Privacy

1. Controller

2. Website and technical data

When you access the website or app, our systems process technically necessary data such as IP address, request time, requested resource, user agent, app version, device type, and security events. We use this data to deliver the service, maintain sessions, prevent abuse, and diagnose errors.

When the app or our servers run into an unexpected error, we send an error report to Bugsink, an error tracking tool we run ourselves on our infrastructure at Hetzner in the EU. The report contains the error type and message, the affected place in the code, app version, browser or device type, and the last technical steps before the error, such as opened screens and network calls, with identifiers removed. It contains no account data, no IP address, and nothing you entered. No third party receives these reports.

The legal basis is Art. 6(1)(b) GDPR where processing is needed to provide the requested service, and Art. 6(1)(f) GDPR for secure and reliable operation.

3. Phone account and one-time codes

The current onboarding flow uses your mobile phone number and a one-time code sent by SMS. We process the phone number, verification status, temporary verification data, account identifier, display name, and session data to create and protect your account. The current phone flow does not require an email address.

We use seven communications GmbH & Co. KG, Willestraße 4-6, 24103 Kiel, Germany, also known as seven.io, to send one-time codes by SMS. We send your phone number and the SMS text containing the one-time code to seven.io, which processes this data on our behalf to deliver the authentication message.

4. Profile and bands

During onboarding, we process your display name and preferred language to create your profile.

When band features are active, members of your bands see your name, and members of the same band see your phone number. We will update this policy before introducing materially different processing.

5. Push notifications

If you enable push notifications, we store the device’s Firebase token, platform, and app version. Google Firebase Cloud Messaging receives the token and notification payload so it can deliver alerts about your bands and dates. You can withdraw the device permission at any time in its settings.

6. Service providers and recipients

We use Hetzner Online GmbH for hosting and database infrastructure in the EU, Scaleway SAS in France for encrypted backups, and Cloudflare, Inc. for DNS, traffic routing, and protection. seven.io receives SMS delivery data. Resend, Inc. receives email delivery data, and Google Firebase receives push delivery data.

We do not sell personal data and do not share it for third-party advertising. Other Come In users receive data only where the feature you choose requires it, for example the members of a band you join.

7. Cookies, local storage, and secure storage

We use technically necessary cookies or browser storage for sessions, language, security, and app preferences. On supported native devices, the bearer session token is stored in secure device storage. We do not use advertising cookies.

8. Audience measurement with Umami

We use Umami, a self-hosted analytics tool, to understand aggregate use of the public website and improve its content. It runs on our own infrastructure at Hetzner in Frankfurt, Germany, is served from our own domain, and sets no analytics cookies. No third party receives this data.

Umami processes page views and technical information such as visited URL, page title, referrer URL, browser language, screen size, browser, operating system, device type, and approximate country. Your IP address is shortened before it reaches the analytics tool, IPv4 to its first three blocks and IPv6 to its first three groups, and no full address is stored. The legal basis is Art. 6(1)(f) GDPR.

9. Contact messages and the launch waitlist

If you contact us by email, we process your message and contact details to handle your request. We retain them only for as long as needed or required by law.

Before launch you can leave your email address on our website to be notified when Come In launches. We store only that address, your language, the time of the signup, a random confirmation token, and the times at which you confirmed or left the list.

We send one confirmation email and add the address only after you click the link in it. We use the address for the launch notice and nothing else, we do not send a newsletter, and we do not pass the address on. The legal basis is your consent under Art. 6(1)(a) GDPR. Every email carries an unsubscribe link that removes you immediately, you can also withdraw your consent by writing to us, and we delete the waitlist once everyone has been notified.

10. Retention

Account and profile data is stored while your account is active. Temporary verification codes and short-lived session data expire automatically. Security data is retained only as long as necessary for abuse prevention or legal obligations. You may request account deletion at any time.

11. Your rights

You have rights to access, correction, deletion, restriction, data portability, and objection. Where processing is based on consent, you may withdraw that consent at any time without affecting earlier lawful processing.

To exercise your rights, contact us at [email protected]. You may also lodge a complaint with the Austrian Data Protection Authority.

12. Data security

We use appropriate technical and organizational safeguards, including encrypted transmission, access controls, secure session handling, restricted infrastructure access, and regular backups.

13. Changes and contact

We update this policy when Come In features, data flows, or service providers change. The current version is always available on this page. For privacy questions, contact Come In Labs FlexCo at [email protected].