process personal data outside the European Union or European Economic Area, in particular in the United States and Singapore.

This currently applies to:

Supabase Pte. Ltd., Singapore

Groq, Inc., USA

Google LLC, USA (Firebase Cloud Messaging)

Apple Inc., USA (Push Notification Service)

We only transfer personal data to third countries where the legal requirements are met. This includes in particular an adequacy decision by the European Commission, appropriate safeguards such as EU Standard Contractual Clauses, or other transfer mechanisms permitted under GDPR.

Where providers in the USA are certified under the EU-U.S. Data Privacy Framework, transfers may be based on the European Commission's adequacy decision. Where no adequacy decision exists, including for Singapore, we rely on appropriate safeguards, in particular EU Standard Contractual Clauses.

15. Data Retention

We retain personal data only for as long as necessary for the relevant purposes or as required by law.

Account data is retained for as long as your Joya account exists. Messages with friends and Eva are retained until you delete your account. Group chats related to a VYB are archived 24 hours after the meetup.

When you delete your account, we delete your personal account data, personality data, and the Bridge Identifier that links personal data to activity data.

Activity data may remain in anonymised form after account deletion. This means it can no longer be linked to you as an individual. Anonymised data may be used to analyse and improve the functionality, safety, and quality of Joya.

Certain data may be retained for longer where necessary to fulfil legal obligations, assert or defend legal claims, investigate security incidents, prevent misuse, or handle reports and rule violations.

16. Account Deletion

You can delete your Joya account directly in the app. We also provide a way to request account deletion through our website.

When you delete your account, your personal account data, personality data, and Bridge Identifier will be deleted, unless legal obligations or legitimate reasons require us to retain certain data for a limited period.

Activity data may remain in anonymised form after deletion. Once anonymised, this data can no longer be attributed to you.

Please note that complete deletion from backups may be technically delayed. Certain data may also be retained longer where required for legal reasons, security, misuse prevention, or handling of reports.

For more information, see our Account Deletion page.

17. Your Rights

Under GDPR, you have the following rights regarding your personal data:

The right to access the personal data we hold about you

The right to correct inaccurate or incomplete data

The right to request deletion of your personal data

The right to restrict processing

The right to data portability

The right to object to certain types of processing

The right to withdraw consent at any time with effect for the future

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, contact us at hello@joya.social.

18. Right to Lodge a Complaint

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a data protection supervisory authority.

You may contact the supervisory authority of your place of residence or the authority responsible for Joya.

The supervisory authority responsible for Joya Social is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz Hintere Bleiche 34 55116 Mainz Germany Website: https://www.datenschutz.rlp.de

19. Changes to This Privacy Policy

We may update this Privacy Policy when Joya, our website, our app, our data processing, or legal requirements change.

The current version is always available on our website.