Hiero privacy policy
Draft. Written with the help of AI, not checked by a lawyer. Date: 2026-10-12. Fill in everything in [brackets] and remove this block before the text goes online. The Dutch version is in
privacy-nl.mdand has the same content.
Last updated: [DATUM]
Short version
- Hiero is an app for doing something spontaneous with people in your city. You must be 18 or older.
- We collect as little as possible: your email address, your profile, your quests and your chat messages.
- We never store your live location. Before you are accepted, others only see a rough area of a quest, accurate to about 300 metres. Only accepted people see the exact spot.
- We delete chat messages 48 hours after the quest has ended.
- No ads, no trackers, no analytics. We never sell your data.
- Our database is in the EU. For push notifications we use Expo, Google and Apple. They also operate outside the EU.
- You can download your data and delete your account in the app.
- Questions? Email [CONTACT E-MAILADRES].
1. Who we are
Hiero is made by two people in the Netherlands: [VOLLEDIGE NAMEN]. We do not have a company yet. We decide together what happens with your data. That makes us jointly responsible for it. The law calls this “joint controllers” (Article 26 GDPR).
- Email: [CONTACT E-MAILADRES]
- Post: [ADRES]
We do not have a data protection officer.
What we agreed between us. We have written down who does what. The essence:
- For all questions and requests about privacy, email one address: [CONTACT E-MAILADRES]. We make sure it reaches the right person.
- You can use your rights with either of us. You do not need to find out which of us does what.
- We are both responsible for security, for reporting data breaches and for the agreements with the companies that work for us.
2. What data we use
| Data | What exactly | Required? |
|---|---|---|
| Account | Email address, login codes (valid for 10 minutes), an account ID, when you accepted the terms | Yes |
| Profile | First name, profile photo, short bio, languages you speak | First name yes. Photo [CHECK: required or not]. Bio and languages no |
| Date of birth | To check that you are 18 or older. Others see your age in years, never your date of birth. [CHECK: matches the app] | Yes |
| Gender | Only needed for women-only quests. Never visible to others | No |
| Quests you post | Title, type, description, time, duration, maximum number of people, cost per person (if you fill it in), languages, settings, up to 4 photos, the exact spot and the rough area | Only if you post a quest |
| Joining | Your requests, whether you were accepted, cancellations, a +1, and whether you want a notification when a spot opens up | Only if you join |
| Chat | Messages in the group chat of a quest. The chat opens 1 hour before the start and closes 1 hour after the end, after that you can only read it. Updates from the host about time, place or cancellation | Only if you chat |
| Check-in | Who scanned whom, at which quest, and when. Not your location | Only if you check in |
| Counters | How many quests you did and hosted, and how often you showed up after being accepted | Created automatically |
| Notifications | Your phone’s push token, whether it is an Android phone or an iPhone, your phone’s language and your notification settings. If you turn on notifications about new quests nearby: an area you choose yourself, rounded to about 1 km | No |
| Reports and blocks | Who you block. Reports you make or that are about you, with the content they are about | Only if it happens |
| Suspensions | If we suspend your account: until when, the reason and which of us decided. If a suspended account is deleted: only a code that we make from its email address with a secret key and that cannot be turned back into the address (a keyed hash) | Only if it happens |
| Technical data | IP address, time and type of request, in security logs | Yes, this happens with every request |
| Contact | Emails you send us | Only if you email us |
People without an account. If you open a quest share link in your browser, your IP address ends up in the logs of our web server. If you report something through our web form, we keep your name, your email address and your report.
What we do not collect. Your contacts, your live location, your location in the background, an advertising ID, data about how you use the app (analytics), and audio. The app uses no tracking SDKs.
Sensitive topics. Some quests are about something sensitive, such as religion, health or an LGBTQ+ meetup. If you join such a quest, you reveal something about yourself to the host and the other participants. Think about that before you post or join such a quest. We do not use this information for anything else.
3. Why we use your data, and on what legal basis
The GDPR lists several legal bases. We use three:
- Contract (Article 6(1)(b) GDPR): we need the data to make Hiero work, as agreed in the terms.
- Legitimate interest (Article 6(1)(f) GDPR): we have a good reason that outweighs your privacy interest, and we keep it as small as possible.
- Legal obligation (Article 6(1)(c) GDPR): the law requires it.
| Purpose | Data | Legal basis |
|---|---|---|
| Creating an account and logging in | Email address, login codes, account ID | Contract |
| Checking that you are 18 or older | Date of birth | Contract |
| Showing your profile | First name, photo, bio, languages, age, counters | Contract |
| Women-only quests | Gender | Contract (you choose whether to fill it in) |
| Posting, showing and finding quests nearby | Quest data, photos, rough area and exact spot, your rounded position (not stored) | Contract |
| Joining and chatting | Requests, participation, messages | Contract |
| Checking in with a QR code | Check-in token, your location at that moment (not stored), the result | Contract |
| Sending push notifications | Push token, notification settings | Contract. You can always turn notifications off |
| Share link and public quest page | Public quest data, IP address of visitors in logs | Contract (for the host). Legitimate interest (visitor logs) |
| Reporting, blocking and moderation | Reports, the reported content, account data | Legitimate interest (a safe app). Legal obligation (Digital Services Act) |
| Keeping reports after an account is deleted | Reports and what we did about them | Legitimate interest (preventing repeated abuse, being able to account for our decisions) |
| Making sure nobody gets around a suspension with another account, for example by deleting their account and signing up again | A keyed hash of the email address of a deleted, suspended account. When someone makes a profile or changes their email address, we check in the same way whether it is the address of a suspended account, deleted or not (also when written a little differently, for example with a +tag). If it is, the suspension applies to that account too, until the same end. When we suspend an account, we look in the same way for other accounts that already have its address, and the suspension applies to them too | Legitimate interest (a safe app) |
| Security and preventing abuse | Security logs with IP address, limits on the number of actions | Legitimate interest (protecting the app and your data) |
| Police and other authorities | What is needed for the report or the order | Legal obligation |
| Handling your privacy rights | Email address, your request | Legal obligation |
| Answering your questions | Email address, your message | Legitimate interest |
| Emailing you about important changes, such as new terms | Email address | Contract |
Legitimate interest. Where we rely on legitimate interest, we have weighed whether that is fair to you. We will send you that assessment on request. You can always object (see section 11).
Consent. We do not ask for consent for anything right now, because we do no marketing and use no analytics. If we ever do, we will ask for your consent first. You can always withdraw consent.
No decisions by a computer alone. We do not make decisions about you that are made only by a computer and that have a major effect on you. A word filter can hold back a text. A human always decides about restricting, suspending or deleting an account. If a suspension carries over to another account with the same email address, that follows from the decision a human made about the first account.
4. How location works
Location is the most sensitive part of Hiero. This is how we handle it:
- Explanation first. After you sign up, the app explains once what a quest is, how to meet safely and how we use location. Only then does your phone ask for permission.
- The map. If you give permission, the app uses your approximate location while the app is open. Your phone rounds your position to 2 decimals (about 1 km) before the app asks the server which quests are nearby. We do not store that position. Without permission you see the centre of Amsterdam and the app still works.
- Posting a quest. You pick a spot on the map. When you post, we move that spot once at random, within about 300 metres. That is the rough area others see. We always calculate distances from the rough area. That way nobody can work out the real spot.
- The exact spot is only visible to the host and to people who were accepted.
- Checking in. Only when you scan a QR code does the app ask for your precise location. Your phone sends it once. The server checks whether you are within 200 metres of the quest. We only store whether it worked, not where you were.
- Notifications about quests nearby. We do not store a live location for these. You choose an area yourself (rounded to about 1 km), or your phone decides by itself whether a quest is close.
- What does not exist. No live location, no background location, and no feature that shows where someone is now or who is nearby.
- No location in push notifications or logs.
- Map tiles. The map comes from [KAARTDIENST]. That party sees your IP address and which part of the map you load. The map is made with OpenStreetMap data.
5. Photos
- You can add up to 4 photos to a quest and one profile photo.
- Before a photo is uploaded, the app re-encodes it. This removes the hidden data (EXIF), such as the GPS position where the photo was taken.
- All logged-in users can see quest photos while the quest is visible. Pick a photo that does not give away the exact spot, and without people who did not agree to it.
- The app does not ask for access to your whole photo library. You pick photos with your phone’s photo picker. The app only uses the camera to scan QR codes.
6. Push notifications
- You only get push notifications if you allow them. You can turn them off per type in the app, or completely in your phone settings. The app also works without them.
- A notification travels like this: our server sends it to Expo’s push service, Expo sends it to Google (Firebase Cloud Messaging, for Android) or Apple (Apple Push Notification service, for iPhone), and they deliver it to your phone. These parties see your push token and the text of the notification.
- That is why a notification never contains chat text or a location. It only says what happened, with at most the quest title and the other person’s first name. For example: “Sanne wants to join Pizza in Vondelpark”.
- We delete your push token when you log out or when the token stops working.
7. Who sees your data
Other users
- Logged-in users can see your profile (first name, photo, bio, languages, age, counters), except people you blocked or who blocked you.
- Logged-in users can see a quest until it is over. Only women can see a women-only quest.
- The host and the other accepted participants see who joins a quest. Others only see how many people are joining.
- Only the host and accepted participants can see the group chat. The chat is deliberately small: it opens 1 hour before the start and closes 1 hour after the end. Hiero is about actually meeting.
- Updates from the host about time, place or cancellation are also shown on the quest page. Only accepted people see a new exact spot.
Anyone with a share link
- A share link opens a web page with public information only: title, type, time, neighbourhood and number of spots. Never the exact spot, names or photos of people. Search engines do not index this page.
Companies that work for us (processors) These parties only work on our instructions. We have agreements with them about security and confidentiality.
| Party | What for | Where |
|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore) | Database, login, photo storage, server functions, live chat | Data in the EU region ([SUPABASE REGIO]). Supabase and some of its subcontractors can access the data from outside the EU, for example for support |
| Expo (650 Industries, Inc., United States) | Forwarding push notifications | United States |
| Google (Firebase Cloud Messaging) | Push notifications on Android | EU and United States |
| Apple (Apple Push Notification service) | Push notifications on iPhone | EU and United States |
| [EMAILDIENST] | Sending login codes and important emails | [LAND, bij voorkeur EU] |
| komoot GmbH (Photon, Germany) | Address search when you create a quest. Only the text you type is sent, never your location | Germany (EU) |
| [KAARTDIENST] | Map tiles | [LAND, bij voorkeur EU] |
| [WEBHOST] | The share page, this privacy policy and the report form | [LAND, bij voorkeur EU] |
Authorities We only give data to the police or another authority when the law requires it, or when someone’s life or safety is at risk.
Google Play and the App Store If you download Hiero from Google Play or the App Store, Google and Apple process data under their own privacy policies. We have no control over that.
We do not sell your data and do not give it to advertisers.
8. Data outside the EU
Our database is in the EU. Data can still leave the EU:
- Supabase is a company from Singapore. Supabase staff and subcontractors can in some cases access the data from outside the EU. The European Commission’s Standard Contractual Clauses (SCCs) apply to this.
- Expo, Google and Apple are American companies or part of one. With push notifications, your push token and the text of the notification can end up in the United States. The EU-US Data Privacy Framework applies, with the Standard Contractual Clauses as a backup. [VERIFY per party which safeguard applies]
The Data Privacy Framework is under pressure. That is why we keep notifications short and free of sensitive data, and choose European parties where we can. For a copy of the safeguards, email [CONTACT E-MAILADRES].
9. How long we keep data
| Data | How long |
|---|---|
| Chat messages and host updates | 48 hours after the quest has ended |
| Exact spot of a quest | 48 hours after the quest has ended, together with the chat. If the quest is deleted earlier, the exact spot goes with it |
| Quests, quest photos, participation and check-ins | 90 days after the quest has ended. Then we delete them or make them anonymous. Only the counters stay on your profile |
| Your position on the map and at check-in | Not stored |
| Profile and account | As long as your account exists |
| Blocks | As long as your account exists |
| Reports and what we did about them | As long as the account exists, and up to 12 months after the report is closed. If you report a message or photo, we keep a copy of it with the report |
| Suspensions | Up to 12 months after the suspension has ended. A suspension for good: as long as the account exists |
| Keyed hash of the email address of a deleted, suspended account | As long as the suspension runs. For a suspension for good: until we lift it. You can ask us to |
| Push tokens | Until you log out or the token stops working |
| Security logs | [X LOGS] days |
| Which actions you took, for the limits on the number of actions | 2 days |
| Sent push notifications (type of notification, quest, time) | 7 days |
| Emails with questions and privacy requests | Up to 12 months after we handled your question |
| Deleted account | Permanently deleted within 30 days. Backups are overwritten within [X BACKUP] days |
If the police or a court asks us to keep data longer, we only do so for as long as needed.
10. 18+ only
Hiero is only for people aged 18 and older. When you sign up we ask for your date of birth, and the database checks it as well. If we find out someone is under 18, we delete the account. Does someone look under 18? Report it in the app.
11. Your rights
You have these rights:
- Access: you can find out what data we have about you.
- Correction: you can have incorrect data corrected. You can change a lot yourself in your profile.
- Deletion: you can have your data deleted.
- Restriction: you can ask us to stop using your data for a while, for example while we look into a complaint.
- Portability: you can get your data in a file that a computer can read.
- Objection: you can object when we use your data based on legitimate interest. We then stop, unless we have a compelling reason, which we will explain to you.
- Withdrawing consent: if we ever ask for consent, you can always withdraw it.
How to use your rights
- Download your data: in the app under [Profile > Settings > Download my data]. You get a JSON file.
- Delete your account: in the app under [Profile > Settings > Delete account].
- Without the app: follow the steps at https://[DOMEIN]/en/delete-account, or email us.
- All other requests: email [CONTACT E-MAILADRES]. Email from your account’s email address, so we know it is your account. Sometimes we ask you to confirm a code that we send to that address.
We reply within one month. If your request is complicated, it can take two months longer. We will tell you within the first month. It is free.
12. Complaints
Not happy with how we handle your data? Tell us first at [CONTACT E-MAILADRES] and we will look for a solution together. You can always file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): https://autoriteitpersoonsgegevens.nl. If you live in another EU country, you can also go to the data protection authority of that country.
13. Security
- All connections are encrypted (HTTPS).
- Every table in the database has rules that decide who can see which row (Row Level Security). The server never trusts the app and checks everything itself.
- Your session is stored in your phone’s encrypted storage. When you log out, we wipe everything on your phone.
- Only the two of us can access the admin environments. Two-factor authentication is on there.
- If something goes wrong with your data (a data breach), we report it to the Autoriteit Persoonsgegevens within 72 hours when required. If the risk to you is high, we tell you as well.
14. Changes
When Hiero changes, we update this policy. The date of the latest version is at the top. For important changes we let you know in advance in the app or by email.