Privacy Policy

Who we are

Gwappy is operated by the Gwappy administrator (the “data controller”). For privacy questions or to exercise your rights, contact privacy@gwappy.com.

What data we collect

• Account & profile: user name, first and last name, email address, phone number, and account type.
• Group data: the groups you belong to, your role in them, and your favourites.
• Activity data: once activity planning is enabled, your availability responses and scheduled assignments.
• Technical data: essential session cookies to keep you signed in, and standard server logs.

We only collect what is needed to run the service.

Why we process it

To provide the service (performance of a contract and our legitimate interest in running Gwappy for your group) and to send necessary transactional emails (invitations, password resets, account notices). We do not use your data for advertising and we do not sell it.

Who processes your data

We use trusted providers to run Gwappy on our behalf:

• Supabase — database and authentication
• Vercel — application hosting
• Resend — sending transactional email
• Cloudflare — domain and DNS

Some providers may process data outside your country (e.g. the EU/US) under appropriate safeguards.

How long we keep it

We keep your data while your account is active. When you delete your account (Profile → Delete account), your personal data is permanently erased, including groups you solely administer.

Your rights

Under the GDPR you can access, correct, delete, and obtain a portable copy of your data, and object to or restrict its processing. In the app you can:

• View and edit your data — Profile
• Download your data — Profile → Download my data
• Delete your account — Profile → Delete account

You also have the right to lodge a complaint with your local data protection authority.

Cookies

We use only essential and functional cookies — no advertising or tracking cookies:

• Session cookies to keep you signed in (set by our authentication provider).
• A language cookie (locale) that remembers your chosen interface language so pages load in it. It stores only the language code (e.g. en or nl) — no personal data — and lasts up to a year.

Changes to this policy

We may update this policy; the “last updated” date above shows the current version.