Poriad1. Who is responsible
The data controller is Taras Vovchenko, a private individual based in Ukraine ("we"). The app is free and not operated as a business. Privacy contact: [email protected]. This policy covers the Poriad mobile app for Android and iOS and this website.
2. Data we process
| Data | When | Purpose |
|---|---|---|
| Email and password | Sign-up | Sign-in, email confirmation, password reset. Passwords are stored only as hashes. |
| Google or Apple sign-in data | If you choose “Continue with Google” or “Continue with Apple” | We receive only the account identifier, email address (Apple may give a private relay address) and name, used for your profile. We never see your Google or Apple password. These services do not share your date of birth: you enter it yourself after the first sign-in. If the email matches an account that already exists, the sign-in is linked to it — it is one account. If you signed in with Apple and delete your account, we also revoke the app’s access at Apple. |
| Profile: name, photo, bio | Sign-up, profile edits | Your profile card (name, photo, bio, month you joined, how many events you organized and attended) is visible to the organizer and confirmed attendees of an event you share, to people requesting to join your event and to people who, like you, tapped "Want to go with company" on the same event. If you organize a published event, any signed-in user can see your card. Nobody but you sees your email. Photo and bio are optional and can be changed or removed in the profile at any time. |
| Instagram (username) | If you add it to your profile | To help people you want to go with understand who you are. Your username is shown only to people who have a "Want to go with company" intent on the same event as you and added their own Instagram. Optional; remove it any time by clearing the field in your profile. We do not access Instagram or take anything from it. |
| "Want to go with company" and "Go together" | When you tap these buttons on an event | Finding someone to go to an event with. Everyone sees how many people are looking for company on an event, without names; signed-in users also see which categories from those people's interests they share. Your first name, photo, bio, how many events you attended, shared interests and profile card are visible only to people who also want to go to this event; your photo only to those of them who have their own. "Go together" is seen only by the person you said it to. When two people say "Go together" to each other, we create a meetup with a chat for them, and the attendance and chat rules apply. You can remove the intent any time; once the event starts it is no longer shown to anyone. We never show your age. |
| Date of birth | Sign-up | Verifying you are 18+ and enforcing event age limits. Stored separately from the profile and never displayed. |
| Events you create | Publishing an event | Title, description, category, place, time, capacity, cover photo and chat link are public to all users. |
| Attendance, waiting list, saved events | Joining, queueing, saving | Your plans in "My events". Queue positions and saved events are private; attendance is visible to the organizer and attendees. |
| Event chat messages | Sending a message | Communication between the organizer and confirmed attendees. Stored on the server, visible to event members only, deleted with the event. A message you delete is erased completely, text included. To show unread messages we store how far you have read each chat. |
| Event ratings | Rating an event that has ended | A score from 1 to 5 and an optional comment of up to 500 characters. Visible to the event organizer so they can improve future meetups; not shown to other attendees. |
| Reports and blocks | Reporting or blocking | Moderation. Reports are visible only to us; blocked users are not notified. |
| Photos | Adding a cover or a profile photo | Covers are public; a profile photo sits behind an unguessable link and is shown on your profile card. The app re-encodes images and strips metadata (including location) before upload. We use the system photo picker and never see other photos in your library. |
| Approximate location | Only when you tap "Near me" and grant permission | Centering the map and detecting your city. The app asks only for approximate location (Android "Approximate" permission, about one kilometre accuracy on iOS) and only while in use. Coordinates are not stored on our server; only the visible map area is sent there. To name the city for a point, coordinates are sent to Photon (see section 4). You can pick a city manually instead. |
| City and address search | Searching for a city or setting the place of your event | City and address suggestions, finding the address of a point on the map. The text you type and the point's coordinates are sent to Photon (see section 4) and are not stored by us separately; the address of an event you create is public with the event. |
| Push token | When you allow notifications | Delivering notifications about new messages, join requests and company for an event (someone else wants to go, said "Go together" to you, you are going together). Removed on sign-out. |
| Device record for event notifications | When the app is open, notifications are allowed and the "What's on this weekend" switch in your profile is on, with or without an account | Reminding you of fresh events in your city if you haven't opened the app for a long time: at most two notifications, around day 30 and day 60. We store the device token, your city (only one of the cities we cover), chosen interests and when the app was last opened, not linked to your account, name or email. About one in five devices doesn't get these notifications and is only counted, so we can check whether they help at all. The record is deleted as soon as you turn off "What's on this weekend" or notification permission, and automatically after 120 days without opening the app. |
| Device record for "Follow" and "My places" | When notifications are allowed, with or without an account | Notifying you about new dates of artists you follow, only in your city, and about new meetups by people in your places. We store the device token, your city, the artists you follow without an account and "My places": districts or a circle whose centre is rounded to about 100 m. An organizer sees only how many people are nearby, and only when there are at least three. The record is deleted as soon as you turn off notification permission, and automatically after 120 days without opening the app. |
| Tickets you add | When you share a ticket to Poriad or add it in "My events" | Reminders and showing the ticket at the entrance. The ticket file and the title, place, time and seats read from it are stored only on your phone and are not sent to our server; the app reads the text from the file on the phone. If the ticket is for a listed event, that event is also saved like a bookmark. Remove a ticket with "Delete ticket"; it is also removed together with the app. |
| Interests and onboarding answers | First launch, profile | Ranking events for you and timing the "What's on this week" digest (weekdays or before the weekend). Answers stay on the device; chosen categories are stored in your server profile. Categories you share with people looking for company on the same event are shown to them and to you (see above). |
| Usage statistics and crash reports | Automatically while the app runs | Which steps people take (viewing, joining, creating an event) and where the app crashes, so we can fix bugs. Via Firebase Analytics, Crashlytics and Amplitude, without the advertising identifier. Amplitude also records how you use the screens (session replay): taps, scrolling and navigation; all on-screen text and people's photos are hidden in the recording. The data is pseudonymous: tied to a random app-instance identifier, not to your account, name or email. You can turn collection off with the Profile → Analytics switch. |
| Technical data | Automatically with each request | IP address and app version in server logs for security and diagnostics, kept for a limited time by our hosting provider. |
| Website visit statistics | Automatically when you open poriad.app | Page views, the referring site, country, device and browser type, page load speed. Via Cloudflare Web Analytics: no cookies, no identifiers and no cross-site tracking; we see only aggregate numbers. |
We do not collect contacts, movement history, background location, advertising identifiers or data from other apps. The app contains no advertising or advertising SDKs; the only analytics is Firebase and Amplitude in the app and Cloudflare Web Analytics on the website, both described above.
3. Legal bases
- Contract (Terms of Use): account, events, attendance, chat, notifications.
- Legitimate interest: security, abuse prevention, rate limiting, moderation; usage statistics and crash reports to keep the app stable. You can opt out of analytics with the "Analytics" switch in your profile.
- Consent: location, push notifications, local reminders. Withdraw at any time in device or app settings.
- Legal obligation: age verification and lawful requests from authorities.
4. Recipients
We never sell personal data or share it with ad networks. Data is processed only by infrastructure providers on our instructions:
| Provider | What |
|---|---|
| Supabase, Inc. (database, auth, file storage, functions) | All account data, events, messages, photos. Hosted in Ireland (AWS eu-west-1, European Union). |
| Google LLC, Firebase Cloud Messaging (Android) | Device token and notification content for delivery. |
| Google LLC, Firebase Analytics and Crashlytics (Android, iOS) | Pseudonymous usage statistics (with an app-instance identifier), crash reports, device model and OS version. Collection is turned off by the "Analytics" switch in your profile. |
| Amplitude, Inc., analytics and session replay (Android, iOS) | Pseudonymous usage statistics and session recordings (taps, scrolling, screen transitions; text and people's photos hidden), device identifier, device model and OS version. Servers in the United States. Collection is turned off by the "Analytics" switch in your profile. |
| Apple Inc., Apple Push Notification service (iOS) | Device token and notification content for delivery. |
| OpenFreeMap (map tiles) | Device IP address and the map area you view while tiles load. |
| unpkg (CDN for the website map library) | Device IP address when the event map opens on the website: the MapLibre library loads from there. |
| Cloudflare, Inc. (website delivery network, visit statistics) | IP address and technical request data (page, browser) when you open the website; cookieless visit statistics. |
| GitHub, Inc., GitHub Pages (website hosting) | IP address and technical request data when website pages load. |
| komoot GmbH, Photon (city and address search, Germany) | Text you type when searching for a city or address, coordinates of a point whose address or city is looked up, and IP address. |
| Source websites of imported events (Karabas, Concert.ua, TicketsBox, DOU and others) | Cover images of imported events load from the source site, which sees your IP address. "Buy ticket" opens the source site under its own policy. |
Data may be processed outside Ukraine, including in the EU and the USA, under the providers' standard contractual clauses.
5. Retention
- Account and profile: until you delete the account.
- Instagram, "Want to go with company" and "Go together" intents: until you remove them, delete the account or the event no longer exists.
- Events, attendance, chat, ratings: while the event or account exists. Chat closes one week after the event ends.
- Reports: as long as needed for moderation. Reports you filed are deleted with your account; reports about you remain after account deletion without a link to it.
- Usage statistics and crash reports: in Firebase and Amplitude no longer than 14 months, then deleted automatically.
- Session recordings: 30 days.
- Push tokens: until sign-out or device change.
- Device record for event notifications: while notifications and "What's on this weekend" are on, and no longer than 120 days after the app was last opened.
- Server logs: up to 30 days.
- Local cache and drafts on the device: until sign-out or app removal.
6. Your rights
- Delete your account in the app (Profile → Delete account) or via the website instructions. Deletion is immediate: account, profile, Instagram, intents to go with company, attendance, messages, ratings, reports you filed, push tokens and uploaded photos are deleted; events you created are deleted together with other people's attendance and the chat.
- Access, rectify or restrict your data by emailing [email protected]. The copy includes your email, profile and Instagram, your events, attendance and queue, "Want to go with company" and "Go together" intents, messages, ratings, chat read markers and devices registered for notifications. We reply within 30 days.
- Withdraw consent for location and notifications in device settings; turn off event notifications and delete the device record with the "What's on this weekend" switch in your profile; opt out of analytics with the "Analytics" switch in your profile.
- Complain to the Ukrainian Parliament Commissioner for Human Rights or, if you are in the EU, to your supervisory authority.
7. Security
All connections use TLS. Sessions are stored in Android Keystore and iOS Keychain. Server-side row-level security prevents access to other users' names, messages and queue positions even via direct API calls. Passwords are hashed. We will notify you of incidents that may affect you within 72 hours of discovery.
8. Children
Poriad is for adults. Sign-up requires being 18 or older, and age is checked at account creation. If you learn a minor has created an account, contact us and we will delete it.
9. Changes
We announce material changes in the app at least 14 days before they take effect. The effective date is shown at the top.
10. Contact
Taras Vovchenko, Ukraine
Email: [email protected]