sup? · Grimm Group AB
Privacy Policy
1. Who we are
sup? is a map-based social network provided by Grimm Group AB, a Swedish limited company (aktiebolag), corporate ID no. 559303-5180, Östra Sjöstadsgatan 8, 654 60 Karlstad, Sweden ("Grimm Group", "we"). Grimm Group is the controller of the personal data processed in sup? under the EU General Data Protection Regulation (GDPR).
This policy explains what we collect, why, who can see it, how long we keep it and how you use your rights.
2. What we collect
Account data: name, username, email address, date of birth, profile photo, description, tags, and which version of the Terms of Service and this policy you accepted and when. Your password never leaves your phone: the app sends a key derived from it, and we store only a salted hash of that key.
Location: your device location while the app is open, used to place your icon on the map. We keep only your latest position, not a history.
Content: posts, activities, events, jobs, organizations, businesses, locations, shop items and photos you create.
Connections: friends, memberships, attendance, applications, pins, people you block and other links in your web.
Chats: direct messages, group chats you make and private chats with a business or organization are end-to-end encrypted: we store them only as ciphertext and cannot read them. We do see who is in a chat and when messages are sent. Group chats of organizations, events and activities are not end-to-end encrypted, so new members can read earlier messages.
Devices: the name of each device you log in on, its public encryption key and, if you allow notifications, its push notification address.
Chat key backup: so you can read your encrypted messages on a new phone, your chat keys are stored with us encrypted with a key that only your password can unlock, on your phone. We cannot open it. If you reset your password while no phone is logged in, earlier encrypted messages cannot be recovered.
Reports and support requests you send, and reports others send about you or your content.
Technical data: your IP address, which our server keeps in memory for at most an hour to stop abuse such as repeated login attempts. Our request logs record no IP addresses; error logs are kept for 14 days.
3. Why we use it (legal bases)
To provide sup? to you (performance of our agreement, GDPR Art. 6(1)(b)): showing the map and webs, delivering messages and notifications, and account emails such as confirmation and password reset.
To keep sup? safe (legitimate interest, Art. 6(1)(f)): preventing abuse, handling reports and blocks, and securing the service.
Location is only collected after you allow it in your phone's settings, and you can withdraw that permission at any time.
To meet legal obligations (Art. 6(1)(c)), for example answering lawful requests from authorities.
We do not sell personal data.
4. Advertising
sup? shows ads from businesses and organizations (advertisers) in a bar on the map. Every ad is labelled as an ad. An ad opens the advertiser's website or shows their business, event or place in sup?.
Everyone sees the same ads. We do not use your personal data, location, chats or activity to choose or measure ads, and we do not tell advertisers who saw or tapped their ad. If you open an advertiser's website, its own privacy policy applies there.
5. Who can see what
You decide who sees your content and associations with the Public, Friends and Custom visibility options, and how precisely others see your location (exact, or only your area: the nearest town or city district) with Location precision on your Info tab.
Anyone you let see your location can see where you were when you last had sup? open. The Terms of Service explain how to share it safely.
Businesses are always public. Others see your age, not your date of birth.
If you block someone, they can no longer see you, your profile or anything you create, and they cannot message you.
6. Sharing
We use service providers (processors) for hosting, sending email and push notifications, under data processing agreements: GleSYS AB (Sweden) for hosting and email, and Google (Firebase Cloud Messaging) to wake the app for new messages and notifications. Push notifications contain only an identifier, never names or message content: the app fetches the content from us. We share data with authorities only when the law requires it. Reports are read by our support team.
Your data is stored in Sweden. Google may process push notification data outside the EU/EEA; this is covered by the EU–US Data Privacy Framework and the EU standard contractual clauses in Google's terms.
7. How long we keep it
We keep your data while you have an account. When you delete your account we delete your profile, everything you created (with its group chats), your connections, messages, photos, devices and notifications immediately; copies in backups are overwritten within 30 days. Group chats other people made stay, without you and your messages. Reports and support requests are kept for up to 12 months to handle them and to prevent abuse. Server logs are kept for 14 days. If we remove an account for breaking the Terms of Service, we may keep a one-way hash of its email address so it cannot sign up again.
8. Your rights
Access and portability: Settings → Download my data gives you a copy of everything we store about your account.
Correction: edit your profile on your Info tab at any time.
Erasure: Settings → Delete account (or hold your own icon on the map) deletes your account and everything you created. You can also do it on the web at https://sup.grimmgroup.eu/delete-account.
You may also ask us to restrict or object to processing, and withdraw consent (for example location access) at any time.
You can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se) or the authority where you live.
9. Security
Passwords never reach our servers, login keys and links are stored only as hashes, chats are end-to-end encrypted as described above, and every connection to our servers is encrypted. No system is perfectly secure; tell us at once if you think your account has been misused.
10. Minimum age
You must be at least 15 years old to use sup?. If we learn that an account belongs to someone younger, we delete it.
11. Changes
We will tell you in the app about important changes to this policy.
12. Contact
Grimm Group AB, Östra Sjöstadsgatan 8, 654 60 Karlstad, Sweden. Privacy questions: privacy@grimmgroup.eu. In the app: Report a problem on your own Info tab.