Privacy Policy

Bonder (bonder.lt and the Bonder iPhone app) is run by Ugnius Motiejunas in Lithuania, who is the data controller for the personal data described here. Write to bondersupport@gmail.com about anything in this policy. The iPhone app shows this same website and follows this same policy.

• Your email address, to sign you in with a one-time code. There are no passwords.
• In the iPhone app, if you choose Sign in with Apple or Continue with Google: from Apple, a user identifier for Bonder and your email address (which may be an Apple private relay address that forwards to you), and your name the first time you allow it; from Google, a user identifier, your verified email address and your name. We use this information to authenticate your Bonder account. For a first-time Google sign-in, we link by email only when Google confirms current control of the address through Gmail or Google Workspace; other addresses require you to continue with an email code. An existing Google link can sign you in using the same Google user identifier. We never receive your Apple or Google password. For Sign in with Apple we also keep a token from Apple, encrypted, only so we can tell Apple to end the link when you delete your account.
• If you choose Google sign-in, Google also processes your IP address and technical information such as the sign-in SDK and iOS versions to operate and protect sign-in. Google may estimate your general location from your IP address to prevent fraud. This does not use your phone's GPS location. See Google's sign-in data disclosure.
• Your profile, if you fill it in: name, username, bio and profile photo, and who you follow and block.
• Venue or organizer pages you manage: the public contact name, email, phone number, address, photos and other details you choose to publish.
• Events you create or co-host: title, description, time, place, cover image, questions for guests and settings.
• Your RSVPs: your name, email, status, number of guests, note to the host and answers to the host's questions.
• What you post: comments, album photos and their comments and reactions, chat messages and chat photos.
• Reports you file about content or people, and problem reports you send us. A problem report includes the page address, error reference and device/browser details, and your account and email if you are signed in. The page address can contain search words or a location used for Nearby.
• In the iPhone app, if you allow notifications: your phone's Apple push token.
• Technical records: errors, crashes and request timings, which may be linked to your signed-in account; sign-in and security records using a hash of your network address; and the usage measurements described under Analytics. Hosting providers also process network addresses and request logs.

Private events are reachable only through their link, and guest details are shown only to the hosts and, as the event allows, to other guests who have RSVP'd.

To run your account and the events you take part in (the service you asked for); to keep Bonder safe, stop abuse and handle reports; to find and fix errors; and to understand how Bonder is used so we can improve it (our legitimate interests). Notifications and device location are used only with your permission, which you can withdraw in iOS Settings at any time.

We record event opens, RSVPs and use of invitation-sharing controls to understand how the service is used. Signed-in activity can be linked to your account in our own database. Share activity does not record recipients or message contents. Page visits to the homepage, map and event lists are recorded in our own analytics using a daily visitor hash and a page category, without search terms or filter values. Page views, public events viewed, navigation, approximate active time, scroll depth, sign-in and registration steps, control interactions, coarse tap positions, repeated taps, and request timing and outcomes are measured with PostHog (EU) using a visitor hash that changes every day, without cookies or a persistent tracking identifier. We estimate country and city from your connection using a local database and send that approximate location, not your IP address, to PostHog. This is not GPS location.

For event creation, we measure the steps reached, save outcomes and which fields are filled (for example “title entered” or “address entered”), counts, switches and the categories chosen, to understand where creation stops. Analytics never contain the text of your event, saved or not: no titles, descriptions, dates, venue names, addresses, links, notes or contact details. We never record your screen, sign-in codes, guest messages or private invitation links in analytics. We also measure clicks to external event websites by destination domain, and campaign labels and referring domains, kept in page memory only.

You can exclude this browser from analytics. This saves a one-year opt-out preference on your device; open the link again in other browsers or after clearing site data.

If you allow notifications, the app gives us your phone's Apple push token, linked to the account you are signed in with, so we can tell you about new chat messages, invitations, follows and events from people you follow. The token is only ever sent to Apple to deliver them. It is removed when you sign out, delete your account, or when Apple tells us it no longer works. If you allow location, the native map sends the visible map bounds to our server to find events; after you tap locate, those bounds are derived from your device's location. Nearby on the website also sends coordinates. These requests can contain precise location. Request and error logs may retain these values, and a problem report you submit can include the Nearby page address linked to your account. We do not use GPS location for advertising or continuously track your location in the background. If the app or a page crashes, a technical report (the error, the page address and your browser or app details) is sent to us; a support report can connect a crash reference to your account.

We share data only with the providers that run Bonder for us, and each receives only what its job needs:

• Railway (EU region): hosts the website and its database.
• Vercel: website hosting.
• Cloudflare: stores uploaded photos (R2) and relays “something changed” signals for live chat, never message contents.
• Resend: delivers sign-in code emails.
• PostHog (EU): product analytics and error tracking, as described above.
• MapTiler: map tiles. Like any website serving an image, it sees your network address and the map area shown.
• Apple Push Notification service: delivers app notifications.
• Apple (Sign in with Apple) and Google (Google Sign-In): confirm who you are, only when you choose them in the app.
• Google Cloud Translation: translates the descriptions of public events.
• OpenAI (United States): screens every uploaded image for objectionable content (the image only), as described under Image screening; and, only after you allow AI suggestions, reads a link or text you import and suggests a category for your public events, as described under AI suggestions.
• GIPHY: receives the search words when you search for a GIF cover, through our server, which may use a Partiful proxy. Search results are cached briefly by search term, and failed searches can appear in error logs.

Nothing from private events, and no guest data, is sent for translation or categorisation, and nothing but the uploaded images it screens goes to OpenAI unless you allowed AI suggestions. Some of these providers are based outside the EU, for example in the United States, and process data under their own data protection terms.

We use only the cookies Bonder needs to work: your sign-in session (60 days), proof of RSVPs you made without an account, your language choice, who invited you (a referral link), a pending account deletion notice, the events list layout, your AI suggestions choice, and the analytics opt-out. Your device also keeps your appearance setting and unsaved event drafts in local storage. There are no advertising or third-party tracking cookies.

We do not sell your data, run advertising, or share guest lists outside the event they belong to.

• Your account, personal profile and everything you post: until you delete your account. The only exceptions are listed under Deleting your account.
• Sign-in codes: they expire after 10 minutes and are deleted about a day later. Sessions end after 60 days.
• For an Apple connection we can revoke, its encrypted token and retry details stay until Apple confirms revocation, including after the Bonder account is removed. Failed requests retry automatically; the token is then deleted.
• Error records in our database: 30 days. Our own usage analytics: 180 days.
• Problem reports are kept for support and troubleshooting until you delete your account; then the reports you sent while signed in or from your email address are deleted. Hosting providers keep request logs according to their service settings.
• Photos uploaded but never used: 2 days, or 30 days if you were signed in.
• Moderation records: a content report is kept while it is open or being reviewed, and deleted 12 months after it was handled; a block case about a deleted account is deleted 12 months after the block. Email unsubscribe preferences are kept so we never email an address that opted out.

Signed in, open Settings, Delete account (in the iPhone app: Me, the gear button, Delete account). You are signed out everywhere at once and have seven days to sign in and restore it. If you cannot sign in, email bondersupport@gmail.com from your Bonder address and we will delete it.

After seven days we delete:

• your account, email, personal profile, profile photo, follows, blocks, sessions, push tokens and linked sign-in identities;
• everything you posted in any event: comments, album photos, photo comments, reactions, chat messages and chat photos, with the stored image files;
• your RSVP details: guest lists keep a row that says Deleted guest, without your name, email, note or answers, so hosts’ counts stay right;
• the problem reports you sent, and your email from the reports you filed;
• events only you host (no co-host, and not run by a page with a team). Upcoming ones are cancelled first and their guests are told. Then the description, address, place, cover image, links and host notes are deleted and the event leaves every listing and search; its link only says the event was removed. Guests keep their own RSVPs, comments and photos, which stay theirs; the title stays in their own history only while other guests are still going, maybe or on the waitlist.

Events you co-host with someone else stay, without your name. Analytics and error logs lose the link to your account. We ask Apple to revoke Bonder's access and retain only the encrypted revocation token and retry details until that succeeds. If an older Apple connection has no usable saved token, deletion still proceeds and the deletion screen links to Apple's instructions for removing that connection yourself.

For each venue or organizer page you own, choose a transfer to an existing team member or closure after the same seven days. Restoring your account cancels those changes. If your chosen successor is no longer available, the page closes instead. Closing a page deletes it with its contact email, phone, address, links and photos; other people's events and their guest/chat history stay, and existing managers keep access to those events.

What we keep, and why: reports and blocks other people filed about you, with the copy of the reported content and your username they hold, on our legitimate interest in keeping Bonder safe and handling abuse. A report stays while it is open or being reviewed and is deleted 12 months after it was handled; a block case 12 months after the block. A comment someone replied to, a photo someone commented on, and a comment, photo or chat message someone reported each leave an empty placeholder without your name, words or image, so the report and the other person's reply keep their place; it is deleted as soon as nothing hangs off it any more. At most a thread shows that a comment was deleted.

You can ask for a copy of your data, have it corrected or deleted, take it elsewhere, or object to how we use it: write to bondersupport@gmail.com. You can also complain to the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt). See also Support and the Terms of Use.