Privacy Policy

Under Art. 12 to 14 of the General Data Protection Regulation (GDPR), this privacy policy explains which personal data Meets processes at meets.social, for which purposes, on which legal basis, for how long, and which rights you have.

1. Controller

Felix ReuterNeue Mainzer Straße 3160311 Frankfurt am MainDeutschlandEmail: [email protected]

For every question about data protection and to exercise your rights, write to [email protected].

We have not appointed a data protection officer at this time, because in our assessment the conditions of Art. 37 GDPR and § 38 of the German Federal Data Protection Act are not met.

2. The essentials

• We store the data of Meets in the European Union, in data centers of Amazon Web Services in Frankfurt am Main.
• We do not sell data and do not show ads.
• We use only strictly necessary cookies and currently no analytics or tracking tools.
• Messages in community rooms are not end-to-end encrypted.
• You must be at least 16 years old to use Meets.

3. Visiting the website and server logs

When you visit meets.social, we process technically necessary data: your IP address, date and time, the requested address, the amount of data transferred, the status code, your browser and operating system (user agent) and the page you came from (referrer). Our providers for delivery and protection against attacks (Cloudflare) and for operations (Amazon Web Services) process this data on our behalf.

Purpose: delivering the website, security, preventing abuse and attacks, troubleshooting. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure and stable service.

Retention: application logs 30 days, load balancer and network logs 30 days, fallback logs in AWS CloudWatch 7 days, technical traces 14 days, error reports 30 days. We keep metrics for 13 months, but without personal data.

4. Your account

When you sign up, we process your email address, your password (only as a secure hash, never in plain text), your date of birth, your name and your username. To confirm the address, we send you a code and a link. When you log in, we process session data and, if you set them up, passkeys.

• Purpose: providing your account and Meets. Legal basis: Art. 6(1)(b) GDPR (contract).
• Date of birth: we use it for the minimum age of 16. It is never shown publicly.
• Name, username, profile picture and bio are public on your profile. Your name does not have to be your legal name.
• Unconfirmed accounts: we delete an account automatically if its email address or phone number is not confirmed within 24 hours.
• Acceptance of the terms: we store which version of the terms you accepted when you signed up and when, and which version of this privacy policy was shown to you. Legal basis: Art. 6(1)(b) and (f) GDPR (proof of the contract).
• Protection against abuse: for log in and sign up we count attempts per IP address and account to slow down attacks. Legal basis: Art. 6(1)(f) GDPR.

Retention: as long as your account exists. After your account is deleted we delete the account data unless statutory retention duties apply.

5. Communities and memberships

When you follow a community, join it, request to join, are invited or take on a role, we process this relationship: membership, role, time, answers to join questions and any bans in the community.

Who sees your membership depends on the settings of the community. Answers to join questions are visible only to the people who approve members in the community. Legal basis: Art. 6(1)(b) GDPR.

Communities are run by their Owners and their team. We are the controller for the processing on Meets. If a community exports data out of Meets, it is itself responsible for any further processing.

6. Content and uploads

We store the content you publish on Meets: posts, comments, reactions, images and videos, pages and details of your community. We store images without their embedded metadata (for example camera and location data). Who sees your content depends on the visibility of the community and of the content.

Purpose and legal basis: providing the features, Art. 6(1)(b) GDPR. Retention: until you delete the content or your account is deleted. Content you published under your profile in communities generally stays after your account is deleted, marked "Deleted account" and without a link to your profile, so that discussions stay readable. When you delete your account you can choose to delete your posts and comments as well.

7. Chat in community rooms

Communities have chat rooms. We store the messages in these rooms on our servers. They are not end-to-end encrypted. The transfer is encrypted, but members of the room, the moderation of the community and, where needed to handle reports or for legal duties, Meets can read the messages. We do not offer direct messages between individual people at this time.

Legal basis: Art. 6(1)(b) GDPR. Retention: as long as the room exists, until you delete a message or until your account is deleted.

8. Events, RSVPs, check-in and attendance

For events we process your RSVP, your check-in on site (for example with a QR code or a short code) and your attendance. From this we calculate streaks. The list of attendees with names is visible to the people who manage events in the community. You see your own streak. We do not store the location of your device.

Legal basis: Art. 6(1)(b) GDPR. Retention: we keep attendance and check-ins while you are a member of the community and for 12 months after you leave. We log corrections of attendance made by the community, with a reason.

Please note: taking part in an event can reveal personal circumstances, for example for health or faith topics. Attendance is therefore not public.

9. Emails and notifications

We send you emails that your account needs: confirmation codes, password reset links, invitations and notices about your account. Amazon Simple Email Service in Frankfurt sends them. We store notifications in Meets for you. Legal basis: Art. 6(1)(b) GDPR. We do not send marketing emails.

10. Cookies and similar technologies

We use only cookies and storage that are strictly necessary for the service you asked for (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). That is why we do not ask for consent and show no cookie banner.

• Session cookies (names with the prefix "meets."): keep you logged in and protect forms. They are valid for our domain only, cannot be read by scripts and end at the latest when the session expires.
• Local storage "meets.join-intent": if you choose "Join" on a community page and need to sign up first, we remember that page for at most one hour so the join continues afterwards.

We do not use analytics, advertising or tracking cookies. Before we introduce an analytics tool, we update this policy.

11. Errors and operations monitoring

To find errors and monitor operations, we process technical data about requests and errors (for example time, affected feature, technical identifiers). We take care not to write content, passwords, codes, email addresses or phone numbers into logs. Legal basis: Art. 6(1)(f) GDPR. Retention: see section 3.

12. Reports, moderation and the audit log

When you report content, or when we or the moderation of a community take action, we process the report, the decision, its statement of reasons and your complaint. We record important actions (for example account creation, acceptance of the terms, roles, bans and moderation decisions) in a log that is only ever added to. After your account is deleted it holds only an internal identifier. Legal basis: Art. 6(1)(c) GDPR with Regulation (EU) 2022/2065 (DSA) and Art. 6(1)(f) GDPR (proof, security).

13. Recipients and processors

We share your data only when it is needed to run Meets, when you cause it (for example by publishing something publicly) or when the law requires it. These providers process data on our behalf:

• Amazon Web Services EMEA SARL (data centers in Frankfurt am Main): servers, database, storage for uploads, backups, logs and email delivery through Amazon Simple Email Service. Data processing agreement pending.
• Cloudflare, Inc.: delivery of the website, protection against attacks, DNS. Delivery can take place at the location of the Cloudflare network nearest to you, also outside the EU. Data processing agreement pending.
• Functional Software, Inc. (Sentry), EU data region: error reports. Data processing agreement pending.
• Grafana Labs, EU region: logs, traces and metrics of the operation. Data processing agreement pending.
• Better Stack: uptime checks, the status page and alerting of the Meets team. No data of users is processed, only contact details of the Meets team. Data processing agreement pending.

14. Transfers to third countries

Some providers are based in the USA or also process data outside the EU. We transfer data there only on the basis of an adequacy decision of the European Commission, in particular the EU-US Data Privacy Framework (Art. 45 GDPR), or of standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR).

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to withdraw a consent at any time with effect for the future (Art. 7(3)). Write to [email protected] to exercise them. We answer within one month.

Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. We then stop processing the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint (Art. 77 GDPR): you can complain to a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

16. Minimum age

Meets is for people aged 16 and over. We ask for your date of birth when you sign up. If we learn that an account belongs to a person under 16, we delete it.

17. Obligation to provide data and automated decisions

Without an email address, password, date of birth, name and username we cannot create an account. There is no automated decision making, including profiling, under Art. 22 GDPR.

18. Changes

We update this privacy policy when Meets or the law changes. The current version with its date is always on this page. We inform you about material changes.