Wbijam Privacy Policy

Effective date: June 12, 2026

This is the English version of the Wbijam privacy policy. The Polish version (wbijam.app/prywatnosc) is the canonical one; in case of any discrepancy, the Polish version prevails.

Wbijam helps you arrange real-life meetups with your friends. We need very little data for that, and that is all we collect. This policy explains in plain language what we do with your data and what rights you have.

In short: we collect your phone number, your first name, and the meetup proposals you create. Access to your contacts is optional and is used solely to check which of your friends already use Wbijam. We show no ads, never sell any data, and track nothing for advertising purposes. To keep the app stable and make it better, we use error-monitoring and usage-analytics tools (Sentry, Datadog) — details in sections 2 and 5. You can delete your account at any time directly in the app.

1. Who is responsible for your data

The controller of your personal data is Damian Mikła (an individual, the creator of the Wbijam app).

Contact for all data matters: kontakt@wbijam.app

2. What data we collect

• Phone number. Used to create your account and log in (SMS code), and to let friends find you if you allow it.
• First name (optionally a surname, and a profile photo if you set one). That is enough for your friends to know who is inviting them.
• Your proposals and answers. The content of meetup proposals: what, when, where, who they were sent to, and the answers given by you and the invited people.
• Phone contacts, only if you enable access yourself. Details in section 4.
• Technical data. A session token (valid for 30 days), SMS login codes (valid for a few minutes), and basic server logs (e.g. IP address and request time) needed for security.
• Usage statistics. In-app events (e.g. opening the app, sending a proposal, screens visited), stored on our servers and in the Datadog analytics tool. They help us understand what works and what needs fixing. After account deletion, the events on our servers lose any link to you.
• Diagnostic data. Reports about app errors and performance (e.g. that the app crashed, device model, OS version), collected via Sentry and Datadog. We configure these tools so the reports contain neither your phone number nor the content of your proposals.
• Waitlist e-mail address. If you sign up on wbijam.app, we store your e-mail address solely to let you know when the app launches (basis: your consent, Art. 6(1)(a) GDPR). We will delete it after launch, or earlier on your request.

We do not collect your location. The “where” field of a proposal is plain text that you type yourself.

3. Why and on what legal basis we process data

4. Contacts: how it actually works

We want this section to be fully clear, because contacts access is a sensitive matter.

• Contacts access is optional. The app is fully functional without it: you can invite friends with a link or a QR code instead.
• If you enable access, we compare normalized phone numbers from your address book with the numbers of registered users, solely to show you which of your friends already use Wbijam and have agreed to be discoverable. We additionally plan to switch to comparing hashes of the numbers instead of the numbers themselves.
• We do not store the numbers of people who do not have a Wbijam account. After matching, those numbers are not retained.
• We never message your contacts ourselves. No SMS, no invitations sent in your name. If you want to invite someone, you send them a link yourself, through a messenger of your choice.
• You withdraw consent by disabling contacts access in your phone settings. From that moment we perform no new matching. You can also write to us to have previous matches deleted.

5. Who we share data with

We share your data only with parties that technically help us provide the service:

• Hosting and database provider: Supabase (Supabase, Inc.), with app data stored in a European Union region (Frankfurt, Germany). Where data reaches an entity outside the EU, this is done under Standard Contractual Clauses approved by the European Commission.
• SMS delivery provider: SMSAPI.pl (a provider based in Poland, European Union), delivering login codes to your number.
• Error monitoring: Sentry (Functional Software, Inc., USA), collecting crash and error reports.
• Performance monitoring and usage statistics: Datadog (Datadog, Inc.), with data stored in a European Union region where available.
• Apple and Google, to deliver push notifications to your device.

All of these parties act on our behalf and solely for the purposes described. We do not sell data. We do not share it with advertisers or ad networks, and we use no tracking tools for advertising purposes.

6. Transfers outside the European Economic Area

App data is intended to be stored on servers in the EU. Push notification delivery (Apple, Google) and error/performance monitoring (Sentry, Datadog) may involve processing outside the EEA, in particular in the USA. In such cases it takes place under safeguards provided for by the GDPR (adequacy decisions, including the EU-US Data Privacy Framework, or standard contractual clauses).

7. How long we keep data

• Account data (number, name, profile): until you delete your account.
• Proposals and answers: as long as you have an account. They are deleted when the account is deleted.
• SMS login codes: a few minutes, until used or expired.
• Session tokens: up to 30 days.
• Technical logs: up to 90 days.
• Diagnostic data and usage statistics (Sentry, Datadog): up to 90 days.

After account deletion your data is removed promptly, no later than within 30 days.

8. Your rights

You have the right to:

• access your data and receive a copy of it,
• rectify your data,
• have your data erased (the “right to be forgotten”),
• restrict processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time (without affecting the lawfulness of prior processing).

How to exercise them: fastest in the app (Settings → Delete account, for erasure) or by writing to kontakt@wbijam.app. We respond within one month at the latest.

You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (PUODO, uodo.gov.pl) or your local supervisory authority if you believe we process your data unlawfully.

9. Account deletion

You can delete your account directly in the app: Settings → Delete account. Deleting your account removes your profile, proposals, answers, and contact matches from our servers. You can also request account deletion by e-mail: kontakt@wbijam.app.

10. Children

Wbijam is intended for people who are at least 13 years old and is not directed at younger children. By creating an account you confirm that you are at least 13. If we learn that an account belongs to a younger child, we will delete it together with its data.

11. No profiling, no automated decisions

We do not make decisions about you based solely on automated processing that would produce legal or similarly significant effects. We do not build profiles of your relationships and we do not score your friendships. This is a deliberate product principle, not just a legal statement.

12. Changes to this policy

If this policy changes, we will inform you in the app in advance and publish the new version at wbijam.app/privacy. Material changes to the scope of collected data will never take effect silently.