Luca Jungwirth, Josef-Brückl-Straße 70, 81825 München, Deutschland
E-mail: lucajungwirth@icloud.com
Palm Up is a web app that helps people make friends through shared activities. It is currently in a closed test phase for invited adults. This notice explains which personal data is processed in the process.
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| E-mail, name, password (stored only as a hash) | Account, sign-in | Art. 6(1)(b) (contract of use) |
| Date of birth | Age check (18+) and showing a group's age range, never the individual date | Art. 6(1)(b), (f) |
| Profile photos (face, favourite picture), bio, city and neighbourhood | Recognising each other at meetups, profile shown to other members | Art. 6(1)(b) |
| Your questionnaire answers: what you are looking for, how often and when you are usually free, your vibe about alcohol, smoking and weekends, chat languages, preferred group size, favourite activities and interests, the five values that matter most to you in a friendship, three self-assessments (how you plan, how you are with new people, what energy you enjoy) and whether you want certain meetups not to be shown at all; also what you hope to get from the test phase. Every question except "What are you looking for?" and "How often do you have time?" can be skipped. | Suggesting meetups that suit you. Meetups that don't quite fit are shown in the area "Outside your comfort zone"; meetups you have explicitly excluded are not shown to you. For suggestions we compare your answers with those of other members on our server; they learn neither your answers nor any result of this comparison. Your answers do not appear on your profile. You can change them at any time under "Me → Edit profile → Your answers". | Art. 6(1)(b) |
| Personality short scale, interest questionnaire, character portrait, bucket list | Suggestions for matching activities and people | Art. 6(1)(b); the AI analysis only with consent (Art. 6(1)(a)) |
| Activities (created, joined), places, shares of ride costs | Organising meetups | Art. 6(1)(b) |
| Messages (group and friend chats), connections, meetup confirmations | Communication, meet-first principle | Art. 6(1)(b) |
| An activity's group chat (messages, who is in the chat, who confirmed "keep chat") | Arrangements around the meetup | Art. 6(1)(b) |
| Reports (including a copy of the reported message or bio) and blocks | Protecting members, moderation | Art. 6(1)(f) |
| Notifications and, if you turn them on, your device's push address | Updates about chats, dates and cancellations | Art. 6(1)(b); push only after you allow it in the browser |
| Feedback after meetups (private, possibly reporting misconduct) | Quality and safety of the community | Art. 6(1)(f) (protecting members) |
| Voluntary feedback: ratings of suggestions (thumbs and reasons), "I'd have liked to see", interest in activities outside your comfort zone, feedback button (with the page you used it on), weekly mini survey | Improving suggestions, fixing bugs, evaluating the test phase; visible to the Palm Up team only | Art. 6(1)(f) (improving the service) |
| Your answer to the daily question "What are you up for today?" (voluntary) and the date | Showing matching activities first, evaluating the test phase; visible only to you and the Palm Up team, not to other members | Art. 6(1)(f) (improving the service) |
| Days of use: on which days you open the app (first and last time), your browser language | Evaluating the test phase (active members, weekly return); no tracking of individual clicks | Art. 6(1)(f) (evaluating the test phase) |
| Which suggestions you were shown in "Surprise" and whether you joined one of them | Evaluating the test phase. Later we may gradually combine your actual behaviour (how often, on which days and how far ahead you sign up for meetups, which kind of meetups you attend) with your questionnaire answers so that suggestions fit better. We only switch this on after informing you in the app; you can object at any time. | Art. 6(1)(f) (suitable suggestions, improving the service) |
| History of your joins and cancellations (time, type and date of the activity, whether by you or the system) | Statistics; in future for developing your profile and suitable suggestions | Art. 6(1)(b); any AI analysis only with consent (Art. 6(1)(a)) |
| Result of the identity check (status, time, method, session ID) | Making sure members are real people | Art. 6(1)(b), (f) |
| Time and version of your consents | Proof under Art. 7(1) GDPR | Art. 6(1)(c) |
| Approximate location (rounded to about 1 km), only when you use the distance filter | Finding activities near you; used for that search only and not stored | Art. 6(1)(b) |
| Technical data (IP address, time, error logs) | Operation, security, preventing abuse | Art. 6(1)(f) |
We don't ask for special categories of data (Art. 9 GDPR) such as health, religion or sexual orientation. Please don't enter such information in free-text fields (e.g. messages) either.
If you organise or have joined an upcoming activity, verified members looking at that activity see your first name, your age and your face photo in the "Who's in" list. Members who aren't verified yet only see your first name and an age group, no photos. For past or cancelled activities, only the organiser and the participants see this.
Members you are connected with (a shared activity, a shared group chat or a contact) can also open your profile: favourite picture, bio and interests. City and neighbourhood only appear there if you switched them on under "Edit profile" (city is on by default, neighbourhood is off); your values are not shown there. People who blocked you or whom you blocked don't see you in these lists and can't open your profile. There is no list or search of all members.
Profile photos are kept in protected storage; they are only shown through links that are valid for one hour and are only created for members allowed to see the photo. Other members don't see your date of birth (only the age calculated from it), your questionnaire answers (including vibe, values and excluded meetups), your character portrait, your bucket list or your contact details. An activity's meeting point (map link) is only visible to the organiser and joined participants; other verified members only see the approximate area (rounded to about 1 km), unverified members only the city or area. When you tap "Open meeting point", the respective map service opens (Google Maps, Apple Maps or OpenStreetMap), and its privacy policy applies there. Messages are only visible to the people in the conversation.
| Provider | Task | Seat / data location |
|---|---|---|
| Supabase Inc. | Database, sign-in, file storage, live chat | Data stored in the EU (Ireland); provider based in the USA |
| Vercel Inc. | Hosting of the web app | USA; server functions run in the EU (Dublin) |
| Resend (Plus Five Five, Inc.) | Sending system e-mails, e.g. the password reset link (your e-mail address and the content of the e-mail) | Sent from the EU (Ireland); provider based in the USA |
| Anthropic Ireland, Limited (contracting party in the EU) | Creating the character portrait – only with your consent | Ireland; processing in the USA |
| OpenAI Ireland Ltd. (contracting party in the EU) | Computing text embeddings for suggestions – only with your consent; also for the text of activities you create | Ireland; processing in the USA |
| Didit Identity Spain, S.L., Calle Nápoles 227, 08013 Barcelona (identity check) | Checking an ID document and face, only if you choose this route and consent | Spain (EU); processed in the EU by default, transfers to third countries only under the EU Standard Contractual Clauses |
| Your browser's push service (e.g. Apple, Google, Mozilla, Microsoft) | Delivering push notifications, only if you turn them on. The content is encrypted; the service only sees that a message goes to your device. | Depends on the browser, partly USA |
| OpenStreetMap Foundation (Vereinigtes Königreich) (map tiles) | Showing the map in the feed, only if you tap "Show map" (your IP address is transmitted when the map loads) | See provider |
Data processing agreements under Art. 28 GDPR are in place or being concluded with these providers. Where data is transferred to the USA, we rely on the EU-US Data Privacy Framework adequacy decision (if the provider is certified) or on the European Commission's Standard Contractual Clauses. Data is not passed on to any other third parties.
If you consent, your answers from the short scale and the questionnaire are sent to Anthropic (character portrait) and OpenAI (embedding). We only use the result for suggestions within the app; there are no decisions with legal effect (Art. 22 GDPR). Consent is voluntary. Without it you can use the app fully, but you get a generic portrait and less fitting suggestions. You can withdraw your consent at any time with effect for the future under "Me → Privacy & account"; your stored embedding is then deleted as well.
Before you can take part in Palm Up, you confirm your identity. There are two ways:
You can withdraw your consent for Didit at any time; please write to lucajungwirth@icloud.com. Without a passed identity check you can only look around in Palm Up.
Group chats: a group chat only starts once someone joins an activity. After the activity ends it stays open for 48 hours. Unless everyone confirms "keep chat" by then, it is closed and all messages are deleted immediately. If an activity is cancelled, the chat stays readable for 48 hours and is then deleted. Kept chats remain as long as at least two people are in them. Notifications are deleted after 30 days, answers to "What are you up for today?" after 60 days. We keep reports for moderation, even if the related chat was deleted.
We keep your data as long as your account exists. You can delete it yourself at any time; this removes your profile, participations, photos, private messages and all other data. Your messages in group chats stay visible to the other members without your name ("Deleted user") until the chat is deleted under the rules above. Upcoming activities you organise are cancelled and the participants are notified. At the end of the test phase (23.11.2026) all accounts and data are deleted, unless you explicitly agree to continue. The providers' server logs are deleted after their usual short periods.
We only use technically necessary cookies: for signing in (session) and for your language choice. In your browser's storage we also remember your filter settings and whether you postponed the weekly survey. There is no tracking, no advertising and no analytics service. No consent is required for this (Section 25(2) No. 2 TDDDG).
The connection is encrypted with TLS. Access to database content is limited to what is needed through row and column permissions; passwords are only stored as hashes. Still, a test version cannot guarantee complete protection.
We update this notice when the processing changes. For significant changes we inform you in the app and ask for any required consent again.