Privacy Policy

Version 2026-08-02 · Effective date: 2026-08-02

This document is a template drafted to address common EU (GDPR/AVG) and US state privacy-law requirements for a service that handles health-related ("special-category") data. It is not legal advice. Before public launch, have a qualified lawyer review it — especially the legal basis for processing health data, international transfer mechanisms if you host outside the EU, and the specific US state laws that apply to your users.

1. Who is responsible (data controller)

The operator of Folkpeer is the data controller for the personal data you provide. Contact details are available via the in-app Contact option. For EU residents, this Policy describes how we meet the obligations of the General Data Protection Regulation (GDPR/AVG).

2. What we collect

Account data: email address and a password (stored hashed with argon2id — we never store your password in readable form).
Profile data: display name, age band, region, condition label, avatar choice, and an optional bio you choose to add.
Symptom data: the symptoms you enter to find matches. These are health data and are treated as sensitive.
Connections: your friends, blocks, group memberships, and messages.
Technical data: basic logs needed to run the service (e.g. login events, audit records). We do not sell or share this for advertising.
Waiting-list email: if you leave your address on our introduction page, we store that email address and nothing else.

3. How we protect your data

Passwords are hashed with argon2id. Profile and symptom text are encrypted at rest; the encryption keys are kept separately from the database. Connections (friends/blocks/messages) are tied to your account and only visible to the people involved. Our servers require a secret key to start, and we apply security headers (including a content-security policy).

4. Why we process your data (legal basis)

For EU/AVG users, we rely on your explicit consent (Article 9(2)(a)) to process health-related symptom data, and on performance of a contract (Article 6(1)(b)) to provide the account and matching service. You can withdraw consent at any time; this does not affect processing already done.

If you join the waiting list we rely on your consent (Article 6(1)(a)) to send you one message when the service opens. That consent is separate from the account consent, and you can withdraw it at any time by asking us to delete your address.

5. Who can see your data

Your symptoms are used to compute matches with other users; only the match signal (shared symptoms, not raw entries) is shown to people you match with.
Your profile (name, age band, region, condition, bio) is visible to people you connect with.
Your messages are visible only to you and the person or group you message.
Your waiting-list email is visible only to us. It is stored for us by our website host (Netlify) and, when you submit the form, held by our mailing provider (Brevo) so that we can send you the one message you asked for. We do not sell it or use it for advertising.
We do not sell your data. We may disclose it only where required by law or to protect the safety of users.

6. International transfers

If you are in the EU/EEA and our servers or processors are located outside it, we will rely on an appropriate transfer mechanism (such as Standard Contractual Clauses) before moving your data. The current hosting location is stated in the app or on request.

7. How long we keep your data

We keep your data while your account is active. If you delete your account, it is reversible for 30 days; after that window your account and associated data are permanently removed. Audit logs may be retained longer where needed for security or legal compliance. Waiting-list addresses are kept until the service opens and that one message has been sent, or until you ask us to delete them — whichever comes first.

8. Your rights

Depending on your location, you have the right to:

Access the personal data we hold about you;
Correct inaccurate data;
Delete your account and data (right to erasure);
Export your data in a portable format;
Object to or restrict certain processing;
Withdraw consent at any time.

To exercise these rights, use the in-app account controls (including "Delete account") or contact us. EU residents may also complain to their local data-protection authority.

9. Children

Folkpeer is not directed to children under 16 (or the age set by your country), and we do not knowingly collect their data. Accounts are blocked at registration for users who do not confirm the age requirement.

10. Changes to this Policy

We may update this Policy and will post the new version with an updated effective date. Material changes will be flagged in the app.

11. Contact

Questions or rights requests: use the in-app Contact option, or email support@folkpeer.com.

← Back to Folkpeer