Privacy Policy

Data Controllers & Contact

Nemanja Samac and Miloš Nikolić jointly determine why and how Qynta processes personal data and are the joint data controllers. Both can be contacted at Sonnleithnergasse 2, 1100 Wien, Austria and through the shared privacy inbox, privacy@qynta.app. You may exercise your GDPR rights against either controller. In this Privacy Policy, "we" and "us" refer to these joint controllers. Qynta is operated by Nemanja Samac. Telephone contact for Nemanja Samac: +43 676 321 9679.

1. Scope & Account Information

This policy covers Qynta’s website, web app and mobile app. We collect the information you provide when creating and managing an account: your name, username, email address, date of birth, and any optional gender, profile, interests, skills, links and preferences you supply. Date of birth is used to enforce the minimum signup age. If you use Sign in with Apple or connect another supported account, we receive the identifiers and information supplied through that connection.

2. Content & Activity

Depending on the features you use, we process posts, comments, Quests, WIPs, polls, events, workspaces, photos, videos, voice messages and direct or group messages. We also store account-linked activity such as Sync connections, searches, reactions, contributions, recommendation interactions, reputation, earned diamonds, virtual-item ownership and support or safety reports. Real-money billing is currently disabled; earned-diamond and virtual-item records still form part of your account data.

3. Technical Data & Notifications

We process IP addresses, browser/device and operating-system information, app versions, session and security records, and crash/performance diagnostics. If you enable push notifications, we store the device push token or browser push subscription, including the endpoint and delivery keys, with your account and notification preferences. We also process connection status and the most recent presence timestamp to operate messaging.

4. Purposes & Legal Bases

We use account, content and communication data to provide the Service you request, including sign-in, publishing, messaging, matching and discovery, on the basis of our contract with you. We rely on legitimate interests in preventing abuse, protecting accounts, maintaining reliability and understanding how the Service is used, subject to your rights. We process information to meet applicable legal obligations. Where processing requires consent, including optional marketing, we ask separately; you can withdraw it at any time through the relevant control or by emailing privacy@qynta.app. Reading or acknowledging this policy is not consent to every optional use of data.

5. Public Profiles & Content

Your public profile and content you publish publicly can be viewed on Qynta’s public web pages, including by people who are not signed in, and may appear in search-engine results. Content with a restricted audience is handled according to that feature’s audience controls. Other people may keep copies of information you share with them. Review your profile and audience settings before sharing personal or confidential information.

6. Messages & Online Status

Messages and attachments are stored on Qynta’s servers to provide delivery and conversation history to the participants. Messaging also processes delivery/read information and group membership. When Show online status is enabled, people you have direct chats with and members of your group chats can see when you are online; blocked accounts are excluded. The setting is enabled by default. Turn it off in Settings to hide your online status and last-seen information from other users across devices. Turning it off does not stop the connection processing needed to provide the Service.

7. Optional Contact Matching

If you choose to find friends from your device contacts, the mobile app asks for contact permission. It normalises and hashes email addresses and phone numbers on your device before sending the hashes for matching; this flow does not upload contact names or raw address-book email addresses or phone numbers. The matching endpoint compares these values with account contact hashes and does not save the imported address-book hashes. Your own account contact hashes may be stored so other members can find you. Hashes used for matching remain personal data, not anonymous data. Connections you choose to make are stored as part of your Sync activity.

8. Device & Browser Permissions

Camera, photo-library, microphone and contacts access are requested for the features that need them. You can refuse or revoke permission in your device or browser settings; the affected feature may then be unavailable. Push notifications are optional and can be managed in Qynta’s notification settings and your device/browser controls. Disabling notifications does not delete your account or its content.

9. AI, Personalisation & Embeddings

Qynta uses profile, interest, content and activity signals to recommend people and content and generate numerical representations called embeddings for matching. Mistral AI processes the inputs needed for AI features, including Guide prompts and relevant context, content submitted for summarisation or moderation, and profile/post text used for embeddings. Reply suggestions and conversation assistance can send recent conversation messages and relevant profile or activity context to Mistral. We store generated outputs, conversation memory, recommendations, feedback and usage records as needed for those features. Recommendations may be inaccurate; you decide whom to contact and what to publish. Contact privacy@qynta.app to ask about or object to profiling or request review of a processing concern. We do not sell embeddings or use them for third-party advertising.

10. Usage Analytics & Diagnostics

Qynta collects first-party usage events to understand feature use and improve reliability and recommendations. These can be linked to your account and include event names, session identifiers, platform/app version and event properties; they are not all anonymous. Sentry receives crash, error and performance diagnostics, which can include technical request/device information. Our diagnostic filters remove credentials, request bodies and direct contact identifiers from events sent through our integrations. We do not use third-party advertising trackers or sell this activity for advertising.

11. Recipients & Service Providers

Other users receive information you share with them as described above. Our current service providers include Hetzner for hosting, Mistral AI for AI processing, Resend for email delivery, and Sentry for diagnostics. Mobile push uses Expo and Apple’s push service; browser push uses the delivery service associated with your browser. Sign in with Apple also involves Apple. These services receive the data needed for their function, such as an email address and email content for delivery, or a push token and notification payload. We may also disclose information where required by law or necessary to protect users and the Service. We do not sell personal data or share it for cross-context behavioural advertising.

12. International Processing

Some service providers may process data outside your country, including outside the EEA or UK. Processing locations and transfer arrangements depend on the provider and the service used. Contact privacy@qynta.app for information about the destinations and applicable transfer safeguards, or to request a copy of relevant safeguards.

13. Retention & Account Deletion

We retain account data while your account is active and as needed to provide the Service. When you delete your account, we delete or irreversibly anonymise ordinary account data in our active systems within 30 days. This deadline does not describe the separate retention of recovery backups or provider diagnostic records; contact privacy@qynta.app for details about those records. Open safety reports expire 365 days after submission; resolved reports expire 180 days after resolution. On account deletion, we replace the relevant account or target identifier with a keyed pseudonymous reference. We erase the deleted reporter’s submission text and, for reports targeting the deleted account or its content, erase evidence snapshots and free-text notes unless a documented legal hold applies. A legal hold extends retention only while necessary for a specific legal obligation or dispute, subject to periodic review.

14. Security

We use TLS in transit, bcrypt password hashing, optional two-factor authentication, access controls and security audit logging. No system is perfectly secure. Keep your account credentials private and use the available security controls. Contact support@qynta.app if you suspect unauthorised access.

15. Your Data Rights

Where applicable under the GDPR and UK data-protection law, you can request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. You can withdraw consent without affecting the lawfulness of earlier processing. In Settings, use Your data & privacy / Download my data or Delete Account; you can also contact privacy@qynta.app or visit https://qynta.app/privacy/request. We may need to verify your identity. We respond without undue delay, normally within one month; if a permitted extension is needed, we explain it within that first month. You may complain to your local supervisory authority, including the Austrian Datenschutzbehörde at https://dsb.gv.at/.

16. California Privacy Rights

Where the CCPA/CPRA applies, California residents can request information about the personal data collected, access, deletion and correction, and opt out of sale or sharing for cross-context behavioural advertising. Qynta does not sell personal information or share it for that advertising purpose. We do not discriminate against you for exercising privacy rights. Use the privacy contact or request page above.

17. Cookies & Local Storage

The website uses necessary first-party authentication cookies and browser storage for functions such as preferences, saved navigation, onboarding, drafts and notification/install controls. It does not currently set analytics or advertising cookies. First-party account activity and Sentry diagnostics can still be processed without analytics cookies. The mobile app uses secure device storage for authentication tokens and local storage for app functionality. See the Cookie Policy at https://qynta.app/legal/cookies for details and controls.

18. Children’s Privacy

Qynta is not directed to children under 16. We enforce a minimum signup age using the date of birth supplied at registration. If you believe an underage person has registered, contact privacy@qynta.app so we can investigate and remove the account and associated data as appropriate.

19. Policy Changes

We publish the version and effective date of this policy. We notify users of material changes through the in-app agreement flow or email, and our existing agreement flow may ask you to read and acknowledge the current version. A policy acknowledgement does not replace any separate consent needed for optional processing.

20. Contact Us

Nemanja Samac and Miloš Nikolić jointly determine why and how Qynta processes personal data and are the joint data controllers. Both can be contacted at Sonnleithnergasse 2, 1100 Wien, Austria and through the shared privacy inbox, privacy@qynta.app. You may exercise your GDPR rights against either controller. Both monitor privacy, support and legal requests. You can also use the support feature. Telephone contact for Nemanja Samac: +43 676 321 9679.