Poruch1. Who is responsible
The data controller is Taras Vovchenko, a private individual based in Ukraine ("we"). The app is free and not operated as a business. Privacy contact: hello@poriad.app. This policy covers the Poruch mobile app for Android and iOS and this website.
2. Data we process
| Data | When | Purpose |
|---|---|---|
| Email and password | Sign-up | Sign-in, email confirmation, password reset. Passwords are stored only as hashes. |
| Display name and avatar | Sign-up, profile edits | Shown to the organizer and confirmed attendees of the same event only. |
| Date of birth | Sign-up | Verifying you are 18+ and enforcing event age limits. Stored separately from the profile and never displayed. |
| Events you create | Publishing an event | Title, description, category, place, time, capacity, cover photo and chat link are public to all users. |
| Attendance, waiting list, saved events | Joining, queueing, saving | Your plans in "My events". Queue positions and saved events are private; attendance is visible to the organizer and attendees. |
| Event chat messages | Sending a message | Communication between the organizer and confirmed attendees. Stored on the server, visible to event members only, deleted with the event. |
| Reports and blocks | Reporting or blocking | Moderation. Reports are visible only to us; blocked users are not notified. |
| Photos | Adding a cover | Covers are public. We use the system photo picker and never see other photos in your library. |
| Location | Only when you tap "Near me" and grant permission | Centering the map. Coordinates are not stored on the server; only the visible map area is sent. You can pick a city manually instead. |
| Push token | When you allow notifications | Delivering notifications about new messages and join requests. Removed on sign-out. |
| Interests and onboarding answers | First launch, profile | Ranking events for you. Answers stay on the device; chosen categories are stored in your server profile. |
| Usage statistics and crash reports | Automatically while the app runs | Which screens are opened and where the app crashes, so we can fix bugs. Via Firebase Analytics and Crashlytics, without the advertising identifier; not linked to your account. |
| Technical data | Automatically with each request | IP address and app version in server logs for security and diagnostics, kept for a limited time by our hosting provider. |
We do not collect contacts, movement history, background location, advertising identifiers or data from other apps. The app contains no third-party advertising or analytics SDKs.
3. Legal bases
- Contract (Terms of Use): account, events, attendance, chat, notifications.
- Legitimate interest: security, abuse prevention, rate limiting, moderation.
- Consent: location, push notifications, local reminders. Withdraw at any time in device or app settings.
- Legal obligation: age verification and lawful requests from authorities.
4. Recipients
We never sell personal data or share it with ad networks. Data is processed only by infrastructure providers on our instructions:
| Provider | What |
|---|---|
| Supabase, Inc. (database, auth, file storage, functions) | All account data, events, messages, photos. Hosted in [Supabase project region: Dashboard → Settings → General]. |
| Google LLC, Firebase Cloud Messaging (Android) | Device token and notification content for delivery. |
| Google LLC, Firebase Analytics and Crashlytics (Android, iOS) | Anonymous usage statistics, crash reports, device model and OS version. |
| Apple Inc., Apple Push Notification service (iOS) | Device token and notification content for delivery. |
| OpenFreeMap (map tiles) | Device IP address and the map area you view while tiles load. |
| Photon / komoot (city search) | City search text and IP address. |
| Source websites of imported events (Karabas, Concert.ua, TicketsBox, DOU and others) | Cover images of imported events load from the source site, which sees your IP address. "Buy ticket" opens the source site under its own policy. |
Data may be processed outside Ukraine, including in the EU and the USA, under the providers' standard contractual clauses.
5. Retention
- Account and profile: until you delete the account.
- Events, attendance, chat: while the event or account exists. Chat closes one week after the event ends.
- Reports: up to 12 months after review.
- Push tokens: until sign-out or device change.
- Server logs: up to 30 days.
- Local cache and drafts on the device: until sign-out or app removal.
6. Your rights
- Delete your account in the app (Profile → Delete account) or via the website instructions. Account, profile, attendance, drafts, tokens and messages are deleted; events you created are cancelled.
- Access, rectify or restrict your data by emailing hello@poriad.app. We reply within 30 days.
- Withdraw consent for location and notifications in device settings.
- Complain to the Ukrainian Parliament Commissioner for Human Rights or, if you are in the EU, to your supervisory authority.
7. Security
All connections use TLS. Sessions are stored in Android Keystore and iOS Keychain. Server-side row-level security prevents access to other users' names, messages and queue positions even via direct API calls. Passwords are hashed. We will notify you of incidents that may affect you within 72 hours of discovery.
8. Children
Poruch is for adults. Sign-up requires being 18 or older, and age is checked at account creation. If you learn a minor has created an account, contact us and we will delete it.
9. Changes
We announce material changes in the app at least 14 days before they take effect. The effective date is shown at the top.
10. Contact
Taras Vovchenko, Ukraine
Email: hello@poriad.app