This is a draft. It describes accurately what the app does with data
today. It has not been reviewed by a lawyer, and it must be before the app is
published.
SOSI is operated by the publisher named in the app store listing. Questions about this policy go to the support address published there.
When you create an account. Your email address, and a password we never see — Firebase Authentication stores a hash. If you sign in with Google or Apple, we receive the email address and display name they release to us.
What you agreed to. Which version of these documents you accepted, when, and which of the three sign-up routes you came through. We keep it because we have to be able to show that you were asked, and because it is how we know who has not yet seen a newer version. Only you can read it, and it is erased with your account.
Your profile. Your name, an optional username, an optional short bio, an optional photo, the city and neighbourhood you type, and the interests you pick. This is visible to anyone signed in — that is the point of it.
Where you are, roughly. If you allow it, we take your location once and round it before storing it. The stored value is accurate to about a kilometre. It is used to rank plans by distance and is never shown to anyone. You can skip this entirely and type a neighbourhood instead; the app works either way.
Plans you create or join. Their title, description, venue, time and capacity. The map position published with a plan is rounded to about 110 metres. The exact address, if the host supplies one, is stored separately and is readable only by people who have joined.
Messages. What you write in a plan's group chat, and what you write to the assistant.
Your device. A push notification token per device, so we can reach that device. No advertising identifier is collected.
Proving you are a person. When you sign up you do a short camera check: you move your face into an oval and the video is streamed to Amazon Web Services in Ireland, which answers one question — is this a live human in front of the camera? We receive a score, and nothing else. No photo or video of your face is kept, by us or by AWS. A face is biometric data, so this happens only with your explicit consent, which you give on that screen. There is no way around it: everybody on SOSI has passed the same check, and that is the only thing that makes the promise worth anything.
We do not track you across other apps or websites. There is no advertising SDK and no analytics SDK in this app. We do not sell data, and there is nobody to sell it to — no third party receives your data except the processors listed below, each of which acts on our instructions.
The part of the assistant that finds plans runs entirely on our own servers: a ranking that weighs your interests, how far each plan is, when it starts and how full it is. Nothing about you leaves the project for that.
Only the Premium chat sends anything out. When you type a message there we send Anthropic your message, the recent conversation, your city and interests, and a short list of plans you are already allowed to see. We do not send your name, your email or your coordinates. Anthropic processes it to generate a reply and does not use it to train models. If you never use Premium chat, nothing about you is sent to Anthropic at all. The conversation is stored in your account until you clear it.
| Who | What for | Where |
|---|---|---|
| Google (Firebase) | Accounts, database, file storage, push | EU (eur3, europe-west3) |
| Anthropic | Premium assistant chat | United States |
| Amazon Web Services | The one-time liveness check | EU (Ireland) |
Only a Premium chat message is transferred outside the EEA. That transfer relies on the processor's standard contractual clauses. The free assistant makes no transfer at all.
Your account data is kept while your account exists. Plans and their messages are kept so the people who were there can still see them.
You can delete your account yourself, in the app: Settings → Delete account. There is no waiting period. The profile, the email address, the settings, the uploaded images, the messages written in group chats and the liveness result are erased, and the account cannot be signed into again.
Two things outlive the account, and both are somebody else's record rather than yours. Plans that already happened stay for the people who were there, with the name and the photo taken off them. Safety reports filed by or about the account stay with moderation — otherwise deleting an account would be a way to clear a report.
For an account that stays open there is still no automatic retention limit.
The liveness check leaves no image behind. What we keep is that you passed, when, and the confidence score — for as long as your account exists.
Moderation records work differently. A moderator's decisions — a warning, a suspension, content removed — are kept for two years along with who decided, when and why; a member of staff resolving an email address to an account is kept for ninety days. When the period is up the entry deletes itself.
The text of a message moderation removed is copied into that record so the decision can be reviewed. If you erase your account that text is taken out too, and what remains is the decision alone — who, when, why. That is a record of what staff did rather than of what you wrote; otherwise deleting an account would be how you delete the evidence of having been moderated.
Under the GDPR you may ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing, or complain to your national data protection authority. Write to the support address; we answer within one month.
SOSI is not for people under 18. The product is built around meeting strangers in person, and that is not a service we offer to minors.
Traffic is encrypted in transit. Server-side rules decide what each account can read: no other person's phone can read your coordinates, your email or your notification settings, and nothing that carries trust — participant counts, premium status, moderation state — can be written by a phone at all.
A limited number of authorised staff can reach this data for moderation: to look into a report, to decide an appeal, or to answer a request you send us. Each such access requires a stated reason and is written to a record we keep. Staff are not shown this data by default; it stays hidden until somebody deliberately opens it.
If this policy changes materially we will say so in the app before the change takes effect.