Draft: this text is waiting for legal review and will change before launch.
Privacy Policy
Last updated November 9, 2026 · version 2026-11-04
1. Who is the controller
This Policy explains what personal data MingleAway processes, why, for how long, and what rights you have. It applies from [date], version [version number].
The controller of your personal data is [full legal name or name and surname], [address], [tax ID] ("we"). We run MingleAway (https://[domain]), where hosts publish trips and other travelers find them and ask to join.
Contact for data protection matters: [email address]. We have not appointed a data protection officer.
MingleAway is not a travel agency: we do not organise, sell or insure trips, and we do not handle payments between travelers.
2. What data we process
| Type of data | What exactly |
|---|---|
| Account | email address, password (stored only as a secure hash), email confirmation status, chosen language, sign-up and sign-in dates |
| Facebook sign-in (if you use it) | name, email address and photo from your public Facebook profile; we do not receive your Facebook password or friends list |
| Profile | display name, home region, short bio (up to 500 characters), profile photo |
| Contact details (optional) | phone number and Messenger username |
| Trips you host | title, destination, dates, description, travel style, group size, up to 3 photos, whether joining is handled through the portal |
| Joining a trip | join request with a short message (up to 1,000 characters) and its status, group membership, saved trips (bookmarks), notifications |
| Safety and moderation | reports (category and details up to 300 characters), user blocks, moderator decisions, a record of which version of the Terms and Policy you accepted and when |
| Technical data | IP address, browser and device type, server and security logs, sign-in session data |
| Trip counters | for each trip and day: how many times it was opened and shared, and how many requests it received; no account, IP address or device data is stored with these numbers. The organiser of the trip sees the totals |
| Statistics (only with your consent) | which pages are visited and how the service performs |
We do not collect payment data or the precise location of your device. Please do not put sensitive information (for example about health, religion or beliefs) in your bio or messages; we do not need it.
3. Why we process data, on what basis and for how long
| Purpose | Legal basis (GDPR) | Retention |
|---|---|---|
| Creating and running your account, sign-in, email confirmation, password reset | Art. 6(1)(b) (contract) | until the account is deleted |
| Publishing your profile and trips, handling join requests, bookmarks, notifications | Art. 6(1)(b) (contract) | until the account or content is deleted |
| Showing your phone or Messenger on a chosen trip | Art. 6(1)(a) (consent: you tick it on the trip) | until you withdraw consent or delete the account |
| Account and trip emails (confirmation, password change, trip cancelled) | Art. 6(1)(b) (contract) | until the account is deleted |
| Safety, moderation, reports, blocks, preventing abuse and fraud | Art. 6(1)(f) (our legitimate interest) | [12] months after a case is closed; technical logs [30] days |
| Proof that you accepted the Terms and Policy, and handling your GDPR requests | Art. 6(1)(c) and (f) (accountability) | acceptances until the account is deleted; request record (ID only) [3] years |
| Establishing, pursuing or defending legal claims | Art. 6(1)(f) | until claims expire |
| Statistics and improving the service | Art. 6(1)(a) (consent in the cookie banner) | until you withdraw consent, at most [13] months |
| Legal obligations (for example tax, if they apply) | Art. 6(1)(c) | as required by law |
Your email and display name are needed to create an account. Everything else is optional, but some features may not work without it (for example, a host cannot publish a trip without describing it).
4. Who can see what
- Everyone, including signed-out visitors and search engines: published trips with their photos, and the host's name and photo.
- Signed-in users: profiles (name, region, bio, photo), the list of trips a person hosts, and a host's phone or Messenger if the host chose to show them on that trip.
- A trip's host: your join request, its text and your profile.
- Moderators and administrators: reports, photos awaiting approval and the data needed to handle a case.
Trip photos are reviewed before they are shown. We do not sell data or use it for advertising.
5. Who we share data with
We use providers that process data on our behalf:
- Supabase: database, authentication and file storage (EU servers, Ireland).
- Vercel: application hosting (server functions in an EU region).
- [email provider]: sending account emails.
- Meta Platforms Ireland: only if you sign in with Facebook; Meta then acts as a separate controller under its own rules.
- Unsplash: some images load directly from Unsplash servers, which then see your IP address and browser details.
- [statistics provider]: only if you consent to statistics.
We may also disclose data to legal and accounting advisers and to public authorities when the law requires it.
6. Transfers outside the European Economic Area
Some providers (for example Vercel and Supabase) belong to groups based in the USA. Transfers rely on an adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses. You can get a copy of the safeguards by writing to [email address].
7. Your rights
You have the right to access, rectify, erase, restrict and port your data, and to object to processing based on our legitimate interest. You can withdraw consent at any time (this does not affect earlier processing), and you can turn statistics off under "Cookie settings" in the footer.
Most things you can do yourself in the app: edit your profile, download a copy of your data (JSON file) and delete your account in Account settings. For anything else write to [email address]; we reply within one month.
You can also lodge a complaint with a supervisory authority; in Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
8. Deleting your account
When you choose "Delete account", a 30-day grace period starts. You can still sign in, see the deletion date and cancel. During this time upcoming trips you host are cancelled and their members are notified, your open join requests are withdrawn, and you are removed from groups that have not ended.
After 30 days we permanently delete your account, profile, profile photo, requests, bookmarks and notifications. Trips that other people joined may remain without your data (the host then appears as "Deleted traveler"). We keep only a record that the deletion happened: an ID, the type of action and the date, with no name or email.
9. Automated decisions
We do not make decisions about you based solely on automated processing, and we do not profile you in a way that has legal effects. People review reports and photos.
10. Cookies and browser storage
We store in your browser only what the service needs to work (sign-in session, your cookie choice, language). Statistics are switched on only with your consent. See the Cookie Policy; you can change your choice under "Cookie settings" in the footer.
11. Security
We protect data with encrypted connections (HTTPS), password hashing, required email confirmation, database access rules that limit each user to their own data, and restricted administrator permissions. If a personal data breach poses a high risk to you, we will notify you without undue delay.
12. Minors
The service is for people aged [18] or over. If we learn that a younger person created an account, we will delete it.
13. Changes to this Policy
When we change this Policy, we update the date and version on this page, and after material changes we ask signed-in users to accept the new version before they continue.
14. Contact
[full name], [address], email: [email address]. We reply within [5] working days.