Privacy

Privacy Policy

Last updated: 16 May 2025

This policy explains what personal data Hobbies+ collects, why we collect it, and how we use and protect it. We have written it in plain language - if anything is unclear, please contact us.

1. Who we are

Hobbies+ is a mobile application operated by Hobbies+ (Cyprus). When this policy refers to “we”, “us”, or “Hobbies+”, it means this entity. We are the data controller for the personal data described below.

For any privacy-related questions, contact us at support@hobbies.plus.

2. Data we collect and why

We only collect data that is necessary to provide the service.

Account & profile

  • Phone number - used to authenticate you via a one-time passcode (OTP). We do not use it for marketing.
  • First name, last name, year of birth, gender - displayed on your profile and used to verify you meet the minimum age requirement (EU/DSA compliance). We collect only the year, not your full date of birth.
  • Avatar choice and accent colour - personalisation preferences stored on your profile.
  • Hobby interests - used to match you with relevant activities and other users.

Activities & social

  • Activities you create or join, including location, date, and participant list.
  • Friend relationships (who you have added as a friend).
  • Chat messages - stored solely to deliver them to the other participants in a group or direct conversation and to maintain chat history. Messages are private and are not used for any other purpose.
  • Blocks and reports you make against other users.

Location

  • Approximate device location - used in real-time to show activities near you and to set activity locations. We do not store your GPS coordinates as a persistent field; location is used only at the moment of a request.

Contacts (optional)

  • If you grant permission, we read the phone numbers in your device contacts, hash them, and compare the hashes against registered accounts. We do not store your contacts or share them. You can revoke this permission in your device settings at any time.

Notifications

  • Device push-notification token - used to send you in-app notifications (friend requests, activity updates, chat messages, reminders). You can disable notifications in your device settings.

Analytics (opt-in)

  • Anonymous usage events (e.g. "activity created", "notification opened") - collected via PostHog only if you opt in inside the app under Analytics & Privacy. We never collect message content, exact location, or any personally identifiable information through analytics.

3. Legal basis for processing (GDPR)

We process your data under the following legal bases:

  • Contract performance - data needed to provide the core service (authentication, profile, activities, chat).
  • Legitimate interest - safety features such as blocking and reporting.
  • Consent - contacts import and analytics. You can withdraw consent at any time.

4. Third-party services

We use the following third parties to operate the service:

  • Google Firebase (Authentication, Firestore database, Cloud Functions, Cloud Messaging) - our core infrastructure, hosted in the EU (europe-west1 region).
  • Google Places API - used for activity location search and autocomplete. Location queries are sent to Google in real-time.
  • Klipy / Tenor - GIF search used inside activity chats. Search queries are sent to the GIF provider when you use this feature.
  • PostHog - analytics, EU cloud (eu.posthog.com), opt-in only.

We do not sell your personal data to any third party. We do not use your data for advertising.

5. Data retention

We retain your data for as long as your account is active. When you delete your account:

  • Your profile, friends list, activity memberships, and notification tokens are removed immediately from active systems.
  • Your messages are anonymised - the content is removed, and the sender is replaced with a deleted-user placeholder.
  • Complete removal from backup systems may take up to 30 days.

6. Your rights

Under GDPR (and applicable data protection law), you have the right to:

  • Access - request a copy of the personal data we hold about you.
  • Rectification - correct inaccurate data (you can edit most profile data directly in the app).
  • Erasure - delete your account and all associated data from within the app, or by contacting us.
  • Portability - receive your data in a structured, machine-readable format.
  • Object or restrict - object to processing based on legitimate interest, or request a restriction on processing.
  • Withdraw consent - revoke your consent for contacts import or analytics at any time in-app.

To exercise any of these rights, contact us at support@hobbies.plus. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority. In Cyprus, this is the Office of the Commissioner for Personal Data Protection.

7. Security

We implement appropriate technical and organisational measures to protect your data, including encrypted data in transit (HTTPS/TLS) and access controls on our backend systems. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but we take reasonable precautions.

8. Children

Hobbies+ is intended for users who are at least 16 years old. We do not knowingly collect data from children under 16. If you believe a child has created an account, please contact us and we will delete it promptly.

9. Changes to this policy

We may update this policy from time to time. When we make material changes, we will notify you via in-app notification or by updating the “Last updated” date above. Continued use of the app after changes constitutes acceptance of the updated policy.

10. Contact

For any questions about this policy or your data, contact us at support@hobbies.plus.