WeFocusBuddy

Privacy Policy

Last updated: 14 November 2026 · version 94

This notice is published in thirteen languages. If the versions differ, the Italian version prevails, without prejudice to the mandatory rules protecting consumers.

Each section starts with the essentials. Where needed, the details are under «Details»: they are part of this notice like everything else.

1. Who processes your data

The data controller is Daniele Cattaneo. For any question or request: [email protected].

There is no Data Protection Officer: for a service like this one is not required (art. 37 GDPR).

2. What data we process

(a) Account. The email you sign in with: with a code we send you by email, or with a Google or Microsoft account (personal, work or university). If you use Google or Microsoft, they send us your email and some basic profile identifiers. We use the email to sign you in. The name on your Google or Microsoft profile, if there is one, appears in the daily summary of sign-ups that we receive by email; nobody else sees it. The sign-in system (Supabase) also saves, for each device you sign in with, the IP address and the browser, to keep the session open: they stay while the session is open and are deleted when you sign out or delete the account.

(b) What you write in the app. Study or work sessions and settings. If you wish, also the name you display and your profile photo. Since 28 October 2026 the Agenda can no longer be turned on: if you used it before, the goals, exams, topic, note and 0 to 10 score you wrote stay saved on your account and are deleted with it. Settings (sounds, theme, language, alerts) are saved on your account, so you find them on every device.

(c) Coworking. The times you book and how each session went, the name you show others, your favourite companions, the people you block and reports.

Details on coworking data
  • Bookings: the time slot and the session status (queued, matched, completed, cancelled).
  • Weekly schedule: if you use it, the sessions you plan for your week (day, time, length), the time zone they are read in, how long it lasts and whether it is paused. They let us book the sessions of the next 8 days for you, which are then bookings like any other. They are deleted with your account or when you delete them.
  • Who you met: for each completed session with another person, the name that person showed and the booked length, so the calendar can show you who you worked with.
  • Your display name: the name or nickname you show other participants, required for coworking. Other signed-in users who look at a time you booked in the calendar also see it, never together with your email.
  • Favourite companions: the people you add in a call with «Favourite companion» or, when matching with priorities is on, with «Meet … again», together with the name they showed in that session, so you can recognise them in the list. Only you see them. The other person finds out only if you propose a time to them. Whoever runs the service counts only the total. They stay until you remove them, until you block that person or until one of the two accounts is deleted. If someone adds you, you do not see it and we do not tell you, until they propose a time to you. If you turn on «My favourites first» in «You» (off by default), when you book we try to match you with your favourite companions first.
  • Companion changes: if your companion for one of your bookings changes up to 10 minutes before the start, we keep the name of the new companion (or the fact that there isn't one yet) and whether you have seen the notice. Until you have seen it, we also keep the identifier of the previous companion, so we don't notify you if the same person comes back.
  • Blocks: the people you block, with the name they showed in the session or in the proposal. We no longer pair you with each other, in either direction. If someone blocks you, you do not see it and we do not tell you.
  • Reports sent or received (section 5).
  • Early exits: when you leave, with confirmation, a session in progress with another real person: the time slot, the minutes completed and the identifier of the other person.
  • Joining and absences: the moment you join a booked session (with «Join», including the waiting room), to know whether you were there; whether a session counts as missed; which notices about a missed session you have already seen, so as not to show them again.
  • Removed bookings: a reduced copy of every booking you cancel or leave: the time, the length, the status, whether you already had a companion (yes or no, not who), when you booked, when you joined and when you removed it. Cancelling removes the booking from the calendar, but we need to know that it existed and how long you waited before leaving.

See also sections 3 and 5.

(d) Messages you send us. If you write to us through the form on the website or from «You» in the app: the text, the type (idea, technical problem, other), the interface language and, only if you leave it, your email. Without an email the submission is anonymous: we store neither your account nor your email. From the app, some technical data arrives together with the message: app version, open screen, language, screen size and the first 120 characters of the string your browser identifies itself with. We do not use them to recognise you. From the form on the website, too, we save the first 120 characters of the browser string.

(e) Technical data. Only what is strictly necessary to run the service: authentication tokens, timestamps and the hosting providers' security logs. Our video call server also keeps technical logs with the IP address of the devices that connect (section 4-bis).

(f) Visit statistics. We count page visits, sign-ins started and sign-ins completed, only as numbers; for completed sign-ins we also count whether the account is new. No cookies, no identifiers on your device, no link between separate visits or with your account.

Details on the statistics
  • For each page opened we record: the page path, the domain it was served from, the referring page, the browser language, the device type (phone or computer), whether you have installed the app, the time of the visit and, only if you arrive through one of our links with a code (for example wefocusbuddy.com/c1), that link's label. The label belongs to the link, not to you: it is identical for everyone who opens it, it is not saved on your device and it disappears from the address bar right away.
  • How we count without recognising you: each time a page opens, the browser generates a random number that is valid only for that opening. It does not let us recognise you in later visits, so it is not possible to reconstruct one person's path or to identify you.
  • Country, region and city: we record the country you come from as a two-letter code (IT, DE…). Cloudflare derives it from the IP address, and we save only the two letters. If Cloudflare also tells us the region (for example the state in the United States or the region in Italy) and the city, we save their names and the region code, never the postcode or the coordinates. The IP address, however, passes briefly from our site to our database, which derives from it only an encrypted code to block mass requests, as in point (g), deleted within 2 days: we do not store the address, we do not pass it to anyone and no third-party geolocation service is involved. If Cloudflare does not provide the code, we derive it from your device's time zone (in that case without region or city). A country, a region or a city on its own identifies nobody.
  • Sign-ins started: when you press Google, Microsoft or «Continue with email» we count which page of the site or which of our links with a code the sign-in started from, with which method, in which language, at what time, and whether the code was sent to you. On the home page we also count which sign-up or sign-in button is pressed and whether the end of the page is reached.
  • Sign-ins completed: when you finish signing in we count that it worked and whether the account is new (created less than 10 minutes ago). With the email code the number goes to the page you started from: the page stays in memory while you type the code, not on your device. With Google or Microsoft the return does not carry the page and only the method is counted. To avoid counting our own test accounts, at the moment of counting we check whether the account is one of them, and the result is neither saved nor linked to the count.
  • First sign-in and documents: in the window that appears the first time you sign in we count how many times it appears, how many times the Terms or the Privacy Policy is opened from it, and how many times the step is completed. These are only daily numbers, with no link to your account: we do not know who opened a document and who did not.
  • “Support WeFocusBuddy” page: we count how many times the page is opened, from “You” or from the “Support” button on the home page after you sign in. It is only a number per day and per language, with no link to your account: we do not know who opened it. We do not record who opens the page or whether they then donate.
  • These are numbers per day, not linked to you or to your account. The internal dashboard shows only these numbers.
  • Why: to understand which pages and which steps lead people to sign in, and where they stop (Art. 6(1)(f) GDPR; you can object, section 9-bis). See also section 10.

(g) Anti-abuse code for the form. To block repeated mass submissions, our server derives an encrypted code (a hash) from your IP address or, if you are signed in, from your account identifier, using a secret key that we keep and a value that changes every day, and uses it to count submissions over the last hour. The code is deleted within 2 days and is not linked to your message. We do not store your IP address; it only passes through the technical logs of the hosting provider and of the server functions (point e). Because the code derives from an IP address, we treat it as personal data, not anonymous data. The same kind of code also protects the visit count and invite links.

(h) Reminders on your device. If you turn on notifications and give the browser permission, we save the delivery address the browser creates for your device (the address of the notification service of your browser's maker and two keys to encrypt the message), the app language and the device time zone, which is used to write the right time. We use them only for the app's notifications: reminders of the sessions you have booked, 15 and 2 minutes before they start, the notice when the companion for a booking changes, and the requests or time proposals you receive.

(i) Invites, requests and proposals. If you create an invite we process the times and length you propose, the link code, which session was taken, by whom and when it was accepted.

Details on invites, requests and proposals
  • Anyone who opens the link, even without an account, sees only: the name you chose to show, the proposed times with their length, the time zone you proposed them in, the language you created the invite in, and whether each session is still open or already taken.
  • Previews in messaging apps: if you share the link, the messaging app usually creates a preview with the same name, times and time zone, under its own rules. That preview may remain in the conversation even after your account has been deleted.
  • Against abuse we count openings of the link minute by minute per network address (for an IPv6 address, per the network it belongs to), using a code of the address computed with a secret key, which changes every day and is deleted within 2 days, as in point (g). If you open the link while signed in, we count your account identifier instead, which is also deleted within 2 days.
  • Requests for another time: anyone who opens an invite and signs in can ask the person who created it for another time. We process the name they show, the time and length they ask for, the person they ask and whether the request was accepted, declined or withdrawn. Only those two people see it, in the app and, if the person receiving it has turned on notifications, in a notification. There are no written messages. Whoever creates an invite can choose not to accept requests.
  • Proposals to favourite companions: you can propose a time to one or more people you added to your favourite companions, up to 5 per time; the invite link always comes with the proposal, and whoever accepts first takes the spot. We process the time and length, the people you propose it to with the name you remember them by, the name you show, who accepted it and whether the proposal was withdrawn or left to expire; for the people who receive it, also whether they answered «No, thanks» or closed the notice that it had already been taken. The person who receives it sees your name, the time, the length and that others received it too, without knowing who, in the app and, if they have turned on notifications, in a notification; from the proposal they can tell that you added them to your favourite companions. Whoever proposes never sees who answered «No, thanks».
  • «No, thanks»: the proposal disappears from the screen of the person who receives it and we record it, but we don't show it to the person who sent it: for them the proposal expires at the same time it would have expired on its own.
  • Against pressure: only one proposal waiting per person; after two proposals in a row that aren't taken, no proposals to the same person for 30 days from when the second one was sent. The person who receives a proposal can block the person who sent it, and from then on gets no more proposals from them.
  • Invite, request and proposal data is deleted like invite-link data (section 8).
  • The image for stories with your invite's times is drawn on your device and is not sent to us.

(j) Studying at university. «I study at university» is a community like the others (point 2(o)): if you are part of it, or if you create your account from the page for university students, we process your membership and the choice “Them first” (on or off). It is used only to order the matching, when matching with priorities is on: if the choice is on, we try to match you first with people who belong to the same community. We do not show it to any other user, you can change it whenever you like and it is included in the data export. It is your own statement: we do not verify it. In the same way we process your choice «My favourites first» (on or off): it serves only the same purpose, we do not show it to any other user, you can change it whenever you like and it is included in the data export.

(k) Withdrawal. If you withdraw with the «Withdraw from contract here» button in «You», we use the name and email you enter only to send you the acknowledgement of receipt required by law, with the content of the statement and the date and time of submission (Art. 6(1)(c) GDPR; Article 11a of Directive 2011/83/EU, transposed in Italy by Article 54-bis of the Consumer Code). We do not save them in our database: the acknowledgement is sent through our email provider (section 6) and right afterwards the account is deleted as described in section 8.

(l) Video call quality. At the end of a session we save six technical data points: whether the other person appeared (yes or no); how many seconds after you joined they appeared; the type of error, chosen from a closed list (call failed, connection lost, camera, microphone), never the text of the error; whether the connection was direct between the two devices or went through our server; the device type, in three categories only (two for phones and tablets, depending on the system they run, or computer); how many times, and for how many seconds in total, the other person's picture froze (two numbers, never at what moment). We add seven numbers, all from your own device and all about the call only: the app version; how many times, and for how many seconds in total, the page was in the background (for example because you opened another app); how many times, and for how many seconds in total, the connection to the video server was interrupted; how many times, and for how many seconds in total, the microphone stopped without you turning it off. They are only numbers: we do not save what you did at those moments, nor anything about the other person. We do not save the IP address, the device model, the browser or the string it identifies itself with, nor any content of the call. They are tied to the session, and therefore to your account. Each time the page leaves the call room we also save a code, chosen from a closed list, with the reason (for example: you pressed «Leave», the app moved to another room, the page was closed), how many seconds it stayed in the room, whether the other person was there and the app version: they are used only to understand why two people sometimes do not see each other, and they are deleted with your account. Since 11 November 2026 we also save, again from your device and only as numbers or words from a closed list: the type of network your browser says it is using (Wi-Fi, mobile, cable or other) with the speed, delay and megabits per second the browser estimates (where it provides them); for how many seconds in total the connection was direct between the two devices and for how many it went through our server, how many times it switched from one to the other, and after how many seconds it first became direct. Here too we do not save your IP address, your provider, your location or the model of your device.

(m) The day you open the app. When you open the app with your account we save one row with your identifier and the date (Rome day): only one per day, even if you open the app several times. In the day row we do not save the time, the device, the page, the IP address or what you do. It is used to count how many different people use the service each day and how many come back. Only the people who run the service see it, as overall numbers. While the app is open in the foreground we also save, in a separate row, the time of the app's last sign of life: it is overwritten on the same row every minute, with no history, no device, page or IP address, and it is used to know how many people are in the app right now. Only the people who run the service see it, in the internal panel, where the email also appears for people who are in the app at that moment. In a separate table we also save, for each quarter-hour in which the app is open in the foreground, your identifier and that quarter-hour (one row per quarter-hour, with no device, page or IP address): it is used to count how many people were in the app in each past quarter-hour. Whoever looks at the calendar sees it as a number, without your name; if you have a visible photo (point 2-ter) it may appear next to the number (point 2-duodecies). It is deleted after 30 days and with the account.

(n) The time you use the app. In a separate table, for each day on which the app is open in the foreground with your account, we save one row with your identifier and the date (Rome day): how many seconds the app stayed open in the foreground (an estimate, calculated by the server by adding up the intervals between the app's signs of life, which arrive every minute), how many times you opened the app that day, the time of the first and of the last sign of life, and the type of device, only “phone” (touch screen) or “computer”. We do not save the page, what you do, the device model, the IP address or anything about the other person. It is used to understand how much and at what times people use the service and on what type of device, in order to improve it. Only the people who run the service see it, in the internal panel, person by person and as overall numbers. Counting starts on the day the app version that collects it is released. It is deleted with the account.

(o) Communities. If you join a community or suggest one, we process your account, the communities you belong to and, for each one, the choice “Them first” (on or off). It is used only to create and run communities and to order pairings, when pairing with priorities is active: if the choice is on, we try to pair you first with someone who belongs to the same community. No other user sees which communities you belong to or who is inside. A suggested community reaches us as a message, with your account email, and it is created only after our approval; the person who suggested it joins it, with the choice off. You can leave whenever you want; this data is included in the data export and is deleted when you leave or delete your account. A community that is switched off or removed no longer counts for pairing.

(p) Changing duration to meet. If, in the first minutes after a time slot starts, no one has chosen your duration, the app may show you the name chosen by one person alone, already in the room, who is waiting with the other duration (25 or 50 minutes), and offer you to adapt to theirs. In the same way, your name, the duration of your booking and the fact that you are in the room may be shown to that person, only if the offer is possible between the two of you and never if one of you has blocked the other. We store nothing new: we use the booking data (point 2(c)). If you accept, the duration of your booking changes; the choice is always yours and you can decline. Legal basis: performing the service you ask for, that is matching you (Art. 6.1.b GDPR).

(q) What you choose when the other person isn't there. During a session, when you choose what to do (continue with a virtual companion, look for another person, go back to the calendar, abandon, stay on the call) or when the search for another person starts on its own, we save your identifier, the time of the session, which of these choices it was and the moment it happened. We do not save text written by you, your device, your IP address or anything about the other person. It is used to understand what people do when the other person does not arrive or leaves, in order to improve matching and the choices the app offers. Only the people who run the service read it, directly in the database. Legal basis: legitimate interest (Art. 6.1.f GDPR); you can object at any time (section 9-bis). It is deleted after 90 days and with the account.

2-bis. If you don't give us the data

Without an email no account can be created, so we cannot provide you with the service. The display name is needed only for coworking: without it, the timer and the rest of the app stay available. All other data is entered by you whenever you want, and not entering it has no consequences.

2-ter. Your profile photo

It is optional. If you upload it in «You», the large photo stays private on your account. A square thumbnail of 128 pixels is seen by people looking at the calendar where you appear and by the person you are paired with. In the past quarter-hours of the calendar it may appear, without your name, together with those of other people who had a spot at that time (point 2-duodecies). If nobody was there in a quarter-hour, you may appear among the last three people present in the previous 24 hours (point 2-duodecies).

  • Purpose: to show a face to the person you are matched with.
  • Legal basis: your consent (art. 6(1)(a) GDPR), which you give by uploading it after reading the sentence next to the «Upload» button. You can withdraw it whenever you like with «Remove»: the thumbnail is deleted from the server at once, without affecting what has already happened. Together with the thumbnail we keep the date and time of upload and the version of the legal documents in force.
  • No face analysis: we do not compare, recognise or extract characteristics from the photo, and no software analyses it automatically. If it needs to be checked because it was reported, a person looks at it, also with the help of the assistant described in section 6.
  • If someone reports it, a person reviews it and may remove it or prevent others from being shown. We keep a record of every decision (what, when, why) to check compliance with the Terms and for legal obligations (art. 6(1)(f) and 6(1)(c) GDPR). We do not tell the reported person who reported them. If your photo is removed, you see this in «You».
  • How long it stays: the thumbnail until you remove it or delete your account; the record of decisions for as long as your account exists. Everything is deleted together with the account.
  • Who receives it: the people who see it in the calendar or paired with you, and Supabase as processor (section 6).

2-quater. Record of acceptance

When you sign up or sign in, or press «Got it» on the notice about updated documents, you accept the Terms and this notice, and with them you declare that you are at least 18. To be able to show this, we store four items: your account identifier, the version of the documents accepted, whether you accepted it from the sign-in screen or from the notice, and the date and time, calculated by our server. Nothing else, neither the IP address nor the device. Legal basis: our legitimate interest in documenting acceptance and the age declaration (Art. 6(1)(f) GDPR). They are kept as long as the account exists and are deleted with it.

2-quinquies. The leaderboard

Since 31 October 2026 the leaderboard no longer exists, and neither does the streak of days in a row: we no longer calculate ranks, categories, percentages or streaks, we no longer send the evening streak reminder, and we have deleted the counts already calculated and the dates of the reminders. What remains, for as long as the account exists and deleted with it, is any "Show only my initial" choice made before that date, which no longer has any effect, and the record of decisions on reported names, which we show to no one.

2-sexies. The connected calendar (optional)

If you want, you can connect your Google Calendar from «Tu» (You): the sessions you book appear in your calendar on their own and update if you move or cancel them. It is off until you turn it on.

  • How it works: press «Connect Google Calendar», choose your Google account and grant permission. We ask Google for a single permission: to create a dedicated calendar called «WeFocusBuddy» and to write events on that calendar. We do not see or touch any of your other calendars or other data in your Google account (we do not read your email, your name or your contacts).
  • What we send to Google: for each booked session, the start time, the length, a title («Coworking session, 25 min») and the app link. We do not send the other person's name, their photo or anything else about the pairing.
  • What we keep: the code Google gives us to write on the calendar (encrypted), the ID of the dedicated calendar, the app language at the time of connecting and, for each event, which booking it matches with its time and length, so we know what to update. We do not keep your Google address.
  • Purpose and legal basis: showing your sessions in your calendar, at your request. Your consent (art. 6.1.a GDPR), which you give by connecting the calendar and withdraw whenever you like.
  • Withdrawal: with «Disconnect» in «Tu» we revoke the permission at Google and delete the dedicated calendar with its events, the code and the connection data. You can also remove the permission in your Google account settings: the connection then stops working and we tell you in «Tu».
  • How long it stays: until you disconnect or delete your account; it is deleted with it. Future events are removed or moved on their own if you cancel or move the booking; past ones stay in the calendar until you disconnect.
  • Who receives it: Google, which handles your calendar as an independent controller under its own privacy rules, and Supabase as processor (point 6). Anyone with access to your calendar, for example if you share it, sees the events.
  • Timing: events update about every minute; there may be a short delay.
  • Use of data received from Google: the use and transfer of information received from Google APIs comply with the Google API Services User Data Policy, including the Limited Use requirements.

2-septies. The security trace when you delete your account

When you delete your account we erase your data as described in section 8. We do, however, keep a reduced trace for 24 months and, for a shorter time, your email address and the name you showed in coworking (30 days, or 24 months only if there is a security reason: see below). It protects the other people who use the service, for example to recognise someone who, after being reported several times, deletes their account and signs up again with the same email to start from scratch, and to let people who worked with you report behaviour even after you have deleted your account.

  • What we keep: the identifier your account had; the dates it was created and deleted; whether you deleted it or it was deleted in another way; how many sessions you did, how many reports you received and made, and how many blocks you received; for each report received, the category, the outcome, the date and the text written by the person who reported, including reports that arrive after the deletion from people who had worked with you (section 2-octies); whether you were suspended and until when; the fingerprint of your email; and, for the time stated below, your email address and the name you showed in coworking.
  • The email fingerprint: it is not the address. It is a code produced by a one-way calculation with a secret key only we have: it does not let anyone work back to the address, but if someone signs up again with the same email it gives the same code, and that is how we recognise it (even if they change the dots or add a «+» in a Gmail address).
  • What we do not keep: your photo, anything you wrote in the app, the people you worked with, the times of your sessions. Your email address, your name and the text of reports do not stay beyond the times stated below.
  • Purpose and legal basis: the security of the service and the prevention of abuse, in our interest and in that of the other people who use it (art. 6(1)(f) GDPR). The email address and the name let a person who runs the service understand who the reported person was and recognise someone who signs up again.
  • Balancing: the impact on you is limited: the trace is mostly numbers; the email address, the name and the text of reports normally stay only 30 days and are deleted automatically if in that time there are no reports, blocks or restrictions; only the people who run the service see it, it is not given to anyone, and it triggers no automatic measure. If the same email signs up again, nothing happens by itself: a person looks at the trace and, only if there are reports or restrictions, assesses the case as for any report (section 5).
  • Your right to object (art. 21 GDPR): you can ask us to delete it, at once and in full, by writing to [email protected]. If there are no reports or restrictions against you, we delete it with the email and the name; if there are, we keep only what is needed if the security reasons outweigh yours, and we explain why.
  • How long it stays: the trace, 24 months from the deletion of the account. The email address, the name and the text of reports, 30 days; they move to 24 months only if there are reports against you (even if they arrive within those 30 days or later), blocks received or a restriction on the account. Then they are deleted automatically.
  • Who receives it: nobody. It sits in our database on Supabase, as processor (section 6).

2-octies. The people you worked with in a session

For every session done with a real person, the server remembers who was really on the call: the name they showed, when they appeared and, if they left before the end, when. It lets you find again the people you met, even if they left halfway or later deleted their account.

  • What you do with this data: by tapping a past session in the calendar you see the people of that session and can add or remove the heart, invite them to a new session, block them or report them. Only the people who did that session can see it.
  • Reporting after the call: you can report up to 30 days after the session, even if the person left halfway or later deleted their account. A report is accepted only if it shows that you were really on a call together.
  • Purpose and legal basis: giving you the functions above (art. 6(1)(b) GDPR, performance of the contract) and the security of the service (art. 6(1)(f)).
  • How long it stays: as long as your account exists; it is deleted with the account. If the other person deletes theirs, the row about them stays 30 days (24 months if there are security reasons, section 2-septies), only so that you can report them.
  • Who receives it: nobody. It sits in our database on Supabase, as processor (section 6); if you report, the person who handles reports reads it.

2-nonies. The place you access from

When you create your account, and then every time you open the app, we work out from your IP address the place you are connecting from (country, region and city) and save it, with the date, next to your account. We do not save the IP address. It is only an approximation: with a VPN or a company network it may not match where you are.

  • How we work it out: Cloudflare, the provider that hosts the site (section 6), calculates it at the edge of its network; we receive only the two-letter country code and the names of the region and the city, never the postcode or the coordinates. We do not use any third-party geolocation service and we do not use the device's position (GPS).
  • Purpose and legal basis: to understand which countries and cities the people who sign up and use the app come from, and how the place changes over time, as statistics (Art. 6.1.f GDPR, legitimate interest; you can object, section 9-bis). We do not use it to decide anything about you and it does not change how the app works for you. Other users do not see it linked to you: on the home page we only show, in aggregate form, the list of countries where at least one person is present and how many there are (a globe), never who you are or how many people there are per country.
  • When we record it: at sign-up and then when you open the app, but a new row is added only if the place differs from the last one recorded or the last row is more than a day old: at most one a day, plus one if you change place within the same day. We do not follow your movements in real time. People who signed up earlier do not have the sign-up data.
  • How long it stays: the country of sign-up and the access places as long as your account exists; they are deleted with the account.
  • Who sees it: only the people who run the service, in the internal panel. It is kept in our database at Supabase, as processor (section 6).

2-decies. Donations (optional)

From “You” → “Support WeFocusBuddy” you can make a free donation by card or with your phone's wallet. It is optional, it does not unlock anything and it does not change how you use the app. If you wish, you can choose what to fund (for example the fee to publish the app on Google Play) and appear with your name among the supporters. This point covers one-off donations: the monthly support is described in point 2-undecies.

  • How it works: you choose an amount and the payment fields appear on the same page. Stripe handles the payment: you type your card details directly into its fields and we never see or store them.
  • What we record: for each donation, the amount, the currency (euro), the outcome, a payment identifier at Stripe, the date, the items you chose to fund and the account you opened it from (its identifier), even if you then do not complete the payment. The link with the account lets us know who made which donation: to tell apart the tests made by those who run the service, to answer you if you write to us about a payment, and to handle refunds and disputes. Only those who run WeFocusBuddy see it, in the internal panel, together with the account's email. We do not record your card. To stop people trying cards in bulk, for one day we remember that a payment was requested from your account (at most 6 per hour): this data is deleted every night and with your account.
  • If you choose to appear among the supporters: it is your choice, never pre-selected. We save the name you write (at most 40 characters) together with your account, only so that you can remove it. People signed up to the app who open the page can see it, in the list and next to the item you funded, only once the payment has succeeded (never for test payments). With the monthly support the name is saved with the subscription, appears after the first successful payment and stays in the list even if you cancel later, until you remove it or delete your account. You can remove it whenever you like with “Remove my name” on the same page: the donation stays, without a name. It is also deleted with your account. The legal basis is your consent (Art. 6.1.a GDPR), which you can withdraw at any time.
  • What Stripe sees: the card details and the technical device data needed to complete the payment and prevent fraud, under its own privacy policy. We do not send Stripe your name, your email, your account or the items chosen.
  • When Stripe loads: Stripe's library is downloaded from its server only when you press “Continue” on the donation page, not before. To prevent fraud it may store or read information on your device: we consider this necessary for the payment you asked for. If you do not press “Continue”, Stripe is not contacted.
  • Where: Stripe may process data outside the European Union, with the safeguards it describes in its own privacy policy.
  • Purpose and legal basis: receiving the donation you decide to make and keeping its accounts (Art. 6.1.b and 6.1.c GDPR, for accounting and tax obligations); for the name in the list, your consent (above). For the link with the account, our legitimate interest in knowing who made which donation and in handling questions, refunds and disputes (Art. 6.1.f GDPR).
  • How long: the donation row (amount, outcome, date, items) is kept as long as accounting and legal obligations require. The link with your account is removed if you delete the account (the row stays, without the account) and, for donations that were never paid, after 30 days. The name in the list stays until you remove it or delete your account. Stripe keeps its own data under its own rules.

2-undecies. Monthly support (optional)

From “You” → “Support WeFocusBuddy” you can choose, instead of a one-off donation, monthly support: a recurring donation of an amount you choose (from 3 to 500 euros) that renews every month until you cancel it. You can cancel at any time from the same page. It is optional, it gives no benefits or features and it does not change how you use the app. The items to fund apply only to one-off donations; you can also choose to appear among the supporters with the monthly support (point 2-decies).

  • How it works: you choose the monthly amount and the payment fields appear on the same page. Stripe handles the payment, by card or with your phone's wallet: you enter the card details directly in its fields and we neither see nor store them.
  • What we record: as with one-off donations, for monthly support we keep the link between your account and the subscription: the customer identifier and the subscription identifier at Stripe, the amount, the status (for example active or cancelled) and the date of the next renewal. We need it to show you your monthly support on the page and to let you cancel it. We do not record your card. If you choose to appear among the supporters, we also keep the name you write together with the subscription (see point 2-decies).
  • What Stripe sees: the card details and the technical device data needed to complete the payment and prevent fraud, under its own privacy policy. Stripe creates a “customer” for the subscription, but it receives neither your name nor your email from us.
  • When Stripe loads: as with one-off donations, Stripe's library is downloaded only when you press “Continue”; if you do not press it, Stripe is not contacted.
  • Where: Stripe may process data outside the European Union, with the safeguards it describes in its own privacy policy.
  • Purpose and legal basis: to start, renew and cancel the monthly support you asked for and to keep the accounts (art. 6(1)(b) and 6(1)(c) GDPR, for accounting and tax obligations).
  • How long: the link between your account and the subscription is kept while the subscription is active and disappears with the account: when you delete the account, we cancel the subscription and there will be no further charges. Charges already made remain in Stripe's records and in our accounts for the period required by law and by Stripe's rules.

2-duodecies. The calendar's past: who had a spot

In quarter-hours that have already passed, the calendar can show signed-in users how many people were around at that time or in the last 24 hours and, for some of them, the profile photo. We do not show names, durations or who was with whom. If this feature is not active, nothing appears.

  • What is shown: for each quarter-hour, a number («+N») and up to three thumbnails. The number counts the different people who had a booking or had the app open in that quarter-hour; with a service setting it counts instead those of the 24 hours ending at that time (each person counts once). The thumbnails are picked at random among the people present in that quarter-hour who have a visible photo (point 2-ter); with a service setting, if nobody was there in that quarter-hour, they are those of the last three people present before that time, within the previous 24 hours, the most recent first: people who really were there in those 24 hours, not people who were absent. The number under the date of each day counts the people present in the 24 hours ending at that day (for today, up to now) or, with a service setting, how many people signed up up to that day. For anyone without a visible photo, only the initial of the chosen name appears on a colour (never the full name). We never show at what time a person was there.
  • Who is counted: people who at that time had a booking (paired or not) or a booking later cancelled or abandoned (point 2(c), «Removed bookings»), or were inside a completed session, alone or in a pair: whoever completed a session counts in every quarter-hour they were inside (25 or 50 minutes). We create no new data: the number is calculated on the spot from this data. People who had the app open in the foreground in that quarter-hour (point 2(m)) also count, even without a booking: they count in the number and, if they have a visible photo, may also appear with the photo.
  • The day's total: under the date of each day that has already begun we show how many people, on that day, opened the app or had a spot, and up to three thumbnails picked among those who had a spot. To know who opened the app we use the «one row per person and per day» record in point 2(m): we never show at what time. Someone who only opened the app counts in the number and, if they have a visible photo, may also appear with the photo.
  • Who sees it: people who are signed in. They do not see your photo if you blocked them or they blocked you; you are still in the number. Without a photo, however, only the initial of your name appears; if you do not want to appear even that way, write to the same address.
  • How to remove yourself: with «Remove» in «You» your photo no longer appears, but you stay in the number. If you do not want to be counted even in the number, write to [email protected] (point 9-bis).
  • Purpose and legal basis: showing when the community is active, to help you choose a time (legitimate interest, art. 6.1.f GDPR); for the photo, your consent under point 2-ter applies. You may object at any time (point 9-bis).
  • How long: the number and the thumbnails are not stored anywhere: they are calculated each time. The data they are calculated from is kept as in points 2(c) and 8 and is deleted with the account.

2-terdecies. Who opened the app recently: the list next to friends

On the screen where you invite your friends, below them, a list of the people who had the app open in the last 24 hours may appear. You can propose a session to them as you would to a friend, and they can do the same with you. If this feature is not active, nothing appears.

  • What others see about you: the name you chose and, if you added and shared one, the thumbnail of your photo (point 2-ter). We do not show when you opened the app, nor your email, country, time zone, sessions or anything else. The list is made of the people who opened the app in the last 24 hours, most recent first (up to 100): you appear only for 24 hours after the last time you opened it.
  • How it is worked out: from the «last time with the app open» mark in point 2(m), which already exists: we keep no history and save nothing new about who saw or looked for you. These people never appear: those blocked in either direction, people who have not finished their profile (name, 18+, time zone) and people who have not opened the app for more than 24 hours.
  • Who sees it: people who are logged in.
  • How to remove yourself: by default you appear. If you don't want to appear, write to us (point 9-bis): we remove you from the list, and from then on you no longer see the others either. We only save this choice (one row with your identifier, deleted with the account).
  • If someone proposes a session: it arrives like a friend's proposal (point 2(c)), with a notification if you turned them on; you can say no without the sender seeing a refusal, and you can block them. We set limits: at most 20 people per invite, 15 different people per day for the person inviting, and 5 open proposals from non-friends for the person receiving them.
  • Purpose and legal basis: to let people who are looking for a study or work buddy meet (legitimate interest, art. 6.1.f GDPR; for the photo, your consent in point 2-ter applies). You can object at any time by writing to us (point 9-bis).

2-quaterdecies. Who is waiting in the waiting room: the notice for people with the app open

If you pressed «Enter» for a session and nobody is with you yet, people who have the app open can see that you are waiting and choose to join you with one tap. If this feature is not active, nothing appears.

  • What others see about you: the name you chose, the booked length (25 or 50 minutes) and, if you added and shared one, the thumbnail of your photo (point 2-ter). We do not show email, country, time zone, sessions or anything else. You appear only while you are alone in the waiting room with the app open: if you get a match, leave the room or close the app, you disappear.
  • How it is worked out: from your booking and from technical data that already exist (having pressed «Enter» and the signal that your app is open). We store nothing new about you or about the people who see you. People blocked in either direction never appear.
  • Who sees it: people who are logged in and have the app open (each one sees at most three at a time). We do not store who saw you.
  • If someone joins you: the session is created immediately, like a normal booking of the same time, and you can leave it like any other session. If two people choose at the same moment, the first one gets in and the other gets a notice, with no booking created.
  • How to remove yourself: by default you appear. If you don't want to appear, write to us (point 9-bis): we remove you from this notice and from then on you no longer see the others either (it is the same choice as in point 2-terdecies).
  • Purpose and legal basis: to bring together people looking for a study or work partner (legitimate interest, art. 6.1.f GDPR; for the photo, your consent in point 2-ter applies). You can object at any time by writing to us (point 9-bis).
  • If you are already paired with someone: the person you are matched with for that session, with the app open, can see even from outside the room that you have already entered and choose to enter too. We store nothing new.

3. Why we process it and on what basis

To provide the service (art. 6(1)(b) GDPR, performance of a contract):

  • authenticating you and syncing your data across your devices;
  • matching you and running the coworking sessions you request, including matching with priorities (favourite companions and communities), notices when your companion changes, invites and proposals to favourite companions;
  • showing you the people you worked with in a past session and letting you find, invite, block or report them again (section 2-octies);
  • understand which countries and cities the people who sign up and use the app come from, using the place worked out from the IP address (section 2-nonies);
  • recording when you join a booked session, applying the pause described below and remembering the notices you have already seen, so that the person you are paired with is not left waiting;
  • answering support requests;
  • writing to you, at the email you sign in with, about the service: an outage that stopped you from using it, a change to the Terms or to this notice, the security of your account and a summary of your activity (your sessions, your friends' pending requests and your upcoming sessions), on by default, at most once a day and only if there is something new to tell you. You turn it off whenever you like from You → Sounds and notifications or from the link at the bottom of the email. The summary contains no advertising or promotional invitations. Community invitations, that is, regular meetups for studying and working together, are part of how the community, and therefore the app, works: they are on by default for everyone who signs up, at most one email a day (in total, together with the summary), and you turn them off whenever you like from You → Sounds and notifications or from the link at the bottom of every email, without the app ceasing to work.

For our legitimate interest (art. 6(1)(f) GDPR; you can object, section 9-bis):

  • security of the service, prevention of abuse and handling of reports between users (our interest and that of other users in a safe environment), including the limit of one waiting proposal per person and the 30-day pause, which protect people who receive proposals from pressure;
  • the anti-abuse code for the form, against spam;
  • the aggregated visit statistics in section 2(f), with the lowest possible impact on your privacy;
  • automatic collection of the app's technical errors (what broke, on which screen, with which browser; never what you wrote), in order to fix faults;
  • reading and replying to messages with ideas and problems;
  • notifying you, at the email you sign in with, of news and initiatives of the service you are using, such as a new feature, a meetup for studying and working together with the other members, or a request for your opinion on the service: rarely, one email per initiative, only about WeFocusBuddy and never with third-party advertising or offers for other products; every email has a link at the bottom to stop receiving them, and you can also object by writing to [email protected] (section 9-bis);
  • the technical logs of the video call server (section 4-bis), for security and to understand faults;
  • the record of acceptance of the documents (section 2-quater) and the record of decisions on reported photos (section 2-ter);
  • the leaderboard and the record of decisions on reported names (section 2-quinquies, which describes the balancing and how to object);
  • the security trace of deleted accounts (section 2-septies, which describes the balancing and how to object);
  • internal per-account statistics, aggregated usage trends and video call quality, described in the details below.

With your consent (art. 6(1)(a) GDPR): reminders on your device; the profile photo (section 2-ter).

For legal obligations (art. 6(1)(c) GDPR).

What we do not do: we do not sell your data, we do not use it for advertising, and we carry out no profiling for advertising or marketing purposes and no automated decisions producing legal effects on you.

Only one automatic measure, and it is temporary. If you have not joined 10 minutes after the start of a booked session (with «Join»), or if 25 minutes after the end no completed session is recorded for that time, your later bookings are not matched until you reopen the app and choose whether to keep or cancel them, and in any case for no longer than 14 days. A notice in the app tells you. It does not depend on other users' reports: the app only looks at whether you joined and whether the session took place.

Details on the automatic measure and internal statistics
  • Why the pause is not a decision within the meaning of art. 22 GDPR: it does not produce legal effects or similarly significantly affect you. It does not touch your account or your data, does not lock you out of the app, does not stop you from working with the virtual companion, lasts until you answer the notice (no longer than 14 days) and has no consequence outside the service. Regardless of this, you have the right to obtain human intervention, to express your point of view and to contest it: just write to [email protected]. Closing an account or any lasting limitation of the account or of coworking is always decided by a person (section 5).
  • Earlier reports: whoever reviews a report also sees how many earlier reports concern the same person and with what outcome. It is context information: the decision is always taken by a person.
  • Internal per-account statistics: we look at how often you book, show up, send or receive conduct reports, leave early and how long you stay in sessions, to detect abuse and improve matching. They are calculated at the time of viewing from the data in section 2(c), including the log of removed bookings, with no separate archive, and only the people who run the service see them. Balancing: the impact on you is low, because they stay internal, appear in no public profile, are not seen by other users, are not used for advertising or commercial profiling, are not a score and on their own trigger no measure.
  • Aggregated usage trends, to understand whether the service works and to improve it: how many people sign up and use the service each week, how many do a first session within 7 days of signing up, how many come back after 1, 2 or 4 weeks, how many have been inactive for more than 14 days, how often sessions repeat, how many of the people who sign up each week book at least once, and at which hours and on which days sessions take place. These are overall counts calculated on the data in section 2(c), on the sign-up date and on the statistics in section 2(f). The view shows no lists, names or identifiers; we install no tracking on your device, use no cookies or additional identifiers and do not share this data with third parties. Balancing: the impact is low because these are overall numbers that do not concern any particular person.
  • Video call quality: the technical data in section 2(l) are used to understand whether the video service works and whether to change the infrastructure it runs on. Only the people who run the service read them, in a view with percentages and averages (successful calls and average connection time by device type, over the last 7 and 30 days): no lists, names or identifiers, no score per person, no measure taken against you. To understand a fault reported in a single call, the people who run the service may also read them for that one session, and for no other purpose. We do not use them for advertising or profiling, do not share them with third parties and install nothing on your device. Balancing: the impact is low because they are technical data about the connection, not the content of the call, reduced to a few categories, and they only say how many times and for how long, not what you did.
  • People active each day: the date in section 2(m) is used to understand how many different people use the app every day and whether the service is growing. Only the people who run the service see it, as a number per day (without internal accounts): no list, name or score, and no measure against you. We do not use it for advertising or profiling, we do not share it with third parties and we install nothing on your device. Balancing: the impact is low because it is a single date per day, with no time and no content; you can object as described in section 9-bis. The same applies to the time of the app's last sign of life (section 2(m)): it is used to count who is in the app right now, it has no history and only the people who run the service see it. The quarter-hours in which the app is open (point 2(m)) are used to count, in overall numbers, who was in the app in the past; the balance is the same and you may object as in point 9-bis. Time you use the app: the data in point 2(n) is used to understand how much and at what times the service is used and on what type of device, in order to improve it. Only the people who run the service see it; we do not use it for advertising or profiling, we do not share it with third parties and we install nothing on your device. Balancing: the impact is limited because it is only a few numbers per day, with no page or content; you can object as described in point 9-bis.

4. Video calls

We do not record audio or video. On our server recording is not a disabled feature: it does not exist. The session chat is not saved anywhere either. Recording the call is prohibited by the Terms.

Calls run on free video-conferencing software, on our server in Frankfurt (Germany, European Union). The machine is provided by Oracle (section 6); we run the software ourselves. No commercial video-conferencing platform is involved.

The other person sees your image and hears your voice while the call is running, and sees the name you chose to display and, under the name, how many sessions you have done in total (a single number). We never show them your email or your account name. We recommend not saying personal things on the call that you don't want known.

Sharing your screen. From a computer you can show the other person a tab, a window or your whole screen, only if you choose to: the browser asks you what to share and you can stop whenever you want. While you share, the other person sees everything that appears in that tab, window or screen, including notifications, messages and data about you or other people: check what you are showing before you share. The screen travels like audio and video (section 4-bis), including to someone outside the European Union; we do not record it or store it. Legal basis: performing the service you ask us for (Art. 6.1.b GDPR).

4-bis. How the call travels and your IP address

Audio and video always travel encrypted. When there are two of you, your devices first try to connect directly to each other: it is the shortest path, and without it the delay is enough for you to talk over each other.

Your IP address. To attempt the direct connection, the two devices exchange their network addresses, including the public IP address, as in any direct connection between two computers. This happens in every call between two people, even when the direct connection then fails. So the person you connect with can see your IP address if they use technical tools to look for it; the app does not show it to them. It is personal data; the legal basis is the performance of the service you asked us for (art. 6(1)(b) GDPR). There is no setting in the app to avoid this exchange. To discover the public address we use our own server in Frankfurt (STUN), not a third-party service.

  • Direct connection (the most frequent case): the call is encrypted from one device to the other and does not go through our server.
  • Through our server (when the direct connection fails, for example on some corporate or mobile networks): audio and video go through our Frankfurt server, encrypted between each device and the server. To forward them, the server decrypts them and encrypts them again, only in its memory and only while forwarding: it does not record them and does not store them.

The video server's technical logs. Like every server, our video call server automatically records in its technical logs the IP address of the devices that connect, with date and time. We use them only for the security of the service and to understand faults, for example when a call does not start (art. 6(1)(f) GDPR; you can object, section 9-bis). We do not use them for anything else, we pass them to no one except the authorities where the law requires it (section 6), and they are deleted automatically within 14 days.

If you do not want the other person to see your IP address, one option is to use a VPN set up to route all of your device's traffic: the other person then normally sees the VPN's address, not yours. We cannot guarantee it, because it depends on the VPN and the browser.

Outside the European Union. Our server is in the EU, but the call reaches the person you are talking to wherever they are, including outside the EU if that is where they live. That is what a video call is, and writing that no data leaves Europe would not be honest. The person you talk to, wherever they are, receives your image and your voice for the duration of the call and, as explained above, your IP address.

5. Reports and moderation

If you report the person you were matched with, the report is read by a person. No report, on its own, suspends an account, and the automatic measure in section 3 does not depend on reports: the app applies it on its own when you do not join a session you had booked, and you lift it yourself. After the review we may limit, suspend or close access to coworking or to the account.

  • What we process: the category you choose, any description you write, the session identifier, time and length, the names shown by the two people, the accounts involved and the number of earlier reports about the same person, with their outcome. The time, length, names shown and earlier reports are added by our server, not by you.
  • Limits: at most 5 reports a day, only one per person and per session.
  • If you are the one reporting: we do not show the reported person your email or your account name.
  • If you are the person reported: we process this data about you without having received it from you; here and in sections 3, 8 and 9 you find the information required by art. 14 GDPR. If you make an access request, we tell you whether there are reports concerning you, of what type and with what outcome. We do not tell you who reported, other people's data or the time of the session, to the extent that the law allows or requires us to protect them (art. 15(4) GDPR; art. 2-undecies of Italian Legislative Decree no. 196/2003); in that case we explain the reason.
  • If a measure is taken against you you can challenge it by writing to [email protected], and you will receive a reasoned reply.

5-bis. Special categories of data

Some fields are free text: messages with ideas and problems, the description of a report, the display name and, in the site's calculators, the entries you type yourself (for example the description of a work item or the subject of an appointment). They are not meant to collect data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, or data concerning health, sex life or sexual orientation (art. 9 GDPR): please do not write it there. If you do so anyway, that data is processed only for the security and support purposes in section 3, with the same safeguards as other data, and you can ask us to delete it at any time at [email protected]. In reports we ask you to describe the facts, not to attribute criminal offences.

6. Who receives the data

We do not sell your data and we do not give it to anyone for marketing.

Providers that process it on our behalf (processors under art. 28 GDPR):

  • Supabase: database, authentication, server functions;
  • Cloudflare: site hosting and email routing;
  • Resend: delivery of your sign-in emails, of withdrawal acknowledgements, of your activity summary, of the community invitations and of the internal alerts through which we receive sign-ups, reports and messages;
  • Google (Gmail): the mailbox that receives the emails written to [email protected] and the service's internal alerts, with the names of sign-ups;
  • Anthropic: the artificial intelligence assistant (Claude) we use to manage the database and reports; it sees the data only during the operations we ask it to carry out, which may include messages, reports and thumbnails of reported photos;
  • Oracle: the Frankfurt machine our video call server runs on. It provides the infrastructure, not the video call service.

Those who process it on their own account (independent controllers): Google and Microsoft, only if you sign in with their account and only for authentication; Google also for the calendar, only if you connect it (point 2-sexies). If you turn on reminders, the message passes through the notification service of your browser's maker, which receives the delivery address and the encrypted message but cannot read it.

Payments: if you make a donation, Stripe processes the payment data under its own privacy policy (point 2-decies and 2-undecies).

There are no other recipients: apart from the payment library described in point 2-decies and 2-undecies (only if you make a donation), the app loads no scripts, fonts, maps or images from third-party servers, uses no external content delivery networks and uses no third-party analytics tools. We may disclose data to judicial or other competent authorities where the law requires it. Messages and reports are read only by whoever runs WeFocusBuddy or by a person authorised by us and bound by confidentiality.

7. Where the data is kept

The database and authentication are on Supabase, in the Frankfurt region (Germany, EU). The video call server is also in Frankfurt. From the browser, each account can directly read and write only its own data (row-level security); what others see of you, such as your name and thumbnail, goes through server functions that show only those fields.

For Supabase, Cloudflare, Oracle, Resend, Google (Gmail) and Anthropic, some technical traffic or support activity may involve infrastructure outside the EU (for Resend and Anthropic, in the United States). In those cases the transfer relies, depending on the provider, on the European Commission's adequacy decision of 10 July 2023 for certified companies or on the Commission's standard contractual clauses, set out in the respective data processing agreements. You can request a copy at [email protected]. Google, Microsoft and the browser's notification service, as independent controllers, may process data outside the EU under their own safeguards.

Until 7 September 2026 the video call ran on a third-party provider's United States infrastructure: we said so openly and asked for specific consent (art. 49(1)(a) GDPR). Since it runs on our server in the EU that transfer no longer happens, and the consent has been removed because it no longer has anything to authorise.

The service is operated from Italy under European Union law. If you use it from another country, you do so on your own initiative and local laws may apply to you.

8. How long we keep it

The rule: account and app data are kept as long as the account is active. If you delete it, we erase them without undue delay; copies in the providers' technical backups disappear with the normal backup cycles, as a rule within 30 days. The only exception is the reduced security trace in section 2-septies, which we keep for 24 months (the email address and the name, as a rule, only 30 days).

Item by item:

  • Coworking sessions: for as long as needed to show you your history and to handle any reports. The name the other person showed stays in your history as long as your account exists; if that person deletes theirs, the name is removed from your sessions.
  • Joining sessions: kept with the booking it refers to, as long as the account exists; if you cancel or leave the booking, it moves to the log of removed bookings.
  • Removed bookings (section 2(c)): as long as the account exists; deleted with it.
  • Missed sessions: after 14 days they no longer cause any pause, but stay recorded with the booking. The record that you have already seen the notice stays as long as the account exists.
  • Early exits: for as long as the account exists; they are deleted with it.
  • Companion-change notices: within one day of the end of the session, or earlier if you cancel the booking.
  • Favourite companions: until you remove them, until you block that person or until one of the two accounts is deleted.
  • Blocked people: until you unblock them or until one of the two accounts is deleted.
  • Communities: until you leave or delete your account.
  • Choice «My favourites first»: until you change it or delete the account.
  • Reports and the outcome of the review: for as long as the accounts of the reported person and of the person who reported exist, to assess repeated behaviour and defend against claims; they are deleted when either account is deleted. For someone who deletes their account, the reduced trace and the reports received remain, as described in section 2-septies.
  • Messages with ideas and problems: with no time limit, because they help us understand what to improve. If you left your email we can find your message and delete it on request; anonymous ones are not linked to you, so we cannot find or delete yours.
  • Technical errors collected automatically: with no time limit; they contain only a code, a number and the app version, and are not linked to you.
  • Anti-abuse code: 2 days at most.
  • Technical logs of the video call server (section 4-bis): 14 days at most.
  • Technical and security logs of the hosting providers and of the server functions (section 2(e)): for the periods set by the providers in their data processing agreements.
  • Invite links (with requests and proposals): for as long as the account of the person who created the link exists; they are deleted with it.
  • Reminder delivery address: while notifications are on. It is deleted when you turn them off in the app, when you sign out, when the notification service tells us it no longer exists, after 5 failed deliveries or when the account is deleted.
  • Video call technical data (section 2(l)): for as long as the session they refer to exists; they are deleted with it or with the account.
  • Day you open the app (section 2(m)): for as long as your account exists; it is deleted with the account. Also the time of the app's last sign of life: a single row per person, overwritten every minute, with no history; it is deleted with the account. The quarter-hours in which the app is open: 30 days, then they delete themselves; they are also deleted with the account. The time you use the app (point 2(n)): as long as your account exists; it is deleted with the account.
  • Aggregated visit statistics: with no time limit, because they are only numbers and do not refer to any person. Aggregated usage trends are calculated when viewed and are not stored separately.
  • Leaderboard (section 2-quinquies): your choice, the counts and the positions for as long as the account exists, and they are deleted with it; the record of decisions on reported names for as long as the account exists, and it is deleted with it.
  • Security trace of deleted accounts (section 2-septies): 24 months from the deletion of the account, then it is deleted automatically; the email address, the name and the text of reports 30 days (24 months if there are reports, blocks or restrictions).
  • People met in a session (section 2-octies): as long as your account exists; if the other person deletes theirs, 30 days (24 months if there are security reasons).
  • Access place (section 2-nonies): as long as your account exists; it is deleted with the account.
  • Profile photo and record of acceptance: see sections 2-ter and 2-quater.

9. Your rights

You have the right of access, rectification, erasure, restriction, objection and data portability (arts. 15–22 GDPR).

  • Export: from You → Your data you download by yourself the data you entered that is saved on your account. It does not include calendar bookings (with the joining time and missed sessions), the history of coworking sessions, invites, requests and proposals, early exits, removed bookings, the record of acceptance or reports: to get them, write to [email protected] (for reports see also section 5). Nor does it include leaderboard data (section 2-quinquies): for those too, write to [email protected].
  • Delete: from You → Your data you delete your account and data. Only the reduced security trace in section 2-septies remains, for 24 months, and your email address and name for 30 days (24 months if there are reports, blocks or restrictions).
  • Everything else: write to [email protected], we reply within one month. You can also ask at any time for a person to intervene, express your point of view and contest the automatic measure in section 3.
  • Complaint: you can turn to the supervisory authority of your country; in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

9-bis. Right to object

You can object at any time, on grounds relating to your particular situation, to the processing based on legitimate interest (section 3): security and handling of reports, messages with ideas and problems, notices of news and initiatives of the service, the anti-abuse code, aggregated visit statistics, internal per-account statistics on coworking, aggregated usage trends, automatic collection of technical errors, video call quality, technical logs of the video call server, record of acceptance of the documents, record of decisions on reported photos, the leaderboard and the record of decisions on reported names (section 2-quinquies, where you can also read what happens in practice if you object). The same goes for the security trace of deleted accounts (section 2-septies). Just write to [email protected]. We tell you here, separately from the rest, because art. 21 GDPR requires this right to be presented to you explicitly and separately.

10. Cookies and data saved on your device

The app uses no cookies, neither strictly necessary nor profiling cookies, and there are no advertising cookies, third-party analytics tools or tracking pixels. That is why you see no consent banner. The only exception is the payment library, which loads only if you press “Continue” to make a donation (point 2-decies and 2-undecies).

The app only uses the browser's storage (both the kind that stays and the kind that is cleared when the tab is closed) and its own cache (a copy of its files, saved after you sign in so it opens faster), needed to run it. They hold: the local copy of your data, the session token, preferences such as language and theme, the last virtual companion shown, the companion-change notices already shown and:

  • if you arrive from the page for university students, a marker valid for at most two hours and deleted the first time the app opens;
  • if you press “Support” on the home page before signing in, a mark with the amount you chose, which lasts two hours and is deleted the first time the app opens;
  • if you prepare an invite on a page of the site before signing in, the days and times you chose, valid for at most one day and deleted the first time the app opens;
  • if you tap a time on a page of the site before signing in, that time, valid for two hours;
  • your «Not now» choice on notifications, valid for 14 days, and which notices, requests and document versions you have already seen, so as not to show them to you again;
  • the last leaderboard tier you saw, to show you a «New» mark when you move up.

Why no consent is needed: cookie law requires consent to store or read information on your device, except where this is strictly necessary to provide the service you asked for. The local storage described here falls under that exception; the visit statistics (section 2(f)) store nothing on your device; the browser creates the reminder delivery address only if you give it permission.

11. Security

We use technical and organisational measures appropriate to the risk: encrypted transmission (HTTPS), per-account data access through row-level security, authentication with no passwords stored by us. No system is absolutely secure: if a data breach involves a high risk to your rights, we will inform you (art. 34 GDPR).

12. Minors

The service is reserved for people aged 18 or over. We do not knowingly collect data from minors. If you think a minor has created an account, write to [email protected] and we will delete it. If a report indicates that a person may be under 18, we may suspend their access to coworking until the situation is clarified.

13. Changes

We may update this notice. We announce material changes in the app with a notice you confirm; when a change reduces your rights, with reasonable notice. The date at the top changes. If you do not agree you can close your account at any time from You → Your data, at no cost. Changes do not apply to processing that has already taken place.

Terms of Service  ·  Open the app