Privacy policy
This privacy notice for Kamil Maślanka (“we”, “us” or “our”) describes how and why we collect, store, use and share (“process”) your personal information when you use the ErasmusApp mobile application or this website (together, the “Services”). Reading it will help you understand your privacy rights and choices. If you do not agree with our practices, please do not use the Services. If you have questions, write to erasmusappsupport@gmail.com.
The short version
The key points, with links to the detail. The full notice below is what counts.
- What we collect. What you give us when you sign up and fill in your profile, what you post in the app, a push token if you allow notifications, and anonymous crash reports. More
- Sensitive information. We do not ask for any.
- From third parties. We do not collect any information about you from third parties.
- Why. To run the app, show you to other students in your city, keep the app safe, and comply with the law. Only ever with a valid legal reason. More
- Who else sees it. Other students in your city see your profile and posts. A few companies process data on our behalf so the app can work. We never sell your data and there are no ads. More
- Cookies and tracking. None, in the app or on this website. More
- Your rights. You can see, correct, export and delete your data, and you can delete your whole account from inside the app in a few taps. More
What information we collect
Information you give us
We collect the personal information you choose to provide when you register, use the app or contact us. That is:
- To sign in: your university email address. We send a 6-digit code to it and you type the code in; there is no password. Sign-in emails are sent through Resend on our behalf.
- Your profile: your full name, home country, home university, faculty, a short bio, the languages you speak, your interests, your arrival and departure dates, a photo, and the city you are on exchange in (the one your university email belongs to).
- Your preferences: whether anyone can say hi to you, and whether you want alerts.
- What you post: activity plans (title, category, description, photo, place, meeting point, time, price, number of spots and, if you place one by hand, a map pin); messages, photos, replies and hearts in a plan’s chat; posts on the board, replies to them and likes; hellos; the plans you join, save or invite friends to; and, if you host a plan, the people you remove from it. Text you publish is checked against a short list of words that are not allowed before it is posted.
- Reports and blocks: when you report a person, a plan, a message or a post we keep the reason, any details you add, a snapshot of what was reported and who reported it, and we email those to our moderator so it is looked at quickly. When you block someone we record that so the block can be enforced both ways.
- Support: if you email us, the conversation.
All personal information you give us must be true, complete and accurate, and you should update it if it changes.
Information from your device
- Push notifications. If you allow notifications, we store a push token for your device so we can tell you about hellos, joins and replies. You can turn notifications off in your device settings at any time; the token is deleted when you sign out.
- Crash reports. If the app crashes, a report with your device model, operating system version, app version and the technical trace of the crash is sent to Sentry. It contains no names or email addresses. We use it to fix bugs, nothing else.
- Location. The app never reads your device location. A map pin on a plan only exists if the host drops it by hand.
We do not collect log or usage data about how you use the app, and we do not use analytics. This website is hosted on Vercel, which, like any host, may keep short-lived server logs (such as IP address and requested page) to run the service.
Sensitive information
We do not ask for sensitive information (such as health, religion, sexual orientation or ethnic origin). Your bio is free text; please do not put such things in it. If you do, you are choosing to show them to other students in your city.
Information from third parties
We do not collect any information about you from third parties.
How we use your information
We process your information to provide and run the Services, to communicate with you, for safety, and to comply with the law. In particular:
- To create your account and sign you in, and keep the account in working order.
- To show you to other students in your city and let you post plans, join them, ask for company, ask questions and say hi. That is the point of the app.
- To send you notifications about hellos, joins and replies, if you have allowed them.
- To keep the app safe: acting on reports, enforcing blocks, and removing content or people who break the terms.
- To fix crashes, using the anonymous crash reports described above.
- To ask you for feedback and contact you about your use of the app, for example while it is in testing.
- To protect someone’s vital interests, such as preventing harm to a person.
We will only process your information for another purpose with your prior explicit consent.
Our legal bases
The General Data Protection Regulation (GDPR) requires us to explain the legal basis for each use of your personal information. We rely on:
- Performance of a contract — to provide the service you signed up for: your sign-in email, profile, city, preferences and the content you post.
- Consent — your photo and push notifications. You can withdraw consent at any time by removing the photo or turning notifications off; see withdrawing your consent.
- Legitimate interests — keeping the app safe and working, where those interests do not override your rights and freedoms: reports, blocks, crash reports and diagnosing problems.
- Legal obligations — where we must, for example to cooperate with a law enforcement body or defend our legal rights.
- Vital interests — where necessary to protect your safety or someone else’s.
Data outside the EU
Our servers are in Ireland. Push notifications pass through Expo in the United States and then through Apple or Google, and crash reports go to Sentry, so some information is processed in the United States and possibly other countries whose data protection laws are not as comprehensive as those in the EEA.
Where that happens we rely on the European Commission’s Standard Contractual Clauses, which require the recipient to protect personal information originating from the EEA in line with European data protection law. Details of the safeguards in place with each provider can be provided on request.
How long we keep your information
We keep your personal information for as long as you have an account, and no longer, unless the law requires otherwise. Past plans do not expire automatically yet. When you delete your account, everything listed under Delete your account is removed immediately, with two exceptions:
- reports you filed about others are kept, with your name and account removed, so we can still act on them
- if we removed your account for breaking the terms, a one-way hash of your email address is kept so the same address cannot sign up again; the address itself is not kept
- crash reports are kept by Sentry for a limited period (90 days) and then deleted automatically; they never contained your identity
Push tokens are also deleted whenever you sign out.
How we keep your information safe
We have put in place appropriate and reasonable technical and organisational measures to protect the personal information we process: your data is stored in the EU, there are no passwords to leak (you sign in with a one-time code sent to your university email), and reports are handled by a person. Please note the point about photos in sharing above.
No transmission over the internet or storage technology is 100% secure, so we cannot promise that unauthorised third parties will never defeat our security. Use the app in a secure environment and keep your sign-in code to yourself.
Age
ErasmusApp is for adult students. We do not knowingly collect data from anyone under 18 years of age, or the equivalent age of majority where you live. By using the Services you confirm that you are at least 18. If we learn that we hold information about someone younger, we will deactivate the account and delete the data promptly. If you think that has happened, contact us at erasmusappsupport@gmail.com.
Your privacy rights
Under the GDPR you have the right to (i) request access to and obtain a copy of your personal information, (ii) request rectification or erasure, (iii) restrict its processing, (iv) data portability, and (v) not to be subject to automated decision-making. We make no automated decisions about you. In certain circumstances you may also object to the processing of your personal information.
In practice:
- see what we hold — most of it is in your profile; for a full copy, email us
- correct it — edit your profile in the app
- delete it — Settings → Delete account in the app, or email us
- take it with you — email us and we will send an export; it is done by hand, so allow a few days
To make any other request, contact us using the details in how to contact us. We will consider and act on every request in line with applicable data protection law: we will acknowledge it within 30 days, look into it without undue delay, and tell you the outcome.
Withdrawing your consent
Where we rely on your consent, you can withdraw it at any time: remove your photo in the app, turn notifications off in your device settings, or contact us. Withdrawing consent does not affect the lawfulness of processing before the withdrawal, or processing that rests on another legal basis.
Complaints
If you believe we are processing your personal information unlawfully, you have the right to complain to a data protection authority. Because we are based in Poland, our lead authority is the President of the Personal Data Protection Office (UODO). You can also complain to the authority in the EEA country where you live; the European Data Protection Board keeps a list of all of them.
Account information
You can review or change your information at any time by editing your profile in the app. When you delete your account, it and your information are removed from our databases straight away; the only things kept are described under how long we keep your information.
Updates to this notice
We may update this notice from time to time. The date at the top tells you when it last changed. If we make a material change, we will tell you in the app or by email before it takes effect. Please look at this page now and then to stay informed.
How to contact us
Questions or comments about this notice: email erasmusappsupport@gmail.com, or write to:
Kamil Maślanka
Poznańska 11
30-012 Kraków
Poland
How to review, update or delete your data
You have the right to request access to the personal information we hold about you, to learn how we have processed it, to correct inaccuracies, and to delete it. Edit your profile in the app, use Settings → Delete account (see Delete your account), or reach us through the support page.