Privacy Policy

The short version

A summary for those who would rather not read everything. The full text below is what applies; each point names the section with the details.

• Who is responsible. Uladzislau Brazouski and Ilya Fomin, the two people who run Sarafun; the project has no legal entity. For any question about your data, write to hello@sarafun.app (section 1).
• What we keep. Your name, @username and photo from Telegram; what you enter in your profile and publish yourself; your event sign-ups and actions in the app (section 4). If you are in Telegram groups connected to the app but do not use it, section 8 explains what we keep about you.
• Why. To make the service work: profile, events, game nights, Random Coffee, notifications — and also to protect it from abuse and to understand which features people use (section 5).
• Who sees it. Your profile is visible to all community members in the app, and anyone who has a link to your profile can see your name, photo, profession, city and the start of your bio. In the settings you can remove yourself from the list of people and from suggestions, and hide your interests. When you publish an event or take a seat at a game-night table, your name may appear in the bot's posts in Telegram chats (section 6).
• Who we share it with. We do not sell data or pass it on for advertising, and we use no advertising or tracking cookies. Data goes to those the service cannot work without: Telegram — sign-in, notifications, posts — and our hosting in the European Economic Area; and to your calendar, such as Google, if you connected it yourself. Some providers are in the US: the texts of public announcements for the listings feed are parsed by the Claude AI model from Anthropic, and mail to hello@sarafun.app goes through Cloudflare to Gmail (sections 7 and 13).
• How long we keep it. Your account, until you delete it; the activity log, for 365 days, with a few exceptions (section 9). You can delete your account yourself in your profile settings. Some data remains — for example, comments and reviews signed «Deleted user» and your Telegram identifier; the full list is in section 11.
• Your rights. To get a copy of your data, correct or delete it, or object to analytics, write to hello@sarafun.app. You can also complain to a data protection authority — in Spain, the AEPD (section 15).
• Age. The service is only for people aged 18 and over (section 2).

1. What this document is, and where to write

This document explains what data the Sarafun project collects and stores: the «Sarafun» Telegram Mini App, the Telegram bots connected to it, the sarafun.app website and short links of the form sarafun.app/s/. The community is based in Valencia, Spain. The data is processed within the European Economic Area, so we describe the processing in the terms of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and honour the rights listed below.

Two people who run Sarafun are jointly responsible for processing your data: Uladzislau Brazouski and Ilya Fomin. The project has no legal entity: we are private individuals and joint controllers within the meaning of Article 26 GDPR. We decide together what data to collect and why. Uladzislau Brazouski is responsible for the server, backups and the technical protection of the data; a data breach is reported to the supervisory authority by whichever of us discovers it, and enquiries are answered by whichever of us reads them first. Whatever the division of duties between us, you may exercise your rights in respect of either of us.

The only channel for data enquiries is hello@sarafun.app. Write there to exercise any right from section 15, to complain about someone else's publication about you, or to report an error in this text. We reply no later than one month after receiving your enquiry. The project has no separate data protection officer; enquiries are read by the two of us.

So that we do not hand your data to a stranger, we will ask you to confirm that you are who you say you are: to write from the same Telegram account, or in another way available to you.

2. Age

The service is intended for people over 18. By registering, you confirm that you are 18 or older.

There is no automated age check in the app, and we say so plainly. Telegram does not pass us a date of birth, and we do not ask for one anywhere ourselves. This means we put no technical barrier in front of a minor — there is only this condition. If you learn that an account is being used by someone under 18, write to hello@sarafun.app and we will delete the account.

3. Where this document applies

This document covers the data that passes through the «Sarafun» Mini App, which is opened through any of our bots. It also covers the data that passes through the Telegram bots themselves: both your private correspondence with a bot and the publications that a bot sends to the community groups and to the chats connected by game-night organisers. It covers the data of the sarafun.app website as well, including the public preview pages behind short links. Separately, it covers information about the members of the community's Telegram groups that are connected to the app: among them are people who have never opened the app (section 8).

The landing site contains no forms, and no analytics or advertising scripts. One cookie is nevertheless set on it: sarafun_lang, with a lifetime of one year and the attribute samesite=lax — it remembers the language you chose for the page. Alongside it, the same setting is written to the browser's local storage under the key sarafun-lang-pref. Both are strictly functional and serve the language switcher only.

Processing inside Telegram itself — the messenger, accounts, chats, the Telegram Stars payment system — is carried out by Telegram under its own rules. We have no influence over it, and this document does not govern it.

4. What data we collect

Telegram identifier. At every sign-in, Telegram passes us the numeric identifier of your account, your @username, first name, last name, a link to your profile photo and your interface language. The numeric identifier is a permanent label by which we recognise you at each sign-in; it is also what ties your account to everything else. Further on we refer to it as your «Telegram identifier».

Profile photo. We not only display the photo from the Telegram link, but also download it as a file to our own server, so as not to depend on the availability of their CDN.

Registration through the bot. If you arrive through the «I'm playing» button under a game-night table post, or the «Looking for a table» button under the post of the game night itself, in a Telegram chat for the first time, or after deleting your account, your account is created by the bot — from the data Telegram passes to the bot along with your message: Telegram identifier, @username, first name, last name and interface language; the bot downloads your profile photo through Telegram. Your acceptance of this policy is pressing «Start» («Запустить» in the Russian interface) under the bot's description, which links to this policy, or — if our records show you have been in a chat with the bot before and may not have seen the description — pressing the «Sign up» button under a text about this policy. The account's city is set to the city of the game night, «Board games» is added to your interests, and you can fill in your profile later; we record the time of such a quick registration. Signing up works the same way if you opened the app through a link to a game night or one of its tables and have not filled in your profile yet: the «I'm playing», «Set up a table» and «Looking for a table» buttons (on the page of the same name — «Sign up and look for a table») state that by signing up you accept this policy.

Profile details. What you enter yourself: your bio, profession, company, «where you're from», skills, «who I'm looking for», links to social networks and a website, interests and your current city. You also edit your first and last name yourself — they are captured at registration and are no longer overwritten from Telegram.

Account settings and internal markers. Notification toggles, quiet hours, time zone, colour theme, the last bot you used, a marker that you have blocked the bot, the time of your last activity, the date on which you accepted this policy, your role, and the reason for a ban if one has been applied. Every time the app opens, it compares the time zone with your phone's time zone and, if the phone's has changed, saves it — quiet hours and notification timing are calculated from it. If you have chosen a time zone manually in the settings, we keep a marker of that and stop saving the phone's time zone until you turn on «Detect from phone». An automatic change of time zone is recorded in the activity log.

Activity log. We record significant actions: opening a page, starting a session, viewing an event, signing up for an event, creating content. Alongside the action we store a free-text note — for example, the title of an event or the list of profile fields that were changed. The client session identifier goes there too, as does an attribution marker for where you came from: which chat or which link, and, if another member shared the link with you, who that was. When you share a link from the app, a marker is added to it that lets us see who shared it, so we know how many people came through your links. The marker itself reveals neither your name nor your account number. Where you came from when you registered — the link marker and, if another member shared the link with you, who it was — is also stored in your account: the activity log entry is deleted after a year, while this source is needed for as long as the account exists. If you came to the bot through a campaign link but have not opened the app yet, we keep your Telegram ID together with the campaign marker for up to 7 days so that it can be counted when you register. When a session starts, we additionally record the device type, the Telegram version and the selected theme.

For game nights, the log records that you set up, edited or cancelled a table, signed up for it, joined its queue, left or were removed, or added a guest (the guest's name is not written to the log row — only whether their @username was given; administrators see the name in the log from the table seat itself, until it is anonymised 365 days after the game night), as well as opening a table's page — with the chat label if you came through the «Details» button under a post. Actions the service performs on your behalf — seating you from the queue, approving a request, removing you from a table on cancellation — are recorded as system actions.

A word specifically about the snapshot of another person's name. When you tap «message» on another member, or open their external link, the log receives not only that person's identifier but also their name at that moment. This is a deliberate decision, not a side effect: without the name the activity feed is unreadable. What happens to these snapshots when a person deletes their account is described in section 11.

Search queries and filters. We store these separately from the activity log. We record: the normalised text of the query, up to 60 characters; the range into which the number of results found falls; the filters applied, as short codes; the screen on which the search was made; the client session identifier; and your city at the time of the query. Personal views — «Mine», «Going», your own listings — are excluded from this collection.

Feedback. The text you send through the feedback form, and the category you chose.

Sessions. We store the identifier of the token issued, the bot through which you signed in, the device type, the Telegram platform and the language. Alongside them: a truncated IP address, from which no individual device can be identified. Then come the times of sign-in, last activity, expiry and revocation, together with the reason for revocation if the session was revoked. The full IP address and the full User-Agent are not stored in the application database — the single exception is described in section 14. The Telegram platform from which you last opened the app (iPhone, Android, desktop or the web version) is also kept in your account — so that we know which devices the app is used on; it is erased when you delete your account.

App crash reports. When an error occurs in the app, it sends us a report: the address of the screen where it happened (it may contain the numbers of events and other objects), the text and technical description of the error, which part of the app it happened in, the Telegram platform and version, and, if you are signed in, your account identifier. The IP address and the User-Agent are not stored with the report.

Linked Google account. If you connect Google Calendar, we store the permanent identifier of your Google account, its email address (to show which account is connected), the list of permissions granted and the access key (refresh token) — encrypted. Your Google password never reaches us: you sign in on Google's own page. For the calendar — the identifier of the «Sarafun» calendar we create, your settings («Maybe» sign-ups, reminder), the time of the last update and, for every event we sent, its identifier at Google and a fingerprint of its content that tells us when the event needs updating. While you are connecting, a single-use sign-in attempt is valid (for a few minutes; the record of it is kept for no longer than a day), and your browser receives two service cookies for 15 minutes: they tie the Google sign-in to this browser and to your confirmation that it is you who is connecting — the connection cannot be completed without them.

Notification logs. For every notification sent: the recipient, the type, the delivery status, the Telegram error code and error text, the message identifier and the sending bot. We do not store the text of the notification.

Bot reachability. For every «user — bot» pair: whether you have started the bot with the /start command, whether it is blocked, when that happened, and when you were last seen.

Event participation. Here we store:

• sign-ups for events and the participation status;
• join requests, with the free-text message to the organiser and the reason for the decision;
• the co-organiser role;
• check-in records: who was checked in, when, by whom, and whether by QR code or manually;
• subscriptions to discussions and to sign-ups.

Game nights and tables. The tables you set up: the game, time, number of seats, length of a round, description, image, language, complexity, links to the rules and a video, and whether the person who set up the table is playing too. Seats at tables: who is seated, who is in the queue, who is waiting for the organiser's approval; when a person signed up, took a seat and left; who seated or removed them; how the sign-up came in — from the app, through the button under a post in a chat, through the bot, by invitation or after a hint from the bot — and from which chat. When a person leaves a table, the seat row is not deleted but marked as left: the game-night statistics are counted from it. For guests without an account — the name and, if it was given, the Telegram @username (section 8). For the chats where tables are published — which organiser connected the chat and the fact that they are its administrator, and the chats and forum topics chosen for each game night. For the posts the bot publishes under these settings (table posts and the post of the game night itself) we do not store the text — only the message identifier and a fingerprint of the content, from which the bot knows the post needs editing.

«Looking for a table». You can sign up for a game night without a table — with the «Looking for a table» button in the app or under the game night's post in a chat; while you are signed up and not seated at any table, you are on that game night's «Looking for a table» list. This list is not stored separately — it is derived from game-night sign-ups and table seats. Your game-night sign-up stores your table preferences, if you set any on the separate «Looking for a table» page in the app: game complexity, «I'm a newcomer», language — and up to three games you would like to play, as you typed them. Table invitations: who was invited to which table, who invited them, when, and whether the invitation was accepted.

History of game nights and chats. A separate history is kept for each game night and for every chat our bot is in: who added or removed the bot and when, who granted or removed administrator rights, who connected the chat to a game night, which topics appeared in the chat, where tables are published, which event and table posts the bot published, edited or deleted (chat, topic, message number, delivery error), what Sarafun administrators did with the chat (enabled or disabled it, changed its city or title, started a member sync, chose it for publishing an event, sent a broadcast to it — the first 100 characters of the text and the delivery result), which messages about the game night and its tables were sent and whether they arrived (cancellation and changes, promotion from the waiting list, removal of a participant, requests, chat connection, table invitations, the bot's hints about free tables), and sign-ups to the game night (including without a table) and to tables, table invitations and their acceptance, check-ins, decisions on requests and edits to the game night, showing who acted and where the sign-up came from. Ordinary joins and leaves of chat members are not written to this history. Guests' names are not written to the history — they are read from the seat row.

User content. The events you create, together with their images. Comments, ratings from one to five, written reviews, reactions. Requests in the «Looking for» section and replies to other people's requests. Listings in the item-sharing section — photo, description, the district where the item is handed over. Loan requests with a free-text message. Recommendations. Referral posts. Content reports with a free-text reason. Suggestions for the listings feed — a link to the page of someone else's event and, optionally, your comment on it. Communities (topic hubs) that you create — name, description, cover, avatar, city and a link to the associated Telegram group — as well as your community subscriptions and moderator rights in them.

Random Coffee. The capacity in which you take part (Man, Woman, Family couple) and who you would like to meet — that is, information about sex and marital status. A snapshot of these values in every round in which you registered. The pairs formed and their status. Your feedback on meetings, including a free-text comment about a specific person — it is never shown to your partner. If a partner has no @username, you can ask the bot to pass on your contact details: we store the time of such a request and which member of the pair sent it. Your «Already know each other» list: the people you have marked so that you are not paired with them. Only you can see it — the person marked is never told and receives no notification. It works both ways and only within your own city. In addition, the app counts the people you have marked and the people you met in Random Coffee as your acquaintances in the «Подходит вам» («For you») block and in the list of people signed up for an event (section 15); the person marked still does not see this.

Community chats and bot messages in them. For every connected chat we store its title, @username and photo. For every publication and broadcast sent by a bot we store the full text of the message, the message identifier in Telegram and internal data — the event title, the button captions, and the name of the administrator or moderator whose action triggered the sending.

Payments. When you donate through Telegram Stars, we store the amount, the Telegram payment identifier and the bot that received the payment. Payment credentials are not passed to us and are not processed by us.

Administrative logs. Administrators' actions on accounts and content, with structured notes, including the reason for a ban and a snapshot of the event sign-ups that were removed. A history of content edits, with fragments of the changed text. An alert log — security alerts and moderation service notices (for example, about events left without an organiser). Its entries may contain a first name, last name, @username, Telegram identifier and internal account number — in moderation notices these are event organisers and co-organisers — and, in certain cases, also information about the browser together with a truncated IP address.

Information about the members of connected Telegram groups. Described separately in section 8.

5. Why we process this, and on what lawful basis

For each purpose below we state the lawful basis under Article 6 GDPR.

Running your account, displaying your profile, event participation, publishing your content, the operation of the «Looking for», sharing, recommendations, communities and referrals sections, and transactional notifications for your subscriptions — performance of a contract with you (Article 6(1)(b)). By accepting this policy at registration you enter into a relationship with us for the provision of the service. Without the data listed, the service does not work.

Matching members for introductions by interests, skills, profession and city — performance of a contract (Article 6(1)(b)): this is a stated function of the service.

Syncing your sign-ups with Google Calendar — consent (Article 6(1)(a)): you switch it on yourself on Google's page and can switch it off at any time in «Settings» → «My sign-ups in a calendar» or in your Google account settings.

Game nights — signing up for a table, showing your name at the table in the app and in the bot's posts in chats, table notifications — performance of a contract (Article 6(1)(b)): a table exists to gather players, and a post in a chat is how they are found. The bot sends the person who set up a table a summary of who signed up, joined the queue or left; tells organisers about new tables and, the day after the game night, sends a short recap: how many people signed up, how many tables there were and how many players sat at them and, if you marked guests, how many came; tells players that they were seated, moved up from the queue or removed, and that a table was cancelled, hidden or rescheduled, and reminds them of the table before it starts; and sends a newcomer who signed up through quick registration, if their profile is still empty, a single message the day after the game night: «How was the game? Tell us about yourself». All of this can be switched off with the event notification toggles, except the service messages that change your plans («a seat has freed up — you are at the table», «you have been removed from a table», «the table was cancelled, hidden or rescheduled») and the profile reminder. The «you have been seated at a table» message is switched off with the «Reminders» toggle, like invitations and hints.

«Looking for a table» — the list of people signed up without a table, showing your name and preferences to those who set up tables at that game night and to its organisers, the number of people looking for a table in the app and in the bot's posts, table invitations and the bot's hints about tables — is also performance of a contract (Article 6(1)(b)): with the «Looking for a table» button you ask for help finding a table, and without this information the person who set up a table would not know whom to invite. Preferences and games are optional; you change and remove them yourself. The person who set up a table, or an organiser, can invite you to the table — the bot sends you an invitation, and you are seated only if you accept it yourself. The bot lets you know when a table that suits you, or a table with a game you named, opens, and two hours before the start sends a list of tables with free seats — no more than two hints per game night. Hints and table invitations are switched off with the «Напоминания» («Reminders») toggle in the event notification settings.

Game-night statistics for the organiser, and information about guests — legitimate interest (Article 6(1)(f)): the organiser plans the tables — seeing which games bring people together, which newcomers to welcome and how many guests come; chat members see who is already at a table; and the community sees how many people come through game nights.

Taking part in Random Coffee, and the processing of information about sex and marital status — your consent (Article 6(1)(a)). You fill in the Random Coffee profile voluntarily and delete it yourself, without deleting your account. Two limitations: while a round is running in which you have already been paired, the app will not let you delete the profile — that becomes possible once the round has finished; and a snapshot of the values you gave remains in rounds that have already passed and in currently active ones.

Optional «everything new» digest notifications — all new events, all new requests, new sharing listings, new referrals — your consent (Article 6(1)(a)). They are off by default, you switch them on manually, and you withdraw consent with the same toggle.

Digests based on your interests — new events and requests that match the interests in your profile — and the city listings feed as a block of the evening digest — legitimate interest (Article 6(1)(f)): you list your interests yourself in order to hear about relevant things, and we want you to learn about such an event in time. That is why they are on by default. With quick registration — signing up for a game night without filling in a profile, in the bot or in the app — they start switched off. You can switch them off at any time in the notification settings; under an announcement there is a «🔕 Отключить» button for this, under the evening digest — «⚙️ Как присылать».

App crash reports — legitimate interest (Article 6(1)(f)) in keeping the app working: they let us find and fix errors, and the account identifier shows how many people an error affects and limits the number of reports from one person.

Protecting the service against abuse — legitimate interest (Article 6(1)(f)). This covers rate limiting, the detection of scraping and brute-force attempts, the alert log, sessions with a truncated IP address, and web-server logs. The interest lies in the availability of the service and the safety of members' data.

Content moderation, handling reports, the administrative audit trail, the edit history and the moderation service notices in the alert log — legitimate interest (Article 6(1)(f)) in maintaining a safe environment and in being able to examine a disputed situation on the evidence.

Product analytics — the activity log, search queries and filters, notification delivery statistics — legitimate interest (Article 6(1)(f)). We want to understand which features are used and what content the community is missing. To be honest about it: in the statistics this data is counted in aggregate, but the admin area also has a per-person activity feed, with filters by action and by date. You have the right to object to this processing (section 15).

The snapshot of another person's name in the log when you move to a conversation or follow an external link — legitimate interest (Article 6(1)(f)) in handling complaints about unwanted approaches and in judging whether the service leads to real contact.

Storing the texts of publications and broadcasts in chats — legitimate interest (Article 6(1)(f)): the bot uses them to edit a message it has already sent, to retry a failed send, and to deal with complaints about the content of a publication.

Information about the members of connected Telegram groups — legitimate interest (Article 6(1)(f)); details in section 8.

Accepting donations — performance of a contract (Article 6(1)(b)); keeping the payment record — compliance with a legal obligation to account for incoming payments (Article 6(1)(c)).

Special categories of data under Article 9 GDPR — health, religious belief, political opinions, biometrics and the like — we do not deliberately collect. That said, we do not control what you write in free-text fields. A profile bio, a comment, a request, a recommendation or a feedback message is stored exactly as you sent it.

6. Who can see your data

Your profile is visible to every community member signed in to the app. That is the point of the service: the app exists so that members can find one another. Your profile also shows public events connected with you: published events you created and past events you were signed up for as a participant — as a count and as a list. Private events and your sign-ups for upcoming events are not shown to other members. Do not put anything in your profile that you are not prepared to disclose.

Two settings under Settings → «Privacy» narrow this circle. «Hide me from Connect» removes you, for other members, from the list of people in the «Connect» section, from people search — including where a person is picked in a form: a co-organiser, a player for a table, a guest to check in, an acquaintance in Random Coffee, the subject of a recommendation — from the «You may be interested in» suggestions, and also from the count of acquaintances in the «Подходит вам» («For you») block and from the «Знакомы» («You know each other») label in the list of people signed up for an event (section 15). Your profile still opens via a link and wherever you are tied to an action: in the list of people signed up for an event, in comments, at a game-night table, in a Random Coffee pair. Recommendations about you written by other members also stay visible in the «Recommendations» section and can be found there by searching for your name; you can remove any of them with the «Hide recommendation» button on its page. «Interests visible only to me» hides your interests from other members everywhere they are shown: in your profile, in people cards, in «interests in common» (on a profile, on an event page and in the list of people signed up, for a Random Coffee partner) and in participation requests seen by an organiser. You still see your interests yourself, marked «visible only to you», and people suggestions and interest-based notifications keep using them as before. Both settings are off until you turn them on; the app's administrators see the whole profile.

In three cases data leaves the app, and it is worth knowing this in advance.

The first is short links. The app issues links to profiles, events, game-night tables, communities, listings, requests, recommendations and referrals. The page behind such a link opens for anyone who has the link — no sign-in required — and Telegram and other messengers show a preview of it. A profile preview shows the first and last name, the profile photo, profession, city and the start of your bio (up to 200 characters together); it contains no interests, and a profile without a completed questionnaire does not open this way. An event preview shows the title, date and time, place, the start of the description and the event picture; drafts, events under review and rejected ones do not open this way, a cancelled one is marked «Cancelled», and a private one opens only via a link with an access key. Other previews show what is already published in the app: the title or the start of the text, the author's name for a request or a recommendation, and the picture, if there is one. The message you send with the «Share» button in Telegram carries the same, but without the description. Links to profiles, listings, requests and recommendations are signed and cannot be guessed by brute force. But anyone can forward a link.

The second is image files. Uploaded pictures, including profile photos, are served from direct addresses without authorisation.

The third is publications in groups. When an event is published, the bot sends a message to the community's Telegram groups containing the organiser's name and a link to their profile. These messages are seen by all members of the groups concerned, and they are stored in Telegram.

Game-night tables are published the same way: one post for each open table, in the chats the game-night organisers or Sarafun administrators chose for its tables (chats where our bot is an administrator; an organiser can only choose a chat where they are an administrator themselves). The post contains the name of the person who set up the table and the names of those seated at it (first names only), with a link to their profile in the app if the profile is open (the account is active and the profile questionnaire is completed); guests appear by name, with a link to their Telegram if an @username was given. Names from the queue are not included in the post — only their number. The bot edits the post whenever the line-up changes: if you leave a table, your name disappears from the post at the next update. But an edit cannot undo what chat members have already seen or forwarded, and in a chat where the bot has lost its administrator rights the post is no longer updated. To keep your name out of a chat, do not sign up for a table: you can sign up for the game night itself without one. Table posts are not published for a private game night. On a table's page in the app, community members can see who is at the table and who is in the queue.

The «Looking for a table» list — the names of people who signed up for the game night without a table, with the table preferences and games each of them named — is visible in the app to those who set up open tables at that game night, to its organiser and co-organisers, and to administrators. Other members see only numbers: «Looking for a table: N» and how many of them marked «I'm a newcomer», and «Want to play: game — N» — without names. The same line with the number of people looking for a table appears in the game-night posts the bot publishes in chats; it contains no names.

The following are not shown to other members: the technical data from section 4 — the activity log, sessions, search queries, notification logs, app crash reports; notification settings; the text of your feedback; Random Coffee meeting feedback; and the reports you have submitted. Meeting feedback is never seen by the person it is written about.

App administrators can see accounts, content, the activity log for a particular person, the administrative audit trail and the statistics. They need this access for moderation and for handling enquiries. App crash reports are seen only by the main administrator.

A game-night organiser — its creator and co-organisers — can see statistics for their own game nights: who signed up and came, who came for the first time, who returned and who has not been for a while, who left a table in the last day before it started, which chats sign-ups came from, which guests were brought and how many of them later registered themselves. An organiser cannot see other people's game nights. Names in these statistics are shown only for people whose profile is open; the rest are counted in numbers only; guests' names are seen only by the organisers of that game night and by administrators. Requests for a seat at a table are seen only by the person who set it up and by the organisers.

The history of game nights and chats is visible only to Sarafun administrators, in the administration section. It is not shown to game-night organisers, co-organisers or city moderators.

7. Who we share data with

We do not sell data and we do not share it for advertising or for profiling in someone else's interests. Data is nevertheless shared, and here are the cases.

Telegram Messenger. Telegram is our infrastructure provider. Sign-in to the app goes through it, all notifications in private messages are sent through it, events are published to groups through it, your session token is stored in it and Telegram Stars payments are processed by it. Everything that goes to Telegram — a name, the text of a publication, the content of a notification — is thereafter processed by Telegram under its own privacy policy.

Administrators. Text sent through the feedback form is also copied by the bot as a private message to the app's administrators — currently the two of us — and it remains in their Telegram correspondence. Deleting your account does not affect that copy in Telegram.

Hosting. The application and the database run on a rented server within the European Economic Area. We rent the machine from a hosting provider and make no claims about any certifications it may hold.

Backups. We keep automatic copies of the database for 30 days; one copy is held separately from the main server. From this follows a consequence for the right to erasure: for up to thirty days after your account is deleted, your data still sits in those copies. Two things are worth calling out separately, because they do not fall under the thirty-day period. The first is the occasional manual database snapshot that we take before major changes; those are kept for longer. The second is a separate copy of the uploaded files: it grows but does not replay deletions, so an image erased on our side may remain in it.

Calendar subscription. If you connect your sign-ups to a calendar (Google, Apple, Outlook or another), that service regularly fetches, via your personal link, the list of events you have signed up for: title, time, place, description and the status of your sign-up. No other participants are included. From then on the calendar service processes this data under its own privacy policy. The link works as a read-only password to your sign-ups: you can replace it with a new one or turn the subscription off in Settings → «My sign-ups in a calendar», and it stops working when you delete your account. On our side we only keep when the calendar last fetched the list and which calendar it is (Google, Apple or Outlook) — no address and no device data.

Google Calendar. If you connect Google Calendar, we send to it, through the Google Calendar API, the events you have signed up for: the title, time, place, a description with a link to the event, the status of your sign-up and, if you chose one, a reminder. No other participants are included. Access is limited to the «Sarafun» calendar that we create ourselves: we do not see or read your other calendars and events. From there Google processes this data under its own privacy policy. Sarafun's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements: this data serves only calendar sync, is not shared with third parties, is not used for advertising, and is not read by people. If Google no longer lets Sarafun into your account (for example, you revoked access in your Google account settings), we can no longer remove the «Sarafun» calendar from your Google Calendar — please delete it there yourself; we erase the connection and the access key on our side in any case (section 9).

City listings feed and AI. We take announcements for the city listings feed from open sources — websites of venues, organisers and ticket sellers, and public Telegram channels (section 8). The texts of these announcements are parsed and rewritten by the Claude AI model from Anthropic: only the texts of public announcements and facts about the event — title, date, place, price — go to the model; such texts mention the names and contact details of organisers, performers and venues. Your data as a member of the app — your profile, community events, comments, messages, photos — is not sent to the model.

Email. Mail to hello@sarafun.app is received by Cloudflare's forwarding service and delivered to our Gmail mailbox (Google): your address, the sender name and the text of the message pass through Cloudflare and are stored in Gmail.

Instagram. We may publish announcements of community events as stories on Sarafun's Instagram account (Meta): the card shows the title, date and time, place, price, city and the event picture, without the organiser's name. Private events and the listings feed are not posted there. Once published, the story is processed by Meta under its own privacy policy.

The list of cities is taken from the open GeoNames dataset (section 17). None of your data goes to GeoNames.

Anthropic, Cloudflare, Google and Meta are US companies, as are most of the calendar services you may connect yourself: they may process data outside the European Economic Area. A similar transfer is possible inside Telegram's infrastructure, which is outside our control. These companies process data under their own terms and privacy policies; if you need details about the transfer, write to hello@sarafun.app.

8. Data about people who do not use the app

The app processes data about people who have never used it themselves and have never accepted this policy. They have rights over that data, so we set out plainly what is stored about them and how it can be deleted.

Members of connected Telegram groups. For every community group connected to the app we store a list of members: Telegram identifier, first name, last name, @username, a marker for a Telegram Premium subscription, interface language and status in the group. The data is collected through Telegram's interfaces — by a service account that is a member of the group, and from events about changes in membership. A substantial part of these records is not linked to any active account. These are both people who have never used the app and people whose account has been deleted or banned. The lawful basis is legitimate interest (Article 6(1)(f)) in understanding the community's reach, in knowing to whom an announcement has already been delivered, and in moderation.

A chat can also be connected to the app by a game-night organiser — by adding the bot through a link from the app in order to publish tables there. Once such a chat has been confirmed — automatically while the organiser has a published game night that has not yet ended (no more than three chats per organiser are confirmed this way), or manually by the Sarafun administration — it is handled in the same way as the other connected chats: the service account joins it and regularly scans its membership, and the bot receives events about changes in membership. On connection, the bot checks with Telegram that the organiser is an administrator of that chat. In such a chat the bot itself posts only table and game-night posts, and it deletes the connection command.

An administrator can export a chat's member list as a file — Telegram identifier, first name, last name and @username. The export is used for moderation and for tracking reach; every such operation is recorded in the administrative log.

We should state a limitation up front, so as not to promise the impossible. The service account rescans the membership of active chats regularly. If we delete a record at your request while you remain a member of the group, it will reappear at the next scan. It can only be deleted for good once you have left the group; until then we can delete it only temporarily.

Subjects of recommendations. A member may publish a recommendation about a person outside the app or about a company, creating a card with a name, photo, city, category and contact details: website, Telegram, WhatsApp, Instagram, telephone, email, address, map link. This information is entered by the author of the recommendation, not by the subject. The lawful basis is legitimate interest (Article 6(1)(f)) in exchanging trusted contacts within the community. If a recommendation concerns you and you do not want it, write to hello@sarafun.app — we will hide or delete the card.

Game-night guests. The person who set up a table, or the game-night organiser, can seat a guest without an account, giving the guest's name (required) and Telegram @username (optional). This information is entered by whoever brought the guest, not by the guest. On the table's page, community members see the guest's name and their @username if one was given; in the table post, all members of the chat see the guest's name — with a link to their Telegram if the username was given. We use this information to run the table and for game-night statistics: how many guests come, who brings them, how many of them later register themselves. If a guest later registers with Sarafun under the same @username, their past guest seats are linked to the account; this link is seen by the organisers of that game night and by administrators. The lawful basis is legitimate interest (Article 6(1)(f)): the organiser plans the tables and sees how many guests come, and chat members see who is already at a table. By bringing a guest, you confirm that they know about this and agree. 365 days after the game night, the guest's name is replaced with «Гость» («Guest») and the @username is erased (section 9). If you do not want a record of you as a guest, write to hello@sarafun.app — we will delete it without waiting for that period; if you have an account, deleting it clears the link to your guest seats.

People in chats our bot is in. If a person adds our bot to a chat, removes it or changes its rights (Telegram allows this not only to administrators), or if a chat administrator changes a game-night organiser's rights or creates, renames or closes a topic, we record their name, @username and Telegram ID in the chat's history — so Sarafun administrators can see why the bot stopped publishing. This applies to every chat our bot is in, not only to game-night chats. Kept for 365 days from the entry. If a topic was created by someone who is not an administrator, the entry carries no name: “chat member”.

Event organisers and venues from the listings feed. The app collects announcements of public events from open websites and open Telegram channels and shows them in the city-wide feed. From an announcement we store the title, date and time, place and address, price, description, image and the link to the original source, and alongside them the announcement's original text exactly as published. Such text often contains the names of organisers and speakers and the contact details of venues. We do not extract the names of individuals into separate fields, and for events that reveal religious or political views, health, sexual orientation or migration status we store neither names nor photographs. The name of a performer, speaker or anyone else the event exists for may nonetheless appear in the description of the card: without it an announcement stops being an announcement. Names of organisers, hosts and contact persons never reach the card. The basis is legitimate interest (Article 6(1)(f)) in letting community members learn what is happening in their city; for the machine processing of announcement text we additionally rely on the text and data mining exception (Article 4 of Directive 2019/790). The machine processing is done by the Claude AI model from Anthropic (section 7).

We do not notify each person mentioned in an announcement individually: we have no contact details for them, and tracking those down would mean collecting more data about them than we hold today. Article 14(5)(b) GDPR allows notification to be omitted where it would involve disproportionate effort, and this section takes its place. If an announcement concerns you or your venue and you would rather it did not, write to hello@sarafun.app: we remove the publication on the first substantiated request and, where needed, stop collecting from that source altogether, erasing the stored original texts of its announcements at the same time. We deliberately promise no number of days — the service is run by two people, and a promise whose fulfilment depends on whether we are on holiday would be worse than an honest "usually within a few days".

Names in other people's log entries. As stated in section 4, when someone moves to a conversation or follows an external link, the log receives the name of the person they approached. If that person deletes their account, we erase their name from other people's entries too — exactly how is described in section 11.

Texts about third parties. Comments, requests, meeting feedback, content snapshots in reports and notes on administrative actions may contain information about other people. We do not edit them in advance; we act on an enquiry or a report.

9. How long we keep each category

Your account, profile details and settings are kept until you delete the account. Your content is more complicated: some of it survives account deletion under the byline «Deleted user», some is hidden, some is erased — the exact breakdown is in section 11. Inactive accounts are not deleted automatically: if you do not delete your account yourself, this data will be kept indefinitely.

Fields that survive account deletion. The Telegram identifier — re-registration and protection against ban evasion rest on it. Along with it, the following remain untouched: city, time zone, quiet hours, colour theme, role, registration date, last-activity time and the last bot used. Your notification settings remain too — optional digest notifications are switched off (section 11) — as do service markers: the time of a quick registration, a marker that the account was registered again, a general marker that you have blocked the bot (the per-bot records are deleted — see section 11), whether you chose the time zone manually, when you last opened sections where the app marks new items, and the reason for a ban if one has been applied. Everything else in the account is anonymised (section 11).

Activity log. 365 days from each entry. Two kinds of entry are excluded from the cleanup and kept indefinitely. The first is messages sent through the feedback form: this is your own text, not telemetry, and within the app it is stored only here; the copy that went to the administrators in Telegram is covered in sections 7 and 11. The second is internal markers recording that a profile-completion reminder has already been sent.

History of game nights and chats. 365 days from each entry.

Search queries and filters. 365 days from the entry.

Sessions. Deleted once more than 90 days have passed since the token expired. They are also deleted immediately — both when an account is deleted and when it is banned.

Notification logs. Event reminders and records of problem deliveries (error, bot blocked, sending deferred) — 400 days. The rest — 90 days. Account deletion does not affect these records.

Registration source — the link marker, the registration date and who invited you. Kept for as long as the account exists; replaced with the new one if you register again.

Bot reachability markers. Kept for as long as the account exists, and deleted together with it. A ban does not affect them.

Personal calendar subscription. The subscription setting and the note of when your calendar last fetched the list are kept while the subscription is on. Turning it off deletes them immediately, and so does deleting or banning your account.

Linked Google account. Kept while the connection is on. If Google stops letting Sarafun in (you revoked access in your Google account settings or changed your password), the link waits to be reconnected for no longer than 30 days and is then deleted; you can remove it at once with the «Disconnect» button. Switching it off in «Settings», deleting or blocking your account erases the access key and all related records — usually within a minute; if Google access still works, the «Sarafun» calendar is first removed from your Google Calendar and our access at Google is revoked. If access is already gone (including while the link is waiting to be reconnected), the «Sarafun» calendar stays with you — delete it in Google Calendar yourself. If Google is unavailable we retry, but the key is erased after ten failed attempts at the latest, in which case the «Sarafun» calendar may remain with you — you can delete it in Google Calendar. If you delete the «Sarafun» calendar in Google yourself or revoke access in your Google account settings, syncing switches off and we send you one message in Telegram. Sign-in attempts are kept for no longer than a day.

Event join requests. Decided requests — approved, declined, withdrawn, expired, and those cancelled because the event was cancelled — are deleted 90 days after the event starts. A request on which the organiser never made a decision is marked expired automatically four hours after the event ends, and is deleted under the same rule.

Event sign-ups, co-organiser roles, subscriptions and check-in records. Not deleted automatically.

Game-night tables, the seats at them, and the records of who connected a chat. Not deleted automatically: the game-night statistics are counted from them. A game-night guest's name and @username — 365 days after the game night; then the name is replaced with «Гость» («Guest») and the @username is erased, while the seat row and the link to an account (if the guest later registered) remain for statistics. Earlier on request to hello@sarafun.app.

Table preferences and the games you named are stored in your game-night sign-up and deleted together with it: when you cancel the sign-up, and when your account is deleted or blocked. Table invitations, like the tables themselves, are not deleted automatically, except unaccepted invitations to a game night whose sign-up you cancelled; invitations you received or sent are erased when your account is deleted or blocked.

Listings-feed data. The original texts of collected announcements, the records of what we saw at a source and when, and the internal notes on how they were processed are stored indefinitely. This is a deliberate decision rather than an oversight: these records show how a published card differs from what the source actually said and why the service treated it the way it did, and they cannot be reconstructed after the fact. There is exactly one limit on that indefinite storage, and it is unconditional: when a source, or a person mentioned in an announcement, asks us to stop publishing, we stop collecting, take the cards down and erase the stored original texts of that source — without waiting for any retention period.

Suggestions for the listings feed. The link to the event page, your comment and the link to your account are kept indefinitely: there is no automatic cleanup. When you delete your account, the comment and the link to your account are erased; the link stays, because it is the address of someone else's page, not your data.

Communities and subscriptions to them. There is no automatic cleanup. Subscriptions and moderator rights are deleted together with the account; a community awaiting moderation is rejected, while one already published remains.

Random Coffee feedback and announced pairs. Kept indefinitely, including the free-text feedback — regardless of whether the author or their partner has deleted their account. A pair not yet announced is deleted if one of its participants deletes their account or is banned, and also when the round is cancelled or the pairs are re-matched.

Content reports and the administrative audit trail. Indefinitely.

Content edit history and the alert log. 400 days. The record of who made an edit is retained even after that person's account has been deleted.

Community chats and the texts of publications and broadcasts sent to them. Indefinitely; there is no automatic cleanup. Records of failed publications are deleted once more than 7 days have passed since the event was created.

Information about the members of connected Telegram groups. Indefinitely; there is no automatic cleanup.

Donation records. Indefinitely, and they are not deleted even on request: the obligation to keep records of payments received limits the right to erasure in this respect.

Logs of internal background tasks. 30 days.

App crash reports. 30 days from the report; reports linked to your account are deleted earlier — when you delete it (section 11).

Uploaded images. Kept for as long as the associated record exists. Files not linked to any record are deleted after 24 hours.

Web-server logs. 15 days. Application logs — roughly a month, and the error log longer.

Database backups. 30 days for automatic copies; manual snapshots taken before major changes, and the separate copy of the uploaded files, live longer (section 7).

10. What we do with the data received from Telegram

At sign-in Telegram passes us a first name, last name, @username, a link to a photo and an interface language. What happens to these fields afterwards differs, and this matters for the right to rectification.

First name and last name are captured at registration. We do not overwrite them at subsequent sign-ins — you may have changed them in the app to suit yourself, and overwriting your edit with data from Telegram would be wrong. You can change your first and last name directly in your app profile.

The @username, profile photo and interface language are refreshed from Telegram at every sign-in. They cannot be changed in the app — change them in Telegram, and the new value will be picked up at your next sign-in.

11. Deleting your account

You can delete your account yourself in your profile settings. Below is a precise description of the consequences.

Anonymised. Your first name is replaced with «Deleted user». The following are erased:

• last name and @username;
• both photo links, the photo file itself on the server, and the internal markers of its synchronisation;
• interface language;
• bio, profession, company, «where you're from», skills, «who I'm looking for»;
• links to social networks;
• the record of your acceptance of this policy.

The account is marked inactive and every token issued becomes invalid. The marker that you have completed the app introduction is cleared, and optional digest notifications are switched off. The recommendation-subject card about you is renamed to «Deleted user» — this is where deletion differs from a ban, where the name is preserved.

What happens to the activity log. In your own entries the free-text note is erased — paths with parameters, snapshots of other people's names, the texts of messages sent through the feedback form. The rows themselves remain: they point to an account that has already been anonymised and are needed for aggregates such as «how many people viewed events on this day». They are deleted under the general rule — 365 days from each entry.

In other people's entries that hold a snapshot of your name, we erase precisely the name. Where someone tapped «message you», the note is cleared entirely. Where someone opened your social link, only the platform name remains: «LinkedIn». The app then substitutes «Deleted user», and the feed stays readable without naming you.

One exception we will name outright. Immediately after deletion, an entry about the deletion itself is added to the log, and it preserves a snapshot of the event sign-ups that were erased. That entry lives for a year.

Registration source. The «who invited» link is erased — both in your account and for the people you invited, including in the registration entries of the activity log. The link marker and the registration date remain in the anonymised account: they are used to count how many registrations a link brought.

Game nights. Your seats at tables are freed, the tables you set up are cancelled, and guests you brought as a player are removed together with you; your name disappears from posts in chats at the next update. Table preferences and games are deleted together with your game-night sign-ups; table invitations — both received and sent by you — are erased. The seat rows remain in the game-night history and point to the anonymised account; the tables you set up remain cancelled — with their title and description. If you were once a guest and those guest seats were linked to your account, the link is cleared; the name and @username given by whoever brought you remain in the table's history until they are anonymised 365 days after the game night (section 9). The records of which chats you connected as an organiser remain. Entries in the game-night and chat history where you acted remain and point to the anonymised account; if you acted in a chat before registering, the snapshot of your Telegram name is erased.

Search queries. The query text and the filters applied are cleared in all of your rows. The rows themselves — signal type, screen, the range of the number of results, city and client session identifier — remain until the general 365-day limit.

Feedback. The text of your message is erased together with the rest of the log notes; the row recording the fact of the message remains indefinitely. Important: the copy of the text that the bot sent to the administrators in Telegram remains in their correspondence — we cannot delete it from Telegram.

Deleted entirely:

• sessions;
• app crash reports received before the deletion (their copy in the application logs is erased on the schedule in section 9);
• your personal calendar subscription — its link stops working;
• your linked Google account — if Google access still works, the «Sarafun» calendar is removed from your Google Calendar and our access is revoked; if not, the calendar stays with you (section 9);
• bot reachability records;
• all event sign-ups — with the first person on the waiting list automatically promoted;
• join requests, together with their free-text message;
• co-organiser roles;
• your interests;
• all subscriptions: to discussions, to sign-ups, to requests, to organisers in both directions, to communities, as well as community moderator rights;
• city moderator rights: the cities assigned to you are removed;
• your Random Coffee profile and registrations in rounds that have not yet started;
• your «Already know each other» list — both your own marks and other people's marks about you;
• all referral posts;
• the file of your profile photo.

Hidden, but retained in the database. Your requests in the «Looking for» section and your replies to other people's requests are marked as deleted — the text is kept so as not to destroy other people's replies under your requests. Draft and rejected events are marked as deleted and disappear from the app; their text stays in the database, while the images uploaded to them are deleted from disk. Sharing listings are deactivated, but their description, photo and handover district remain; active loans of your items are closed — the borrower is told that the item can no longer be returned through the app — and pending requests are declined. Loans where someone else's item is currently with you stay active: the owner receives a message, without your name, that the borrower has deleted their account, and marks the return or loss themselves. Recommendations awaiting moderation are hidden. Communities awaiting moderation are rejected. Announced Random Coffee pairs in the current round are marked as not met, and your partner receives a message, without your name, that you are no longer taking part; a pair not yet announced is deleted.

Left unchanged. Your Telegram identifier and the internal fields from section 9. Comments, ratings and written reviews on events — under the byline «Deleted user». Published and cancelled events, together with their images. Published recommendations and your «I recommend them too» marks. Published communities that you created. Reports you have submitted. Event check-in records. Random Coffee meeting feedback, including its free text. Registrations in rounds that have already started or finished, together with the snapshot of the sex and household composition you gave. Notification logs. Donation records. The administrative audit trail. The content edit history. The alert log — it may contain your name, @username, Telegram identifier and internal account number.

In the records about Telegram group members, only the link to your account is cleared. The first name, last name, @username and Telegram identifier in those records remain.

On your device the app erases form drafts, the markers of dismissed hints, saved filters and internal flags, clears the tab's temporary storage and deletes the token and, if it is still there, the page address from the link from Telegram's cloud storage.

In the database backups the deleted data still exists and disappears as they rotate — within thirty days. The two caveats from section 7 apply here as well: occasional manual database snapshots are kept for longer, and the separate copy of the uploaded files does not replay deletions, so an image erased on our side may remain in it.

Re-registration is possible. It creates a new profile, requires you to go through the app introduction again and to accept the policy; your role is reset to that of an ordinary member.

The main administrator's account cannot be deleted through the interface — this is a safeguard against losing control of the service.

12. Banning an account

A ban is applied by an administrator when the community rules are broken. In terms of what happens to data, it works fundamentally differently from deletion.

A ban anonymises nothing. The account is marked inactive, the tokens issued become invalid, and the reason for the ban is stored. First name, last name, @username, photo and the whole profile remain in the database as they are, the photo file is not deleted, and the name remains visible in administrative search and on the recommendation-subject card. This is a deliberate decision: lifting a ban should restore the profile as it was.

Some data, however, is deleted irreversibly at the same time, and lifting the ban will not bring it back. The following are deleted:

• sessions;
• your personal calendar subscription — its link stops working;
• your linked Google account — if Google access still works, the «Sarafun» calendar is removed from your Google Calendar and our access is revoked; if not, the calendar stays with you (section 9);
• all event sign-ups — with the first person on the waiting list promoted;
• join requests, together with their free text;
• co-organiser roles;
• all subscriptions: to discussions, sign-ups, requests, organisers and communities, including moderator rights;
• city moderator rights: the cities assigned to you are removed and your role is changed to that of an ordinary member;
• the Random Coffee profile and registrations in rounds that have not yet started.

Rejected with no way back: events awaiting moderation; communities awaiting moderation; referral posts awaiting moderation.

Game nights: your seats at tables are freed, the tables you set up are cancelled, and guests you brought as a player are removed. Table invitations you received or sent are erased; table preferences go together with your event sign-ups. Unbanning does not restore this.

Hidden but retained: your requests and replies are marked as deleted; published referral posts are hidden; recommendations awaiting moderation are hidden; sharing listings are deactivated, active loans of your items are closed (the borrower is notified) and pending requests are declined. Loans where someone else's item is currently with you stay active: the owner receives a message with your name saying that you have left Sarafun, and marks the return or loss themselves. Announced Random Coffee pairs in the current round are marked as not met, and your partner receives a message, without your name, that you are no longer taking part; a pair not yet announced is deleted. The link to chat-member records is cleared.

Comments and ratings are not affected and remain signed with your real name.

The activity log and search queries are not anonymised on a ban — unlike on deletion. They are deleted under the general one-year rule, with the same two exceptions named in section 9: feedback text and the internal reminder markers remain, and a ban does not anonymise them. App crash reports are not deleted on a ban and are erased after the general 30-day period.

An entry is added to the administrative audit trail with the reason for the ban and a snapshot of your event sign-ups and join requests. It is kept indefinitely.

Form drafts on your device survive a ban — the app does not clear them.

If you consider a ban unjustified, or if you would like your data to be deleted after it rather than retained, write to hello@sarafun.app.

13. Data on your device and in Telegram's storage

The app uses no advertising or tracking cookies and does not track you across sites. The single cookie on the landing site is covered in section 3.

Session token. After sign-in the token is saved in Telegram's cloud storage and tied to the «you — this particular bot» pair. This is so that you do not have to sign in again the next time you open the app. The token survives closing the app; it is erased when the account is deleted, and becomes invalid on a ban and on a change of role.

The page from the link you came by. If you first opened the app through a link (to an event, a profile and so on), then while you are filling in your profile the address of that page is kept in Telegram's cloud storage, so that the page opens once you finish, even if the app was restarted in between. The entry is erased as soon as you finish the profile and when the account is deleted; an entry older than a week is not used and is erased the next time the profile form opens.

The device's local storage. The app keeps form drafts there, containing the text you have entered:

• an event;
• a sharing listing;
• a request;
• a recommendation;
• a referral post;
• a game-night table;
• the app introduction;
• feedback.

Alongside the drafts sit the markers of dismissed hints, the city and community filters you have selected, and a few internal flags. This data is stored on your device and does not go to the server: it reaches us only when you submit the form yourself. When an account is deleted, the app clears everything listed, including the referral-post draft and the filter keys.

Client session identifier. A random identifier is generated each time the app is launched. It accompanies activity-log and search-query entries within a single visit and makes it possible to see the sequence of actions inside it. It is not shared between visits: a new one is generated at the next launch.

14. Technical logs outside the database

Web-server logs. For the app domain app.sarafun.app and for the pages of the landing site, the web server records the full IP address, the full User-Agent, the request path and method, and the response code. We use these records to protect against scanning and automated attacks. The retention period is 15 days. The lawful basis is legitimate interest (Article 6(1)(f)).

Application logs. These are kept in structured form and contain the user identifier and the type of action, as well as copies of app crash reports (section 4). The full IP address, User-Agent, authorisation headers and secrets do not reach these files. Entries about protective mechanisms being triggered — the request rate limit being exceeded, an invalid or expired session token, security alerts — keep a truncated IP address: the first three numbers of an IPv4 address or the first three groups of an IPv6 address, from which no individual device can be identified.

The User-Agent exception. Where there are clear signs of an automated attack, the full User-Agent and a truncated IP address are written to the alert log in the database. Such entries are rare and are kept for 400 days.

15. Your rights

You hold the rights set out in Articles 15–22 GDPR. To exercise any of them, write to hello@sarafun.app. So that we do not hand your data to a stranger, we will ask you to confirm that it is you — for example, by replying from the same Telegram account you use for the app.

Right of access (Art. 15). You have the right to obtain confirmation that we process your data and a copy of it. There is no automated export in the app — we prepare the extract by hand, so a reply may take up to a month.

Right to rectification (Art. 16). You change your profile details, first name, last name and settings yourself at any time. Change your @username, photo and interface language in Telegram — they will be refreshed on our side at your next sign-in (section 10).

Right to erasure (Art. 17). Delete your account in the settings, or write to us. Section 11 describes what is erased and what remains. The right is limited — here is exactly where.

• We are obliged to keep the record of a donation.
• The administrative audit trail, the edit history and the alert log remain as an evidence base under legitimate interest, and are deleted under their own retention rules.
• The Telegram identifier is retained to protect against ban evasion.
• Data lives for up to thirty more days in the automatic backups; manual database snapshots and the separate copy of the uploaded files live longer (section 7).
• Records about the members of connected Telegram groups keep your name and @username for as long as you remain in the group (section 8).
• Random Coffee meeting feedback, including its free text, remains indefinitely.
• Notification logs and check-in records are not subject to erasure.
• Published content remains under the byline «Deleted user».
• The history of seats at game-night tables and information about guests remain (section 11).

The full breakdown is in section 11. On a separate request we will consider erasing particular records beyond the standard procedure.

Right to restriction of processing (Art. 18). There is no separate suspension mode in the app — we say so plainly rather than describe a mechanism that does not exist. The closest thing to it is a ban, but a ban deletes part of the data, so it is not a suspension. If you request restriction of processing, we will stop using your data manually and tell you exactly what we have done.

Right to object (Art. 21). You may object at any time to processing carried out on the basis of legitimate interest. That is primarily product analytics — the activity log and search queries — the snapshot of your name in other people's entries, and the storage of information about the members of connected groups. Against digest notifications you may object unconditionally: switch off the relevant toggles in your settings. Transactional notifications without which the service does not work — for example, about your sign-up for an event — will continue to arrive.

Right to data portability (Art. 20). You have the right to receive the data you have provided in a machine-readable format. There is no automated export mechanism; we prepare it by hand on request.

Withdrawal of consent (Art. 7(3)). The consents from section 5 are withdrawn in the settings: you delete your Random Coffee profile in the Random Coffee section, and switch off optional digest notifications with the toggles. One limitation for the Random Coffee profile: while a round is running in which you have been paired, the app will not let you delete it — wait for the round to finish, or write to us. Withdrawal does not affect the lawfulness of processing carried out before it.

Right to lodge a complaint (Art. 77). You have the right to complain to a data protection supervisory authority — in your country of residence, of work, or of the alleged infringement. In Spain this is the Agencia Española de Protección de Datos (aepd.es).

There is no automated decision-making with legal effects (Art. 22) in the app. The matching algorithm produces a list of suggestions and affects only the order of the cards. The «Подходит вам» («For you») block of events works the same way: it takes into account the interests in your profile and the history of your sign-ups and attendance check-ins — the topics of events you signed up for, organisers whose events you attended or whom you follow, and how many of your acquaintances are going to an event (a number only, no names). Your acquaintances are the people you have been with at two or more events, the people you met in Random Coffee (at least one of you confirmed the meeting in feedback) and the people you yourself marked «Already know each other» (while you are in the same city: the list works only within it), except those who have turned on «Hide me from Connect». Your sign-up likewise counts towards this number for those who have been with you at two or more events, met you in Random Coffee or themselves marked you «Already know each other», unless you have turned on «Hide me from Connect» yourself. Game nights do not count towards those events: at game nights, people count as each other's acquaintances only if they have sat at the same table at least once. If you or another member deletes their Random Coffee profile, earlier meetings and «Already know each other» marks between you no longer count, even if the profile is filled in again (for this we keep the date the profile was deleted until the account itself is deleted). By the same rule, in the list of people signed up for an event your acquaintances carry the label «Знакомы» («You know each other») — only you see it. Only your own «Already know each other» marks count: a mark someone else has put on you is not shown to you. If your profile has no interests and there is nothing to match from your history, the block shows what is popular: in the events feed — in the city selected there (your own city by default), on the home screen — always in your own city.

16. Security

We take technical and organisational measures proportionate to the risks. The connection to the application is protected by TLS. The data that Telegram passes at sign-in is verified by a cryptographic signature with a time limit. Access rights are checked on every request, so a change of permissions takes effect immediately. Only administrators have service access to the data, and their actions are recorded in the audit trail. We do not disclose how the protective mechanisms are built: publishing that would make an attack easier.

Secrets and tokens do not reach the logs. The full IP address and browser details are stripped from the application logs.

No measure offers an absolute guarantee. If an incident occurs that creates a risk to your rights, we will notify the supervisory authority, and, where the risk is high, you as well, within the time limits laid down in Articles 33 and 34 GDPR.

17. Data sources

The list of cities and their attributes is taken from the open GeoNames dataset (geonames.org), which is distributed under the Creative Commons Attribution 4.0 licence.

Event announcements in the listings feed are collected from the open websites of organisers and venues and from open Telegram channels. Every card links to its original source; the rights to the original texts and images belong to whoever published them. We follow robots.txt directives, we do not circumvent paywalls, CAPTCHA checks or rate limits, and we take a publication down on a substantiated request from the rights holder.

18. Changes to this policy

We update this policy as the service evolves. The date of the latest revision is given at the top of the document.

The revision published in the app is the one in force. The same revision is published on the sarafun.app website in Russian and in English translation; in the event of a discrepancy, the Russian revision in the app prevails.

We announce substantive changes — new categories of data, new purposes of processing, longer retention periods — in the Telegram community and in the app. If you continue to use the service after the changes take effect, the updated revision applies to the processing that rests on the contract and on legitimate interest. Processing that requires consent we will resume only once we have obtained it.

19. Status of this document

The wording on lawful bases, retention periods and limitations of rights describes how the service actually works.

If you notice a discrepancy between what is written here and how the service actually behaves, write to hello@sarafun.app. We will correct either the text or the behaviour of the service.

See also: Terms of Use.