Where your data lives
Last updated: October 8, 2026
This page sums up, by type of data, where your data is stored, which providers process it and in which country. It does not replace the privacy policy, which prevails and details each processing operation (§4 for providers).
Our commitments
- The core of the service is stored in Europe. Database, servers, cache, error reports and backups are located in the European Union; photos and videos are stored in Cloudflare's EU jurisdiction (storage guaranteed in the European Union). Some providers are US companies that may access them remotely, and some data leaves the Union to be delivered or analyzed (emails, text messages, notifications, moderation, AI): the table below says so case by case.
- No sale of data. We do not sell or rent your personal data, to anyone.
- Artificial intelligence only with your consent. Each AI feature (assistant, assisted creation, cover images, subtitles, translation) asks for your consent before the first submission, and you can withdraw it. Only automated content moderation, which protects users, applies without individual consent in spaces where it is enabled.
By type of data
| Data | Where it is stored | Who else processes it (country) | Safeguard |
|---|---|---|---|
| Account and profile (email, name, phone, date of birth, preferences) | Supabase database, European Union (Frankfurt) | Railway, our servers (EU, Amsterdam); Resend for emails and Twilio for text messages, when they are sent (United States) | SCCs; SCCs / DPF for Railway, Resend and Twilio |
| Messages (chats and private messages) | Supabase database, European Union (Frankfurt) | Railway, real-time relay without storage (EU, Amsterdam); push notifications: Expo (United States) then Apple or Google, with the sender's name and the first 100 characters, unless you turn off "Message previews" (off by default for 15 to 17-year-olds); moderation: text sent to OpenAI (United States) in spaces where it is enabled, without any account identifier | SCCs / DPF |
| Photos, videos, voice messages and documents | Cloudflare R2, Cloudflare's EU jurisdiction (storage guaranteed in the European Union; Cloudflare remains a US company) | Cloudflare's global network for delivery (temporary cached copies); moderation: image addresses sent to OpenAI (United States) in spaces where it is enabled | SCCs / DPF |
| Live location | Supabase database, European Union (Frankfurt); deleted no later than 24 hours after the end of the event or of your sharing | Mapbox (United States), queried by your device: the map area displayed and, if you convert a point into an address, its coordinates | SCCs / DPF |
| Payments and subscriptions | Plan, dates and status in our Supabase database (EU). Your payment card details stay with Apple or Google: we do not receive them | Apple or Google, sellers of the subscription (independent controllers); RevenueCat (United States), which only receives a random internal identifier | Apple's and Google's policies; SCCs / DPF for RevenueCat |
| Artificial-intelligence features | Nothing is kept on our side apart from a usage log without content (Supabase, EU) | Anthropic and OpenAI (United States), only with your consent; no email, phone number or account identifier | SCCs / DPF |
| "Bugs and suggestions" feedback | Supabase database (EU); screenshots on Cloudflare R2 | Nothing is sent automatically. The team handles it with its internal tools, Linear and Claude Code (Anthropic) (United States), without your name | SCCs / DPF |
| Technical logs, error reports and backups | Railway (EU, Amsterdam); Sentry (EU, Germany); encrypted backups at Backblaze (EU, Amsterdam), when backups are in service | No other recipient | SCCs / DPF; SCCs for Backblaze |
SCCs: the European Commission's standard contractual clauses. DPF: the EU–US Data Privacy Framework, for certified US companies. They cover any transfer outside the Union, including remote access by a foreign provider to data stored in Europe.
What we do not do
- We do not sell or rent your data.
- We do not send your email, phone number or account identifier to AI providers, and their API terms rule out training their models on this data.
- We do not receive your payment card details.
- We do not keep your address book.
- We do not automatically pass your feedback on to any third party.
- We only show non-personalized ads to accounts under 18, when advertising is shown.
For the details of each processing operation, retention periods and your rights, see the privacy policy.