HYBRID BUDDY

Privacy Policy — Hybrid Buddy

Effective date: 7 June 2026

This Privacy Policy explains what personal data we collect when you use the Hybrid Buddy mobile application and related services (the "Service"), why we collect it, how we use it and what rights you have. It complements our Terms & Conditions.

The data controller is Luca Pintimalli, sole operator, based in Spain. Contact: [email protected].

1. At a glance

We only store the data you choose to share with us in order to operate the Service.
We never sell your personal data to third parties.
You can delete your account and associated data at any time from the in-app Profile, or by writing to [email protected].
Processing is governed by the EU GDPR and Spanish data-protection law (LOPDGDD).

2. What we collect

Category	Examples	Legal basis
Account	email, hashed password (bcrypt), display name	Performance of contract (Art. 6(1)(b) GDPR)
Profile	photo, age, city, country, sport categories, run pace, personal best, bio, "open to train together" flag	Your consent (Art. 6(1)(a) GDPR) — you choose what to share
Activity	workouts you create or like, training spots you submit, event RSVPs, forum posts, chat messages and invitations	Performance of contract
Approximate location	only when you tap "USE MY CURRENT LOCATION" or enter an address to geocode — never silent background tracking	Your consent
Technical	device push-notification token, error logs, IP address (for security and rate-limiting)	Legitimate interest (Art. 6(1)(f) GDPR) — security
Communications	content of any email you send to [email protected] or any in-app report you submit	Legitimate interest — moderation

3. How we use your data

to provide the core features of the Service (matching athletes, hosting chats, displaying events and spots);
to send transactional emails (password reset, contact-form replies) via Resend;
to send optional push notifications (event reminders, new chat messages) — you can disable them in your OS settings at any time;
to enforce community rules — admins can review reports, block abusive accounts and remove flagged content;
to monitor security, prevent fraud and comply with legal obligations.

We do NOT use your personal data for automated decision-making with legal effects, and we do NOT profile you for advertising beyond what is described in Section 5.

4. Sharing your data

We share data only with the providers strictly necessary to operate the Service, all of whom act as our processors under written agreements:

MongoDB Atlas / Emergent — database and application hosting (EU region);
Resend — transactional email (EU/US, EU Standard Contractual Clauses);
Google AdMob — ad delivery (see Section 5);
Google Maps / OpenStreetMap — map tiles and geocoding;
Expo / Emergent push — push-notification routing.

We may also disclose data when required by law, court order, or to protect the rights, property or safety of Hybrid Buddy, our users or others.

5. Advertising

The free tier of Hybrid Buddy shows non-disruptive banner ads via Google AdMob in Athletes, Events and Chat. Ads are served and measured by Google and may use device identifiers in accordance with Google's policies. You can:

manage personalised-ad preferences from your device (iOS: Settings → Privacy & Security → Apple Advertising; Android: Settings → Google → Ads);
consult Google's privacy policy at https://policies.google.com/privacy.

6. International transfers

Some of our processors are based outside the European Economic Area (notably in the United States). Where this happens we rely on:

adequacy decisions of the European Commission, or
the EU Standard Contractual Clauses (2021/914) with supplementary safeguards as appropriate.

7. Retention

Account data: kept while your account exists; deleted or anonymised within 30 days of account deletion (longer if required by law or to defend legal claims).
Backups: rotated within 90 days.
Moderation logs and security logs: up to 12 months.

8. Your rights (EU/GDPR)

You have the right to:

access your personal data;
rectify inaccurate data;
erase your data ("right to be forgotten");
restrict processing in certain situations;
port your data to another controller;
object to processing based on legitimate interest;
withdraw any consent at any time without affecting prior lawful processing;
lodge a complaint with the Spanish data-protection authority — Agencia Española de Protección de Datos (AEPD), www.aepd.es.

To exercise any of these rights, write to [email protected]. We will respond within one month.

9. Children

The Service is not directed to children under 16 years of age and we do not knowingly collect personal data from anyone under 16. If you believe a minor has provided us with personal data, please contact us at [email protected] and we will delete the data.

10. Security

We protect your data using industry-standard measures: encryption in transit (HTTPS / TLS), password hashing with bcrypt, principle-of-least-privilege access controls, periodic security review and isolated production environments. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will notify you in-app or by email at least 14 days before the changes take effect.

12. Contact

Data controller: Luca Pintimalli — sole operator, Spain.

Email: [email protected]