Privacy Policy

Last updated: 26 October 2026

Who we are

Pivka (the "app") is operated by SPEED CONTROL s.r.o., ID No. (IČO) 02596733, registered office Prokopa Velikého 606/32, Vítkovice, 703 00 Ostrava, Czech Republic, registered in the Commercial Register kept by the Regional Court in Ostrava, file C 58146. We are the data controller for the purposes of GDPR. This policy explains what data we collect, why, and what you can do about it. Privacy questions and requests: privacy@pivka.app.

What we collect

• Account: email address, username, display name, date of birth (to confirm you are 18 or older), password (stored only as a salted argon2 hash on our own servers — never in plain text).
• Profile: optional avatar photo; optional body stats (weight, height, biological sex) used only to estimate your BAC — never shared with other users.
• Activity content: photos, captions, titles, voice notes, drink logs, timestamps, optional venue label, BAC estimates, morning check-in responses (how you felt the morning after).
• Stories: photos you post as a story; they disappear after 24 hours and are then deleted.
• Location (optional): if you grant location permission, the approximate GPS location where a night starts, and any location data attached to your activity photos (read from the photo's own metadata or from your device when you take it in-app). Used only to remember where your night happened. It is never required — the app works fully without it, and you can decline or revoke the permission at any time in your device settings.
• Social: friends list, tags, likes (Cheers), comments, crews (name, picture, members), blocks, reports. When you start a night you can choose to show friends that you are out ("who's out"); this never includes where you are.
• Device: push notification token, device identifier (used internally by crash reporting and update services), app version, OS version.
• Crash and error data: anonymised stack traces, breadcrumbs, and device context collected automatically when the app crashes or encounters an error.
• Access tokens: if you create a token to connect an external tool (such as an AI assistant) to your account, we store only a hash of it.

Email address, username, password and date of birth are required to create an account. Everything else is optional; leaving it out only switches off the feature that uses it.

How we use it

To operate the app: show your feed, run leaderboards, deliver notifications, calculate your BAC estimate, and let friends interact with your activities. If you have entered body stats, "Look out for each other" estimates your drinking level during an active night (the estimate is not stored) and may send a push notification to you and a heads-up to the friends tagged in that night. We do not sell your data, and we do not use it for advertising. Leaderboards and statistics are calculated from your activity, but we do not carry out automated decision-making that produces legal or similarly significant effects.

Legal basis for processing

We rely on the following legal bases under the GDPR:

• Your account and activity content — to provide the service you signed up for (Art 6(1)(b), performance of a contract).
• Body stats, your BAC estimate and "Look out for each other" alerts — health-related data we process only with your explicit consent (Art 9(2)(a)), given when you choose to enter body stats. You can withdraw that consent at any time by deleting them in Settings.
• Location — processed only with the consent you grant on your device (Art 6(1)(a)), which you can withdraw at any time.
• Reports, blocks, crash and security logs — our legitimate interest in keeping the app safe and stable and preventing abuse (Art 6(1)(f)).

What is visible to other users

• Your username, display name, avatar, posted activities (photo, title, caption, drink summary, BAC estimate, voice note, morning check-in emoji), stories, crews, and Cheers / comments are visible to accepted friends and to users you tag.
• Friends tagged in your night may receive a "Look out for each other" heads-up if you have body stats set.
• Your email, date of birth, push token, body stats, location data, and blocks / reports are private to you. Location is owner-only: the coordinates attached to your activities and photos are never shown to other users, and location metadata is stripped from every photo file before it is stored and served to anyone else.

BAC estimate

The BAC estimate is available only in the Android app; the iOS app does not collect body stats or calculate BAC. Body stats are stored on the server and attached only to your account. Because body stats and the resulting BAC estimate are health-related, we treat them as special-category data under Art 9 GDPR and process them only with your explicit consent. The BAC value shown on each activity is a rough estimate computed from your drinks and body stats using the Widmark formula. It is not medical advice and must not be used to decide whether you can drive or operate machinery.

Reports and moderation

When you report content or a user (blocking someone also files a report), we receive your username, the reported user and content, and the reason you chose, in our moderation inbox. A person reviews every report; we do not use automated tools to make moderation decisions.

Where data is stored

Data is stored on servers we manage ourselves, rented from Hetzner Online GmbH in its data centre in Helsinki, Finland (EU). The database (PostgreSQL), the file storage for photos and voice notes, and our crash reporting run on that infrastructure.

Recipients and processors

• Hetzner Online GmbH (Germany) — server hosting in the EU.
• Expo (650 Industries, Inc., USA) — relays push notifications to Apple and Google; receives your push token and the notification text, which can include friends' names. Also over-the-air app updates (device and update metadata).
• Apple Push Notification service / Google Firebase Cloud Messaging (USA) — push delivery; receive your push token and the notification.
• Resend (Resend, Inc., USA) — sends password-reset emails (your email address) and delivers reports to our moderation inbox.
• Cloudflare (Cloudflare, Inc., USA) — DNS for pivka.app and forwarding of emails you send to @pivka.app addresses.
• Apple App Store and Google Play — distribute the app under their own terms and privacy policies.

Crash and error monitoring runs on GlitchTip that we self-host on our own infrastructure, so anonymised error reports, stack traces, and device context are not shared with a third party. No personal content (photos, captions, drink data, or location) is sent to it.

Expo, Apple, Google, Resend and Cloudflare are based in the United States, so using them involves a transfer outside the EU. These providers are certified under the EU–US Data Privacy Framework and/or rely on Standard Contractual Clauses. All other personal data stays on our EU servers. We disclose data to public authorities only where the law requires it.

How long we keep it

Until you delete your account. Deleting your account removes your profile, activities, drinks, photos, voice notes, stories, comments, Cheers, friendships, crews you own, body stats, location data, blocks, and reports. Stories are deleted 24 hours after posting. Backups, where kept, are overwritten within 90 days. Anonymised crash logs may be retained for up to 90 days. Some security logs may be retained for up to 30 days for abuse-prevention purposes.

Your rights

Under GDPR you have the right to:

• access your personal data and get a copy of it (Art 15);
• have inaccurate data corrected (Art 16);
• have your data erased (Art 17);
• restrict processing (Art 18);
• data portability — Settings → Download my data gives you everything as a file (Art 20);
• object to processing based on our legitimate interest (Art 21);
• withdraw consent at any time (for body stats, your BAC estimate, and location) — this does not affect the lawfulness of processing carried out before you withdrew.

You can delete your account in-app at any time (Settings → Delete account — step-by-step guide). For any other request, write to privacy@pivka.app. We respond without undue delay and at the latest within one month; in complex cases this can be extended by two more months, and we will tell you if so. Requests are free of charge.

You also have the right to lodge a complaint with a data protection supervisory authority. In the Czech Republic, this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.

Age limit

Pivka is only for people aged 18 or older, because it is about alcohol. Signing up requires confirming a date of birth showing you are 18 or older. We do not knowingly collect data from minors. If you believe a minor has created an account, contact privacy@pivka.app and we will remove the account promptly.

Changes

We may update this policy. We will note the change date at the top and notify active users in-app when changes are material.

Contact

SPEED CONTROL s.r.o., Prokopa Velikého 606/32, Vítkovice, 703 00 Ostrava, Czech Republic
privacy@pivka.app