top of page
Groopzy-Logo

Privacy Policy

Last updated: 5 October 2026 · Beta version
This Privacy Policy applies to the Groopzy app for iOS and Android and to our website groopzy.app.

1. Controller

The controller under the GDPR is Groopzy GbR, represented by its partners Tobias Neef and Daniel Schotte, Käfertaler Straße 21, 68167 Mannheim, Germany. Contact for privacy questions: hello@linus.works.

Groopzy is intended for people aged 16 and over. People under 16 may not use Groopzy.

2. What data we process in the app

  • 2.1 Account data. When you register: email address, display name, the identifier from your sign-in provider, sign-in times, and a home region derived from your app store country or sign-in. Legal basis: Art. 6(1)(b) GDPR (performance of contract).
  • 2.2 Coordination data. When you plan something: your chat input, activity title and description, suggested and confirmed time slots, locations, participants’ responses and voting results. Legal basis: Art. 6(1)(b) GDPR.
  • 2.3 Calendar data. With your explicit permission, the app reads your device calendar to match suggestions against your availability and, if you want, adds confirmed dates to it. Your event titles never leave your device. Only busy times are sent to our servers, meaning the information that a slot is taken, not what it is taken by. We use these times only for the duration of the calculation and do not store them. Calendar data is never sent to the language model. On the server we only store dates that were created through Groopzy itself. You can withdraw the permission at any time in your device settings; the app remains usable without automatic availability checks. Legal basis: Art. 6(1)(a) GDPR (consent via the system permission).
  • 2.4 Contacts. Groopzy does not access your address book. You decide whom to invite by sharing an invite link yourself.
  • 2.5 Invitations. Anyone who joins a plan via an invite link uses the app with their own account; sections 2.1 to 2.3 apply. When an invite link is opened in a browser, we process technical connection data and show a preview of the invitation (name of the person inviting, activity) in order to direct you to the app. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in carrying out the invitation).
  • 2.6 Technical and diagnostic data. Device type, operating system version, app version, language setting, error reports, response times and identifiers for troubleshooting. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable operation).
  • 2.7 Push notifications. With your permission, we process a device token to notify you about invitations, responses and confirmed dates. Legal basis: Art. 6(1)(a) GDPR.
  • 2.8 Purchases and subscriptions. No payments are charged during the beta. Once we offer subscriptions, Apple (App Store) or Google (Google Play) handle payment and billing. We do not receive payment data such as card or bank details. Through our service provider RevenueCat, we receive the information needed to unlock the subscription: a pseudonymous purchase and customer identifier, the product purchased, purchase date, term, renewal and cancellation status, country or currency and price. We also count how many plans you have started in a month in order to apply the free allowance. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (statutory retention obligations).

3. Use of AI for scheduling

Groopzy uses a large language model to turn your input into structured scheduling suggestions. For this, the content of your planning conversation is sent to our service provider OpenAI, acting as a processor under a data processing agreement. The data is not used to train OpenAI’s models. No calendar data is sent to the language model. There is no automated decision-making with legal effect within the meaning of Art. 22 GDPR; all suggestions are non-binding and confirmed by you. Legal basis: Art. 6(1)(b) GDPR.

4. Use for product improvement

With your consent, we analyse the history of your coordinations in pseudonymised and cleaned form to improve the quality of suggestions. In particular, names, activity titles and locations are removed. We do not pass this data to third parties for their own purposes and do not use it to train third-party AI models. Details are set out in section 8 of our Terms of Use. Legal basis: Art. 6(1)(a) GDPR (consent during onboarding). You can withdraw your consent at any time with effect for the future; the app remains fully usable without it.

5. Website and waitlist

  • 5.1 Hosting. Our website groopzy.app is hosted by Wix.com Ltd. (Israel). When you visit it, Wix processes technically necessary data such as IP address, browser type, operating system, pages visited and time of access. The European Commission has issued an adequacy decision for Israel. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website).
  • 5.2 Cookies and analytics. The website uses strictly necessary cookies. We set Wix Analytics cookies only with your consent via the cookie banner. You can change your choice at any time via the banner or in your browser settings. Legal basis: Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act) together with Art. 6(1)(a) GDPR for analytics cookies; Section 25(2) TDDDG and Art. 6(1)(f) GDPR for necessary cookies. More information in Wix’s Privacy Policy.
  • 5.3 Waitlist. If you sign up for beta access on the website, we store your email address, first and last name and, optionally, how you currently organise meetups. We use this only to send you a beta invitation and to manage the waitlist. Legal basis: Art. 6(1)(a) GDPR (consent). You can ask to be removed at any time.

6. Recipients and processors

  • Hetzner Online GmbH (via Sliplane): Hosting, application servers (Germany)
  • Managed PostgreSQL database provider: Database (EU)
  • Auth0 (Okta): Sign-in and authentication (EU or USA)
  • OpenAI: Language model for scheduling (USA)
  • Expo: Push notification delivery (USA)
  • Apple, Google: Push transport (APNs, FCM) (USA)
  • BetterStack: Error and performance diagnostics (EU or USA)
  • RevenueCat, Inc.: Subscription management and unlocking (USA)
  • Apple, Google: Payment processing for in-app purchases (EU or USA)
  • Wix.com Ltd.: Website hosting, waitlist, analytics (Israel)

We disclose data to authorities only where we are legally required to do so.

7. Storage location and transfers to third countries

Your app data is stored in the European Economic Area. For the US providers listed in section 6, transfers are based on standard contractual clauses or an adequacy decision; an adequacy decision exists for Israel. If you take part in a plan organised by someone from another region, the coordination is processed in the organiser’s region. This is technically necessary because a plan contains shared data of several people.

8. Retention

  • Account and coordinations: until the account is deleted
  • Busy times from the device calendar: not stored, used only during the calculation
  • Purchase and subscription data: for the duration of the subscription; accounting-relevant data in line with statutory retention periods
  • Diagnostic data: 30 days
  • Cleaned data for product improvement: 24 months
  • Waitlist data: until the end of the beta or until you request deletion

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw any consent at any time with effect for the future. You can delete your account completely in the app under “Account → Delete account”. For all other requests, an informal message to hello@linus.works is enough. You also have the right to lodge a complaint with a data protection supervisory authority.

10. Information for users in Switzerland

If your habitual residence is in Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies. The purposes and processing described in this policy apply accordingly; the rights in section 9 are also available to you under the FADP. Switzerland recognises the EEA states as providing an adequate level of data protection. Transfers to the US providers listed are based on standard contractual clauses or the Swiss-U.S. Data Privacy Framework. You can also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC).

11. Changes

We update this Privacy Policy when our processing or the law changes. We inform you about material changes in the app. The current version is always available at groopzy.app/privacy-police.

bottom of page