1. Data controller
Controller: FreeTime
Contact email: privacidad@freetime.club
Website: https://www.freetime.club
This policy explains what personal data we process when you use the FreeTime app, for what purpose, on what legal basis, with whom we share it, and what rights you have.
2. Guiding principle: privacy by design
FreeTime is designed to collect the minimum data necessary:
- From your calendar we only read free/busy blocks — never the content of your events (no titles, attendees, or locations).
- From your contacts we only store encrypted identifiers (hashes) to detect who else uses the app; we do not store your contacts in plain text.
- We only match you with people you and the other person have mutually chosen; never with strangers.
3. What data we process
| Category | Specific data | Source |
|---|---|---|
| Identity and profile | Display name, language, time zone | You, at sign-up |
| Authentication | Phone number (for OTP login) | You, at sign-up |
| Contacts (hash) | Hash of phone numbers of the contacts you choose to share | Your contacts, with permission |
| Interests | Selected interests and favourites | You |
| Availability | Time slots you decide to share (e.g. Mon–Fri 5–10 pm) | You |
| Calendar (free/busy) | Busy time blocks, without event content | Your calendar, with permission |
| Connections | People you select to connect with | You |
| Matches | Overlapping slots, suggestions, and your responses (I'm in / pass) | Generated by the service |
| Messages | In-app chat content with your matches | You |
| Notifications | Preferences (quiet hours, active days) and device token (push) | You / device |
| Technical usage | Minimal operational and security logs | Device |
We do not intentionally process special categories of data (health, ideology, religion, etc.). We ask that you do not share that type of information in the in-app chat.
4. How we use your data and legal basis (Art. 6 GDPR)
| Purpose | Legal basis |
|---|---|
| Creating and managing your account; providing the service (matching, chat) | Performance of a contract (Art. 6.1.b) |
| Accessing your calendar (free/busy) to calculate availability | Explicit consent (Art. 6.1.a), revocable |
| Accessing your contacts and cross-referencing hashes to find connections | Explicit consent (Art. 6.1.a), revocable |
| Sending push notifications for matches and messages | Consent (Art. 6.1.a), revocable |
| Security, abuse prevention, moderation | Legitimate interest (Art. 6.1.f) |
| Compliance with legal obligations | Legal obligation (Art. 6.1.c) |
You can withdraw your consent at any time by revoking the permission in your phone settings or from the app settings, without affecting the lawfulness of prior processing.
5. Device permissions
- Calendar (read): only to calculate your free slots from free/busy blocks. We do not read event content.
- Contacts (read): only to identify, via hash, which of your contacts use FreeTime and to let you connect with them. You choose which contacts to share.
- Notifications: to alert you to matches and messages, respecting your configured quiet hours.
You can revoke any of these permissions from your phone settings. Some features will no longer be available as a result.
6. How we protect your contacts and calendar
- Contacts: phone numbers are transformed into a hash before being stored; we do not retain numbers in plain text. Connection matching is done by comparing hashes.
- Calendar: only busy time intervals (start and end) are synced, with no event details.
- Matching privacy: no other user can see your free slots or calendar directly. Matching is performed automatically by our system and only reveals an overlapping slot when a confirmed mutual connection exists between the two users.
7. Automated decisions
Matching is an automated process that cross-references availability and interests among mutual connections and suggests plans. It does not produce legal effects or significantly affect you: you always decide whether to accept or pass on each suggestion.
8. Who we share data with
We do not sell your data or share it with third parties for commercial purposes.
To provide the service we use providers acting as data processors under contract (Art. 28 GDPR):
| Provider | Function | International transfer |
|---|---|---|
| Supabase | Database, authentication, chat, backend functions | EU region; Standard Contractual Clauses (SCC) |
| Google Firebase Cloud Messaging (FCM) | Push notifications on Android | USA; covered by SCC |
9. Data retention
- We retain your data while you have an active account.
- Calendar blocks and expired matches are periodically deleted or anonymised.
- If you delete your account, we erase your associated personal data (profile, connections, availability, matches, and messages), except what we must retain due to a legal obligation or to defend against claims.
10. Your rights (Arts. 15–22 GDPR)
You have the right to: access, rectification, erasure ("right to be forgotten"), restriction, objection, portability, and to withdraw consent.
You can exercise them:
- Directly from the app (account deletion, privacy settings).
- By writing to privacidad@freetime.club.
If you believe we have not addressed your rights, you can lodge a complaint with the competent data protection authority in your country of residence.
11. Minors
FreeTime is intended for people aged 16 or older. We do not knowingly collect data from minors below that age. If we detect an account belonging to a minor under 16, we will delete it.
12. Security
We apply proportionate technical and organisational measures: row-level access control (Row Level Security) so that each user only accesses their own data and what is strictly necessary from their mutual connections; encryption in transit; and data minimisation across all processes.
13. Changes to this policy
We may update this policy. We will notify you of material changes through the app at least 30 days in advance, giving you the option to accept them or delete your account. The date of the last update appears at the top of this document.
14. Contact
For any privacy-related question: privacidad@freetime.club