Privacy policy

Last updated: 2026-10-30

Fugaz limits most operational data by design. If you come in through WhatsApp, your phone is turned into an irreversible code and the clear number is retained only for the periods in section 3. Your location is rounded to a 500-metre grid before storage. Some identity, access, attribution and moderation records persist for the periods explained below.

1. Who processes your data

The data controller is Diego Herrero, a natural person operating the Fugaz application (fugaz.app).

For anything concerning your data, including any of the rights in section 7, write to legal@fugaz.app.

2. What Fugaz is, and why that matters here

Fugaz shows people on a map who are nearby and want to meet right now. You can sign in with your email, with Google or with Apple, and also by messaging our bot on WhatsApp or Telegram; then you share your location and appear on the map for up to 24 hours. To recognise you when you come back we keep a user record and the credentials of the door you came in through:

Google, through Neon Auth, Neon's authentication service. We receive your Google account id, your email address if Google has verified it, and your first name, which starts your profile. We do not receive your photo.
Email and password. The password is kept and checked by Neon Auth: it passes through our server only to be handed to it, and we neither store nor log it. We store your email address once you confirm it with the link we send you. If you forget your password, the reset email is sent by Neon.
Apple, if you use the iPhone app. We receive your Apple id and, the first time only, the name Apple shares. We store your email address only if Apple verifies it and it is not a private relay address.
WhatsApp or Telegram. You message the bot. From WhatsApp we receive your number, which we turn into an irreversible code (section 3). From Telegram we receive your Telegram user id and, if you choose to share it, your number.

We use those credentials to recognise you when you sign in again and, for a confirmed email address, to send the app's notices to you by email.

Much operational data expires automatically. Other data lives in the persistent database and is kept until it is no longer needed or until you exercise your right to erasure, subject to the legal and moderation exceptions explained in this policy.

3. Your phone number

This section applies if you come in through WhatsApp, give us your number on Telegram, are invited to a business account by phone, or type your number when requesting a code. It is the most sensitive thing that passes through here, so it gets its own section.

When you message the bot, your number arrives with the message. The first thing we do is turn it into an irreversible code (HMAC-SHA256 with a secret key of ours). That code is your identity inside the system: everything else — your profile, your position, your groups — hangs off it and not off the number. The number cannot be derived back from the code.

The full number is kept only for as long as something needs it to work. These are all the cases:

What for
So we can answer you on WhatsApp, and so other people on the map or your group can message you: WhatsApp only lets us write to a number, and only within 24 hours of its last message
How long
24 hours from your last message to the bot. Every message you send restarts the clock; if you stop writing, it deletes itself
Who else receives it
Meta (WhatsApp), as processor
What for
If you apply to be a buddy: so we can call you to approve you
How long
30 days, or until your application is resolved
Who else receives it
Nobody outside Fugaz
What for
Linking your number to your Telegram chat so we can route your messages to that chat
How long
180 days from your last Telegram message; each message renews the period
Who else receives it
Telegram, as processor
What for
If a business account invites you by phone: so whoever invited you knows whom they invited and added
How long
No automatic expiry: as long as that business account exists, also after the invitation lapses or you are removed from it. You can ask for its erasure
Who else receives it
The admins of that business account
What for
If you request an affiliate code: the WhatsApp number you type in the request, so whoever hands out the code can contact you
How long
No automatic expiry: as long as the request exists, which is deleted with the programme or with your business account. You can ask for its erasure
Who else receives it
Whoever manages that programme, who receives it by email (Resend)
What for
Only the last four digits, next to your credentials and roles: so you can recognise which number each one belongs to
How long
As long as that credential or role exists
Who else receives it
Nobody outside Fugaz

The first row's period is renewable, and you are the one renewing it: 24 hours from your last message to the bot, not a minute more. It is exactly how long your presence in the app lasts — the countdown you see in your profile is the retention period of your number. The honest flip side: if you use the app every day, the number is stored continuously, because each of your messages restarts the 24 hours.

And there is real on-demand erasure: when you leave the map, the app asks whether you want to keep receiving notices. Say no, and your number is deleted on the spot, without waiting for any expiry.

Outside the cases in this table, the full number is not stored: in the long run only the irreversible code remains. When somebody contacts you from the map, your number is not handed over: the contact goes through the bot and requires you to answer. We also keep no separate record of when you wrote: the WhatsApp window clock is the number's own expiry.

When you delete your account, the number in the first row is deleted on the spot. The others are not: the Telegram link expires on its own after 180 days, or on the spot if you remove the phone from your account in your profile; the buddy application expires after 30 days; and business account invitations and memberships, code requests and the last four digits are kept until you ask us to erase them.

Internal activity statistics

To measure use and return to Fugaz, we store one record per account and UTC day indicating whether you opened foreground screens on the web or in the app. It contains no coordinates, visited paths, messages or browsing history. The dashboard shows aggregate results and excludes the known demonstration cast. Queries cover the last 90 days; older records are deleted in batches when new activity is received. Deleting your account removes these records. For new accounts we also retain the signup method (Google, Apple or email) until account deletion; we do not infer it from credentials you link later.

4. Your location

The location you share is rounded to a 500-metre grid before it is stored. The exact coordinate is used in memory to do that rounding and then discarded: it is written to no database and to no log. What other people see — and the only thing that would exist if somebody got into our systems — is the 500-metre cell.

That position lives up to 24 hours, renewed while you keep messaging the bot — the same clock as your number — and then disappears on its own. We keep no history: there is no way to reconstruct where you have been, not even for us.

The lawful basis for processing your location is your explicit consent, given when you share it and withdrawable at any time by leaving the map (section 7).

That consent has two levels, and the second one is yours to choose. By default your location is only used so that the members of your group can find you: you do not appear on the people map (“People”). If you also want to appear there — where anyone nearby can see you and message you — you have to allow it explicitly, by unticking the box when you share your location or from your profile. It is reversible in the same place, and until you allow it you cannot see the people map either: nobody watches without being watched.

5. What else we process, what for, and how long

Data
Irreversible code derived from your phone number
What for
Identifying you inside the system without knowing your number
Lawful basis
Performance of the service
How long
As long as you keep an identity in Fugaz; you can ask for its erasure
Data
Internal user record, verified credentials and roles granted or revoked
What for
Keeping a stable identity, managing access and evidencing changes
Lawful basis
Performance of the service and legitimate interest in security
How long
As long as you keep an identity or a role; revocations are kept as long as security needs them
Data
Sign-in credentials: your confirmed email address, your Google, Apple and Telegram ids, and the link to your Neon Auth account
What for
Recognising you when you come back through that door
Lawful basis
Performance of the service
How long
Until you delete your account from the app or the web. Deleting only the profile, from the bot, does not delete them
Data
Password, as a hash. Kept by Neon Auth, not by Fugaz
What for
Checking it is you when you sign in with email
Lawful basis
Performance of the service
How long
Until you delete your account from the web with that session open: we then ask Neon Auth to delete your sign-in record. Deleted from the app, it no longer opens any Fugaz account; you can ask for its erasure
Data
If you ask to try the Android app: the Google email address you give us
What for
Adding you to Google Play's test list and telling you when you are in
Lawful basis
Consent
How long
Until the test ends or you delete your account
Data
Email address awaiting confirmation, with the link we sent you
What for
Checking the address is yours
Lawful basis
Performance of the service
How long
24 hours
Data
Chosen channel and link between phone number and Telegram chat
What for
Opening your session and replying through the right door
Lawful basis
Performance of the service
How long
180 days from the last activity; the browser preference lasts up to 1 year
Data
Position rounded to 500 m
What for
Showing you on the map to people nearby
Lawful basis
Explicit consent
How long
Up to 24 h, renewed with every message to the bot
Data
Profile: name, what you tell about yourself, and — optional — age range, gender, nationality, languages and your social handles
What for
So people who see you on the map know who you are
Lawful basis
Consent
How long
15 days, renewed every time you publish a location
Data
Minimal profile (name only) created when you enter through a buddy's QR
What for
So you do not show up as a nameless dot
Lawful basis
Consent
How long
72 hours
Data
Chat messages between groups
What for
The conversation itself
Lawful basis
Performance of the service
How long
72 hours from when each message is written
Data
Conversation requests
What for
So the other side can accept or not
Lawful basis
Performance of the service
How long
24 hours
Data
Groups and who is in them
What for
So a group exists and shows on the map
Lawful basis
Performance of the service
How long
72 h the group; 15 days the membership
Data
One-off permission to show your social handles to a specific person
What for
Showing them to somebody without making them public
Lawful basis
Consent
How long
7 days
Data
Notices pending delivery
What for
So a notice is not lost if the channel is down
Lawful basis
Performance of the service
How long
7 days
Data
A group's photo of the day, with its caption
What for
Showing what is going on there right now
Lawful basis
Consent
How long
24 hours
Data
Comments somebody writes about another person
What for
So that whoever knows you can say something about you to whoever just saw you
Lawful basis
Consent
How long
15 days, the same as the profile it talks about
Data
A shared view of a group (the link somebody sends to a chat)
What for
Showing what they were looking at without the other person having to sign up
Lawful basis
Legitimate interest in the app being showable
How long
72 hours, after which the link stops opening
Data
Web session (our own cookie)
What for
So you do not have to identify yourself on every screen
Lawful basis
Strictly necessary for a service you requested
How long
14 days
Data
If you use the app: the app session (we keep only an irreversible fingerprint of its key)
What for
So you do not have to sign in every time you open it
Lawful basis
Strictly necessary for a service you requested
How long
180 days from its last use
Data
If you use the app: the record of each device (an id the app generates at random, the operating system, the language and the notification token)
What for
Knowing which phone to send a notice to
Lawful basis
Performance of the service
How long
180 days from the last use of the app on that device

Every profile field except the name is optional. We do not deliberately process special categories of data under Article 9 GDPR. You upload profile and group photos from your own device; we do not use them to identify you.

If you use the mobile app

The Android and iPhone app opens the same Fugaz as the web, with three differences. First: it asks for your location when you come in, only while it is open and never in the background, and it is rounded as in section 4. Second: notifications. To tell you about a new message we send Expo, and through it Google (Firebase Cloud Messaging) or Apple (APNs), your device's token, the title “Fugaz” and the first 100 characters of the message; the app downloads the full message from our servers. Third: the device record in the table above.

If you delete your account from the app (⋯ menu, “Delete my account”), besides deleting your profile and your location we close all your app sessions, on other phones too, and forget your devices along with their notification tokens.

6. Who we share with

We do not sell data, we run no advertising, and we hand nothing to third parties for commercial purposes. The only recipients are these categories of providers, contracted so the app can work. The specific technical inventory is kept in our internal processing records and processor agreements:

And there is one thing another person can do, not us: whoever sees you on the map can share that view —your card and the ones around it, frozen— as a link that opens for anyone who receives it, signed up or not. The link stops working after 72 hours. If you delete your profile before that it disappears from the app at once, but a view already shared may keep showing the frozen copy until it expires. If that bothers you, write to us and we will kill it.

Category
Databases: Neon and Upstash
What they receive
Everything described above, with its retention periods
Where
European Union (Frankfurt, Germany)
Category
Neon Auth (Neon), sign-in
What they receive
If you sign in with email: your email address and your password as a hash. If you sign in with Google: the link to your Google account. It sends the password reset email
Where
European Union (Frankfurt, Germany)
Category
Google
What they receive
That you sign in to Fugaz with your Google account, if you choose that door. If you ask to try the Android app, the email address you give us, as part of Google Play's test list. And if you use the app on Android, the token and content of notifications (Firebase Cloud Messaging)
Where
Per Google's own privacy policy
Category
Apple
What they receive
That you sign in to Fugaz with your Apple account, if you choose that door. And if you use the app on iPhone, the token and content of notifications (APNs)
Where
Per Apple's own privacy policy
Category
Expo, app notifications
What they receive
Your device's token, the title “Fugaz” and the first 100 characters of each message we notify you of, to hand it to Google or Apple
Where
Per its own policy
Category
Resend, email delivery
What they receive
Your email address and the content of the emails we send you: the confirmation one and the app's notices, which you can turn off from the email itself. If you request an affiliate code, also the request with the WhatsApp number you typed, which we send to whoever manages the programme
Where
Per its own policy
Category
Web hosting and delivery
What they receive
Requests to the app, including your IP
Where
Distributed infrastructure; transfers outside the EEA are covered by the applicable contractual safeguards
Category
Cookieless audience measurement (Vercel Web Analytics)
What they receive
Visited page, referrer, approximate country, browser, operating system and device type. Vercel uses the IP to generate a daily identifier and does not retain it in the metric; we send no account, phone number or location
Where
Distributed infrastructure; transfers outside the EEA are covered by the applicable contractual safeguards
Category
Real-time notifications (Ably)
What they receive
Only the signal that a new message exists: conversation or message id, and the time. The text never leaves our database
Where
Infrastructure contracted to provide the service
Category
Map provider
What they receive
Your IP and the tiles your browser requests, i.e. roughly which area you are looking at
Where
The provider's infrastructure, with the safeguards applicable to international transfers
Category
Meta (WhatsApp)
What they receive
Your number and the messages you exchange with the bot, as in any WhatsApp conversation
Where
Per WhatsApp's own policy
Category
Telegram
What they receive
Messages exchanged with the bot and, when you choose to share it, your phone number. Fugaz keeps the relationship between that number, your internal identity and the chat for 180 days
Where
Per Telegram's own privacy policy
Category
Image storage, delivery and security
What they receive
The photos that get published, and the IP of whoever requests them. It also automatically scans what passes through its network for child sexual abuse material
Where
The store sits in the European Union, but cached copies are served from servers around the world
Category
Artificial intelligence provider (OpenAI)
What they receive
Three separate things. One: the photos you upload, and only as you upload them, to block sexual, violent or self-harm content before they are published; they travel already resized and stripped of metadata, so neither the place nor the date they were taken goes with them. Two: if we write to you to help you get started, the text of that conversation and, for each person in the group, their name, their handle inside the app, what they say about themselves, their languages, the country they probably come from, and whether they are on the map. Three: when you tap the button to translate a chat message, the text of that message — only that one, only when you ask, and without who wrote it or which conversation it belongs to. Your phone number does not travel, and neither does your position
Where
We contract through the provider's Irish establishment; processing happens in the United States under the European Commission's standard contractual clauses. None of this is used to train models. The provider keeps a log for up to 30 days to detect abuse and then deletes it

WhatsApp, Telegram, Google and Apple are external services. Each platform processes what you exchange with it under its own terms, which we do not control. This is separate from what Fugaz retains in its own systems.

7. Your rights

You may exercise the rights of access, rectification, erasure, objection, restriction of processing and portability. Two of them need neither a message from you nor an answer from anybody:

Delete your profile — from the app itself, on your profile screen, or by messaging the bot delete profile. It is deleted immediately.
Leave the map — from the app ("stop showing up", which also offers to delete your number on the spot) or by messaging the bot stop. Your position disappears at once; this is how you withdraw the consent in section 4.

The three ways to delete your account, and what is kept afterwards, are explained in Delete your account.

For any other right, write to legal@fugaz.app. The most direct way to prove that some data is yours is to write to us from the email address you have confirmed in Fugaz. If you come in through WhatsApp, since in the long run we only keep a code derived from your phone number, we cannot always locate your data from an email address: in that case, message the bot from the same number you use the app with.

If you believe your request was not handled properly, you may lodge a complaint with the supervisory authority of your country of residence. In Spain that is the Spanish Data Protection Agency (aepd.es).

What erasure does not reach

If somebody reports a person from their profile card, we keep a copy of what was reported — what the card showed and, if the reporter and the reported person have a one-to-one conversation, up to its latest 20 messages as context — for 90 days and the decision we made for 2 years. Blocking another person lasts 1 year, and a ban from the app, 3 years. Those records are not erased at the request of the reported person while they remain necessary to defend against a claim (Article 17.3(e) GDPR) and to be able to tell whoever reported what was decided. A report copy never includes location.

8. Cookies

We use first-party technical cookies: at_session keeps your session for 14 days; locale and theme remember language and appearance; and chat_app remembers your WhatsApp or Telegram choice for one year. If you sign in with email or Google, signing in also uses Neon Auth's technical cookies and at_neon_flow, which remembers for ten minutes which screen to return to. They are necessary or store requested preferences, so no consent banner is required. We use no advertising cookies or advertising profiles. We measure visits with Vercel Web Analytics, which sets no cookies: it records the page, referrer and browser technical data and creates an identifier that changes every 24 hours. Our legal basis is our interest in understanding which pages are used and improving the service. We also generate internal service and onboarding statistics.

9. Minors

Fugaz is for people aged 18 and over. The form requires confirming you are of age before a profile can be saved. If we find a profile belonging to a minor, we delete it.

10. Security

Beyond the usual technical measures, the real protection here is what we do not accumulate: with no exact coordinates or location history, an incident cannot reconstruct journeys. Operational data has expiry periods; persistent records are limited to identity, access, attribution and moderation.

11. Changes to this policy

If we change anything material, we change the date in the header too. The retention periods on this page match the ones the system applies as of that date.

This is a translation. The binding version is the Spanish one, available at fugaz.app/privacy.