Privacy Policy

Who is responsible for your data?

The controller responsible for Dozo is:

Pepijn Kreffer
The Netherlands
[email protected]
dozoapp.app

For questions about this privacy policy, the processing of personal data or exercising your privacy rights, you can contact us using the email address above.

What personal data does Dozo process?

The data Dozo processes depends on the features you use.

2.1 Account data

When you create or use an account, Dozo may process, among other things:

• your email address, including an Apple relay address where applicable;
• your chosen username;
• an internal user ID;
• your year of birth and the status of your age check;
• an optional profile photo;
• information about your sign in method, for example email or Sign in with Apple;
• session data and technical authentication data;
• the time at which you accepted or acknowledged terms and privacy information, including the version that applied at that time.

Dozo uses your full date of birth only to check whether you are at least 16 years old. After a successful age check, only your year of birth and the status of the age check are stored on the server.

During email registration, your username, date of birth, internal account ID and a timestamp may temporarily be stored locally on your device until your email address has been confirmed and registration can be completed. This temporary data expires after approximately three days at the latest.

Your password is processed through Supabase Auth. Dozo does not store your password as readable text in its own profile or database.

2.2 Event data

When you create or join an event, Dozo may process, among other things:

• the event name and any destination you provide;
• start and end date;
• time zone and recap settings;
• your membership and role, such as owner, admin or member;
• the time you joined;
• invitation codes and invitation links;
• event settings and certain interactions within the event.

2.3 Photos, videos and other content

Dozo processes content that you create, import or drop into an event. This may include:

• photos and videos;
• audio that is part of a video;
• thumbnails and final rendered versions;
• captions, text overlays and similar content metadata;
• camera style, filter information and capture mode;
• capture information such as date, time, duration, dimensions and orientation;
• information needed to create daily, final and personal recaps.

Dozo may keep an original file alongside a rendered version when this is necessary to reliably process a style, text, recap or export. An imported file may also contain technical metadata added to the file by the device or camera.

2.4 Location data

If you allow location access and use a feature that adds location to a capture, Dozo may process location data around the time of capture, such as:

• geographic coordinates;
• accuracy and time of the location determination;
• place name, city, address or location description;
• a point of interest or technical place ID.

Dozo does not use background location. Location is only requested while you actively use the app for a feature where location is relevant.

To convert coordinates into location context, Dozo may use Geoapify through a request sent from the server. Dozo does not need to send your username, email address or Dozo user ID with that request. Geoapify does receive the coordinates and technical information relating to the server request.

2.5 People without a Dozo account

Photos and videos uploaded by users may contain identifiable people who do not have a Dozo account themselves. As a result, Dozo may also process images, voices or other personal data relating to non users.

Dozo does not automatically create a separate profile for these people. Users must take the privacy and rights of others into account when capturing and uploading content. If you appear recognisably in Dozo content and object to this, you can contact [email protected]. Dozo will assess such a request based on the circumstances and may restrict or remove content where appropriate.

2.6 Reactions, recaps and interactions

Dozo may process, among other things, which user posts a reaction, which clip that reaction relates to, when the reaction was posted, which clips appear in a recap, the status of a recap and limited viewing information needed for recap features to work.

2.7 Push notifications

When you enable push notifications, Dozo may process a push token, a technical device or installation ID, platform information, sending status, delivery status and error information. A push notification may, for example, contain a username, event name or recap information.

Push notifications are processed for delivery through Expo and the Apple Push Notification service. A notification that has already been delivered to your device falls outside Dozo's server storage.

2.8 Reports, blocks and moderation

When you report a user or content, Dozo may process, among other things, the reporting user, the reported user, the relevant clip and event, the reason, free text explanation, time, status and moderation action taken. Dozo may also process blocks between users and limited internal notes where necessary for safety and enforcement.

For a moderation report, relevant text data may be sent to the support address through Resend. The media file itself is not normally included in that moderation email.

2.9 Technical data

Dozo and its technical service providers may automatically process data needed for operation, security and troubleshooting, such as:

• IP address, user agent, device model and operating system;
• app version, session data and installation IDs;
• upload, render and recap statuses;
• timestamps, error codes and limited technical logs;
• storage paths and technical information about failed requests or join attempts.

2.10 Data on your device

Dozo may store data locally that is needed for the app to work reliably, such as your sign in session, an account or event snapshot, the persistent upload queue, local file paths, temporary overlay or location data, a cache of temporary media access, a pending invitation, an installation ID and temporary signup data.

Some local data is deleted when you sign out or delete your account. Media you save yourself in your device's Photos app falls outside Dozo's storage.

2.11 Website and invitation links

When you open dozoapp.app or an event invitation link, the web infrastructure may process technical request data such as IP address, time, browser and connection information, requested path and an invitation token that forms part of the link.

How does Dozo obtain this data?

Dozo receives personal data in several ways:

• From you. For example, your email address, username, date of birth, event data, photos, videos, captions, reactions and support questions.
• Through your use of Dozo. For example, internal IDs, upload statuses, event membership, recap data, technical logs and push statuses.
• From your device. For example, camera and microphone content, gallery files, location, device information and push data when you use the relevant feature or grant permission.
• From others or external parties. For example, data through Sign in with Apple, content in which you appear that is uploaded by someone else, a report about you or technical information from hosting, authentication or push services.

What does Dozo use personal data for?

Dozo uses personal data only for purposes connected with the service. These include:

• creating and securing accounts and allowing users to sign in;
• checking whether a user is at least 16 years old;
• creating events and managing membership;
• uploading and storing photos and videos and making them available at the correct time;
• processing styles, text and other edits;
• generating daily, final and personal recaps;
• adding location context to clips when you use this feature;
• making invitations and event links work;
• enabling reactions, notifications and push notifications;
• exporting media to Photos at your request;
• providing support and investigating technical issues;
• preventing abuse, fraud, spam and unauthorised access;
• reviewing moderation reports and protecting users;
• carrying out deletion requests;
• complying with legal obligations and protecting legal rights.

On what legal basis does Dozo process data?

Performance of a contract

For data necessary to provide your account, events, clips, recaps and other core features, Dozo generally bases the processing on the performance of the contract between you and Dozo or on steps taken at your request before entering into that contract.

Consent

For the processing of precise location data, Dozo relies on your consent. iOS separately requests system permission to give Dozo access to your location. You can withdraw this consent later. Withdrawal does not affect processing that took place lawfully before the withdrawal.

iOS may also show a system permission prompt for other optional device permissions. Such a system permission does not automatically determine the GDPR legal basis for every underlying processing activity.

Legitimate interests

For security, abuse prevention, moderation, technical reliability and protecting users and the service, Dozo may rely on a legitimate interest. Dozo balances the interest in the processing against the privacy rights and reasonable expectations of the people concerned.

When event content also contains personal data relating to people without a Dozo account, the technical storage and availability of that content within a closed event may, depending on the circumstances, also be based on a legitimate interest. The interests and rights of the person concerned must be taken into account. A person may contact Dozo if they object to particular content.

Legal obligation

Dozo may process or disclose data where this is necessary to comply with a legal obligation, respond to a valid request from a competent authority or establish, exercise or defend legal claims.

Who can see your content and data?

Dozo is built around closed events. Event content is not intended to function as a public social network and is not automatically visible to everyone on the internet.

Depending on the feature and the status of a recap, other members of the same event may eventually see, among other things:

• your username and profile photo;
• your role within the event;
• your clips after they become available under the event rules;
• captions and text overlays;
• time and location context linked to a clip;
• reactions and information shown in a recap.

Dozo cannot fully prevent an event member from taking a screenshot, saving a permitted export or otherwise storing content outside Dozo. Once a copy has been stored outside Dozo, Dozo cannot remove that external copy from that person's device.

Which parties does Dozo work with?

Dozo does not sell personal data to advertisers. Dozo does use external service providers to provide the service.

Dozo uses private file storage. Original clips and rendered files are not permanently publicly accessible. Where access to media is required, Dozo uses temporary and controlled access.

Service providers receive only the data needed for their role in providing the service. Their own technical logs, security data and backups may be processed in accordance with their own applicable retention policies.

Processing outside the European Economic Area

Some service providers may process personal data outside the European Economic Area or may access data from another country.

Where personal data is transferred outside the EEA and additional safeguards are required, an applicable transfer mechanism is used, such as an adequacy decision of the European Commission, approved Standard Contractual Clauses or another legally permitted safeguard.

You can ask for more information about the safeguards applicable to a specific transfer by contacting [email protected].

How long does Dozo retain data?

Dozo does not retain personal data longer than necessary for the purpose for which it is processed. The following principles currently apply to the main categories.

After deletion, it may take some time before data disappears from queues, temporary files, technical logs or backups. This data is not reused for normal product features or advertising.

What happens when data is deleted?

Deleting a clip

When one of your own clips is deleted, it immediately becomes invisible and inaccessible. Linked metadata and files are then cleaned up through server processes. It may take a short time before every technical storage object is permanently removed, for example if a processing task or retry was still active.

Deleting an event

A deleted event immediately becomes inaccessible to ordinary users. A recovery period of up to 30 days may then apply. After that period, the event, including linked clips, renders, reactions, recaps, invitation links and other event data, is removed from active systems.

Deleting your account

You can delete your Dozo account from within the app. Dozo then deletes, among other things, your profile, sessions, event memberships, your own clips, linked original and rendered files, reactions, push tokens and directly linked export data, unless a valid exception applies.

If you are the owner of an event with other members, ownership may be transferred so that content belonging to other members is not automatically removed. If an event has only you as a member, the event may be deleted completely.

What may remain after deletion?

Some data may remain temporarily or for longer where this is necessary for security, fraud prevention, moderation, legal claims, legal obligations or technical backups. Dozo also cannot delete external copies that other event members have stored outside Dozo, such as screenshots or media in their own Photos app.

Which data is required and which is optional?

Not every type of data is needed for every feature. If you do not provide required data, Dozo may be unable to provide the relevant feature.

How does Dozo protect personal data?

Dozo takes technical and organisational measures appropriate to the nature of the data and the risks of the processing. These include, among other things:

• private storage for media files;
• database level access rules;
• authentication and authorisation;
• temporary and controlled media access instead of permanent public links;
• server controls for sensitive actions;
• encrypted network connections;
• limited access to production data;
• rate limiting, logging and monitoring where necessary for security and reliability.

No digital system can guarantee complete security. Dozo therefore cannot guarantee that unauthorised access, loss or misuse is impossible in all circumstances.

What privacy rights do you have?

Depending on the circumstances, under the GDPR you may have the right to:

• access your personal data;
• correct inaccurate data;
• have personal data deleted;
• restrict processing;
• receive certain data in a portable format;
• object to certain processing, including processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• lodge a complaint with the Dutch Data Protection Authority.

You can submit a request via [email protected]. Dozo may ask for additional information to verify that the request actually comes from you.

In principle, Dozo responds to a GDPR request within one month. For complex or multiple requests, this period may be extended under the conditions of the GDPR. Some rights are not absolute and may be restricted where a legal exception applies.

Managing device permissions

Depending on the features you use, Dozo may request access to:

• Camera and microphone for taking photos and recording videos.
• Photos for importing or saving media.
• Location for adding place information to a capture. Dozo does not use background location.
• Notifications for, for example, event and recap notifications.
• Motion or orientation data where iOS needs this to determine device orientation while capturing media. Dozo does not use this data to build a movement history.

You can manage system permissions in your device settings. If you withdraw a permission, the relevant feature may become limited. Earlier lawful processing is not automatically undone.

Users under 16 years old

Dozo is intended for users aged 16 and older. During registration, your date of birth is used to check this. After a successful check, Dozo stores only your year of birth and the technical status showing that the age check has been completed.

If Dozo reasonably determines that a user is under 16, access to the service may be blocked and the account may be deleted.

Automated checks and decision making

Dozo does not use personal data for profiling or fully automated decision making that produces legal effects concerning you or similarly significantly affects you.

Technical systems may automatically perform checks needed for, for example, age verification, access rights, upload and render status, rate limiting, blocks and detection of invalid or failed requests. If you believe such a check incorrectly blocks access or causes an error, you can contact Dozo.

Advertising, tracking and analytics

In version 1.0, Dozo does not sell personal data to advertisers and no advertisements are active in the app.

In this version, Dozo does not use an advertising SDK, does not use IDFA for advertising tracking and does not perform cross app tracking. No general analytics SDK or crash reporting SDK is active either. Technical logs are used for operation, security and troubleshooting, not to build advertising profiles.

If Dozo changes this in a later version, this privacy policy will be updated before the new processing becomes applicable.

Changes to this privacy policy

Dozo may update this privacy policy when features, service providers, retention periods, security processes or laws and regulations change.

The current version is published on dozoapp.app. In the event of important changes, Dozo will inform users in an appropriate way, for example in the app or by email where necessary. The date of the most recent version is always shown at the top of this page.

Contact and complaints

For questions, requests or complaints about privacy, you can contact:

Pepijn Kreffer
The Netherlands
[email protected]

You also have the right to lodge a complaint with the Dutch Data Protection Authority.