Privacy policy

This policy tells you which personal data CheersFeed processes, what for, and who else gets to see it. It follows the revised Swiss Data Protection Act (revFADP, Art. 19 FADP) and covers both the app and this website.

1. Controller

Benjamin Amhof, Hertensteinstrasse 2, 6004 Lucerne, Switzerland.
For privacy questions, access requests and deletion requests: team@slackers.dev.

2. What we process

Your photos may also show people without a CheersFeed account, other guests in the frame for instance. Their consent to being shown recognisably is solely the responsibility of the person uploading the moment — not ours (terms of use, section 6).

3. What we process it for

• To provide the app: feed, rounds, friendships, map, push.
• To show you summaries: statistics, the rewind of the night, the heatmap of your places and your friends’. The map looks back 365 days by default, the statistics on your profile over all time.
• To fight abuse: reviewing reported content, suspending accounts. Every uploaded photo (both cameras) is checked once, automatically, by the Google Gemini API for nudity and violence and classified by content (e.g. “group photo”, “outdoors” — which also feeds the rewind and the statistics). Only on an unambiguous classification — or when the model refuses to answer about the image — is a moment automatically pixelated with a warning; that happens purely algorithmically, without a human seeing the picture first. You can ask for a human review of this automated decision (Art. 21 FADP, Art. 22 GDPR) — write to team@slackers.dev.
• To find bugs and keep the service secure, including through the bug reports you send us from the app.

We do not sell data and we pass nothing to ad networks. There is currently no advertising in the app. If that changes, it will be the same for everyone — not tailored to you, and no data about you flows to advertising partners for it. Your photos are not used to train models.

4. Who else sees the data

Other users: anyone signed in can find you by name or @handle and then sees your display name, @handle, profile picture and when you joined. Your moments and rounds are seen by the friends you share them with.

Processors — technical service providers working for us and on our instructions:

For Google Cloud and Firebase a data processing agreement is in place (Google Cloud Data Processing Addendum). Google is a US company; the transfer relies on the Swiss–U.S. Data Privacy Framework, which the Swiss Federal Council has recognised as adequate since 15 September 2024. For users in the EU we additionally rely on the European Commission’s standard contractual clauses.

The Gemini API is governed by its own contract (Gemini API Additional Terms of Service), not by the Google Cloud agreement covering the other services. We only use the paid API tier, for which Google’s terms provide no use of the submitted photos for training.

We file a bug report (text, screenshots, technical details) as an entry in our private task list on GitHub. Your name, @handle and email address do not go with it, only an internal id. GitHub is a US company too; the transfer likewise relies on the Swiss–U.S. Data Privacy Framework. If you delete your account, we remove your reports there as well.

Many venues are created by users themselves; the initial set and the town names come from an import of OpenStreetMap — map data © OpenStreetMap contributors, ODbL. No data about you flows to OpenStreetMap in the process; the places sit in our own database.

We ourselves: we can access content for debugging, for support cases and to review reports — for those purposes, not out of curiosity, and limited to very few people. Authorities only where we are legally obliged.

5. Legal bases

In Switzerland the revFADP applies: private parties may process personal data as long as the principles of Art. 6 FADP are respected. For users in the EU and EEA the GDPR applies on top. We rely on:

• Performance of a contract (Art. 6(1)(b) GDPR) — account, moments, friendships, rounds. Without this data there is no app.
• Consent (Art. 6(1)(a) GDPR) — camera, photos, location, notifications and the route of the night. You give it through your device prompt or the question in the round, and you can withdraw it at any time.
• Legitimate interest (Art. 6(1)(f) GDPR) — operational logs, rate limiting, the automatic image check, and handling reports and bug reports. Our interest: an app that works and in which nobody gets harassed.

6. How long we keep it

Moments in the feed

Visible for 24 hours. After that only in your own history and for friends who were out that night — and for all your friends if you pin it to your profile.

Account, photos, rounds, friendships

Until you delete them or your account. There is no automatic sweep — visibility and storage are two different things.

Map and heatmap

Show the last 365 days by default. The moment itself is kept until you delete it.

The capture coordinate of a moment

As long as the moment itself — it hangs off it and goes with it. Delete the moment or your account and it is gone; it has no expiry of its own.

Route waypoints, start and “Zuhause” (home) place

90 days, then deleted automatically.

Signed image links

Valid for 1 hour, worthless afterwards.

Invitations

QR code 15 minutes; shared profile link 7 days (whoever redeems it becomes your friend straight away — sharing it counts as your confirmation); round link while the round runs.

Reports

As long as the reported moment or comment and the reporter’s account exist. If either is deleted, the report goes with it.

Comments

Until you delete them, the owner of the moment or rewind removes them, or the moment, the posted rewind or your account is deleted.

Bug reports

Screenshots and the GitHub ticket included, until you delete your account. Unlike the rest of your data, the ticket does not sit in Zurich but with GitHub in the USA.

Operational logs

30 days (Google Cloud Logging).

On your device

Caches for the feed, profile and images plus your drinks list stay local only. A moment not yet sent for lack of signal waits on the device with its photos, location and text until it is sent or you discard it. The server no longer accepts it once it is older than 7 days.

7. Who sees what

• Moments go to confirmed friends — in a round too. The one exception is a posted rewind (below). Anyone in a round with you who isn’t your friend only sees your name, @handle, picture and when you got home. There is no public view and no web profile.
• A shared round link shows nothing in a browser but a hand-off to the app: anyone not friends with someone in the round lands as a request and has to be confirmed before seeing anything.
• On the map a moment sits at the venue’s point, not at yours. If it has no venue — because none is mapped there — it sits at its own spot: to the metre for you, and rounded onto a fixed grid of about 50 metres for everybody else, the same precision a venue pin stands for anyway. So a moment posted from the sofa gives away no home address. The exact coordinate is handed to nobody but you.
• Your route of the night, your starting point and your “Zuhause” (home) place are exact points. Your friends who were in the same round see them in the rewind — and for 24 hours after the round ends, your other friends do too. Nobody who isn’t your friend ever sees your starting point or home place.
• Numbers and pinned moments on a profile are for friends only — that includes the venues you have been to and your drinks. Your moments also feed, counted per venue, into your friends’ heatmap. Anyone arriving from search sees name, @handle, picture and the month you joined — nothing else.
• If someone from your round posts the rewind to the feed, their friends see it for 24 hours the way the poster sees it: with the people, moments and routes of the round, yours included if you and the poster are friends. That includes the poster’s friends who are not your friends; they do not get to see the start and end of your route. Everyone who was in the round can always open the rewind.
• Comments and reactions under a moment or rewind are seen, with your name and picture, by everyone allowed to see it. That means the friends of whoever posted it, even if they are not your friends.
• If you export a rewind slide as an image, you decide where it goes — what you share leaves CheersFeed.
• The social score stays with you. It is delivered to nobody, not even friends.
• Blocked people disappear from feed, search and lists in both directions.

8. Security

All traffic runs over TLS. Every endpoint except the health check and the redirect pages behind shared links (which reveal nothing) requires a valid Firebase ID token. Photos sit in private storage with no public access and are encrypted server-side (AES-256); the app only ever receives short-lived signed links valid for one hour. Access is limited to the backend service and very few administrators.

There is no end-to-end encryption on top of that — it would be incompatible with sharing moments and with checking for abuse. That is a deliberate decision rather than an oversight, and it is written here so you know it.

9. No tracking, no personalised advertising

There is no analytics SDK in the app, no ad network and no cross-device identifier for advertising. There is no advertising id, no ATT prompt and no tracking domains. What goes to Google goes there because sign-in, push, the map, storage or the image check need it. There is currently no advertising in the app. If that changes, it will be labelled and the same for everyone — no profile of you decides what you see. The breakdown by App Store category is on the data practices page.

10. Your rights

You have the right to access (Art. 25 FADP), rectification, erasure and data portability (Art. 28 FADP); under the GDPR also to restriction and objection. Consent you have given can be withdrawn at any time with effect for the future.

• Much of it you do in the app: edit your profile, delete moments, turn the route off, block users, delete your account (Settings → Delete account; that removes your photos too) — how that works, even without access to the app.
• For everything else write to team@slackers.dev. We answer within 30 days.
• You may complain to the FDPIC (edoeb.admin.ch), or in the EU to the supervisory authority where you live.

11. Device permissions

You can revoke every permission in your device settings at any time. The app stays usable, just with less.

12. Changes

We update this policy when the app changes. The date above says when we last did. For material changes we ask for your consent again in the app.