Privacy Policy
Last updated: July 19, 2026
1. Who we are
Ollovas (“we”, “us”, “our”) provides a mobile and web application for privately sharing photos and videos of shared “moments” with friends, available at ollovas.com and through our mobile app. This policy explains what personal data we process, why we process it, and the rights you have under the EU/UK General Data Protection Regulation (GDPR) and similar laws.
2. The data we collect
Data you provide
- Account data: your email address, password (stored only as a salted hash by our authentication provider), and display name.
- Profile photo: an optional avatar image you upload.
- Content: the photos and videos you upload, their captions, and the moments you create (titles, descriptions, dates).
- Social interactions: comments you post and likes you give.
- Invitations and membership: the moments you join and your role in them (owner, contributor, or viewer).
- Waitlist (website only): your email address and, optionally, an age range, region, and feature interests.
Data collected automatically
- Photo location data: with your permission, the GPS coordinates embedded in photos you upload are stored with those photos and shown only within the moment they belong to. You can prevent this by disabling location access for your photo library in your device settings.
- Media metadata: capture date and time, dimensions, and file type of uploaded media.
- Server logs: request method, path, response status, and timing. We do not log request or response bodies, so these logs never contain your content, email, or credentials.
Photos and videos may show identifiable people, and images can reveal sensitive characteristics. We rely on your consent for the content you upload, and we ask that you only upload content you have the right to share.
3. How and why we use your data
| Purpose | Legal basis |
|---|---|
| Create and operate your account; provide the core sharing service | Performance of a contract (Art. 6(1)(b) GDPR) |
| Store and display the photos, videos, and moments you share with the people you choose | Performance of a contract; your consent for uploading images of others |
| Store photo location data and show it within a moment | Consent (Art. 6(1)(a)) — withdrawable at any time |
| Send account, security, and sign-in (magic link) emails | Performance of a contract |
| Waitlist sign-up and related updates | Consent |
| Keep the service secure, prevent abuse, and debug problems | Legitimate interests (Art. 6(1)(f)) |
4. Who we share it with
We do not sell your personal data, and we do not use it for advertising. We share it only with service providers who process it on our behalf:
- Supabase — database, authentication, and delivery of sign-in emails.
- Cloudflare R2 — storage of photos, videos, and avatars (European Union storage endpoint).
- Google Cloud Run — application hosting.
We also share your content with the other members of any moment you participate in — that is the purpose of the app. Profile avatars are visible to the people you share moments with.
5. International transfers
Some of our providers may process data outside the EEA or UK (for example, in the United States). Where they do, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision. Contact us for details of the safeguards that apply to a specific provider.
6. Your rights
You have the right to access, rectify, erase, restrict, and port your personal data, to object to processing, and to withdraw consent at any time. You can exercise the most important rights directly in the app:
- Access & portability: Profile → Download My Data exports the personal data we hold about you as a file.
- Erasure: Profile → Delete Account permanently deletes your account, the moments you created, and the media you uploaded.
- Rectification: update your name and photo in Profile at any time.
You can also email us at privacy@ollovas.com. You have the right to lodge a complaint with your local data protection supervisory authority.
7. Withdrawing consent
You can disable location access in your device settings and stop providing optional data at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
8. Security
We protect your data with encryption in transit (HTTPS), hashed passwords, access controls that restrict every moment to its members, and short-lived signed links for media access. No system is perfectly secure; if a breach affecting your rights occurs, we maintain a process to notify you and the relevant authority within 72 hours.
9. Retention
- Account data: kept until you delete your account.
- Deleted media: removed from the app immediately and permanently purged from storage within 30 days.
- Incomplete (pending) uploads: cleared automatically after about 1 hour.
- Waitlist data: kept for at most 24 months, or until you ask us to remove it.
10. Children
The service is not intended for children under 16, and we do not knowingly collect data from children under that age. If you believe a child has provided us personal data, please contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. We will post the new version on this page, update the “Last updated” date, and notify you of material changes in the app or by email.
12. Contact
For any privacy question or to exercise your rights, contact us at privacy@ollovas.com.