Privacy Policy

1. Who is responsible

Dijabole is the app described on this site. The operator of the app is responsible for the personal data it holds and acts as the data controller. For anything to do with your data, write to app@dijabole.mybench.net.

2. Data we collect

We only hold what the app needs in order to work. There is no hidden collection beyond the list below.

Your account

Your activity in the app

• The groups you own or belong to, and invites you have sent or received.
• Events you create, including the name, description, date, time, place and price you enter.
• Your reply to an invitation, whether you were marked as having attended, and whether you were marked as having paid.
• Items you submit to a call for order, including the link and description you provide, and the price the organiser records.
• Your notification history inside the app.

Technical data

• A push notification token for your device, so notifications can be delivered to it. It is deleted from our records once it stops being valid.
• Sign in tokens, held on your own device in the operating system secure storage, not on our server. The short lived one expires after 15 minutes, the long lived one after 30 days.
• Ordinary server logs produced when your app talks to our server, which include an IP address and are used for security and fault diagnosis.
• The dates on which your account and your entries were created and last changed.

3. Phone numbers and invites

Invitations in Dijabole are addressed to a phone number, so this deserves stating plainly:

• The app does not read your contact list. A member typing an invite enters the number by hand.
• A number can be invited even if it does not belong to a registered user. That invite is stored and waits. If somebody later registers with that number, they join the group automatically.
• An organiser can also add a guest to an event by name and phone number, for somebody who does not use the app at all. That entry is bookkeeping for the organiser and generates no message to the number.
• We send no SMS messages. Adding a number to the app does not cause it to be contacted by us.
• Your phone number is not verified and is never a way of signing in on its own. Signing in always needs your username and password.

4. Why we use it

Each piece of data has one purpose, which is to make the app do what you asked of it. Specifically, we use your data to:

• Create and secure your account, and let you sign back in.
• Show you your groups and events, and show the other members who is coming.
• Connect an invitation to the right person.
• Tell you when an event is created, changed or cancelled.
• Keep the attendance and payment record an organiser needs.
• Keep the service running, investigate faults and deal with abuse.

Where the law requires a legal basis, ours is the performance of our agreement with you for the features you use, and our legitimate interest in a secure and working service for the technical and security data. We do not use your data for advertising and we do not sell it.

5. What others can see

Dijabole is a shared space, so some of your data is visible to the people you share a group with. Please read this before you put anything sensitive in a description field.

• Other members of a group can see your name, your display name and your profile picture, and whether you accepted an event.
• The organiser of an event can see and set whether you attended, and for a shuttle whether you paid and what price applies to you.
• In a call for order, the items you submit and their confirmed prices are visible within that event, by design, so the group can see what is being bought.
• Our operators can see accounts, groups, events and usage totals through an internal administration dashboard, in order to run the service and act on reports of abuse. Access is restricted to the operator and is separate from ordinary user accounts.

6. Notifications

The app notifies you when you are invited to an event and when an event you are part of changes or is cancelled. Notifications appear in a list inside the app, and are also delivered to your device as push notifications.

Push delivery uses Firebase Cloud Messaging, a Google service. To deliver a message, Google receives the device token and the content of that notification, which typically includes the event name and your group. You can switch push notifications off in your device settings at any time, and you will still see the list inside the app.

7. Payments

Dijabole does not process payments. The paid and unpaid marks are a note the organiser keeps, nothing more. No money moves through the app, and we never receive card numbers, bank details or any other payment credentials. Whatever the group agrees on, cash or a transfer between you, happens outside Dijabole.

8. What we do not collect

Stated explicitly, because absence is as important as presence:

• No location tracking. The app does not ask for or use your device location. A place on an event, and the city on your profile, are text somebody typed.
• No contact list access. Phone numbers are typed in by hand.
• No analytics or tracking software. There is no advertising network, no analytics product and no third party crash reporting in the app.
• No advertising profiles and no advertising identifier.
• No microphone, camera roll scanning or background access. Photo access happens only when you choose a picture for your profile.

9. Sharing with third parties

We do not sell personal data and we do not share it for advertising. Data reaches outside parties in only these cases:

• Google, through Firebase Cloud Messaging, to deliver push notifications, as described in section 6.
• Our hosting and email providers, which store the database and send the occasional service email such as a password reset. They process the data for us and on our instructions.
• Authorities, where a valid legal obligation requires it.

10. How long we keep it

Your account and its data are kept while your account exists, because a group needs its own history to be of any use. Past events stay in the group record so the organiser can look back at what happened and what was settled.

Ask us to delete your account and we will delete your personal data, or anonymise entries that a group still needs for its own records, within 30 days of confirming your request. Pending invitations to a phone number are deleted on request. Server logs are kept for a short period for security and diagnosis, and then discarded.

11. Security

Passwords are stored only as cryptographic hashes, never in a readable form. Traffic between the app and our server is encrypted in transit. Sign in tokens are held in the secure storage the operating system provides, are short lived, and can be revoked. Access to the administration dashboard is restricted, requires its own separate credentials and carries protection against cross site request forgery.

No system is perfectly secure. Please use a password you do not use anywhere else, and tell us at once if you think somebody else has got into your account.

12. Your rights

Depending on where you live, and in the European Economic Area under the GDPR, you have the right to:

• Ask what data we hold about you and get a copy of it.
• Correct anything that is wrong. Most profile fields you can edit yourself in the app.
• Have your data deleted, and your account with it, through the account deletion request form.
• Object to or restrict a particular use of your data.
• Receive your data in a portable form.
• Complain to your national data protection authority.

To use any of these, write to app@dijabole.mybench.net from the address on your account, or tell us your username so we can identify you. We answer within 30 days. There is no charge.

13. Children

Dijabole is not aimed at children and is not intended for anybody under 13, or under the higher minimum age that applies where you live. We do not knowingly collect data from a child. If you believe a child has created an account, write to us and we will remove it. A parent or organiser may of course record a child as an attendee of an event, which creates a note in that group and no account.

14. Changes

If this policy changes we will update the page and the date at the top. Where a change materially affects how we use your data, we will tell you in the app before it takes effect.

15. Contact