Privacy policy

1. What Dotty is

Dotty is an app for sharing moments (a photo, optionally with text) exactly where you are right now. Your friends see them on a map. Public moments are visible to all users. There are also comments, reactions, chats, streaks and a weekly leaderboard.

2. Which data we process

• Account: your phone number (when signing in with an SMS code) or your Apple ID identifier and, if shared by Apple, your email address (with “Sign in with Apple”).
• Profile: username, optionally a display name, profile picture and city, and who invited you.
• Location: your precise location while the map or the camera is open. It is only stored when you share a moment: then the coordinates, their accuracy, the chosen place, and the district and city. For the city chat we store when you were last in that city. Your location is never collected in the background.
• Content: your photos, captions, comments, reactions (🔥) and chat messages, and places you add yourself.
• Social data: friendships and requests, group chats and memberships, your invite codes and who joined with them.
• Points and streaks: calculated from your activity and shown to friends or on the city leaderboard.
• Notifications: a push token for your device so we can send you notifications, and the notifications themselves (e.g. “… commented”).
• Reports: when you report a moment, the reported moment, the reason and who reported it.
• Technical data: calling our servers creates technically necessary log data (e.g. IP address, time, request). It is kept by our hosting provider for a short time.

Dotty does not access your contacts, microphone or photo library. Exception: when you pick a profile picture, only the one picture you pick.

3. Who sees what

• Moments shared with “Friends”: only your confirmed friends.
• Moments shared with “Everyone” (public): all Dotty users for 24 hours, including place and time. After that, only you and your friends see them. Others only see your public moments from the last 24 hours on your profile.
• Profile: username, display name, profile picture, streak and points are visible to other users.
• City leaderboard: anyone who shares publicly in a city during a week appears there with username, profile picture, points and streak.
• Chats: direct and group messages are only visible to their members. Messages in the city chat are visible to everyone currently in that city.
• Sharing: when you pass on a moment or an invite through the share menu, the privacy policy of the app you choose applies (e.g. WhatsApp, Instagram).

4. Purposes and legal bases

• Providing Dotty and all its features (account, sharing, map, friends, chats, leaderboard): Art. 6(1)(b) GDPR (contract).
• Location, camera and notifications: only with your permission in the system settings, Art. 6(1)(a) GDPR. You can withdraw it at any time in your iOS or Android settings.
• Security and abuse prevention (e.g. checking that you are really on site, daily limits, handling reports, the invite system): Art. 6(1)(f) GDPR (legitimate interest in a safe, honest platform).
• Legal obligations, e.g. requests from authorities: Art. 6(1)(c) GDPR.

We do not use your data for advertising, do not build advertising profiles and do not use any analytics or tracking services.

5. Service providers

We use the following service providers, who process data on our behalf (Art. 28 GDPR):

• Supabase Inc. (USA): database, sign-in, file storage and server functions. The data is stored in a data center in Frankfurt am Main, Germany (AWS eu-central-1).
• Mapbox Inc. (USA): map display and turning your location into district, city and address. For this, coordinates and technical data are sent to Mapbox.
• 650 Industries Inc. / Expo (USA): delivery of push notifications; your push token and the notification text are processed.
• Apple Inc. (USA) and Google LLC (USA): delivery of notifications to your device (Apple Push Notification service and Firebase Cloud Messaging) and “Sign in with Apple”.
• Twilio Inc. (USA): sending the sign-in code by SMS; your phone number and the code are processed.

For transfers to the USA we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses (Art. 46 GDPR).

Place data comes from OpenStreetMap (© OpenStreetMap contributors, ODbL) and Foursquare Open Source Places (Apache 2.0). It is stored in our own database; no data about you is sent to OpenStreetMap or Foursquare.

6. How long we keep data

• As long as you have your account. You can delete individual moments and comments yourself at any time.
• When you delete your account (Einstellungen → Konto löschen), we immediately delete your profile, photos, moments, comments, reactions, messages, friendships, notifications and push tokens. Backups may still contain data for up to 7 days.
• Places created through a moment remain, without any link to you.
• Server logs are deleted automatically after a short time.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future.

To do so, write to privacy@dottysocial.app. You can also complain to a data protection authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information.

8. Minimum age

Dotty is for people aged 16 and over. We do not knowingly process data of younger children.

9. Security

The connection to our servers is encrypted. Access is protected by access rules in the database: photos of moments are only delivered through time-limited links, and everyone only sees what has been shared with them.

10. Changes

When Dotty changes, we update this policy. We will inform you about significant changes in the app.

11. Controller

Pablo Guillen
Gürtelstraße 35
10247 Berlin
Germany
Email: privacy@dottysocial.app

For questions about privacy or your rights, write to this email address.