Privacy policy

Who is responsible

See the legal notice.

What data we store

Groupilla works in open groups without an account. For protected groups you create an account with your email address, which you confirm with a code. If you set a password, we only store it encrypted. If someone invites you by email, we store your address for that. On your first visit, your device gets a random, anonymous ID. When you take part in a group, we store the name you enter and what you add, for example chat messages, votes, expenses or lists. Private conversations in the chat are only visible to the people in them, not to admins either. If someone reports a chat message, including a private one, we see its text so we can review the report. Information about diet and allergies, a wish list or contact details for a carpool are only added if you enter them yourself. Most things are visible to everyone in the same group. A wish list is only visible to the person who drew you, and contact details only to the people in the same car.

Where the data is stored

The database runs at Supabase in Frankfurt am Main, Germany (EU). We send emails through Resend from Ireland (EU), so the address and the content of the email go there. What you enter in the feedback form reaches us by email, and we keep it so we can reply to you. If you join a group’s chat, the admins of that group see your email address, the others don’t. The app is delivered through Vercel. For the weather forecast we query Open-Meteo, which only receives the place name you entered and no personal data. Suggestions for places and addresses in carpools come from Photon through our server. Only the text you are typing goes there, without your name and without your IP address. Photon is made by Komoot and based on OpenStreetMap data.

If someone calculates the detour for a carpool, we send the places entered through our server to Google (Google Maps Platform): the start and end of the ride and the places of the people looking for a ride. We don’t send any names, and we don’t store the result. Google may also process the request outside the EU. You can read more in the Google Privacy Policy.

A map of the ride only loads once you tap “Show map”, and then comes directly from Google. Google then learns your IP address and the places of the ride and may set its own cookies. Your browser remembers this choice on this device.

GIFs in the chat come from Giphy (Giphy, Inc., USA). When you search for a GIF, only your search term goes to Giphy through our server, without your name and without your IP address. The images also load through our server, so your browser never connects to Giphy. For a GIF that was sent, we only store its Giphy ID and its size. You can read more in the Giphy Privacy Policy.

If you share your location in the chat, your browser asks for permission first. Only that one spot is stored, as coordinates in the message, and it’s visible to everyone who can see the message. We don’t track your location any further.

Visitor numbers

To see which pages are used, we use Vercel Web Analytics. It doesn’t set cookies. It records the page visited, where the visit came from and rough information about country, device and browser. According to Vercel, visits are only told apart by a value that changes every day, and they can’t be followed across several days or websites. Group content is not included, and for group pages we send neither the group’s name nor the invite link.

How long

Groups stay stored, also after the event. From the answers we learn, for example, which amounts suit a group. If you’d like us to delete a group or your information, just send us an email.

What we don’t do

No tracking across websites, no advertising cookies, no sharing with third parties other than the services named above. We only set cookies for your anonymous session and, if you choose it or we detect it, for your language (cookie “sprache”).

Your rights

You have the right to access, correction, deletion, restriction of processing, data portability and withdrawal of consent, and you can complain to a supervisory authority. Contact us at the address in the legal notice.