Privacy Policy

1. Data controller

The controller of your personal data is BLACK STYLE TREND S.R.L. (CUI 49361636, Nr. Reg. Com. J2024000009180, EUID ROONRC.J2024000009180), registered office Str. Gării, Bl. 1, Sc. 1, Et. 3, Ap. 16, Bumbești-Jiu, jud. Gorj, 215100, România, which operates the "PocPin" app and services. You can reach us about any data matter at [email protected].

2. Data we collect

We only collect what we need to provide the service:

• Account data: email address, password (stored encrypted), first and last name, username.
• If you sign in with Google or Apple: we receive your name, email address and, from Google, your profile photo. We never receive your password for those accounts. Apple may hide your real email address.
• Profile data: bio, profile and cover photos, gender, car brand, license plate (optional, collected only if you add it, with visibility controlled by you). We do not access official vehicle registries (DRPCIV) and do not import vehicle data.
• Location data: check-ins at places you choose; while you use the map, your position (for nearby places and people). If you turn on "Show my area to friends", we keep only your approximate area (about 1 km) and the locality name; your exact spot (about 10 m) only if you choose it for your close-friends list. Area updates while the app is closed work only if you turn them on (you can stop them anytime in Settings or on your phone).
• User-generated content: posts, reels, stories, comments, reactions, direct messages (including photos and voice messages), live streams, virtual gifts.
• Audio/video calls and live streams: relayed through our EU servers and not recorded.
• Reports: what you reported, the reason and the details you write.
• Purchases: history of coins bought and gifts sent/received (no card details).
• Technical data: IP address, device type, operating system, app version, error logs and performance telemetry.
• Push notification tokens (if you enable them).

3. How we use data

• To provide and operate the app features (account, feed, map, check-in, messaging).
• To show your presence and content to other users, according to your privacy settings.
• For security, abuse prevention, content moderation and enforcing our Terms.
• Links in posts, comments and messages are checked automatically against public lists of dangerous sites (phishing, malware), so we can warn you before you open them.
• To send you relevant notifications (if enabled).
• To improve performance and stability (aggregated telemetry, error logs).

3a. Your private messages

• Direct messages are private between you and the person you talk to. The PocPin team does not read them.
• Exception: if you report someone, the team can see the conversation between you, only to review the report. Every access is logged.
• Where the law requires it (for example, an official request from the authorities), we may provide data strictly within the limits of that request.
• Messages are encrypted in transit (HTTPS/TLS). We do not use end-to-end encryption.

3b. Automated checks

• We use automated checks to protect the community: images are screened for nudity, links for dangerous sites, and behaviour such as spam, location spoofing (fake GPS) or excessive requests can lead to temporary limits.
• These checks have no legal effect on you and never decide on their own to close an account permanently. Any automatic limit can be reversed by our team.
• If an automated check affected your account, you can ask for a person to review it by writing to [email protected].

4. Legal basis (GDPR Art. 6)

• Contract performance — to provide the service you requested.
• Consent — for push notifications, plate visibility and other optional features. You can withdraw it anytime.
• Legitimate interest — for security, fraud prevention and product improvement, without overriding your fundamental rights.
• Legal obligation — where the law requires us to retain or disclose certain data.

5. Who we share data with (processors)

We do not sell your data. We use service providers ("processors") that handle data strictly on our behalf under data processing agreements:

• Hetzner (Germany) — server and database hosting (EU).
• Cloudflare — CDN, security and anti-abuse protection.
• Sightengine — automated image moderation (nudity detection).
• Expo, Apple (APNs) and Google (Firebase Cloud Messaging) — push notification delivery.
• Sentry — error monitoring (with personal data masking).
• Resend — transactional email delivery (where applicable).
• Apple / Google — in-app payment processing for coins; RevenueCat — purchase validation. We never receive or store your card details.
• Mapbox — showing the map in the app (receives your IP address and technical device data, not your account).
• Google and Apple — sign-in, if you choose “Continue with Google/Apple”.

5a. Other cases where data may be disclosed

• To authorities — only where the law requires it (e.g. an official request from the police or prosecutors) and strictly within that request.
• To protect the rights or safety of users, of us or of others, including in legal disputes.
• In a reorganisation, merger or sale of the business, data may pass to the new operator, who takes on the same obligations. We will tell you beforehand.

6. International transfers

Data is stored in the European Union (Germany). Where a processor handles data outside the EEA, we ensure appropriate safeguards (standard contractual clauses) are in place.

7. How long we keep data

• Account data — for the lifetime of your account.
• Active check-ins — end automatically (usually after 2 hours).
• Approximate area shared with friends — deleted as soon as you stop sharing.
• Conversations deleted by both people — 7 more days (for safety and reports), then permanently deleted.
• Reports and moderation decisions — as long as needed for community safety and legal obligations.
• Telemetry and logs — up to 30 days (90 days for crash incidents).
• Content you delete — disappears from the app immediately; it is kept for at most 3 days for moderation checks, and backup copies are erased within 35 days at most.
• When you delete your account, your data is permanently removed, except where we are legally required to retain it.

8. Your rights

Under GDPR, you have the right to:

• Access — download a copy of your data directly in the app (Settings → Your data → Download my data).
• Rectification — edit your profile data anytime.
• Erasure ("right to be forgotten") — delete your account in the app (Settings → Delete account). Deletion is permanent and includes your content.
• Portability — data export is provided in a structured JSON format.
• Objection and restriction — you can object to certain processing.
• Withdraw consent — for consent-based features.
• Lodge a complaint with the Romanian Data Protection Authority (ANSPDCP).

9. Minimum age

PocPin is intended for people aged 16 and over. We do not knowingly collect data from anyone under 16. If you learn that a minor under 16 has provided us data, contact us and we will delete it.

10. Security

We use encryption in transit (HTTPS/TLS), hashed passwords, two-step verification for the admin team, access control, regular backups and automated moderation. No system is perfect, but we treat security as an ongoing priority.

If a security incident affects your data, we notify ANSPDCP within 72 hours, and if the risk to you is high we tell you directly and explain what you can do.

11. Changes

We may update this policy. We will mark the effective date and, for material changes, notify you in the app. Current version: 1.1.

12. Contact

For any privacy question, write to us at [email protected].