Privacy Policy
FAYA App

Faya UG (haftungsbeschränkt), c/o Axel Dieterle, Solinger Str. 5, 40227 Düsseldorf, Germany · Managing director: Axel Dieterle · Commercial register: Amtsgericht Düsseldorf, HRB 100928 · E-mail: info@getfaya.app · Legal notice. This address is also our point of contact under Art. 11 and 12 of the Digital Services Act (German or English).

This policy covers the FAYA app for iPhone (iOS), including remaining Android installations of version 2. Two generations exist and differ technically. Where processing differs, it is marked Version 2 (the app available on the App Store since 2024, versions 2.x) or Version 3 (the newly built app from version 3.0). Unmarked sections apply to both. Your version is shown in the app settings or on the App Store.

• Account & sign-in: phone number, SMS verification code, session token, technical connection data. Purpose: creating and securing your account. Legal basis: Art. 6(1)(b) GDPR. Version 2 uses Firebase Authentication (Google) and optionally Sign in with Apple. Version 3 uses Supabase Auth with SMS codes sent via Twilio.
• Profile: display name, date of birth, gender, photos, bio, city, music genres, optional social handles (Instagram, TikTok, Facebook) and other optional details you choose to add. Signed-in users can see your profile (name, age, gender, photos, bio, city, genres, handles). If you RSVP to an event, you appear on its guest list. Your phone number, e-mail, like filters and block list are never visible. Note: while the app displays only your age, the app's API currently transmits your full date of birth to other signed-in users; we are working to restrict this to the age. Legal basis: Art. 6(1)(b), optional details Art. 6(1)(a).
• Events, RSVPs, follows, likes, matches: stored with your account to show your events, guest lists and connections. No automated decision-making within the meaning of Art. 22 GDPR. Legal basis: Art. 6(1)(b).
• Chat: text messages, voice messages, GIFs and (version 3) photos, with sender, recipient and time. Messages are encrypted in transit (TLS) and stored securely on servers in the EU, but not end-to-end encrypted: we could technically read them, we do not analyse them, and we only look at content if a chat is reported or the law requires it. You see whether a message was delivered; whether you have read a message is never shown to others. Version 2 additionally encrypts 1:1 text messages at rest (AES-256, server-held key) and uses Tenor (Google) for GIFs. Version 3 stores media in a private bucket with 5-minute signed links and uses GIPHY (Giphy, Inc., a Shutterstock company, USA) for GIFs. GIF providers receive your search term and IP address only when you open the GIF picker; GIFs that are sent load from the provider's servers on both sides. Legal basis: Art. 6(1)(b).
• Blocking & reporting: reports (reason, description, reporter, reported person, time) are reviewed by a human. Version 2 sends the report by e-mail to our support mailbox including both users' display names, IDs and phone numbers and the last 20 chat messages in plain text; the reported user is blocked automatically and the chat deleted. Legal basis: Art. 6(1)(f), (b) and (c) (Art. 16 DSA). Retention: until the review is completed, at most 12 months.
• Push notifications: only if you allow them in the iOS dialog. We store a device token. Chat notifications contain the sender's name and the message text and travel through Apple's push service (and, in version 2, Google Firebase Cloud Messaging). Turn off previews or notifications in iOS Settings at any time. Event notifications are limited to at most one per 24 hours. Legal basis: Art. 6(1)(a) for the channel, (b) for content, (f) for event notices.
• Location: only "while using the app", only to show distance to events, never sent to our servers or third parties (version 3: accuracy limited to about one kilometre). Maps: Google Maps SDK (version 2) or Apple MapKit (version 3) load map tiles for the event venue. Legal basis: Art. 6(1)(a).
• Usage analytics: screens opened, features used, app/OS version, device model, session length. No chat content, no session replays, no cross-app tracking, no ad profiles. Version 2: Firebase Analytics (Google) plus our own event log linked to your account; the app asks for App Tracking Transparency permission, but we do not use the advertising ID for advertising. Version 3: PostHog, processed exclusively on servers in Frankfurt (EU), linked to your random account ID. Legal basis: Art. 6(1)(f); object at any time by e-mail.
• Crash reports: error message, stack trace, device model, OS and app version. No chat content, no screenshots, no user identity. Version 2: Firebase Crashlytics (Google) and our own error endpoint. Version 3: Sentry, EU region (Frankfurt). Legal basis: Art. 6(1)(f). Retention: 90 days.
• Goodies & sweepstakes: we record that your account redeemed a goodie for an event (version 2: your phone number and the event) and your participation in event sweepstakes; winners are drawn at random and notified in the app or by push (version 2 possibly by SMS). Legal basis: Art. 6(1)(b).
• Secret Link (invitations & applications) Version 3: which account redeemed which invitation; for applications your Instagram handle, optional e-mail, and first name, age and phone number from your account. Retained up to 12 months after the event. Legal basis: Art. 6(1)(b).
• Tickets Version 3: tickets are bought in the browser from ticket.io (Ticket i/O GmbH, Cologne), not in the app. The provider sends us order data (name, e-mail, phone, ticket category, amount, entry scans) which we store in the same database for entry, accounting and statistics. These data are not shown in the app and are currently not linked to your app account. Details: the "Ticketkauf & Gästedaten" section of the website privacy policy.
• Artists & organisers: we display publicly available information about artists, organisers and venues (name, photo, description, links). Legal basis: Art. 6(1)(f); affected persons may object at any time.

Permissions are requested only when you use the related feature and can be changed in iOS Settings at any time: Photos (profile, groups, chat photos in version 3), Camera (version 3, chat photos), Microphone (voice messages), Location (distance to events, stays on the device), Notifications (device token), Tracking (version 2, ATT prompt – no advertising). Stored locally on your device: your session (encrypted keychain), settings such as language and city, a cache of recent messages and voice messages (version 3, cleared on sign-out), seen events and goodie proofs. The app does not read your contacts, calendar or other apps.

We only share data with the service providers we need to run the app, under data processing agreements (Art. 28 GDPR). Transfers outside the EU rely on the EU-US Data Privacy Framework (DPF), the EU Standard Contractual Clauses (SCC) or, for features you trigger yourself, Art. 49(1)(b) GDPR.

Instagram, TikTok, Facebook, Spotify, SoundCloud, YouTube, WhatsApp, Telegram or a maps app only receive data when you tap a link or share content yourself. Authorities receive data only where the law obliges us (Art. 6(1)(c)).

Delete your account any time in the app: Profile → Settings → "Delete account", or e-mail info@getfaya.app (ideally from or with the phone number of your account). This deletes your account, profile, photos, RSVPs, likes, connections, chats and chat media, push tokens, group memberships, reports and blocks (version 2: also your Firebase sign-in account). Group messages you wrote may remain visible to other members without your name. Secret Link applications, goodie redemptions and analytics are detached from your account and deleted when the periods above expire. Data we must keep by law is retained only for that purpose. Accounts unused for more than 24 months may be deleted after prior notice.

FAYA is for adults aged 18 and over only. We check your date of birth at sign-up and do not knowingly process data of minors; such accounts are deleted.

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), to withdraw consent at any time with future effect (Art. 7(3)) and to object to processing based on legitimate interests (Art. 21), for example analytics or crash reports. Send requests to info@getfaya.app; we reply within one month.

Complaints: you may lodge a complaint with a supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de – or the authority of your place of residence.

We protect your data with technical and organisational measures under Art. 32 GDPR: TLS encryption in transit, encrypted session storage on your device, database access rules limiting each account to its own data and what features require (version 3), at-rest encryption of 1:1 chat text (version 2), short-lived signed links for chat media (version 3), and need-to-know access for staff and providers. We update this policy when the app or the law changes and inform you in the app about material changes. The current German version at faya.events/app/datenschutz prevails.

Last updated: 29 September 2026 · Replaces the policy dated 18 August 2024 (getfaya.app).