Privacy Policy
Last updated: August 23, 2026
1. Who we are
Ollovas (“we”, “us”, “our”) provides a mobile and web application for privately sharing photos and videos of shared “moments” with friends, available at ollovas.com and through our mobile app. This policy explains what personal data we process, why we process it, and the rights you have under the EU/UK General Data Protection Regulation (GDPR) and similar laws.
2. The data we collect
Data you provide
- Account data: your email address, password (stored only as a salted hash by our authentication provider), and display name.
- Profile photo: an optional avatar image you upload.
- Content: the photos and videos you upload, their captions, and the moments you create (titles, descriptions, dates).
- Social interactions: comments you post and likes you give.
- Invitations and membership: the moments you join and your role in them (owner, contributor, or viewer).
- Waitlist (website only): your email address and, optionally, an age range, region, and feature interests.
Data collected automatically
- Photo location data: with your permission, the GPS coordinates embedded in photos you upload are stored with those photos and shown only within the moment they belong to. You can prevent this by disabling location access for your photo library in your device settings.
- Media metadata: capture date and time, dimensions, and file type of uploaded media.
- Server logs: request method, path, response status, and timing. We do not log request or response bodies, so these logs never contain your content, email, or credentials.
Data used on your device, but never collected
- Your device’s location — optional, and off unless you turn it on: if you switch on Moments near you in Profile, the app asks your device where you are so it can show you a moment you shared nearby. That position is compared with the coordinates already stored on your own photos, entirely on your phone, and then discarded. It is never sent to us, never stored, never written to any log, and never shared with anyone. Turn it off in Profile at any time, or withdraw the permission in your device settings.
Photos and videos may show identifiable people, and images can reveal sensitive characteristics. We rely on your consent for the content you upload, and we ask that you only upload content you have the right to share.
3. How and why we use your data
| Purpose | Legal basis |
|---|---|
| Create and operate your account; provide the core sharing service | Performance of a contract (Art. 6(1)(b) GDPR) |
| Store and display the photos, videos, and moments you share with the people you choose | Performance of a contract; your consent for uploading images of others |
| Store photo location data and show it within a moment | Consent (Art. 6(1)(a)) — withdrawable at any time |
| Show a moment near where you are (optional; your position is used on your device only and never reaches us) | Consent (Art. 6(1)(a)) — withdrawable at any time |
| Send account, security, and sign-in (magic link) emails | Performance of a contract |
| Waitlist sign-up and related updates | Consent |
| Keep the service secure, prevent abuse, and debug problems | Legitimate interests (Art. 6(1)(f)) |
4. Who we share it with
We do not sell your personal data, and we do not use it for advertising. We share it only with service providers who process it on our behalf:
- Supabase — database, authentication, and delivery of sign-in emails. Hosted in the EU (Ireland).
- Cloudflare R2 — storage of photos, videos, and avatars. European Union storage endpoint.
- Google Cloud Run — application hosting, EU region.
- Apple — delivery of push notifications to iPhones. A notification carries the moment's title, the name of the person who acted, and for a comment its opening words; Apple handles that text in order to deliver it. No photo or video is ever sent to Apple.
- Expo — the same notification text, for devices still running an older version of the app.
Where your photos actually rest. Your account, your moments and every photo and video you upload are stored inside the European Union — the database in Ireland, the media in Cloudflare's EU storage region, the application itself in an EU data centre. Notification delivery is the one exception above, and it carries text only.
We also share your content with the other members of any moment you participate in — that is the purpose of the app. Profile avatars are visible to the people you share moments with.
5. International transfers
Some of our providers may process data outside the EEA or UK (for example, in the United States). Where they do, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision. Contact us for details of the safeguards that apply to a specific provider.
6. Your rights
You have the right to access, rectify, erase, restrict, and port your personal data, to object to processing, and to withdraw consent at any time. You can exercise the most important rights directly in the app:
- Access & portability: Profile → Download My Data exports the personal data we hold about you as a file.
- Erasure: Profile → Delete Account permanently deletes your account, the moments you created, and the media you uploaded.
- Rectification: update your name and photo in Profile at any time.
You can also email us at privacy@ollovas.com. You have the right to lodge a complaint with your local data protection supervisory authority.
7. Withdrawing consent
You can disable location access in your device settings and stop providing optional data at any time. Moments near you can also be switched off directly in Profile. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
8. Security
We protect your data with encryption in transit (HTTPS), encryption at rest in our storage providers, hashed passwords, access controls that restrict every moment to its members, and short-lived signed links for media access. A photo is never served from a public address: every request is authorised against your membership of that moment, or by a signed link that expires within the hour.
What this does not mean. Ollovas is not end-to-end encrypted. Your photos are protected against other users and against outsiders, but we hold the keys to our own storage — so we, and the three providers that actually hold or serve the files (Cloudflare, Supabase and Google Cloud), are technically capable of accessing them. Apple and Expo are not among them: they only ever handle notification text. We do not look at your content, and nothing in the service does so for advertising, training or analysis. We would rather state the limit plainly than let anyone assume a protection that is not there.
No system is perfectly secure; if a breach affecting your rights occurs, we maintain a process to notify you and the relevant authority within 72 hours.
9. Retention
- Account data: kept until you delete your account.
- Deleted media: removed from the app immediately and permanently purged from storage within 30 days.
- Incomplete (pending) uploads: cleared automatically after about 1 hour.
- Waitlist data: kept for at most 24 months, or until you ask us to remove it.
10. Children
The service is not intended for children under 16, and we do not knowingly collect data from children under that age. If you believe a child has provided us personal data, please contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. We will post the new version on this page, update the “Last updated” date, and notify you of material changes in the app or by email.
12. Contact
For any privacy question or to exercise your rights, contact us at privacy@ollovas.com.