Privacy Policy

CityKlub is provided by SL Spiking Labs UG (haftungsbeschränkt), Subbelrather Straße 15 a, 50823 Köln, Germany ("CityKlub", "we", "us"). We are responsible for processing your personal data. For privacy questions or requests, email [email protected].

1. Data we collect

Depending on how you use CityKlub, we process:

• Account data: your phone number, internal user ID, and login and verification information.
• Profile data: your display name, optional biography, neighborhood, interests, avatar information, and account dates.
• Activity data: activities you create or join, descriptions, categories, times, capacity, join requests, participation status, and meeting notes.
• Location data: meeting points selected on the map. We show other users an approximate, randomized location. The exact meeting point is restricted to the host and approved participants.
• Communications: messages you send in activity group chats.
• Safety data: blocks, reports, report details, moderation decisions, and related audit records.
• Technical data: IP address, device and browser information, app version, session information, and security or service logs produced when the app communicates with our providers.

The current version does not read your device's GPS location. A host selects a meeting point on the map. If we add device-location functionality, we will explain its use before requesting permission.

2. Why we process data

We use personal data to:

• authenticate users and maintain accounts;
• display profiles and activities;
• let people create, join, and manage activities;
• provide group messaging and controlled access to meeting points;
• operate blocking, reporting, abuse-prevention, and moderation features;
• secure, maintain, and troubleshoot CityKlub; and
• provide support and comply with legal obligations.

For people in the European Economic Area, our legal bases are performance of our agreement with you (Article 6(1)(b) GDPR), our legitimate interests in operating and protecting CityKlub (Article 6(1)(f)), compliance with legal obligations (Article 6(1)(c)), and consent where we specifically request it (Article 6(1)(a)).

3. What other CityKlub users can see

Your display name, biography, neighborhood, interests, avatar, public activities, and approximate activity locations may be visible to other CityKlub users. Exact meeting points and group-chat messages are restricted to the host and approved participants. Please do not put sensitive personal information in profiles, activities, meeting notes, messages, or reports unless it is necessary.

4. Service providers and other recipients

We use or disclose data to the following recipients where necessary:

• Supabase: authentication, database, realtime messaging, and backend infrastructure. CityKlub's primary database is hosted in London, United Kingdom.
• SMS delivery providers: delivery of one-time login codes. The provider receives the phone number and information needed to deliver and protect the message service.
• CARTO and map infrastructure providers: delivery of map tiles. Requests may disclose an IP address, device or browser information, and the map area being viewed. OpenStreetMap provides underlying map data.
• Content-delivery providers: delivery of web resources used by the in-app map; these providers receive ordinary network-request information.
• Authorized CityKlub safety administrators: review of reports and protection of users.
• Authorities and professional advisers: where required by law or necessary to establish, exercise, or defend legal claims.

We do not sell personal data, use advertising SDKs, or use CityKlub data for cross-app advertising tracking.

5. International processing

Our Supabase database is located in the United Kingdom. The European Commission has recognized the United Kingdom as providing an adequate level of data protection. Other providers may process data outside your country. Where required, we rely on an adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses.

6. Retention

We retain personal data only for as long as needed for the purposes described above:

• account, profile, activity, and message data are generally kept while your account is active;
• verified account-deletion requests are generally completed within 30 days;
• residual backup copies may remain for up to 90 days before being overwritten;
• security logs are generally kept for up to 90 days unless an incident requires longer retention; and
• safety reports and moderation records may be kept for up to 24 months after resolution, or longer where reasonably necessary for user safety or legal claims.

Where data must remain after an account is deleted, we limit it, restrict access, and delete or anonymize it when the reason for retention ends. Authentication sessions are stored on your device until you sign out, delete the app's local data, or uninstall the app.

7. Security

We use encrypted network connections, database access controls, row-level authorization, restricted administrative access, and audit records. No storage or transmission system can be guaranteed completely secure.

8. Account deletion and your rights

To request deletion of your CityKlub account and associated data, email [email protected] from a reachable email address and include the phone number used for your CityKlub account. We will verify that the account belongs to you before completing the request. Data that must be kept for security or legal reasons is handled as described in the retention section.

Depending on applicable law, you may request access, correction, deletion, restriction, or portability of your data, or object to processing. You may withdraw consent without affecting processing that was lawful before withdrawal. You may also complain to a competent supervisory authority, including the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

9. Children

CityKlub is intended for people aged 18 or older. We do not knowingly permit children to create accounts. Contact us if you believe a child has provided personal data through CityKlub.

10. Changes to this policy

We may update this policy when CityKlub's features or data practices change. We will communicate material changes in the app or through another appropriate channel. The effective date above shows when this policy was last revised.