Privacy Policy

1. What this is about

KOSMO shows you people nearby who want to do the same things as you. You mark activities with a heart; people who like the same thing can chat. To do that we process the data described below. We show no ads, use no tracking and do not sell data.

2. What we process and why

2.1 Account

Email address, password (stored only as a hash), first name, date of birth, account type; for business accounts also company name, address and website. We calculate your age from your date of birth; others only see your age, never the date. Purpose: providing your account. Legal basis: Art. 6(1)(b) GDPR (contract).

2.2 Profile and mood board

Profile photos (up to 6) and your mood board (pictures and texts). Other signed-in users can see them. Your mood board is only visible once you switch it on. We remove location data (EXIF) from photos before they are uploaded. Legal basis: Art. 6(1)(b) GDPR.

2.3 Location

If you allow it on your phone, we read your location and store it as a point in our database, together with city and country. We use it to show you people and activities within about 10 km, and you to them. Other users see neither your exact location nor a distance. To turn coordinates into a city, your phone uses Apple's (iPhone) or Google's (Android) location service. You can withdraw location access at any time in your phone's settings; without a location KOSMO cannot show you anyone nearby. Legal basis: Art. 6(1)(b) GDPR; access to your device is based on your consent (Sec. 25(1) TDDDG).

2.4 Likes, chats and interactions

Which activities you like on which day (visible to others), your chat messages, photos shared in chats, reactions, read receipts and the "typing…" indicator. Only the people in a chat can see its messages. They are encrypted in transit and at rest, but not end-to-end encrypted. We also store when you last used the app. Legal basis: Art. 6(1)(b) GDPR.

2.5 Deleting, blocking and reporting

We store whom you deleted (blocked) and which categories you hid, so they stay hidden for you. If you report someone, we store the report (who, whom, reason, the chat if any). Our team reviews reported content and can suspend accounts. Legal basis: Art. 6(1)(b) and (f) GDPR (legitimate interest in a safe community).

2.6 Contact form

Messages you send through "Contact us" are stored with your name, email address, app version and device type, and forwarded to our team by email so we can reply. Legal basis: Art. 6(1)(b) and (f) GDPR. We delete them after 12 months at the latest.

2.7 Emails

We send you emails to confirm your address and to reset your password. Confirmation and password links open a page on our website. Legal basis: Art. 6(1)(b) GDPR.

2.8 Push notifications

If you allow notifications, we store a device token to tell you about new messages. Legal basis: your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG), which you can withdraw in your phone's settings.

2.9 Crash reports

If the app crashes, we receive a technical report (stack trace, device model, operating system, app version, a random installation ID). We use it only to fix bugs. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working app).

2.10 Font

On first start the app loads its font from Google's servers (Google Fonts), which transmits your IP address to Google. Legal basis: Art. 6(1)(f) GDPR.

3. Recipients and service providers

• Supabase Inc. – Database, sign-in, file storage – Servers in Stockholm, Sweden (EU); Supabase is a US company, so access from the USA is possible
• Sendinblue SAS (Brevo) – Sending emails – France (EU)
• Google Ireland Ltd. (Firebase) – Push notifications, crash reports, font – EU; transfer to the USA possible
• Apple Inc. – Push delivery to iPhones, location lookup – USA
• Vercel Inc. – Website incl. confirmation and password pages – USA, served from EU servers
• Cloudflare, Inc. – Bot protection for the website contact form (Turnstile) – USA

Where required, we have data processing agreements with these providers (Art. 28 GDPR). Transfers to the USA rely on the EU-US Data Privacy Framework or EU Standard Contractual Clauses. Other users see the content described as visible in section 2.

4. Retention

• We keep your data as long as your account exists.
• If you delete your account in the app (Settings → Delete account), your account, profile, photos, mood board, likes, your chats and messages, contact requests and device tokens are deleted immediately. Your email address can then be used again.
• Reports you made about others are kept without any link to you until they are handled. Reports about you are deleted with your account.
• Database backups are overwritten after 30 days at the latest.
• Crash reports are deleted after 90 days; email delivery logs follow Brevo's retention periods.
• Accounts from the previous version of the app (Google Firebase) that were used in the last 12 months have been moved to the new app. The remaining old accounts are being deleted.

5. Minimum age

KOSMO is for people aged 18 and over. We delete accounts when we learn they were created by someone younger.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time for the future. Just send us an email.

You can complain to a data protection authority, for example ours: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

7. Security

All connections are encrypted (TLS). Passwords are stored only as hashes. Access rules in the database make sure everyone only sees what they are allowed to see.

8. No advertising, no profiling

We do not use your data for advertising, do not pass it on for advertising, and make no automated decisions within the meaning of Art. 22 GDPR.

9. Changes

When the app changes, we update this policy. The current version is on our website.

1. Hosting and server logs

Our website is run by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and served from servers in the EU. For every page request Vercel processes technically necessary data: IP address, date and time, requested page, browser and operating system. This is needed to deliver the website securely and reliably. Legal basis: Art. 6(1)(f) GDPR. We have a data processing agreement with Vercel; transfers to the USA rely on the EU-US Data Privacy Framework or EU Standard Contractual Clauses.

2. No cookies, no tracking

The public website sets no cookies and uses no tracking or advertising services, which is why we do not ask for cookie consent. Only the admin area for our team uses technically necessary cookies for signing in. One exception: the contact page runs the Cloudflare Turnstile bot check (see below).

3. Audience measurement with Vercel Web Analytics

To understand how often which pages are visited, we use Vercel Web Analytics. It works without cookies and without recognising visitors across days: visitors are told apart only by a hash of request data that is discarded after 24 hours. We only see aggregated numbers (e.g. page views, country, device type), never individual people. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a website that meets visitors' needs).

4. Fonts

The website's font is served from our own server. There is no connection to Google Fonts.

5. Email confirmation and password reset

The links in our emails to confirm your address and to reset your password open pages on this website. These pages process the one-time code from the link in your browser and send it – for a password reset together with your new password – encrypted directly to our sign-in service (Supabase, servers in Stockholm, Sweden). Nothing of this is stored on the website. Legal basis: Art. 6(1)(b) GDPR.

6. Contact form, email and phone

Through the contact form on this website, visitors send us their name, email address and message. We store them in our database (Supabase, servers in Stockholm) and forward them by email via Brevo (Sendinblue SAS, France) to our team so we can reply. To prevent abuse we also store an irreversible, salted hash of your IP address – never the address itself – and use it to limit the number of messages per hour. We delete messages once the request is settled, after 12 months at the latest.

To protect the form against spam bots we use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Turnstile is loaded only on the contact page and checks technical features of your browser and your IP address to tell whether a person is using the form. It sets no cookies for advertising or tracking; it uses technically necessary information in your browser only to check the request you yourself are making (Sec. 25(2) no. 2 TDDDG). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse); transfers to the USA rely on the EU-US Data Privacy Framework.

If you write to us directly or call us, we likewise process your details only to answer your request.

Legal basis: Art. 6(1)(b) or (f) GDPR.

7. Links to other services

The website links to the App Store (Apple), Google Play and Instagram. Data is only transferred to these providers once you click one of the links; their privacy policies then apply.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object (Art. 15–21 GDPR). Just send us an email. You can also complain to a data protection authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

9. Changes

We update this policy when the website changes.