Privacy Policy
Effective Date: July 8, 2026
Welcome to Goba (the "App"), a service for chatting about ephemeral topics with people nearby. We believe your privacy should be simple and transparent. This Privacy Policy explains how we collect, use, and protect your data.
1. Who we are (Data Controller)
The controller of your personal data is:
- Operator: Valerii Lesko
- Country: Ukraine
- Privacy contact: info@goba.app
For any questions about your data or to exercise your rights, please contact us at the email above.
2. Data we collect
We collect only what is needed to operate the App:
- Account data: When you sign in with Apple or Google, we receive a sign-in identifier and your email address. Your email is used strictly for account recovery and essential communication; it is never visible to other users.
- Profile data: Your nickname, and optionally your date of birth, gender, languages, interests, and an avatar. You provide these yourself, and you can hide certain elements from other users in your privacy settings.
- Location: Precise device location (collected only "While In Use") or a city you choose manually. Location is necessary to show you topics and people nearby. We always coarsen/offset your precise location before showing it to others — your exact address or pinpoint location is never disclosed.
- User-generated content (UGC): Topics you create, chat messages (text and images), private messages, and user reviews.
- Technical data: User identifier, push notification token, network request data, server logs (including IP address), and online status.
- Moderation data: Reports you submit to us and your list of blocked users.
Note: We do not collect data for advertising tracking, do not sell your data, and do not track you across other apps or websites.
3. Why we process data and our legal basis (GDPR)
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Providing the service (sign-in, chats, profile creation) | Account, profile, UGC, technical data | Performance of a contract (Art. 6(1)(b)) |
| Showing nearby topics and people | Location | Consent (Art. 6(1)(a)) |
| Push notifications | Push token, notification settings | Consent (Art. 6(1)(a)) |
| Safety, moderation, and abuse prevention | UGC, reports, blocks, logs | Legitimate interest (Art. 6(1)(f)) |
| Legal compliance | As required by applicable law | Legal obligation (Art. 6(1)(c)) |
You can withdraw your consent for location access and notifications at any time via your device's system settings.
4. Who we share data with (Processors)
We do not sell your personal data. We use trusted third-party providers ("processors") strictly to operate the App:
- Apple / Google — to facilitate account sign-in.
- Google Firebase Cloud Messaging — to deliver push notifications.
- Google (Google Maps) — for displaying maps within the App.
- Hetzner Online GmbH — for secure server and database hosting.
Automated image screening: Images you upload are automatically checked for illegal or abusive content by software running on our own servers in Germany. This screening is not performed by, or shared with, any third party.
Public Content: Please remember that some of your content (topics, public messages, nickname, and avatar) is, by its nature, visible to other users of the App.
5. International data transfers
Your data is primarily processed on secure servers located in Germany. Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as EU Standard Contractual Clauses.
6. Data retention
- Active Accounts: We keep your account and profile data for as long as your account exists.
- Account Deletion: When you delete your account, it enters a pending-deletion state. After 30 days, your data is permanently deleted or irreversibly anonymized. You can restore your account within this 30-day window.
- Content: Deleted topics and messages are hidden immediately and permanently removed within a timeframe similar to the account deletion window.
- Safety and Legal Holds: We may retain certain data (such as identifiers of banned users) for a longer period to prevent abusive users from creating new accounts, to investigate safety incidents, or to comply with legal obligations. Where an uploaded image is flagged as potentially illegal, we may preserve it, and related records, beyond the normal deletion window as evidence, to the extent required to investigate and to comply with the law.
- Server Logs: Kept for a limited, short-term period strictly necessary for security and diagnostics.
7. Your rights (GDPR)
Depending on your location, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Erase your data (the "right to be forgotten"). You can delete your account and data directly within the App (Profile → Delete profile).
- Restrict or object to our processing of your data.
- Withdraw your consent at any time.
For any privacy requests not covered by the App's settings, email info@goba.app. We will respond within the time required by law. You also have the right to lodge a complaint with your local data protection supervisory authority.
8. Age restriction
The App is intended for users who are 16 years of age and older. We do not knowingly collect data from children under 16. If we discover that a child under 16 has created an account, we will promptly delete it.
9. Security
We implement reasonable and robust technical and organizational measures to protect your data, including HTTPS traffic encryption and strict access controls. However, please be aware that no method of internet transmission or electronic storage is 100% secure.
10. Changes to this Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you via the App or by email. The effective date at the top reflects the latest revision.