Privacy Policy

This Privacy Policy explains how Roundly ("we", "our", or "us") collects, uses, stores, and handles your personal data when you use the Roundly mobile application and associated services (the "Service"). By using the Service, you acknowledge that you have read and understood this policy.

If you do not agree with this policy, please do not use the Service.

1. Who we are

Roundly is an independently developed application. For any privacy-related questions or requests, please contact us at the email address listed at the bottom of this policy.

2. What personal data we collect

Account data

Your display name, your initials and avatar colour, when you accepted this policy, and your app preferences such as hydration reminders and whether you appear in group statistics. Authentication is handled by a third-party identity provider (Supabase Auth), which holds your email address, the provider you signed in with, and your sign-in history. Roundly's own database never stores your email address: the app only receives the claims in your identity token.

Group activity

The groups you belong to or have left, your role in each, the rounds you fetched, ordered in, logged or deleted, the shared costs you paid or hold a share of, price list entries, and the notes and deletion reasons written on those records. Every change is stamped with who made it, so a group can see who edited what.

Settlement data

What you owe or are owed in each group, the payments calculated between you and other members, and whether each of those has been marked as sent or confirmed as received.

Whereabouts

If you use the whereabouts feature, we store the stage or location you pick from your group's own list, the short message you attach to it, and when you last updated it. This is a list your group writes itself. We do not collect GPS or device location.

Statistics

We derive per-group totals from your activity, such as how many rounds you fetched, what they were worth, and how many drinks were fetched for you. You can opt out of appearing in group statistics in the app.

Feedback

If you send feedback from within the app, we store what you wrote, along with your name, app version, platform, and the group it was about if you picked one.

Technical data

We may collect technical data such as device type, operating system version, app version, IP address, and error logs. Crash and error reports can include your user ID so a fault can be traced back to the request that caused it. This data is used to maintain and improve the Service.

3. How we use your data

We use the personal data we collect for the following purposes:

• To provide, operate, and maintain the Service.
• To authenticate you and manage your account.
• To enable group features, round tracking, and settlement calculations.
• To detect and prevent fraud, abuse, or violations of our Terms of Service.
• To diagnose technical issues and improve the reliability of the Service.
• To comply with applicable laws and legal obligations.
• To send you service-related communications (for example, account or security notices).

We do not use your data for automated decision-making that produces legal or similarly significant effects.

Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases:

• Performance of a contract: everything needed to give you the Service, including your account, your groups, rounds, shared costs, whereabouts, and settlement.
• Legitimate interests: keeping the Service secure and reliable, diagnosing faults, acting on the feedback you send, and preventing abuse.
• Consent: optional features you switch on yourself, which you can switch off again at any time.
• Legal obligation: where the law requires us to keep or disclose data.

4. How we may share your data

We do not sell your personal data. We may share your data in the following circumstances:

Other members of your groups

Roundly is a shared tab. The members of a group can see your name, the rounds and shared costs you are part of, what you owe or are owed, and your whereabouts if you report them. That is the point of the app, and it is worth knowing before you join a group.

Service providers

We use the following providers, each given access only to the data necessary for its function:

• Supabase: authentication. Holds your email address and sign-in history.
• Hetzner: hosting for our servers and database, located in the EU.
• Sentry: error monitoring. Can record your user ID alongside a crash or failed request.

Where a provider processes data outside the European Economic Area, that transfer is governed by the safeguards in that provider's data processing terms.

Legal requirements

We may disclose your data if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of Roundly, our users, or the public.

Business transfers

In the event of a merger, acquisition, sale of assets, or similar transaction, your data may be transferred as part of that transaction. We will notify you in advance if your data becomes subject to a different privacy policy as a result.

With your consent

We may share data for other purposes with your explicit consent.

5. Data retention

We retain your data for as long as your account is active or as long as is necessary to provide the Service. We also retain data as required to comply with legal obligations, resolve disputes, and enforce our agreements.

When you delete your account, we remove your profile and your account with our identity provider, including the email address held there. Your name is replaced with "Deleted User" everywhere it appears in the groups you were in. The rounds and shared costs themselves stay in those groups, because removing them would change what other members owe each other and break the group's audit trail. We keep a record that the account was deleted for a short period afterwards, so that sessions issued before the deletion cannot be used.

Invite links expire on their own, 48 hours after they are created or once they have been used the maximum number of times.

We reserve the right to delete your data at our discretion, including in cases of account termination, extended inactivity, or discontinuation of the Service. See Section 7 for your rights regarding deletion.

6. Data security

We implement reasonable technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These include encrypted connections (HTTPS/TLS), access controls, and routine security reviews.

However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee the absolute security of your data, and you use the Service at your own risk. In the event of a data breach that is likely to affect your rights or freedoms, we will notify affected users as required by applicable law.

7. Your rights

Depending on your jurisdiction, you may have the following rights with respect to your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate or incomplete data.
• Deletion: request deletion of your personal data. Note that certain data may be retained to fulfill legal obligations or legitimate interests even after deletion.
• Portability: request your data in a structured, commonly used, machine-readable format where technically feasible.
• Objection: object to certain processing activities.
• Restriction: request that we restrict the processing of your data in certain circumstances.

Exercising these rights in the app

Access, portability, correction, and deletion are all self-service in Roundly. These options take effect immediately, need no request and no identity check, so please use them rather than emailing us:

• Access and portability: go to Settings → Export my data. Roundly builds a machine-readable JSON file you can save or share wherever you like. It contains your profile and app settings, your email address and sign-in history from the identity provider, the groups you belong to or have left and your role in each, the rounds you fetched, ordered in, logged or deleted, the shared costs you paid or hold a share of, your balance and settlement payments in each group, your whereabouts, your per-group statistics, the invite links you created, and any feedback you sent us. The file also states what we use your data for, who else receives it, how long we keep it, and where to complain. Shared records appear as your own share of them, so the file does not list what other members ordered. Very large accounts may receive a partial export; if so, the file itself tells you how to request the remainder.
• Correction: go to Settings → Profile and tap Edit to change your display name and initials.
• Deletion: go to Settings → Delete account, type DELETE to confirm, and tap Delete my account. If you are the sole admin of a group that has not been settled, the app will name the groups you need to settle or hand over first. See Delete Your Account for what is removed and what is retained.

Requests we handle by email

Contact us at the address listed in Section 10 for anything the app cannot do for you: objection or restriction of processing, or a case where the in-app route is unavailable to you, for example if you have lost access to your account or cannot resolve a group that is blocking deletion. We will respond within a reasonable timeframe and no later than required by applicable law. We may need to verify your identity before processing your request.

If you are located in the European Economic Area and believe we have not adequately addressed your request, you have the right to lodge a complaint with your local data protection authority.

8. Children's privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16 without verifiable parental consent, we will take steps to delete that data promptly.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will make reasonable efforts to notify you, such as through an in-app notice or email. Continued use of the Service after the updated policy becomes effective constitutes your acceptance of the revised policy.

We encourage you to review this policy periodically.

10. Contact

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us at:

Before you write in about a copy of your data or an account deletion, check Section 7: both are available directly in the app under Settings, and take effect immediately.

Email: contact@getroundly.app