This is a translation; the German version is legally binding.
The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data in the “Friens” app (iOS, Apple Watch, widgets) and on the website friens.app is:
For any question about data protection or to exercise your rights, a simple message to leonardo@friens.app is enough. No data protection officer has currently been appointed.
Friens helps you meet up with your friends: plan meetups, coordinate groups, discover events and get to know people nearby. We only process the data each feature needs. The key points:
Below we describe, for each feature, which data we process, for what purpose, on what legal basis and for how long. The legal bases are: Art. 6(1)(a) GDPR (consent), (b) (performance of the user agreement or pre-contractual steps), (c) (legal obligation), (d) (vital interests) and (f) (legitimate interests). Access to information on your device is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
When you visit the website, our server processes technically necessary connection data: IP address, date and time, the address requested, amount of data transferred, and browser and operating system details (user agent). This data is needed to deliver the pages, establish the encrypted connection (TLS) and fend off attacks. It is not combined with other data and is not used for profiling. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website.
The website sets only one cookie: “NEXT_LOCALE” stores the language you chose (German or English) for up to one year. This cookie is strictly necessary for the service you requested (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR) and does not require consent. There are no analytics, marketing or tracking cookies, no social media plugins, and no external fonts or scripts; all content is loaded from our own server.
Links such as friens.app/f/…, /t/…, /e/… or /r/… (e.g. from QR codes, shared invitations or the password reset email) open the app directly on an iPhone. If the app is not installed, the website only shows a redirect page. The code contained in the link is only used to forward you to the app and is not stored by the website.
You need an account to use Friens. You register either with an email address and password or with “Sign in with Apple”. Registration usually requires a friend code from an existing user.
The legal basis is Art. 6(1)(b) GDPR. We store this data for as long as your account exists.
After you sign in, your app receives a short-lived access token (valid for 15 minutes, not stored) and a refresh token (valid for up to 60 days). Of the refresh token we only store a hash and the first 200 characters of the device/app identifier (user agent) so you can see your signed-in devices and sign out everywhere. Expired sessions are deleted automatically 7 days after expiry, revoked sessions 30 days after revocation. Legal basis: Art. 6(1)(b) and (f) GDPR (security of your account).
If you request a new password, we send you an email with a link that is valid for 60 minutes. Only a hash of the link is stored; it is deleted one day after expiry. The email is sent in encrypted form via our own mail server, which runs on the same server. Legal basis: Art. 6(1)(b) GDPR. We do not send newsletters or promotional emails.
Other users only see your data within these settings. The legal basis is Art. 6(1)(b) GDPR; data is stored until your account is deleted or until you change the information or remove a friendship.
When you create a meetup, we store the title, description, category, place (name and exact coordinates of the meeting point), time frame, visibility (private, invite-only, friends, open; optionally “verified people only”) and, where applicable, a linked event. For participants we store status, who invited them, how they joined and join requests. People who are neither invited nor friends only see the meeting point rounded to about 1 km.
A meetup’s group feed stores your actions for the other participants, e.g. “on my way”, “running late”, “where are you?”, reactions, rounds, taxi, check-ins, way-home messages and – only if you explicitly share them – drink counters. Private drink counters stay on your device only.
For shared expenses we store who paid what (amount, currency, description of up to 120 characters), who the expense is for, and who paid back how much to whom. Only the participants of the meetup can see this. Friens does not process payments; we do not process any bank or payment details.
With a check-in you confirm that you have arrived at a meetup or event. We store the time and method (“I’m here”, holding phones together, QR code or location). When you check in by holding phones together, we store as proof of encounter that you and the other person met at this meetup at that time; the other person’s first name appears in your check-in entry.
The legal basis for section 6 is Art. 6(1)(b) GDPR. Meetups, feed, expenses, check-ins and encounter proofs are stored for as long as the respective account or meetup exists. If the host deletes a meetup, it is first marked as deleted and hidden from everyone; it is removed for good when the host’s account is deleted.
Friens only requests location with the “While using the app” permission. There is no background location. You start every location feature yourself and can revoke the permission at any time in iOS settings. Location is accessed because it is strictly necessary for the feature you explicitly requested (Section 25(2) no. 2 TDDDG). The legal basis for further processing is Art. 6(1)(b) GDPR; for the optional visibility features (Nearby, Neighbours, live location) it is additionally your consent (Art. 6(1)(a) GDPR), which you give by switching the feature on and can withdraw at any time with effect for the future by switching it off.
When you create a meetup, the app shows a map from Apple (Apple Maps) centred on your location. If you search for an address, your search term is sent together with your IP address and language setting to the Nominatim service of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) to find matching places. We store the chosen meeting point (name and coordinates) with the meetup (see 6.1).
When you search for events within a radius (10, 25 or 50 km), the app sends your position, rounded to about 100 m, with the search request to our server. It is used only for that request and not stored in the database; on your device it stays in memory for at most 10 minutes.
In Nearby you can make yourself visible to other verified Friens users near you. The feature is off by default and requires verification (Face Scan or World ID). Your iPhone converts your position into a coarse cell of about 5 × 5 km; only this cell is transmitted while you are visible and have Nearby open (about every 5 minutes). On the server it remains valid for 30 minutes and is then deleted automatically; when you turn visibility off, immediately. Others only see “here” or “nearby”, never your coordinates. To show the name of your town and district, your position is sent to Apple’s geocoding service.
Neighbours shows you people from your neighbourhood. The feature is optional and requires verification. To do this, the app notes on your device once per evening (between 8 pm and 7 am, only while you use the app) which grid cell of about 400 m you are in, and keeps at most the last 30 evenings locally. From this it works out your neighbourhood on the device. No raw coordinates are stored.
Only a hash value computed from your neighbourhood cell and a weekly changing random value is sent to our server. It expires at the end of the week and is then deleted; a neighbourhood is only shown once at least three people are there. Please note: this is pseudonymisation, not anonymisation. To show the neighbourhood name, the centre of your cell is sent to Apple’s geocoding service. “Pause” or “Delete” removes your entry from the server immediately; “Delete” also removes the evenings learned locally.
Neighbourhood posts (text, emoji, place and time), replies to them and “hellos” to other users are stored. Posts are removed one day after they expire or are deleted (together with their replies), hellos after 30 days.
For directions to a meetup, the app calculates the travel time using Apple MapKit. For this, your current location and the meeting point are sent to Apple; your location is not sent to our server. Our server only receives the calculated departure time, the travel duration and the mode of transport so it can update the Live Activity on your lock screen in time. This data is deleted one day after the departure time. The “time to leave” reminder is scheduled locally on your device. If you tap “Route”, Apple Maps (Google Maps on Android) opens with the destination; Apple’s or Google’s privacy terms apply there.
You can share your location with the participants of a meetup for 15, 60 or 180 minutes. Your position (accuracy about 100 m) is transmitted once and not updated continuously; “Restart” sends a new position. Only the participants of this meetup can see it. When the chosen duration ends or you stop sharing, it is deleted automatically on the server. It may be cached on participants’ devices until the next refresh.
With the way-home feature you tell your group that you are heading home. No location is transmitted. We store the start time, the chosen deadline (20, 45 or 90 minutes) and your confirmation of arrival. If you do not confirm your arrival in time, we notify the group. A Live Activity appears on your lock screen for this. Legal basis: Art. 6(1)(b) GDPR; the data is stored with the meetup (see section 6).
If you trigger an emergency alarm in the app or on Apple Watch, your group is notified immediately. Optionally (preselected in the app, automatic on Apple Watch if you have granted location permission) your current position is sent along. The coordinates are removed from the alarm automatically after 24 hours. Legal basis: Art. 6(1)(b) and (d) GDPR (protection of vital interests). Friens is not an emergency service: in an emergency always call 112 or 110.
When you check in to an event by location, our server checks once whether you are less than 1 km away. We only store that you checked in by location, not your position.
With the Face Scan you confirm that a real, living person is using the account. The scan is optional. The app uses the TrueDepth front camera and Apple ARKit and checks depth relief, head movement, blinking and tracking quality exclusively on your iPhone. Camera images, depth maps and face geometry are only processed briefly in memory and are neither stored nor transmitted. There is no face recognition and no comparison with other images; no facial template is created.
The app only sends our server a summary of the result (passed, method and version, timestamp, the randomly assigned check steps, yes/no results of the individual checks and metrics such as duration and number of blinks), signed with Apple App Attest. Afterwards we only store “verified”, the date, and the method and version.
Apple App Attest confirms that the request comes from an unmodified Friens app on a genuine Apple device. For this, your iPhone creates a key in the Secure Enclave once per account and device. We store the key ID, the public key, a counter and the attestation issued by Apple (at most 5 keys per account) until your account is deleted; the check takes place on our server without sending data to Apple. One-time challenges are deleted one day after expiry. Face Scan results are logged with your user ID to detect abuse (see section 14).
Since only a liveness check without identification takes place and no face data leaves the device, in our assessment we do not process biometric data for the purpose of uniquely identifying a person within the meaning of Art. 9(1) GDPR. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by starting the scan. You can withdraw it at any time by removing the verification in the app; the result is then deleted.
Alternatively, you can verify with World ID. World ID is a service of the World Foundation and Tools for Humanity Corporation (USA) or Tools for Humanity GmbH (Erlangen, Germany). The app opens World App, where you confirm the request. Friens receives a zero-knowledge proof that reveals neither your name nor a photo. To verify it, we send the proof and a pseudonymous value specific to Friens (“nullifier hash”) to the World developer portal’s interface. We only store “verified”, the date and the nullifier hash (so one World ID cannot be used for several accounts). Tools for Humanity is itself responsible for processing within World App. Legal basis: Art. 6(1)(a) GDPR; withdrawal by removing the verification or deleting your account.
To add friends or check in, you can hold your iPhone against another one or look for people right next to you. For this the app uses the local network (Apple MultipeerConnectivity), Nearby Interaction (ultra-wideband distance measurement) and Bluetooth signal strength. Only a random session identifier and a short-lived random token are exchanged between devices, never your user ID or friend code. The token is issued by our server, is valid for 5 minutes and is revoked when you close the screen; requests expire after 30 minutes. Our server resolves the token into the other person’s first name, avatar and friendship status. The search only runs while the screen is open, never in the background. The result (friendship, check-in, encounter proof) is stored as described in sections 5 and 6. Legal basis: Art. 6(1)(b) GDPR, Section 25(2) no. 2 TDDDG.
Friens shows public events from open sources, including the City of Cologne, the City of Karlsruhe, berlin.de, BayernCloud, destination.one (North Rhine-Westphalia, Lower Saxony, Saxony, Bremen), Open Data Germany (German National Tourist Board) and Ticketmaster. No user data is sent to these sources during import. Event data may contain names of organisers or image authors as published in the source (legal basis: Art. 6(1)(f) GDPR, interest in providing information about public events). Ticketmaster data is deleted or reduced to title and time no later than 24 hours after the last update.
For events we store whether you are going, have saved an event, are looking for company (with an optional note of up to 200 characters), buddy requests (with a message of up to 200 characters) and your check-in. Legal basis: Art. 6(1)(b) GDPR; stored until your account is deleted.
Event images are loaded directly from the servers of the respective source; for technical reasons the provider receives your IP address (Art. 6(1)(f) GDPR, interest in an attractive presentation). Ticket and source links (e.g. Ticketmaster) only open in your browser after you tap them; from then on the respective provider’s privacy terms apply. You can open event addresses in Apple Maps if you wish.
In the app you can report people or posts (reason, optional description of up to 1,000 characters, context) and block people; a report also blocks the person. Reports are also possible by email to leonardo@friens.app, even without an account; in that case we additionally process the data you provide (e.g. name, email address, content of the report) to handle the report and tell you our decision. The reported person does not find out who reported them. If we take action against content or an account, we inform the person concerned and give reasons. We store reports to examine indications of violations and to protect users’ safety, and blocks so that blocked people can no longer see or contact you. Legal basis: Art. 6(1)(b) and (f) GDPR and, where applicable, Art. 6(1)(c) GDPR in conjunction with the Digital Services Act. Blocks are stored until you lift them or an account is deleted. If an account involved is deleted, we remove the link to that account from the report; the description is kept for documentation purposes.
If you allow notifications, the app registers a device token with our server (platform, token, app version, language, technical delivery status). Notifications are delivered via Apple Inc.’s Apple Push Notification service (APNs) and – for Android devices – via Firebase Cloud Messaging from Google Ireland Ltd. or Google LLC. The contents (e.g. first names, title and place of a meetup, amounts from expenses, neighbourhood messages) are transmitted to Apple or Google and are not end-to-end encrypted. Sent notifications are deleted from our queue 14 days after sending; device tokens are stored until your account is deleted. You can switch off “a friend has time” notifications in the app; safety notifications (way home, emergency alarm) are always delivered. Legal basis: Art. 6(1)(b) GDPR, Section 25(2) no. 2 TDDDG; you can revoke the permission at any time in iOS settings.
For meetups and the way home, Friens shows Live Activities on the lock screen and in the Dynamic Island. To keep them up to date, we store the push tokens iOS assigns to the Live Activity and, where applicable, a start token for the device. They show the title, place and times of the meetup and the first names and avatar colours of those involved. Tokens of running Live Activities are deleted one day after the last renewal, start tokens after 60 days, related start records after 3 days, and queued updates after one hour. Legal basis: Art. 6(1)(b) GDPR.
Widgets and the Apple Watch app only receive their data locally from the iPhone app (via an app group or Apple WatchConnectivity): your next meetup with first names and avatars, friends who are free today, and your check-in, way-home and alarm status. The Watch app does not establish its own internet connection and does not use health data. Actions on the Watch (e.g. check-in, live location, way home, emergency alarm) are carried out via your iPhone.
The app only stores on your device what its features require (Section 25(2) no. 2 TDDDG): in the iOS Keychain, the sign-in tokens and the App Attest key ID; in app storage, a copy of your profile, group feeds (including expenses, way home, locations shared by others), the Neighbours evenings learned locally and your neighbourhood, chosen modes of transport, your event search location and the app language. When you sign out, account-related data is deleted; device settings such as language, transport preferences and event search location remain until you delete the app.
For every request to our server we log the time, request ID, method, path requested (without search parameters or content), status code, duration and the IP address. The logs are rotated by size (at most about 30 MB per service) and continuously overwritten in the process. To prevent abuse (e.g. password guessing) we limit requests per IP address in memory and store counters for sign-in attempts under a hash of the IP address, email address or user ID; these counters are deleted 2 days after the last attempt unless a lock is in place. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is the security and availability of the service.
All connections between app, website and server are TLS-encrypted. Tokens, links and codes are only stored as hashes, passwords with Argon2id.
We run our servers (database, API and website) with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in their data centre in Helsinki (Finland), i.e. within the European Union. Our mail server runs there as well. Hetzner processes the data as a processor under Art. 28 GDPR. The database is backed up daily; backups are kept for 14 days and then deleted automatically. Deleted data may therefore remain in backups for up to 14 days; backups are only used to restore after an outage. Legal basis: Art. 6(1)(b) and (f) GDPR, Art. 32 GDPR.
We do not sell data or pass it on for advertising. The only recipients are:
Our servers are located in the EU. Data may be transferred to the USA in the case of Apple, Google and Tools for Humanity. We base such transfers on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the respective provider is certified, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). For the United Kingdom (OpenStreetMap Foundation) there is an adequacy decision by the European Commission.
As a rule, we store data for as long as your account exists and delete it when the account is deleted. Shorter periods apply to:
You can delete your account in the app at any time under Profile. Deletion takes effect immediately and permanently: all sessions are ended, and your profile, friendships, verifications, device tokens, feed entries, expenses and the meetups you created as host (including other participants’ entries in them) are deleted. Individual details relating to shared activities may remain with other users (e.g. your first name in their check-in entry as an encounter). Deleted data remains in backups for up to 14 days. If you would also like specific details deleted, write to us.
You have the right at any time to:
Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.
To exercise your rights, an email to leonardo@friens.app is enough.
The account data (email or Apple identifier) is required to use Friens; without it we cannot create an account. All other information and the location and verification features are optional. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
Friens is intended for people aged 16 and over (see the terms of use). If you are younger, you may not use Friens; if you are not yet an adult, you need the consent of your parents or guardians. If we learn that an account belongs to someone under 16, we will delete it.
We update this privacy policy when the app, the website or the law changes. The version published here applies; we will inform you of material changes in the app. The German version is legally binding.
Last updated: Oct 21, 2026