Privacy Policy

The short version

Vynd App AB is responsible for how Vynd uses your personal data (the data controller). We use information to run your account, deliver the features you choose and keep the service safe. You choose what to share and can ask us to access, correct or delete your information. Optional ride measurements and live sharing have separate choices.

Be careful with location: a route can reveal where you live or spend time. Other people can save what you share. Some providers receive information directly from your phone, including when it loads GIFs. The provider sections below explain this; we cannot promise that every provider uses information only for Vynd.

Information we receive

You provide account details such as email, name, username, sign-in information and optional photo/bio; posts, comments, photos, videos, messages, routes, ride recordings, communities, polls and events; and choices such as follows, blocks, likes, saves and audiences. We receive device notification tokens and technical information such as app/device version, network requests and fault reports. When you use location or measurement features, the app processes the coordinates and sensor data needed for those features.

We ask for a birth date to check age eligibility. The current service stores that date with your account until account deletion; it is not a public profile field. Other users may include information about you in their content or reports, even if you have no Vynd account. Apple or Google may supply identity details when you choose their sign-in option. Providers may supply delivery, security or subscription status.

Why we use it

To provide the service you request, we use the necessary account, content, relationship, messaging, map, route and notification information. The legal basis is performance of our agreement with you. Account and age information is needed to create an eligible account; optional profile fields and optional features can be left unused.

We rely on consent for optional measurements and live sharing. You can refuse them without losing unrelated features. We rely on legitimate interests for limited age checks, security, fault diagnosis, moderation, recovery backups, current moderator visibility and community activity counts. Those interests are protecting people and the service, fixing faults, recovering from loss and explaining community activity. We also use limited support/payment records to resolve follow-up problems and disputes. You can object to uses based on legitimate interests.

We use data as required by law to handle privacy rights and retain genuine accounting records. Information about other people in user content is handled only for the limited hosting, communication and safety purposes described here, based on legitimate interests where appropriate. We do not deliberately infer sensitive traits or create criminal-history profiles. Sensitive information or allegations need additional legal justification; unnecessary information must be removed or restricted.

Location, measurements and your audience

Location supports the map, search, navigation, recording and sharing features you use. An active ride or navigation session can continue using location when the app is in the background or your phone is locked. Live sharing is off by default and uses the audience you select. Stop the session or sharing when you no longer want it running.

In Recorded ride data, you choose which measurement categories may be saved. Measurements you do not save can still be processed temporarily on your phone for live ride metrics. Changes apply to your next ride. You can stop saving a category and expressly choose to keep previously saved measurements, or stop and delete the saved measurements. You can later withdraw storage consent and delete them. Withdrawal does not undo lawful use before withdrawal. Phone permissions and accepting terms do not replace these choices.

Use private accounts, audience controls, hidden statistics and privacy zones to limit what others see. Check the audience before publishing. Privacy zones hide selected areas from shared views; they do not erase your original private recording. Public content can reach people outside your followers. Posts and media shared to a community appear in that community rather than on your personal profile; access follows the community's privacy and membership settings. People in a conversation can retain their own copies. Community moderator profiles are public while they hold that role; individual community visits are not public.

Community visitor counts

To show community activity, we keep your internal account ID, community ID and latest successful qualifying content-request time to count distinct visitors. We rely on our legitimate interest in showing community activity. Others see totals, not a visitor list. These records are not used for advertising or individual recommendations. Records expire seven days after the last qualifying request and are removed on account deletion.

You can object by turning off Community visitor counts in Settings → Privacy. This stops future counting and deletes your visit records. You can also object by emailing support@vynd-app.com. Turning the setting back on counts future requests only.

Hosting, safety and diagnostics providers

Vynd operates its database and API server in Sweden. Cloudflare provides website/network delivery, stored media, recovery storage and incoming email forwarding, and receives the relevant content and network information. Media storage and global delivery are not guaranteed to stay only in the EU.

AWS Rekognition screens uploaded images and videos, including private-message media, for safety. Screening uses Ireland, with temporary video staging in S3. Service-improvement use is opted out. Automated screening can hold content for human review; contact us if you believe a decision is wrong.

Sentry receives sanitised error, performance and device/app information to diagnose faults. Event storage is in the EU with 30-day retention; international support or subprocessor access may still occur. We disable session replay, screenshots and profiling and filter sensitive content from routine diagnostics.

Maps, messages, sign-in and purchases

Apple/Google supply native maps and process network, device and map-request information under their platform terms. Geoapify receives requested search terms and coordinates through our server without a Vynd account ID or forwarded device IP. OpenFreeMap supplies resources for server-generated map previews and sees the requested map area and server IP; we do not upload the route geometry to it.

Expo, Apple Push Notification service and Google Firebase Cloud Messaging receive device routing information and notification payloads needed to deliver alerts. Notifications can reveal information on your lock screen; use your phone's notification controls. Firebase's optional sharing for broader non-Firebase service improvement is off in the reviewed Dev project; delivery and Firebase service improvement still occur.

Apple/Google handle their sign-in services under their own privacy terms. If purchases are enabled, the relevant store and RevenueCat process product, entitlement and transaction information. Vynd does not receive card details. Provider customer cleanup does not cancel a store subscription or delete your Apple/Google account. RevenueCat's terms also permit aggregate or de-identified service-improvement uses.

GIFs from KLIPY

Opening the GIF picker sends requests directly to KLIPY, including your search text and public IP address. Loading GIFs or previews in comments or messages also connects your device to the media provider, even when someone else chose the GIF. Older app versions may send searches through Vynd's server, but media still loads directly. Vynd does not add your account ID, email or advertising ID to these requests.

The Dev integration has monetization off. However, KLIPY's published policy permits IP-linked viewing/search histories, advertising measurement or targeting, and linking with partner information. We have not confirmed narrower contractual limits or applicable transfer safeguards for this integration. Its published hosting includes the US and Asia, and retention is based on service need and legal/dispute purposes, without a fixed day count. This describes permitted uses, not proof that tracking has occurred. Vynd does not sell your personal data, but we cannot describe this provider as having no advertising-related uses.

Email and international transfers

Resend sends account emails and receives the recipient address, message and sign-in/recovery links or codes. Its message/log storage is in the US; the reviewed plan retains those records for 30 days. Open/click tracking is not enabled. Resend also processes mail for service safety.

Mail to support@vynd-app.com passes through Cloudflare to our monitored Google Gmail inbox. The current inbox uses consumer Gmail terms; a business processing agreement is not yet in place. Cloudflare keeps routing events for 31 days. Google's deletion processes can include delayed removal and backup retention up to six months.

Providers may process information outside Sweden and the European Economic Area, including in the US. Where applicable, our provider agreements use EU standard contractual clauses or recognised adequacy arrangements such as the EU-US Data Privacy Framework. These safeguards are not confirmed for every current flow: the KLIPY and consumer Gmail limitations above remain. Contact support@vynd-app.com for information about a particular transfer and a copy of applicable safeguards.

How long information stays

Our retention rules limit data to its purpose. Account data lasts while the account exists. Content and saved routes normally follow the item/account lifecycle; optional saved measurements last only while the storage choice remains in place. Deleting a comment also erases its replies. Deleting a route or event erases its stored details and associated discussion and removes content from linked share posts; media cleanup runs separately. A documented preservation hold can prevent erasure until reviewed; the app will tell you if that applies. Contact us to request a review.

Community visits expire after seven days without a new qualifying request. Ordinary notifications expire two days after reading or 90 days unread. Device tokens expire after 90 days without app use, or earlier on logout, account deletion or provider invalidation. Unused uploads have a one-day grace period before cleanup.

Routine server/security logs have a 14-day limit; diagnostics have a 30-day limit; resolved operational alerts have a further 30-day limit. Ordinary support records have a limit of six months after resolution; minimal privacy-request completion evidence has a limit of 12 months after closure. Unnecessary identity-verification material is removed sooner.

Moderation records normally have a six-month limit from notification, extended for a pending appeal and at least 30 days after its resolution where later. Minimal active restrictions can last while needed. Open cases, legal holds and continuing bans are reviewed rather than kept without a reason.

Non-accounting subscription history normally has a 90-day limit after the subscription ends, with at least 90 days for late events; sandbox history has a 30-day limit. Unresolved cases need review. Genuine accounting information is kept through the seventh year after the calendar year in which the financial year ended. This does not apply to all payment telemetry.

Recovery backups have a 14-day target. Minimal deletion-reconciliation identifiers remain while recovery copies depend on them so that erased information is not restored. Cleanup jobs can take additional processing time. A specific legal duty or dispute may require limited, justified retention; we will explain applicable exceptions when handling your request.

Deletion and provider copies

Confirmed account deletion removes your account and associated content from the active database immediately after identity verification, without a recovery period. Media cleanup runs separately. Signing in again cannot recover the deleted account.

Deletion does not instantly erase every backup, moderation, accounting or provider record. We handle relevant provider requests and explain necessary exceptions. We cannot erase copies another person independently saved. Separate provider records follow their own rules: Geoapify normally keeps detailed request data up to 24 hours, or up to two months for suspicious requests; OpenFreeMap keeps ordinary logs seven days and incident IP logs up to 30 days. Firebase installation records can take up to 180 days to disappear from live/backup systems after a deletion request. Apple, Google, KLIPY and some other provider records use purpose-based retention rather than one fixed period.

Communities cannot be deleted by their creators. A community remains when its creator leaves or deletes their account, subject to moderation. Account deletion removes the creator link and their membership. The community's name, description and rules remain as part of the community and can be changed through the available moderation and support processes. You can still delete your own posts and other personal content using the available controls. If community information contains personal data about you, you can request its correction or erasure by contacting support@vynd-app.com; keeping the community does not remove your data-protection rights.

Your rights and how to use them

Email support@vynd-app.com to ask for access, a copy, correction, deletion, restricted use or transfer of your personal data, or to object to a use based on legitimate interests. These rights apply under the conditions set by data-protection law. You can withdraw consent to optional uses at any time without affecting earlier lawful use. You do not need to sign in, keep the app installed or have an active account to contact us.

Tell us what you need and your account email or handle if you have one. Do not send passwords, sign-in codes or identity documents with your first request. We may need proportionate information to verify your identity. We normally respond within one month; if the law permits and we need longer, we explain why within that month. Requests are normally free.

You may complain to Sweden's privacy authority, Integritetsskyddsmyndigheten (IMY), at https://www.imy.se/, or your local data-protection authority. You can contact the authority without first contacting us. For help understanding this policy, including if you are younger, ask us to explain the part you are unsure about.

Younger users, automated tools and updates

Vynd is for ages 13 and above. Tell us if an account belongs to someone under 13. Depending on the country and the feature, a parent or guardian's consent or permission may be required even when you are 13 or older. Our age check alone does not establish that permission.

We do not build individual recommendation profiles from browsing history. Automated safety screening helps flag or hold uploads for review; you can ask us to review an error through support. We do not use these tools to create sensitive personal profiles.

This policy covers the Vynd app and website. The public website source has no advertising pixel or optional analytics script; hosting still processes ordinary network information. We will explain material changes to this policy in the app or on the website. A policy update alone does not give consent for a new optional use.