Privacy Policy for the Skandineer app

The short version

• Your exact location is never shown to others. We store your most recent position on our server so we can calculate distances and derive which approximate area your pin should show. What others see is an approximate area of roughly 5 km and, on your profile, which city or town that area is in, never your exact location. Location sharing is entirely optional, and if you turn off your map visibility the stored position is deleted.
• Your trips are never shown on the map. If you add a trip, others who are also going to the country see it, and it is shown on your profile. People you block never see it, and you can remove the trip whenever you like.
• We do not read your messages in the ordinary course. If a conversation is reported a moderator may read it, and opening the conversation beyond the reported message is logged together with the reason.
• We never sell your data and show no ads. We make money from optional Plus subscriptions, nothing else.
• All core data is stored within the EU (Frankfurt, Germany).
• You can download your data and delete your account directly in the app, without contacting us.
• Skandineer is for adults (18 or older).

Data controller

Skandineer AB, Swedish company reg. no. 559579-5435, Stockholm (“Skandineer”, “we”) is the data controller for the processing of your personal data in the Skandineer app.

Contact for privacy matters: hello@skandineer.se

What data we collect

We process no special categories of data under Art. 9 GDPR (health, religion, sexual orientation, ethnicity, etc.). What we do process:

• Account: email address and password (always stored encrypted), or your Apple identity if you use Sign in with Apple, or your Google account if you sign in with Google. If you sign in with Google, Google sends us your Google ID, your email address, your name and a link to your profile picture at Google. We only use your first name, as a suggested display name when you create your account; the name and picture from Google are never shown to others.
• Profile: display name, date of birth, gender (including “prefer not to say”), home country, languages, profile picture, bio and interests. Your date of birth is never shown to others, at most your age or an age range.
• Location: if you choose to appear on the map, we store your most recent position on our server, along with how accurate the measurement is and which country and city it falls in. We need it to calculate distances and to derive which approximate area your pin should show. The position is never shown to other users. What others see is an approximate area of roughly 5 km derived from the position, and the name of the city or town that area is in. Both are stored as separate records. Your position is only updated while you are using the app (never in the background) and always replaces the previous one. If you choose “Hide me from the map”, the stored position is deleted immediately. If you delete your account, it is deleted when the account is permanently deleted, 30 days later. Trips do not use your position.
• Content: chat messages, posts, comments, images, and the groups and activities you create or join. Posts in the forum written in an older version of the app can have one or more countries and months, or the label “Open destination”. New posts have no country. Images are automatically stripped of hidden metadata (such as GPS coordinates in photo files) at upload.
• Social connections: groups you have joined, activities you have signed up for, country group chats you have joined, and users you have blocked.
• Trips: the country you are travelling to (one per trip), start and end month (at most twelve months) or that your dates are flexible, if you like a city, and when you added the trip. With flexible dates we store no months as yours, and the trip lasts twelve months from when you added it. You pick the city from a list of cities and towns, never an address or a place within a city. We never store days. You add trips yourself and can remove them at any time. More on who sees them under “Trips in detail”.
• Searches in the forum: when you search the forum, we keep what the search was about, for example “Jobs” and “Spain”, and when you searched. We never keep the text you typed. We use it to show your recent searches and to show posts about the same thing higher up in the forum. Topics that could reveal health, sexual orientation, dating or family circumstances are never kept, even if you search for them. You can clear your searches at any time.
• Device: device model, operating system version, app version, your phone's time zone and a push notification address (token), so notifications reach the right device at a reasonable time. The time zone is also used so that the day in Trips starts at midnight where you are (see “Trips in detail”).
• Purchases: payment is handled entirely by the store, the App Store or Google Play. We never see your card details, only the subscription's status.
• Usage statistics: which screens and features are used, tied to an internal ID and never to your name or email address. Never contains your messages, your exact location, your destinations, months or cities, or any free text. To find usability problems we may also record how the app is used on screen, with automatic masking: text you type and images are hidden in the recording. All of this can be turned off at any time in settings (“Share usage statistics”).
• What kinds of profiles you look at: when you open someone else's profile we save that you did, when, for how long and from where in the app (for example the map, the forum or Trips), and a few rough facts about the person compared with you: roughly how big the age difference is, whether they were in your free selection on the map, whether you had Plus yourself and, when you are both on the map, roughly how far away they are (for example 10-30 km) We never save whose profile you looked at. When someone else opens your profile, the same rough facts about you compared with them are saved, but never your name or your ID. The data is kept by us, not in the statistics tool. We use it to understand what makes people buy Plus, and only read it as totals for many users at a time, never for an individual. If you have turned off “Share usage statistics”, nothing is saved about which profiles you look at and no facts about you when others open your profile, and what was saved about your looking before is deleted within a day.
• Crash reports: technical error reports linked to an internal ID, never to your name or email address (other personal data is scrubbed automatically).
• Translation: when you tap “Translate”, the text is translated on your phone with Google's ML Kit tool. The text is never sent to us or to Google. The first time a language is used, your phone downloads a language file from Google. The tool also sends technical usage data to Google: device model, operating system version, app version, performance metrics, which languages are detected and translated, and a per-installation ID that is not linked to your account.
• Reports and moderation: reports you make or are affected by, a copy of reported messages, decisions and their reasoning, and a log of when a moderator read a conversation and why. If someone is reported from Trips, we also keep a copy of the trips that belong to the report (see “Trips in detail”).
• Abuse protection in Trips: when you see the trips on someone else's profile, we record that you did and when, so we can limit how many profiles each person can see trips on. Nobody else sees it.
• Event log: for operations, security and statistics we log that certain things happened in the app, for example that an account was created, that a trip was added or removed, or that a message request was sent. The log contains no messages and no destinations or months.

Why, and on what legal basis

We process the data to provide the service, keep it safe and comply with the law. We send no marketing, only messages that belong to the service. Legal basis under Art. 6 GDPR per area:

• Account, profile, content, groups and chat: contract (6.1.b).
• Trips and the country and month on posts: contract (6.1.b), to show who else is going to the same country and which of them are there in the same month, to show trips on profiles, and to order the forum so that what concerns you comes first.
• Searches in the forum: contract (6.1.b), to show your recent searches and to show posts about what you searched for higher up in the forum.
• Country group chats (membership, member list, messages, notifications): contract (6.1.b), to let people going to the same country talk to others going there, to show who is in the chat, and to tell you when there are new messages or someone replied to you.
• Trip notifications: contract (6.1.b), to tell you that more people have added a trip to the same country, in the same month as you or at any time if your dates are flexible, or have written about the same country and month. You turn them off with the notification switch in settings.
• Location (approximate): consent (6.1.a), voluntary and revocable. The location is used to show you on the map to other Scandinavians, to calculate distances, and to notify you when Scandinavians, groups or activities are near you. Country and city are also used in our internal statistics on where the app is used.
• Device data: contract (6.1.b) and legitimate interest (6.1.f) to prevent abuse.
• Abuse protection in Trips (whose trips you have seen on profiles): legitimate interest in a safe service (6.1.f), to prevent anyone from mapping many people's trips.
• Usage statistics and session recordings: legitimate interest (6.1.f); you can object at any time by turning it off in settings (Art. 21).
• What kinds of profiles you look at, and rough facts about you when others open your profile: legitimate interest (6.1.f), to understand what makes people buy Plus, so that we can shape the offer and what is free. You can object at any time by turning off the usage statistics in settings (Art. 21).
• Crash reports: legitimate interest (6.1.f).
• On-device translation (technical usage data to Google): legitimate interest (6.1.f), so you can read posts and messages in your language.
• Purchase data: contract (6.1.b).
• Moderation, security log and event log: contract, legitimate interest and legal obligation (6.1.b, 6.1.f, 6.1.c), to protect users, comply with the law and run and measure the service.
• Review of reported conversations, the copy of trips in a report, and spam protection: legal obligation under the EU Digital Services Act (6.1.c) and legitimate interest in a safe service (6.1.f). The spam protection counts patterns (volume, recipients, whether messages are identical) without anyone reading the content.
• Accounting records for purchases: legal obligation (6.1.c, the Swedish Bookkeeping Act).

Location sharing in detail

The map is the heart of Skandineer, so we want to be extra clear:

• Location sharing requires two active choices: the operating system's location permission and your choice inside the app.
• Your pin marks an approximate area of roughly 5 km, never your exact location. The area is derived on our server from your position. Other users see the area and, on your profile, the name of the city or town it is in, never the position.
• On your profile, others see which city or town your area is in (for example “Barcelona” or “Bali”). In and around cities it is the city's name, which says less than the pin. Outside cities it is the nearest town within roughly 10 km, and far from any town the region, which says about as much as the pin but never more. The name is derived from the approximate area, never from your exact position. It is only visible to people who can open your profile, even if they hide from the map themselves. If you hide from the map, or have not been on the map for a long time, it says “Location off” instead. Place names come from GeoNames (geonames.org) and are used under the CC BY 4.0 licence, in adapted form.
• Your exact position is stored on our server for as long as you are visible on the map. We need it to calculate distances, to know which area your pin should show and for the notifications about what is near you. It is never disclosed to other users and it is not visible anywhere in the app.
• If you choose the “Hide me from the map” mode, your pin disappears from the map, the stored position is deleted, and you no longer see other people's pins either (reciprocity). You still see which city or town others are in when you open their profile. Your trips are still visible to other travellers and on your profile, because they are not part of the map. If you do not want them to be visible, remove them.
• Your position is only read while you are using the app, never in the background.
• If you delete your account, your pin disappears immediately. The stored position is kept during the 30 days in which you can change your mind, without being shown to anyone, and is deleted when the account is permanently deleted.

Trips in detail

A trip says something about where you will be later on, so we have built Trips to show as little as possible to as few people as possible:

• Only country, month or flexible dates, and if you like a city. Never days, never an address or a place within the city. The cities come from the same GeoNames data as the place name on your profile and are never more precise than that.
• Who is going there is only shown to someone who is going there too. The list of others going to the same country is only shown to someone who has a visible trip to the country, whatever the months. They see your name, your age, your profile picture, your home country, your bio, the city if you picked one and your months (or that your dates are flexible), and a marker if you are there in the same month. They do not see your other destinations in the list. Without Plus, three people per trip are shown and the rest as blurred pictures with no name or other text. The three are picked from the first five in the list and move on by one place a day, at midnight where the viewer is, so without Plus someone can over time see up to five people per trip. Counts are also only shown to someone who has a trip there.
• On your profile your active trips (country, city and months) are visible to people who can open your profile, also to people who have no trip themselves and also if you hide from the map. The viewer must have a public profile with a profile picture. Each person can only see trips on a limited number of profiles per day and per week, and to count this we record whose trips you have seen and when.
• Never on the map. No trips and no counts are shown on the map.
• The same rules as in the rest of the app apply: someone you have blocked, or who has blocked you, never sees your trips and you never see theirs. Trips are only shown between people within the age range the app shows you. Suspended or deleted accounts are not shown.
• The trip is visible when you have a profile picture. Without one, the trip is not visible to others, and you do not see others either.
• Contact: replying to posts and writing your own is free. With Plus you can send a message request to someone who also has a trip to the country, even if you are not near each other on the map. The recipient decides whether to reply and can decline, block and report. We limit how many such requests can be sent per day and per week, and we log that the request came through a trip, without the country or month.
• Trip notifications: if you have a trip or a post with a country and month, you may get a notification when more people have added a trip there in the same month as you, or at any time if your dates are flexible, or have written about the same country and month, for example “Vietnam in March: 2 more people are going at the same time as you” or “Vietnam: 2 new travellers”. Without Plus the notification only counts new people you can see without Plus. At most one such notification per day, only between 9:00 and 21:00 in your time zone, never with a name or picture. The notification text contains the country and the month (see “Transfers outside the EU/EEA”). You turn them off with the notification switch in settings.
• Country group chats: if you have a trip that others can see, you can join the group chat for that country from the trip's page, one for people aged 18-30 and one for people 31 and older. Only people with an active trip there in the same age group can join. The chat then sits among your other chats. The others in the chat see that you are in it: the chat has a member list, and in it members who may see you on the trip's page see the same details as there (name, age, profile picture, home country, bio, city and months), with the same rules for Plus, blocking and age range. Everyone in the chat reads what you write there, even if the trip you joined with is only shown to some people. Readers see your name, your profile picture and your message, and from the context that you are going to the country. In the chat for 31 and older the age range does not limit who reads, but it does limit the member list, who can open your profile and who can message you. Someone you blocked, or who blocked you, does not see your messages and you do not see theirs. You can leave the chat whenever you like, and when your trip ends or is removed you leave it automatically. When there are new messages you may get a notification with the country and the number (“Thailand: 5 new messages”), and if someone replies to your message a notification that names the country but never the person (“Someone replied to you in the Thailand chat”), at most one per chat every ten minutes. A switch in the chat turns both off. Messages are deleted automatically after 90 days. We moderate the chats through reports, like all other content.
• “Remove trip” deletes the trip immediately. Otherwise the trip stops being visible the day after its end month and is deleted 30 days later.
• Reporting from Trips: if you report someone from Trips, we keep a copy of the trips that belong to the report, the reported person's trips that you could see when you reported and those of your own trips that show why you met (country, city, months and when the trip was added). The copy is needed because a trip can be removed in an instant. Only moderators see it. Your own trips are removed from the copy when the report has been decided. The reported person's part follows the report (see “How long we keep your data”).

Who we share data with

We never sell your data. Beyond the providers below, we only disclose data where the law requires it (for example in a criminal investigation, after legal review). These providers process data on our behalf under data processing agreements:

• Supabase: database, sign-in and file storage (EU, Frankfurt).
• Sentry: crash reports (EU, Frankfurt).
• PostHog: usage statistics and masked session recordings, can be turned off in settings (EU, Frankfurt).
• RevenueCat: subscription management (USA, see next section).
• Mapbox: the map imagery in the app, the place search when you create a group or an activity, and the map's own usage telemetry (global CDN, see next section).
• Resend: service emails such as confirmations and password reset (USA, see next section).
• Expo: relays our push notifications to your device, and delivers app updates (USA, see next section).
• Apple: payments in the App Store, Sign in with Apple and push notification delivery to iPhone.
• Google: payments in Google Play, sign-in with Google (Google then learns that you sign in to Skandineer), push notification delivery to Android devices, and the language files for on-device translation (ML Kit), which sends technical usage data to Google (see “What data we collect”).
• Vercel: hosting of our internal administration tool (EU).

Transfers outside the EU/EEA

• RevenueCat (USA): protected by the European Commission's Standard Contractual Clauses (SCCs). We minimize what is sent: subscription data and a customer ID, never your messages, your location or your content.
• Resend (USA): sends our service emails and stores metadata and logs in the USA, protected by Standard Contractual Clauses (SCCs). Only your email address is involved.
• Mapbox: when the app fetches map tiles, Mapbox sees your IP address, as does any web server you visit. When you search for a place in the group or activity wizard, Mapbox receives your search text and your position so results can be sorted by distance. The map component also sends usage telemetry to Mapbox, which according to Mapbox includes location, altitude, accuracy, a session ID and IP address. All of it is governed by a data processing agreement. Nothing is sent to Mapbox when you pick the country and city for a trip.
• Expo (USA): our push notifications are relayed to your device via Expo's service. Expo receives and stores your push notification address (token), and receives the notification's title and body, which can contain another user's name and the beginning of a message, or, for trip notifications and the country group chats, a country and sometimes a month you are travelling. The notification text itself is not stored by Expo: it is passed on to Apple or Google and discarded. The app also asks Expo whether a new app update exists, and Expo sees your IP address when it does. Expo participates in the EU-U.S. Data Privacy Framework, which covers the transfer to the USA. We never send your location, your password or whole conversations to Expo.
• Apple and Google: push notifications are delivered via Apple's servers to iPhone and via Google's servers to Android devices. Push tokens cannot be linked to your identity without our database.

How long we keep your data

• Account, profile and content: for as long as your account exists.
• Location (exact, on our server): only the most recent position is stored, each new one replacing the previous. It remains for as long as you are visible on the map, and is deleted when you choose “Hide me from the map” or when the account is permanently deleted, 30 days after you delete it.
• Pin area and the city or town name (what others see): same as above, only the most recent one, deleted when your pin disappears or the account is deleted.
• Trips: no longer visible the day after the end month and deleted 30 days later. “Remove trip” deletes immediately. When you add a trip, a copy of the response is kept for at most 7 days so that a retry does not create the trip twice; it is overwritten when you remove the trip.
• Whose trips you have seen on profiles (abuse protection): at most 8 days.
• Searches in the forum: 30 days after you last searched for the same thing, and at most the 50 most recent. “Clear” deletes them at once.
• Trip notification bookkeeping (when you last got one and what you have already seen): deleted after 8 days without a new notification or a new visit, and with the account.
• Deleted account: 30-day grace period, then permanent deletion.
• Database backups: kept for 7 days and overwritten on a rolling basis. Data that has been deleted may remain in a backup until then, but it is not restored to the service.
• Messages in country group chats: deleted automatically 90 days after they were sent. A message under an open report, or one you have appealed, is kept until the case is closed. Notifications from the chat are deleted after 90 days, and at once when you leave the chat (yourself, or when your trip ends). That you are in the chat is kept until you leave it.
• Chat images: for as long as the chat exists. An image you delete is permanently removed 30 days later. Everything is deleted when the account is deleted.
• Notifications: for as long as your account exists, and deleted with the account. Notifications about a trip are deleted with the trip.
• Crash reports: 90 days.
• Usage statistics: up to 1 year.
• What kinds of profiles you have looked at: 1 year, then deleted automatically. Deleted with the account, and within a day if you turn off the usage statistics.
• Session recordings: up to 30 days.
• Purchase/accounting records: at least 7 years (the Swedish Bookkeeping Act), anonymized if the account is deleted.
• Copies of reported messages and trips: deleted 90 days after the report is closed without action. If the report leads to a decision, the copy follows the moderation log. The reporter's own trips are removed from the copy when the report has been decided.
• Security and moderation log: kept for as long as the account exists, and anonymized when the account is deleted.
• Event log: for as long as it is needed for operations, security and statistics. When your account is deleted, your ID is replaced by a random code.
• Account under an active suspension: the data the case requires is kept for as long as the case is open, and for no more than 12 months.

What happens when you delete your account?

The account is deactivated immediately: your profile, your pin, your trips and your content stop being visible. For 30 days you can change your mind by signing in again. After that, your data is permanently deleted, including images, location, trips and searches. The exception is cover images for groups and activities that remain for their other members; they are kept with no link to you.

Two things we must keep by law, in anonymized form with no link to your identity: accounting records for purchases and the security/moderation log. Copies of messages you sent that were reported are anonymized, and copies of your trips in reports are deleted. In the event log and our other logs, your ID is replaced by a random code that is created at deletion and never stored together with your data, so the logs can no longer be linked to you. If someone wrote your name in their own message (“hi Erik!”), it remains in that person's conversation, just as in email and text messages.

Your rights

Under the GDPR you have the right to:

• Access and export your data: tap “Download my data” in the app's settings to receive everything you have provided, in machine-readable format, including your trips (Art. 15 and 20). Three things are not included, to protect others: whose trips you have seen on profiles (that is other people's data and is only kept for a few days for the abuse protection), copies of your trips in reports about you as long as the report has not led to a decision, and, for the profiles you have looked at, how far away the person was (that would reveal where they are). The facts about you when others have opened your profile are kept without your ID, cannot be linked to you and therefore cannot be provided (Art. 11). When a report has led to a decision, you get your own trips from the copy, but never anything about who reported (Art. 15.4).
• Correct inaccurate data: most things you edit yourself in your profile; locked fields (such as name and date of birth) we correct by email (Art. 16). You change a trip by removing it and adding it again.
• Delete your account: directly in the app under Settings (Art. 17). You remove a single trip on the trip's page.
• Restrict or object to processing: usage statistics, session recordings and what kinds of profiles you look at are turned off directly in the app's settings, with “Share usage statistics” (Art. 21). For other objections, email hello@skandineer.se (Art. 18 and 21).
• Withdraw consent at any time: location sharing is turned off in settings, without affecting the rest of the service.

Automated decisions and complaints

No decisions with legal or similarly significant effects are made about you in a fully automated way (Art. 22). Automated filters may temporarily hide content that violates our rules. Such actions are reviewed by a human, you receive a statement of reasons, and you can appeal in the app.

Complaints: you can always contact the Swedish Authority for Privacy Protection (IMY, imy.se), or the data protection authority in the EU country where you live.

Age limit

Skandineer is for adults. You must be 18 or older. This is verified at registration, and younger users cannot create an account. If you suspect someone is under 18, you can report it in the app.

Changes to this policy

For material changes we will notify you in the app before they take effect, and you can always choose to close your account. Each version of this policy is versioned (this one is privacy_v6), and we record which version you accepted.

If we want to engage a new provider that processes personal data, we will notify you 30 days in advance in the app and by email.

The website skandineer.se

This policy also applies when you visit our website. There we collect no personal data and set no cookies. We use Vercel Web Analytics for anonymous visitor statistics: which pages are visited, where visits come from, what type of device is used and how many click through to the App Store or Google Play. No IP address is stored, and visits are counted with a temporary value that is deleted after one day, so the statistics cannot be linked to you. The website is hosted by Vercel. The language you read in is given by the address, not by a cookie.

Contact

Skandineer AB · Company reg. no. 559579-5435 · hello@skandineer.se

The website waitlist has its own privacy policy: skandineer.se/integritet.