Privacy Policy

Language notice: This Privacy Policy is provided in German and English. The German version is available at ffffffffriends.com/privacy-policy.

Welcome to friends! We're happy you're interested in using our Service.

Protecting your data is important to us. This policy describes how we collect and process your personal data. Together with our Terms of Service, this policy forms the legal framework for the use of our Service.

As a German startup, we understand that data protection is an important way to set ourselves apart from our competitors. That is why we have implemented technical and organizational measures (TOMs) for the processing, in order to ensure comprehensive protection of the personal data processed via our platform. For the sake of transparency, we would nevertheless like to point out that data transmissions over the internet are, as a rule, subject to security risks that cannot be completely ruled out.

Below, we explain what data we collect and process and what rights you have in this regard.

The technical terms used in this Privacy Policy have the meaning given to them in the GDPR (Art. 4 GDPR).

Table of contents

• In Section A you will find information on the scope of this policy.
• In Section B you will find information about the controller responsible for the processing.
• In Section C you will find the contact details of the data protection officer.
• In Section D you will find information about the processing of your personal data.
• In Section E you will find information on the use of profiling within our Service.
• In Section F you will find information on the deletion and retention periods of your personal data.
• In Section G you will find information on our processors and third-party providers.
• In Section H you will find information on the transfer of your data to third countries.
• In Section I you will find information on access to terminal equipment (Section 25 TDDDG).
• In Section J you will find information about your rights regarding the processing of your personal data.
• In Section K you will find supplemental information for residents of the United States.
• In Section L you will find information on the version and amendments of this Privacy Policy.

A. Scope

This Privacy Policy applies to the use of the offerings of Friends App UG (haftungsbeschränkt), Rathenower Str. 36, 10559 Berlin, Germany, support@itsaboutfriends.com, registered in commercial register B of the Local Court (Amtsgericht) of Charlottenburg under no. 272600 (hereinafter "we," "us," or "our"), and the services connected with them, by you as a user (hereinafter "you" or "User"). Our offerings include, in particular, the friends mobile app (iOS and Android), our website, our waitlist, and our profiles on social networks. All offerings are collectively referred to below as the "Service." Where individual offerings involve separate data processing, we point this out in the relevant sections.

To protect minors, our Service is directed at persons aged 16 and over. Age is requested during registration. If the minimum age is not met, registration is not possible. Should we become aware that a User does not meet the minimum age, we will take the necessary measures.

Our app may contain links to external services in certain places (e.g., Google Maps, social media platforms). When you follow these links, you leave our Service. The respective provider is solely responsible for the data processing that takes place there.

We maintain profiles on social networks. When you visit our profiles, the respective platform operator processes personal data in accordance with its own privacy provisions. We are not responsible for the data processing carried out by the platform operator itself.

If you reside in the United States, Section K additionally applies.

B. Name and Address of the Controller Responsible for the Processing

The controller within the meaning of the GDPR:

Friends App UG (haftungsbeschränkt)
Rathenower Str. 36
10559 Berlin
Germany
Email: privacy@itsaboutfriends.com

C. Contact Details of the Data Protection Officer

If you have any questions or suggestions regarding data protection, you can contact our data protection officer at any time:

Ms. Aurea Kindshofer
exkulpa gmbh
Waldfeuchter Straße 266
52525 Heinsberg
Germany
Email: a.kindshofer@exkulpa.de

D. Information About the Processing of Personal Data

I. Technical provision of our Service

We process personal data for the technical operation of our Service. Below you will find more detailed information:

Provision of content

When you use our app or visit our website, data is processed on our server in order to provide you with the content you access.

For this purpose, we process the following data:

• HTTP and device data: log data that is generated for technical reasons when the website is accessed via the Hypertext Transfer Protocol (Secure), HTTP(S), or when the app is used. This includes your IP address and the approximate location at city or region level derived from it, device ID, device type, operating system and version, app version, access times, time zone, push token, language setting, usage activity, and, when you visit our website, browser type, browser data, and referrer URL.

The legal basis for the processing is our legitimate interest (Art. 6(1)(f) GDPR). Our legitimate interest is providing the content you access.

Security of the IT infrastructure

We store data in log files on our server and analyze them in order to ensure the security of the IT infrastructure used to provide the Service, in particular to detect and eliminate disruptions (e.g., DDoS attacks) and to document them in a manner that preserves evidence.

For this purpose, we process the following data:

• HTTP and device data: log data that is generated for technical reasons when the website is accessed via the Hypertext Transfer Protocol (Secure), HTTP(S), or when the app is used. This includes your IP address and the approximate location at city or region level derived from it, device ID, device type, operating system and version, app version, access times, time zone, push token, language setting, usage activity, and, when you visit our website, browser type, browser data, and referrer URL.

We use technical and organizational measures in accordance with Art. 32 GDPR to ensure a level of protection appropriate to the risk. These include, in particular, encryption of data transmission (TLS), access restrictions for our systems, and safeguards against unauthorized access at the network level. Only authorized employees have access to personal data. Despite all measures, absolute security cannot be ensured. The legal basis for the processing is our legitimate interest (Art. 6(1)(f) GDPR). Our legitimate interest is ensuring the security of the IT infrastructure used to provide the Service, in particular detecting and eliminating disruptions (e.g., DDoS attacks) and documenting them in a manner that preserves evidence.

Error analysis

We store data in log files on our server and analyze them in order to quickly identify errors that have led to a disruption or a crash and thereby improve our Service.

For this purpose, we process the following data:

• IP addresses, device information (e.g., operating system, app version), error logs, error and crash reports, and, in exceptional cases, user input where it is contained in the error report.

The legal basis for the processing is our legitimate interest (Art. 6(1)(f) GDPR). Our legitimate interest is the stability and security of the app.

Categories of recipients

In the context of these processing operations relating to the technical provision of our Service, we transfer your data to the following categories of recipients: hosting providers, error detection and error handling services.

Retention period

You can find information on how long the various categories of personal data are stored in Section F.

II. Waitlist

You can sign up for the waitlist via our website or app in order to be notified as soon as the Service becomes available to you.

For this purpose, we process the following data:

• Name, phone number, email address, and waitlist status.

Providing this data is necessary in order to add you to the waitlist and to be able to inform you about the availability of the Service. The legal basis for the processing is the implementation of steps taken prior to entering into a contract (Art. 6(1)(b) GDPR).

Categories of recipients

In the context of these processing operations, we transfer your data to the following categories of recipients: hosting providers, internal administration services, and authentication services.

Retention period

You can find information on the retention period in Section F.

III. Use of our services

We process your data in order to provide you with our Service and to fulfill our contractual obligation to you. Below you will find more detailed information:

Creating and providing a user account

You can create a user account in our app. If you do so, we process certain data.

The processing of this data serves to provide and operate your user account and to handle matters arising in the course of your use of our Service.

For this purpose, we process the following data:

• Registration data: data that you provide to us during the registration process in order to create a user account. This includes the following mandatory information: name, mobile phone number, year of birth, username, and city. Registration is not possible without this information.
• Login data: data generated when you sign in to your user account. This includes your mobile phone number and an authentication token. It also includes a unique ID for the session while you are signed in to your user account (a "session ID") and the expiration date of the respective session.
• Supplementary user account data: data that you voluntarily add to your user account. This includes profile picture, bio, and interests.

The legal basis for the processing is the preparation and performance of our contractual obligations to you (Art. 6(1)(b) GDPR). The processing is necessary to provide and operate your user account.

User Content and interactions

We operate the friends app as a communications service in order to provide Users with features that allow them to make plans with friends, discover activities, and receive suitable suggestions. This includes, in particular, communication between Users, the organization and display of hangouts (including automated widgets), the personalization of your feed, your friends list, and city-based content, notifications about relevant events, service- and feature-related communications, and payment processing via Apple Pay and Google Pay. For processing by Apple, we refer you to https://www.apple.com/legal/privacy/data/en/app-store/ and, for Google, to https://policies.google.com/privacy.

For this purpose, we process the following data:

• User Content: all content that you create or share in the course of using our Service. This includes messages, texts, bookmarks, hangouts, events, media (where you grant access to your camera, photo library, or microphone), public posts, and feedback, including associated metadata.
• Interaction data: all data generated in the context of your social connections and interactions with other Users. This includes, in particular, friendships, friend requests/confirmations/rejections, blocks, friend circles you have created, follow relationships, profile views, interactions, deletions of content, reports, and associated content.
• Payment data: transaction metadata via Apple Pay / Google Pay.

We may use automated processes and AI-based systems to generate visual representations (e.g., images) based on your text input, which serve to accompany your content. For this purpose, your input is transferred to specialized AI service providers. Through contractual agreements, we ensure that these service providers do not use your data to train their AI models and do not store it for longer than is technically necessary to perform their services. You can find a current overview of these providers at https://ffffffffriends.com/service-providers. The legal basis for the processing is the preparation and performance of our contractual obligations to you (Art. 6(1)(b) GDPR). The processing is necessary to provide you with the core features of our Service, in particular connecting with friends, organizing hangouts, and communication between Users.

Visibility of your profile and your content

Within our Service, other Users can see certain data about you. Visibility is governed by the following levels:

• All Users: your username, your first name, your profile picture, your bio, and your city are visible to all Users and findable via search. Publicly shared posts such as Inspirations are also visible to all Users, including username, first name, profile picture, and friend count.
• Friends and friends of friends: further profile information and your social activity are visible only to your friends and to friends of friends who are attending the same hangout as you.
• Chat participants: chat content can be viewed exclusively by the participants of the respective chat.
• Internal (not visible): your year of birth is processed internally but not displayed.

Location data is displayed only as an approximate distance. You can block Users, report content, or delete your account. Blocked Users cannot see your profile and cannot contact you directly. If mutual friends create group chats, it may nevertheless happen that blocked Users are in the same group chat as you.

Location data

a) Foreground location

If you enable location sharing, we process precise GPS data while you are actively using the app. Location is a core feature of our app. It allows you to find friends near you and to discover relevant content and activities in your area, so that spontaneous hangouts can happen. We also derive your city from your location and keep it up to date, so that friends and content from your city are shown in your timeline and your Inspiration feed.

For this purpose, we process the following data:

• Precise GPS data while the app is actively in use.

The legal basis for the processing is the performance of our contractual obligations to you (Art. 6(1)(b) GDPR). The processing is necessary to show you the distance to your friends and to provide location-based features. You can withdraw location sharing at any time with effect for the future in your device settings. The app remains usable without location sharing, but location-based features will then not be available.

b) Background location

With your separate consent, we may process location data even when you are not actively using the app. This makes it possible to keep the distance between you and your friends up to date at all times, so that you can reliably find each other and make plans.

For this purpose, we process the following data:

• Precise GPS data in the background.

The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). You can withdraw background location sharing at any time with effect for the future in your device settings, without affecting the other features of the app.

Categories of recipients

In the context of these processing operations, we transfer your data to the following categories of recipients: hosting providers.

Retention period

Location data is overwritten with your current location each time and deleted at the latest when your account is deleted.

Abuse prevention

We process data to protect our Service and our Users from abuse. This includes abuse prevention, technical operation, internal statistical analysis, and the establishment, exercise, or defense of legal claims. We may use AI-based systems to automatically check uploaded content or texts for violations of our Terms of Service (e.g., nudity, violence, spam). In the case of clear violations, content may be removed automatically. Further measures, such as account suspensions, are reviewed by our team before they are implemented. No decision-making based solely on automated processing that produces legal effects or similarly significant effects within the meaning of Art. 22 GDPR takes place. For this purpose, we may in principle draw on all categories of data processed in the course of the use of our Service, in particular technical data and usage data, account data, usage activity, and content from reports. The legal basis for the processing is our legitimate interest (Art. 6(1)(f) GDPR). Our legitimate interest is ensuring platform security and detecting and preventing abuse.

Categories of recipients

In the context of these processing operations relating to the use of our Service, we transfer your data to the following categories of recipients: hosting providers, authentication services, payment service providers, content delivery networks, geodata services, AI service providers, notification services, app distribution platforms, and internal administration services.

Retention period

You can find information on how long the various categories of personal data are stored in Section F.

IV. Contact matching and invitation system

Our Service is accessible by invitation only: registration is possible only if an already activated User accepts your activation request or actively invites you.

a) Contact matching

When you use our Service or want to register, you can choose whether to add the contacts stored on your device to our Service. This optional feature allows us to check whether your contacts are already using our Service and makes it easier to be activated by them and to connect with them. If this is the case, we can show you these contacts as friend suggestions and keep these suggestions up to date. We also update your friend suggestions as soon as one of your contacts who previously did not use our Service joins at a later time. To do this, the phone numbers of your contacts are regularly uploaded to our servers to ensure that the information is always up to date. The transmission is protected by transport encryption (TLS). Uploads take place at regular intervals and depend on various factors, including how often you use our Service. The stored contact details are associated with your user account.

For this purpose, we process the following data:

• Phone numbers from your address book (of both registered Users and contacts who are not using our Service at that time) as well as the activation status of the respective contacts. We store only phone numbers, not names or any other information from the address book stored on your device.

We use this data for the following purposes:

• Contact matching: to identify which of your contacts are already using our Service. If you have not yet been activated, contact matching lets you see which of your contacts can activate you.
• Friend suggestions: to suggest registered contacts to you as friends. Even if you do not share your address book, we may make friend suggestions to you based on contact details that other Users have shared with us.

The activation status is visible only to Users who also have the person concerned saved in their contacts. The activation must be actively claimed by you, and the full registration process must be completed, before the app can be used. Until then, the inviting User can take back the activation and give it to another person. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). We rely on our legitimate interests and on the interests of our Users in efficiently connecting with their contacts. Our legitimate interest lies in enabling friends to connect, which is the core purpose of our Service. The processing is limited to what is necessary for this purpose. You can withdraw contact sharing at any time with effect for the future in your device settings. No further contact details will then be transferred.

Information for non-registered individuals

If you are saved in the address book on the device of a User who chooses to add their contacts to our Service, we may process your phone number even if you do not use the Service yourself. Your number is encrypted in transit using transport encryption (TLS) and stored on our servers.

We help Users who have your phone number saved in their address book connect with you if you choose to join our Service. This means that you will automatically be shown to them as a friend suggestion as soon as you join our Service. Users who have your phone number saved in their contacts may be notified when you join. The processing also serves to check whether you have been activated for our Service and to display this status to Users who have you in their contacts.

For this purpose, we process the following data:

• Your mobile phone number, encrypted in transit (TLS), and your activation status. We do not store names or any other information from the address book stored on the User's device.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest). We rely on our legitimate interests and on the interests of our Users in efficiently connecting with their contacts. Our legitimate interest lies in enabling friends to connect, which is the core purpose of our Service. The processing is limited to what is necessary for this purpose.

Categories of recipients

Your phone number is processed on the servers of our hosting provider. The activation status is visible only to Users who also have your phone number saved in their contacts.

Retention period

Your data is stored on our servers for as long as Users have granted contact sharing and the corresponding phone numbers are saved in their address book. Your data is deleted at the latest when the account of the User who uploaded your number is deleted. If several Users have uploaded your number, deletion takes place when the last of these Users' accounts is deleted. You can request the deletion of your data at any time, without an account, at support@itsaboutfriends.com.

Your rights

The data subject rights described in Section J also apply to non-registered individuals. You can request the deletion of your data or object to the processing at any time, without an account, at support@itsaboutfriends.com.

b) Invitations via the share function

Registered Users can invite non-registered individuals to use the Service via the app's share function, for example by SMS, messenger, or comparable messaging services. The message is sent directly from the inviting User's device. In the process, the invited person's phone number is stored with us and recorded as activated, so that they can register with their phone number.

For this purpose, we process the following data:

• The invited person's mobile phone number in encrypted form and their activation status.

The information provided under a) regarding legal basis, recipients, retention period, and data subject rights applies to the processing of this data.

V. Product analytics

When you use our app or visit our website, we use an analytics tool to collect, in pseudonymized form, information about how our Service is used. This allows us to detect errors, understand which features are used, and improve our Service. The aim of the analysis is to examine which areas of our Service users visit, and how often and for how long they view which content and categories, in order to further develop our Service.

a) In our app

For this purpose, we process the following data:

• Analytics device data: technical data collected when the analytics tool is used. This includes your IP address and the approximate location derived from it (city, region, country), device ID, device type, screen resolution, operating system and version, app version, access times, time zone, push token, language setting, network information, and your device's accessibility settings.
• Analytics end-device data: data assigned to your device by the analytics tool. This includes a unique ID for recognizing returning users. In addition, we transfer the identifier of your user account as a pseudonymous user ID.
• Analytics data: data generated by the analytics tool and stored in usage profiles. This includes information about the use of our Service, in particular usage behavior, interactions, screen views, and session duration, as well as detection of whether a screenshot was taken. The content of the screenshot is not captured.
• Age group: your age grouped into age ranges (e.g., 20-25, 26-30), derived from the age you provided at registration. We transfer only the age range to the provider of the analytics tool, not your exact age or date of birth.
• Accepted versions: which version of this Privacy Policy and of our Terms of Service you accepted.

The legal basis for the processing is our legitimate interest (Art. 6(1)(f) GDPR). Our legitimate interest is ensuring the stability, security, and user-friendliness of our Service and its further development in line with user needs. You can object to this processing at any time with effect for the future by emailing support@itsaboutfriends.com.

b) On our website

On our website, the analytics tool is activated only after you have given your consent via our cookie banner (see Section D.VIII).

For this purpose, we process the following data:

• Analytics device data: browser type and version, operating system, device type, screen resolution, your IP address, and the approximate location derived from it (city, region, country).
• Analytics end-device data: a unique ID stored in your browser for recognizing returning visitors.
• Analytics data: pages and areas visited, interactions, access times, the referring website (referrer), and campaign parameters in the URL accessed (e.g., UTM parameters and click identifiers from advertising platforms).

The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future at support@itsaboutfriends.com.

Categories of recipients

In the context of these processing operations, we transfer your data to the following categories of recipients: analytics services.

Retention period

You can find information on how long the various categories of personal data are stored in Section F.

VI. Advertising and marketing

As part of our Service, we may inform you about news and display third-party advertisements in the app. We use personalized advertising and marketing features only with your explicit consent. This includes notices about new features or promotions by email, push notification, SMS, or messenger, as well as personalized advertising in the app.

For this purpose, we process the following data:

• Advertising identifiers: unique identifiers of your device provided by your operating system for advertising purposes (e.g., IDFA on iOS or AAID on Android). You can restrict or prevent access to these identifiers at any time in your device settings.
• Marketing preferences: your settings as to whether and which marketing communications you wish to receive from us.
• Interactions with advertisements: whether and how you interact with displayed advertisements (e.g., whether you tapped an ad).
• Campaign and installation attribution: information about the channel or campaign through which you found our Service, for example whether you installed the app via an advertisement.

You can withdraw any of these consents at any time, with effect for the future, by email to support@itsaboutfriends.com or via the unsubscribe link in our emails. The legal basis for the processing is your consent (Art. 6(1)(a) GDPR).

Categories of recipients

In the context of these processing operations, we transfer your data to the following categories of recipients: advertising networks for delivering and optimizing advertisements, and measurement service providers for campaign measurement and attribution. These partners process the data as independent controllers, including for their own purposes. The transfer takes place exclusively on the basis of your consent. You can find an overview of our advertising partners at https://ffffffffriends.com/service-providers. We reserve the right to update the list maintained at https://ffffffffriends.com/service-providers accordingly, provided that this does not involve any material deviations from the purposes and data processing operations described in this Privacy Policy.

Retention period

You can find information on how long the various categories of personal data are stored in Section F.

VII. Communication

We process your data when we communicate with you. Which data we process, and for which purposes, depends on how and why we communicate with you.

Contact

You can contact us at any time with questions by email at support@itsaboutfriends.com. In that case, we process certain data. We store your inquiry in order to process it and in order to keep our support traceable and improve it. Personal details are used only to process the inquiry. Where applicable, we also store and use the information for evidentiary purposes in connection with the potential establishment, exercise, or defense of legal claims, or to comply with statutory retention obligations, in particular under commercial and tax law.

For this purpose, we process the following data:

• Inquiry data: data that you provide to us as part of your inquiry. This includes, in particular, your name, your email address, your phone number, and the content of your inquiry.

The legal basis for the processing of this data is our legitimate interest in answering inquiries and improving our support offering (Art. 6(1)(f) GDPR). If your contact is aimed at concluding a contract, the processing constitutes a step taken prior to entering into a contract (Art. 6(1)(b) GDPR).

Surveys and product tests

We may occasionally invite you to take part in surveys or product tests in order to further develop our Service. The legal basis for the processing is our legitimate interest (Art. 6(1)(f) GDPR). Our legitimate interest is the further development of our Service.

Categories of recipients

In the context of these processing operations relating to communication, we transfer your data to the following categories of recipients: hosting and infrastructure providers and email service providers.

Retention period

You can find information on how long the various categories of personal data are stored in Section F.

VIII. Use of cookies and comparable technologies

Our website uses cookies and similar technologies (e.g., local storage) to store or retrieve information on your device. Cookies do not identify you by name; they merely recognize your device.

We provide you with a feature for managing your cookie settings for our website via a consent management provider. For this purpose, we process the data you provide to manage your cookie consents, as well as data assigned to your device. This includes your consent and, where applicable, your individual selection for the use of cookies on your device.

We set necessary cookies without consent, as they are required for the operation of the website (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG; see Section I). Optional cookies, and the analytics tools connected with them, are activated only after you give your consent.

You can withdraw or change your settings at any time with effect for the future via our cookie banner. You can find information about the use of cookies in our cookie banner. The legal basis for the processing of the consent data is our legitimate interest (Art. 6(1)(f) GDPR). Our legitimate interest is managing the cookie consents you have given for our website.

Categories of recipients

In the context of these processing operations, we transfer your data to the following categories of recipients: consent management providers, hosting providers.

Retention period

The consent data is stored for the duration of your consent. You can find information on how long the other categories of personal data are stored in Section F.

E. Profiling

We use automated processes to show you personalized content and advertising. This may constitute profiling within the meaning of Art. 4(4) GDPR. Below, we describe the logic involved, the data used, and the significance and consequences.

I. Personalization of the Service

For personalization, we analyze which content and activities you have interacted with in the past, how strong your social connections to other Users are, and which activities are taking place in your geographic vicinity. Content matching these patterns is weighted more heavily and shown with priority, for example in your feed, in suggestions for creating hangouts, and in activity recommendations. The weighting is predominantly automated and may be supplemented by editorial intervention. The factors that may be taken into account include, in particular, your location (derived from your IP address, from your profile information, or from GPS data while you are actively using the app), your interests, your bio, your age group, your interaction data, your User Content, and your usage behavior with regard to displayed content. This profiling has no legal effect on you and does not similarly significantly affect you. It influences only the order and selection of the content shown to you. No decision-making based solely on automated processing that produces legal effects or similarly significant effects within the meaning of Art. 22 GDPR takes place. The legal basis for the processing is the performance of our contractual obligations to you (Art. 6(1)(b) GDPR). Personalization is an essential part of our Service, as it allows you to discover relevant activities and hangouts near you.

II. Personalized advertising

If you consent to personalized advertising, we may display advertisements in the app that are tailored to your interests. This may constitute profiling within the meaning of Art. 4(4) GDPR. To personalize advertising, we analyze your usage behavior and your interactions with previous advertisements and assign you to an audience based on characteristics such as your interests, your bio, your age group, your region, and your device type. On this basis, we select advertisements that match your audience. The selection is fully automated; no manual editing takes place. The factors that may be taken into account include, in particular, your advertising identifiers, your location (derived from your IP address, from your profile information, or from GPS data while you are actively using the app), your bio, your interests, your age group, your device type, your usage behavior, and your interactions with advertisements. This profiling has no legal effect on you and does not similarly significantly affect you. It influences only which advertisements are shown to you, so that we can show you content from advertising partners that is as relevant as possible. No decision-making based solely on automated processing within the meaning of Art. 22 GDPR takes place. For this purpose, we may create audience segments and transfer them to advertising partners in pseudonymized form. Without your consent, there is no personalized advertising and no disclosure of advertising identifiers to third parties. The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time, with effect for the future, by email to support@itsaboutfriends.com or via the unsubscribe link in our emails.

F. Deletion and Retention Periods

We store personal data for as long as (i) it is necessary for the provision of our Service, (ii) it is necessary with regard to the contractual relationship, or (iii) statutory retention obligations exist. We store and use the data you provide to us for the performance of the contract. After your user account is deleted, the data is restricted from further use (blocked) with regard to retention periods under tax and commercial law, and deleted once those periods have expired, unless you have explicitly consented to further use of your data or a legally permitted further use of data on our part exists, of which we will inform you separately. In detail, the following retention periods apply:

• Registration and account data, profile data, interaction data, and technical data are stored until your account is deleted.
• User Content is stored until your account is deleted. You can delete individual content, such as chat messages, yourself at any time.
• Location data is overwritten with your current location each time and is not stored permanently as a history.
• We retain payment records for 10 years in accordance with Section 257 of the German Commercial Code (Handelsgesetzbuch, HGB). To the extent that we are legally obligated to do so, we may transfer personal data to authorities, courts, or other authorized bodies (Art. 6(1)(c) GDPR).
• Advertising and marketing data are stored until you withdraw your consent or until your account is deleted, whichever occurs first.
• Analytics data from the app are stored until you object or until your account is deleted, whichever occurs first. Analytics data from the website are stored until you withdraw your consent.
• We store requests to exercise your data subject rights, and the response provided, for a period of 3 years, in accordance with our accountability obligation (Art. 5(2) GDPR), in order to be able to document and demonstrate proper handling. Only authorized employees have access to this data. After the period expires, the data is deleted.
• Waitlist data is deleted as soon as you withdraw your sign-up, or at the latest 3 months after the Service becomes available to you.
• Contact details of non-registered individuals are deleted at the latest when the account of the last User who uploaded the number is deleted. Non-registered individuals can request the deletion of their data at any time at support@itsaboutfriends.com. Likewise, registered Users can request the deletion of address book data they have already transmitted at support@itsaboutfriends.com.

If you request the deletion of your account, we will delete your account and the associated personal data within 30 days, except for data that we are legally required or permitted to retain as described in this Section F. Accounts that have not been used for a continuous period of at least one year may be deleted after prior notification. In the event of legal disputes or well-founded claims, we may retain relevant data until the statutory limitation periods expire (Art. 6(1)(f) GDPR). We retain data on reported incidents for as long as is necessary to investigate them and, where applicable, to pursue legal action.

G. Data Processing on Our Behalf

To provide our Service, we use service providers that process data on our behalf (processors). We have concluded a data processing agreement in accordance with Art. 28 GDPR with each processor. You can find a complete overview of our service providers at https://ffffffffriends.com/service-providers. We reserve the right to work with other service providers and partners in the future, to replace existing ones, or to update the lists maintained at https://ffffffffriends.com/service-providers accordingly, provided that this does not involve any material deviations from the purposes and data processing operations described in this Privacy Policy.

H. International Data Transfers

We take care that your data is processed in the European Union or the European Economic Area. Should this not be possible in a particular case and a transfer of data to a third country be necessary, we will ensure, after prior review, that the transfer to the destination country takes place in accordance with the requirements of the Court of Justice of the European Union and the European Commission (Art. 44 et seq. GDPR). In these cases, the data transfer takes place on the basis of an adequacy decision of the European Commission or on the basis of the so-called standard contractual clauses for the transfer of personal data to third countries, in the version currently in force. These can be accessed here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj. Some of our processors are based in the USA. Any transfer of personal data takes place on the required legal basis (e.g., the standard contractual clauses pursuant to Art. 46(2)(c) GDPR). A transfer of data to a third country may also take place on the basis of your consent. We will inform you of this separately in each case.

I. Access to Terminal Equipment (Section 25 TDDDG)

When you use our app, information may be stored on or retrieved from your terminal equipment. This may involve further processing of personal data within the meaning of the GDPR. This concerns, in particular, access to location, contacts, camera, microphone, and device storage. If advertising features are enabled, this additionally applies to your device's advertising identifier (e.g., IDFA, AAID) and to data from integrated advertising SDKs. You grant the respective permission via your operating system's permission dialog. To the extent that this is technically strictly necessary in order to properly provide our Service, we rely on Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG). Where access goes beyond what is technically necessary, for example to design our app in line with user needs, it takes place exclusively on the basis of your consent pursuant to Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. On iOS devices, we additionally ask for permission via the Apple App Tracking Transparency framework (ATT) before we access your advertising identifier. If you decline, the app continues to function without restriction. You can find details on the individual processing operations and the respective legal bases in Section D.

J. Your Rights

The following rights apply to you regardless of whether or not you are a registered User.

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR): You have the right to request confirmation as to whether personal data concerning you is being processed and, where that is the case, to obtain access to that data.
• Right to rectification (Art. 16 GDPR): You have the right to request the rectification of inaccurate personal data or the completion of incomplete personal data.
• Right to erasure (Art. 17 GDPR): You have the right to request the erasure of your personal data, provided that the conditions of Art. 17 GDPR are met.
• Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your personal data, provided that the conditions of Art. 18 GDPR are met.
• Right to data portability (Art. 20 GDPR): You have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21 GDPR): You have the right to object at any time to the processing of your personal data, where the processing is based on Art. 6(1)(f) GDPR.
• Right to withdraw consent (Art. 7(3) GDPR): Where the processing is based on your consent, you can withdraw it at any time with effect for the future.
• Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Friedrichstr. 219, 10969 Berlin, Germany.

To exercise your rights, please contact our data protection officer (see Section C). In order to process your request to exercise your rights, we are obligated to carefully verify your identity. Please understand that, depending on the sensitivity of the data, we reserve the right to request additional information. This also serves, in particular, to protect your data against unauthorized access by third parties.

K. U.S. Privacy Notice

This Section K supplements our Privacy Policy and applies to users residing in the United States. The rights described in Section K.III and the procedures described in Section K.IV apply to the extent required by applicable U.S. law. Your rights described elsewhere in this Privacy Policy remain unaffected. In this Section K, U.S. privacy-law terms have the meanings assigned to them by the applicable U.S. law.

I. Personal Information We Collect

Section D describes the categories of personal information we collect. In the terms used by U.S. state privacy laws, it falls into the following categories:

• identifiers
• customer records information (Cal. Civ. Code § 1798.80(e))
• characteristics of protected classifications under California or federal law (age)
• commercial information
• internet or other electronic network activity information
• geolocation data
• audio, electronic, visual, or similar information
• inferences
• sensitive personal information, where applicable (precise geolocation, account login information in combination with authentication credentials allowing access to your account, and contents of private user-to-user communications where treated as sensitive under applicable law)

II. Disclosure of Personal Information

Depending on the relevant processing operation, we may disclose personal information to the following categories of recipients:

• providers supporting the operation of our Service, such as hosting and infrastructure providers, content delivery networks, authentication, notification and email services, error detection, analytics and geodata services, AI service providers, payment service providers, app distribution platforms, consent management providers and internal administration services;
• other Users, as described under “Visibility of your profile and your content” in Section D.III;
• professional advisers, such as legal, accounting, audit and compliance advisers, where necessary to obtain their professional advice or services;
• advertising and measurement partners, if we introduce advertising features, subject to your consent and applicable law (see Section D.VI);
• public authorities, courts, law enforcement or other third parties where required or permitted by law;
• another entity in connection with a merger, acquisition, reorganization, asset sale or similar transaction, where permitted by applicable law. Your personal information remains subject to this Privacy Policy.

Sections D and G provide further information about our processing operations and service providers.

III. Your U.S. Privacy Rights

Depending on the state in which you reside, you may have some or all of the following rights:

• Right to know or access: you may request information about the personal information we collect, use, disclose, share or otherwise process about you. Where required by applicable law, you may also request information identifying specific third-party recipients.
• Right to receive a copy: you may request a copy of certain personal information we maintain about you in a portable and, where technically feasible, readily usable format.
• Right to delete: you may request that we delete personal information that we have collected about you, subject to legal exceptions.
• Right to correct: you may request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale, sharing or targeted advertising: you may direct us not to sell your personal information, share it for cross-context behavioral advertising, or process it for targeted advertising, as those activities are defined by applicable law.
• Right to opt out of certain profiling: where applicable, you may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. We do not currently engage in this type of profiling.
• Right to appeal: where required by law, you may appeal our decision if we deny your privacy request.
• Right to non-discrimination: we will not discriminate against you for exercising your privacy rights.

IV. How to Exercise Your Rights

You can exercise certain choices directly in the app, including deletion of your account and withdrawal or modification of consent where available. You may also submit a request by contacting our data protection officer (see Section C).

If you make a request through an authorized agent, we may require proof that the agent is authorized to act on your behalf, and we may ask you to verify your identity directly with us, unless applicable law provides otherwise.

If your state gives you a right to appeal and you wish to appeal our decision on your request, you can contact our data protection officer (see Section C) and include "Privacy Appeal" in the subject line.

V. Content Removal for Users Under 18

If you are under 18 and a registered User, you can delete content you have posted at any time in the app. You may also request the removal of such content by contacting our data protection officer (see Section C) with "Removal Request" in the subject line and a description sufficient to locate the content. Please note that removal does not ensure complete or comprehensive removal, for example where the content has been shared or copied by other Users or where we are required to retain it by law.

VI. SMS Communications

If you opt in to SMS updates about friends, we use your mobile phone number to send you updates about the app, including its launch. Message frequency varies. Message and data rates may apply. You can opt out at any time by replying STOP or contacting support@itsaboutfriends.com. Reply HELP for help. Even if you opt out, we may still send you account-related text messages that you request, such as verification codes when you register or sign in.

We do not share mobile phone numbers or SMS opt-in data and consent information with third parties or affiliates for their own marketing or promotional purposes. We may share this information with service providers that deliver and support our SMS communications on our behalf, solely for that purpose.

VII. De-identified Data and AI Training

We may create de-identified or aggregated information from personal information, for example aggregated usage statistics, that can no longer reasonably be linked to you. Where we maintain such information, we will maintain and use it in de-identified form and will not attempt to re-identify it.

We do not collect, use or sell personal information for the purpose of training large language models. Where we use AI service providers (see Section D.III), they are contractually prohibited from using your personal information to train their models.

VIII. Online Tracking

We do not allow third parties to collect information about your activities over time and across different websites or apps for their own purposes when you use our Service, and we do not track you across third-party websites or apps ourselves. Our analytics provider processes usage data only on our behalf, as described in Section D.V.

L. Version and Amendments of This Privacy Policy

This Privacy Policy is dated September 2026. Due to technical developments and/or changed legal and/or regulatory requirements, our app and website are constantly being revised and further developed. Accordingly, we adapt this Privacy Policy regularly. The current version can be found in this Privacy Policy at any time. We will notify you of material changes via in-app notice or email.