Privacy policy

Last updated: 16 October 2026  ·  Effective date: 16 October 2026

This Privacy Policy describes how Summoner ("we", "our", or "us") collects, uses, and protects your personal data when you use the Summoner mobile application and the website summoner-app.com (collectively, the "Service"). We are committed to processing your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Bulgarian data protection law.

1. Data we collect

1.1 Account Data

When you register, we collect:

• Email address - used to sign in and to recover your account. We never show it to other users. Someone who types your whole email address into Find people can find your account; you can switch that off in You > Security. If you sign in with your username, the address stays on our server. If reports hide one of your public Summons, we write to you here to say why.
• Your agreement - when you confirmed you are 18 or older and agreed to the Terms and this Policy, and which version.
• Phone number - optional. Collected after OTP verification. Stored in hashed form (using a one-way hash of your normalised number) in a server-side lookup table. The number itself is held by Google's sign-in service, which verified it, and in your private account record. No other user can see it.
• Username - the display name you choose.
• Profile avatar - an image you upload voluntarily.
• Two-step sign-in - if you turn it on, Google's sign-in service (part of our cloud infrastructure) stores the secret your authenticator app uses. We never see the codes.

1.2 Content You Create

• Circle messages and media - text, photos, videos, voice messages, files and stickers, stored on our cloud infrastructure. Circle chat is not end-to-end encrypted. Our server reads a circle message to send its notification, which carries the message's words, and to notice when it names a member with "@", who then gets a notification of their own.
• Private messages - end-to-end encrypted. Your phone encrypts the text, photos, videos, voice messages, files and inbox previews before they leave it, and only you and the other person can decrypt them. We can't. The notification for a private message carries the text still encrypted; your own phone decrypts it when it arrives. What we can see: who you chat with, when each message was sent, what kind it is (text, photo, voice and so on), emoji reactions, when you last read the chat, and whether you're typing.
• Your encryption key - your phone creates it. So you can get your messages back on a new phone, we also store a copy of the key on your profile, locked with your recovery key. The app shows you the recovery key once, and it never leaves your phone, so we cannot unlock that copy.
• Summons - including activity description, duration, and the geographic coordinates you choose to share. For circles, the circle's timeline keeps each ended Summon (see section 5).
• Active status - when you were last in the app, shown to your friends as "Active now". You can hide it in You; then you don't see theirs either.
• Public content (Discover) - public Summons, communities, and the messages you post in public Summon or community chats. This content is publicly readable (or readable by community members) and is NOT end-to-end encrypted: unlike private messages, we can access it and moderate it. It includes your username, avatar, the text/photos you post, tags, and (for public Summons) an approximate location.

1.3 Location Data

• Summon locations - coordinates you select for a Summon. For public Summons, the exact point is never published: it is offset to an approximate area before storage, and the precise coordinate is shared only with the host and confirmed attendees.
• Live device location - used to find Summons near you when you open the public discovery feed, to confirm you are inside a region-based community's area at the moment you join it, and, once you have said you are going to a Summon, to work out how far you still are from it. Your phone works that distance out itself, and your location is not sent anywhere for it. We do not store a persistent "home area" for you; each of these uses your location at the time of the action. What is stored is a single straight-line distance in metres, with no coordinates and no route. It is a reading from the moment you last opened that Summon, not a live position, and it is deleted 30 minutes after it was taken, or as soon as the Summon ends, whichever comes first.
• Community region - if you create a local community, the centre point and radius you choose are stored as part of that community's public profile.

1.4 Public Reputation

For Discover, we maintain a small, publicly visible count of how many public Summons you have hosted and attended (credited only when an event completes). These counts and the badges derived from them are shown on your public profile to help other users decide whether to join.

1.5 Technical & Usage Data

• Push notification token - a device token used to deliver push notifications, with which kind of phone it belongs to. Stored privately and never exposed to other users.
• Notification settings and time zone - which kinds of notification you have switched on, your quiet hours, and your phone's time zone (for example Europe/Sofia). These are copied to your private account record so our server can hold back notifications during your quiet hours on an iPhone, which cannot filter them itself.
• Last activity timestamps - used to sort circles and determine notification eligibility.
• Failed sign-ins - if someone gets the password wrong when signing in with a username, we count the attempt against a scrambled (hashed) form of the username and of the IP address, to stop guessing. We delete these counts within two hours.
• Rate limits - when you use the contact form, we keep a scrambled (hashed) form of your network address with the times you used it, so the form cannot be used to flood our inbox. We keep a similar count of the report emails each account triggers. Only the last hour counts, and we delete the record within two days of its last entry.
• Standard server logs generated by our cloud infrastructure (IP address, device type, request timestamps). These are processed by our infrastructure provider under their own terms.

1.6 Reports

When you report someone, we receive your username, theirs, the reason and your note. From a circle or a public Summon, the report also carries the last messages between the two of you there (up to 20). From a private chat, the person reporting can choose to attach your messages to each other; their phone decrypts them, and then we can read those messages. Without that choice, a private-chat report tells us only which chat it came from. The copy of a report that reaches our inbox also carries the sign-in email addresses of both people, so we can write to either side.

1.7 Contacts (Optional)

If you give Summoner access to your contacts, your phone normalises their numbers to E.164 format and hashes them. Only the hashes are transmitted to our servers to identify mutual connections. Raw phone numbers from your contacts are never sent to or stored by us.

1.8 What you must give us, and what is optional

To open an account you need an email address, a username, and to confirm you are 18 or older and agree to the Terms and this Policy. Without those there is no account. Everything else is optional: a phone number, an avatar, your contacts, your location, your photos, notifications and the rest. Say no to any of them and the feature that needs it stays off; nothing else changes.

2. Legal basis for processing

Each purpose has its own legal basis under Article 6 GDPR:

• Your account, chats, circles, Summons, friends and Discover - performing our agreement with you (Art. 6(1)(b)).
• Your encryption key backup - performing our agreement, so you can restore your messages (Art. 6(1)(b)).
• Maps, place search and GIFs - performing our agreement (Art. 6(1)(b)). Google and GIPHY handle what they receive as independent companies, as section 4 explains.
• Push notifications and contact matching - your consent (Art. 6(1)(a)), which you give in your phone's permission prompts. You can withdraw it in your phone's settings or in the app at any time. Your notification settings and time zone are kept to carry out the choices you made (Art. 6(1)(b)).
• The contact form and support emails - answering you: performing our agreement where it concerns your account (Art. 6(1)(b)), otherwise our legitimate interest in replying to people who write to us (Art. 6(1)(f)).
• Your location - your consent through your phone's location permission (Art. 6(1)(a)), used only when you take the action that needs it.
• Being found by your email address, and active status - our legitimate interest in helping friends find and reach each other (Art. 6(1)(f)). You can switch either off in the app.
• Moderation, reports, image scanning and the emails about hidden Summons - our legitimate interest in keeping people safe (Art. 6(1)(f)), and our duties as a hosting service under the Digital Services Act (Art. 6(1)(c)).
• Your 18+ confirmation and agreement record - our legal duties and our legitimate interest in showing who agreed to what (Art. 6(1)(c) and (f)).
• Failed sign-in counts and crash reports - our legitimate interest in security and in fixing faults (Art. 6(1)(f)).

3. How we use your data

• To create and maintain your account.
• To enable real-time messaging, Summons, and social features within the app.
• To deliver push notifications for messages, Summons, and friend requests.
• To power public discovery - showing nearby public Summons and communities based on your current location, and confirming you are within a region-based community's area when you join it.
• To moderate public content for safety (automated image scanning and prohibited-term checks) and to act on user reports.
• To allow optional contact-based friend discovery.
• To enforce our Terms of Service and prevent abuse.
• To operate and maintain the technical infrastructure of the Service.

We do not sell your personal data. We do not use your data for advertising profiling.

3.1 Automated processing in moderation

Some safety measures run without a person looking first, and Article 13(2)(f) GDPR requires us to tell you which:

• Image scanning. Images destined for public places - avatars, circle and community icons and covers, public Summon cover photos, and photos and video thumbnails in community chat - are checked by Google Cloud Vision SafeSearch before publication. A flagged image is refused. The image is not published; nothing else about your account changes.
• Prohibited-term checks. Text entered when creating public Summons and communities is matched against a blocklist and can be refused at the point of creation.
• Report thresholds. A public Summon reported by three or more separate people is hidden from Discover pending review, and an account reported by five or more separate people is flagged for us to look at. Hiding is reversible and flagging is only a queue for human attention.

No penalty against your account is ever applied automatically. Warnings, restrictions on Discover, suspensions and bans are decided by a person, every time, and deliberately so: an automatic ban driven by report counts could be triggered by a handful of accounts acting together, which would make the safety system into a weapon. Automated steps can hide a piece of content or refuse an upload; only a human decision reaches your account.

Because of this, we do not carry out decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. If content of yours is refused or hidden and you believe it was wrong, write to support@vaultpointlabs.com and a person will review it.

4. Data sharing & third parties

We use the companies below. The ones marked processor act only on our instructions, under a data processing agreement that binds them to protect your data at least as this policy requires. Google Maps Platform, Apple's push service, your phone's own address lookup and GIPHY are different: they handle what your phone sends them under their own privacy policies, linked here.

• Google LLC, through Firebase (processor) - Firebase Authentication (sign-in, email and phone verification, two-step codes), Cloud Firestore (the database), Cloud Storage for Firebase (photos, videos, voice messages and files), Cloud Functions (our server code, which sends notifications and runs moderation), Firebase Cloud Messaging (push notifications), Firebase Hosting (this website) and Firebase Crashlytics (section 10). Our database and files are stored in the European Union; section 9 covers the rest.
• Apple Push Notification service (Apple Inc.) - on an iPhone, every notification reaches you through Apple's push service. A circle message's notification carries the sender's name, the circle's name and the message's words; a Summon's carries who called it, the activity and when it ends; a private message's carries the text still encrypted, which Apple cannot read. Apple describes its handling in Apple's privacy policy.
• Google Maps Platform (Google LLC, as an independent controller) - the maps in the app, place search and address lookup, and the small map pictures on Summon cards. Google receives your phone's IP address and the coordinates of any map or map picture we draw (for public Summons that is the approximate offset area, unless you are the host or a confirmed attendee; for a circle Summon, the place that was picked); what you type into a place-search box, with the map's centre; and, when a public Summon is created, its exact coordinate, sent to the Places and Geocoding services so our server can size the blur area and name the surrounding neighbourhood. That last exchange happens on our server, and the exact coordinate is still never published to other users. When you send a message that is only a short Google Maps link (maps.app.goo.gl), your phone also asks Google once where the link leads, so the place arrives as a map. Google uses this data under the Google Privacy Policy.
• Your phone's own address lookup (Apple on an iPhone, Google on Android) - when Google's place search is unavailable, and to name the area around a point, the app asks the address service built into your phone. It receives the coordinates, or the address you typed, under that company's privacy policy.
• Google Cloud Vision (SafeSearch) (processor) - avatars, circle and community icons and covers, public Summon cover photos, and photos and video thumbnails posted in community chat are sent to Google's image-moderation service before they are published. An image we cannot check is not published. Images are checked transiently for this purpose and are not used to build a profile of you.
• OpenStreetMap / Nominatim - not currently in use. The browser version of Summoner is closed while it is rebuilt, and it is the only part of the Service that used OpenStreetMap map tiles and the Nominatim address-search service. If and when it reopens, the coordinates or search terms involved would be processed under OpenStreetMap's privacy terms, and we will say so here without the caveat.
• Resend (processor; Plus Five Five, Inc., United States) - sends our emails: what you write in the contact form, with your name and the email address you give; the copy of each report that reaches us, which carries the usernames and sign-in email addresses of the reporter and the reported person, the reason, the note and any attached messages; and the email to a host whose public Summon reports have hidden.
• Firebase Crashlytics (Google, processor) - crash and error reporting in the app, on Android and iPhone, described in section 10. Crash reports are processed by Google on our behalf. Firebase Analytics was removed in version 1.0.5 and is no longer present.
• Fonts and styles - none. The fonts our pages use are served from our own servers, so opening a page does not disclose your IP address to a font CDN. We load no third-party stylesheet or script libraries on the website at all.

Some processing never leaves your phone and involves no company: the sticker cut-out (a model that Google Play services downloads on Android and the phone runs itself), your fingerprint or face for unlocking chats (checked by your phone's operating system; no biometric data ever reaches us), and the distance from you to a Summon.

GIPHY (GIPHY, Inc., United States, as an independent controller) supplies the GIFs behind the app's GIF button. GIPHY is an independent company and handles this data under its own privacy policy. It receives what you type into the GIF search, your phone's language setting, and your phone's IP address each time your phone loads a GIF: in the GIF panel, and when a GIF someone sent you appears in a chat. In a private chat the GIF's link travels inside the end-to-end encrypted message, so we cannot see which GIF was sent. GIPHY sees your phone load it, but not who sent it or anything else in the conversation. We send GIPHY nothing that identifies your account: no username, email address or phone number.

We do not share your data with any other third parties except where required by law or a court order, in which case we will notify you to the extent permitted by law.

5. Data retention

• Account data - retained for as long as your account is active.
• Messages - kept until someone deletes them. When you delete a message, we erase its content for everyone, including quotes of it in replies. Deleting a circle deletes all its messages. A temporary chat and everything in it is deleted within 5 minutes of the time it was set to end.
• Circle Summons - the live Summon is cleared within 5 minutes of ending. An entry stays in the circle's timeline: the activity, the place, who went, when it started and ended, and any photos people added. It stays until the circle is deleted. Each circle also keeps a count of how many Summons each member attended, for its leaderboard.
• Private chat Summons - cleared within 5 minutes of ending, with nothing kept.
• Public Summons - marked ended at expiry and their cover photos deleted. The entry itself, with its exact location, its attendee list and its chat, is deleted by a daily step once 30 days have passed since the Summon ended. A host may cancel a public Summon, which puts it on the same 30-day clock, or delete it at any time, which removes its attendees, chat, and exact location straight away.
• Communities - retained while active; deleting a community removes its members, chat, and icon. Public reputation counts persist with your account.
• Active status - one timestamp, overwritten each minute you are in the app, written no more once you hide your status, and deleted with your account.
• Notification token and settings - until you sign out on that phone or delete your account. A token that no longer works is removed when a notification fails.
• Distance to a Summon - 30 minutes, or until the Summon ends (section 1.3).
• Pending uploads and loose files - a photo waiting for its safety check is deleted after 24 hours if it is never published; a chat file nothing refers to is deleted after 24 hours.
• Rate-limit records - the scrambled network address and the times from section 1.5. Only the last hour counts, and we delete the record within two days of its last entry.
• Abuse reports - kept for two years after we close the case, so a safety record can't be wiped by deleting an account and coming back. A daily step deletes each report two years after its case was closed; a report whose case is still open stays.
• Crash reports - Google keeps them for 90 days.
• Server logs - Google's sign-in service keeps the IP addresses it logs for a few weeks; the website host keeps its request logs for a few months.
• Usernames - when an account is deleted, its username stays reserved for good, so nobody can take a name that old chats still show.
• Account deletion - when you delete your account, your authentication entry, profile, circle memberships, and social connections are removed via an automated cascade. You can do this yourself in the app, or ask us to; how to delete your account sets out both routes and exactly what is and is not removed. Encrypted private message history may be retained in read-only form for the other participant with a clear "account deleted" indicator.
• Backups - we keep no backups of the database of our own, so what we delete is gone. Google's file storage lets us recover a deleted photo, video or file for 7 days; after that it's gone for good. Google's sign-in service finishes removing a deleted account's data from its own systems and backups within 180 days.

6. Your rights under GDPR

As a data subject in the EU, you have the following rights:

• Right of access (Art. 15) - request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) - request correction of inaccurate data.
• Right to erasure (Art. 17) - request deletion of your personal data ("right to be forgotten"). You may delete your account directly from the app, which triggers an automated erasure cascade; see how to delete your account, including what to do if you can no longer open the app.
• Right to restriction (Art. 18) - request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20) - request your data in a structured, machine-readable format.
• Right to object (Art. 21) - object to processing based on legitimate interests.
• Right to withdraw consent - withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at support@vaultpointlabs.com. We will respond within one month; a complex request can take up to two months more, and we tell you if so. You also have the right to lodge a complaint with the Commission for Personal Data Protection of Bulgaria (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, kzld@cpdp.bg, www.cpdp.bg. We have not appointed a data protection officer: Article 37 GDPR does not require one of a service this size, run by one person.

7. Security

We implement industry-standard technical and organisational measures to protect your data:

• Private messages are end-to-end encrypted, as section 1.2 describes. You can also lock your chats behind your fingerprint or face; your phone does that check, and no biometric data ever reaches us.
• All data in transit is encrypted via TLS.
• Security rules on our database decide who can read what. Your profile (username, avatar, public key and the locked key backup) is visible to other signed-in users. Your phone number, push tokens, friends list and private chats are not.
• Push notification tokens and phone numbers are stored in private records inaccessible to other users.

No system is 100% secure. In the event of a personal data breach that poses a risk to your rights, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by Art. 33-34 GDPR.

8. Children's privacy

Summoner is for people 18 and older. Everyone confirms their age when they sign up. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has an account, write to support@vaultpointlabs.com and we will close it and delete its data.

9. International transfers

Some of the companies in section 4 are established outside the European Economic Area (EEA) or operate infrastructure there, including in the United States:

• Google LLC - cloud infrastructure, Maps Platform, Cloud Vision and Crashlytics. Our database and file storage are in the European Union. Our server functions, which send notifications and handle sign-in and moderation, run in the United States (Iowa), so data passes through there while they work. Crash reports and the Maps and Vision requests are handled by Google wherever it runs those services, including the United States.
• Apple Inc. - push notifications to iPhones, United States.
• Resend (Plus Five Five, Inc.) - email delivery, United States.
• GIPHY, Inc. - GIF search and loading, United States. Your phone talks to GIPHY directly; we have no contract with GIPHY, and it handles your data under its own privacy policy.

Google and Resend are certified under the EU-U.S. Data Privacy Framework, and their data processing agreements with us also contain the European Commission's Standard Contractual Clauses (SCCs). For Apple and GIPHY the exchange happens between your phone and that company, under its own privacy policy and the safeguards it states there. You may request a copy of the applicable transfer mechanisms by contacting us.

10. Cookies & tracking

The website sets no cookies and runs no analytics. There is no analytics package, tag manager, advertising pixel, session recorder or A/B testing tool on summoner-app.com. We do not track you across sites. There is nothing on the website to consent to, which is why you are not asked.

The app runs no analytics either. Earlier versions included Google's Firebase Analytics, which switched itself on by being present and recorded automatic events - first opens, session starts, screen views - against a pseudonymous app-instance identifier. We never asked it for anything and never used it, so we removed it. From version 1.0.5 onward it is not in the app at all, and neither is the advertising-identifier permission it brought with it.

One Google SDK remains, and it only reports on the app itself rather than on you:

• Firebase Crashlytics - when the app crashes, on Android or iPhone, it sends us the crash: the stack trace, the device model, the operating system version and the state of the app at that moment, against its own installation identifier. It also records errors the app catches without crashing, in the same form. We never attach your account to a report. It is what tells us something is broken for real people rather than only on our own phone. It is switched off entirely in development builds.

It is not used to build a profile of you, it is not shared with advertisers, and it cannot read your messages. It is listed as a processor in section 4 and Google keeps its reports for 90 days (section 5).

In full, this is everything the website stores in your browser:

• Nothing. The pages you can currently reach - the home page, this policy, the terms, the legal notice, the child safety standards, the contact page and a shared Summon page - set no cookies, and write nothing to local storage, session storage or IndexedDB.

The website also loads no third-party resources on its own initiative. Typography is served from our own domain rather than from a font CDN, so opening a page does not tell Google, or anyone else, that you did.

The Summoner app stores its settings on your own device (your theme, which chats you have hidden, your reactions and your encryption key). That data stays on the phone and is not a cookie. Two things are copied to your account: the locked copy of your key described in section 1.2, and your notification settings with your time zone, described in section 1.5.

There is exactly one exception, and it only happens if you ask for it. On a shared Summon page (/summon) we can show an embedded Google map of the meeting point. That embed is not loaded until you press "Show map", because loading it would send your IP address and the address of the page you are on to Google. Until you press it, nothing about your visit reaches Google. If you do press it, that request is governed by Google's own Privacy Policy and Google may set cookies on your device. The "Open in Maps" link on the same page is an ordinary link and behaves like any other link you choose to follow.

11. Changes to this policy

We may update this Privacy Policy, for example when we add a feature. For a small change we update the date above. For a change that affects how we use your data, the app shows you the new Policy before you carry on.

12. Contact & data controller

The controller of your personal data under Article 4(7) GDPR, and the provider of the Service, is:

Send privacy questions, requests and complaints to that address or that inbox. Our Legal notice carries the same identity together with our register entry, VAT status and hosting details.