This is an English translation, for convenience. The text that applies is the Dutch version. Where the two differ, the Dutch text is the one that counts.

Privacy at GroepsDruk

GroepsDruk runs on your photos, videos and goals. So you ought to know exactly what happens to them. This is the whole story, no small print.

Version 1 · 2 September 2026 · applies to the GroepsDruk app and this website

1. Who we are

GroepsDruk is a social goals platform: you set your own goals and prove with a photo or video check-in that you are working on them, while your friends look on and cheer you on. GroepsDruk is made and run by EXOD IT, and EXOD IT is also the one responsible for your data. For anything to do with privacy, from questions to deletion requests, email privacy@groepsdr.uk. Rather do it by post, or want to know who is behind it?

EXOD IT
Grote Kerkstraat 28
4941 DP Raamsdonksveer
KvK 96306939

2. Who GroepsDruk is for

GroepsDruk is there for everyone aged 16 and over. If you are younger than 16, do not create an account.

3. What data we store

Only what the app needs in order to work:

Your account: your email address, your password (stored as unreadable code, a hash, which we cannot read back either) and your language choice.
Your profile: your username, first and last name, possibly a nickname and a profile picture.
Your phone number (optional): you only fill this in yourself, and only you and the administrators can see it.
Your check-ins: the photos and videos you take, with the time and any caption.
Your goals and progress: which goals you have, when you checked in, your streaks and your jokers.
Your friends: who your friends are and who invited whom.
Your chats: messages, attachments and nudges between you and your friends.
Your reactions: your ratings of and reactions to your friends' stories.
Your device: a notification code (push token) for every device you have notifications switched on for.
Email sending log: your address, the kind of system email and whether sending it worked. We only keep the contents of an email briefly, while it is being sent.
Reports and measures: what you report and why, a copy of the reported content (if it is a message, the text of it as well), warnings you have been given, a reason for a block, and an appeal you file.

What we do not do, and what stays that way: we do not sell your data and we do not pass it on so that someone else can advertise with it. And we do not make automated decisions about you, with one exception: a name you choose, for a goal, a community or in your profile, is checked by the app automatically against a word list, and a name that does not get through you change yourself straight away. Everything decided about you or your content after that is decided by a human.

Beyond that we do no more with your data than what is set out above, and we do not ask for your location. That is how it is now, not a promise for ever: if we start measuring how the app gets used, for instance, it will be here before it goes live, and at the bottom of this page you can see what changed in each version.

You are never obliged to give us anything: it is only that without an email address and a username an account cannot exist. Everything else is optional.

4. What others see of you

Your friends see your check-ins as a story, for 36 hours, and can react to them. On top of that they see the items (three at most) that you pin to your profile yourself.
Your archive is yours: check-ins older than 36 hours are shown by the app to you alone, with the items you pin yourself as the only exception.
Other GroepsDruk users (not friends) only see your username, name, nickname, profile picture and when you joined, for instance when they are searching for friends. Your phone number is never visible to other users.
Outside the app profiles and check-ins cannot be viewed. One exception: your profile picture sits on a direct link that works without an account too.

5. What we use your data for

To make the app work: keeping track of your goals, showing your check-ins to your friends, working out your streaks and sending you system emails (such as password recovery). Legal basis, in other words why the law allows this: performing our agreement with you.
To send you notifications if you switch them on, for instance for a nudge or a new message. Legal basis: your consent; switching them off is always possible, in the app or on your device.
To keep the community safe: moderation, blocks and preventing abuse. Legal basis: our legitimate interest in a safe app.

Your phone number is optional and we process it on the basis of your consent: if you remove them, that consent is withdrawn. There are no other purposes.

One purpose falls outside that list: complying with a legal duty, or averting danger. Legal basis: a legal obligation, or our legitimate interest in a safe app. What that means is set out below, under who gets your data.

6. Where your data lives and who works on it

Your data lives within Europe: the database and the media storage run in London (AWS eu-west-2). In December 2025 the European Commission again designated the United Kingdom as offering adequate protection, until the end of 2031, which means the same protection rules apply there.

These parties work on our instructions:

Lovable hosts the platform for us, on infrastructure from Supabase and Amazon Web Services (AWS), and sends the system emails on our behalf (sender: noreply@groepsdruk.app). Lovable is allowed to bring in parties of its own for that; those are then bound by the same agreements as Lovable itself.
Apple delivers push notifications on iPhones. The contents of such a notification, like the name of the sender and the first bit of a chat message, go via Apple in the process.
Browser notification services (from Google, Mozilla or Apple, for instance) deliver notifications if you use GroepsDruk in the browser; the content is encrypted in the process and not readable for those services.

On top of that there is one service that does not work for us: jsDelivr, a public CDN that in rare cases supplies the app with an emoji image that is not shipped with it. This website fetches nothing from there.

Notifications may be processed by Apple, Google and Mozilla in the United States. The European arrangements for transfers apply to that, such as the EU-US Data Privacy Framework and standard contractual clauses.

One recipient falls outside this list. If we suspect a criminal offence in which someone's life or safety is in danger, or if the law obliges us to, we share what is needed with the police or another authority. We do not do that lightly and not as a matter of course: it is the exception described in the house rules and the terms of use.

There is one more recipient that could join the list one day. EXOD IT is a sole trader at the moment. If the business takes on a different legal form, or if GroepsDruk passes to another company that carries on the service, your data goes along to that party. From that moment on they are bound by this privacy policy, and we will let you know at least a month beforehand, so that you can leave if you do not want to come along. Section 12 of the terms of use says the same.

And this website? It sets no cookies, measures nothing and loads nothing from third parties. The site is published through Lovable and runs on their infrastructure; as a host, they only process technically necessary server logs. The screenshots on the site come from the real app: the people who are recognisable on them by name or picture have given permission for that. Are you on one and do you want off? One email is enough.

7. How long we keep your data

Photos and videos: 42 days. With a premium status, which we hand out ourselves to a small group of testers and which is not for sale, that becomes 5 years, and whatever you pin to your profile stays for as long as your account exists.
Check-in data without images (that you checked in, for your streak and score): for as long as your account exists.
Chat messages: for as long as the conversation exists. A message you delete yourself is gone from the conversation straight away; a file you sent along with it may sit in our storage briefly, until we clear it out.
Notification codes: until you switch notifications off or sign your device out.
Email sending log: metadata only, no content. We keep that for as long as we need it to look into sending problems. If sending an email keeps failing, that email stays in the queue until we clear it out.
Reports, warnings and measures: we keep those even after a case has been dealt with, so that a decision can still be backed up if you appeal against it. The admin log itself we keep permanently, so that stepping in always stays checkable.

8. Your rights

You may always see what we have on you, have it corrected or delete your account. On top of that you may object to a processing, ask for it to be restricted temporarily, get your data in a readable file, and withdraw consent (such as for notifications or the optional fields) again at any time. Email privacy@groepsdr.uk for that; we reply as quickly as we can and within 30 days at the latest. Deleting your account is something you do yourself in the app, in Settings under "Account and personal details".

If you delete your account, it is set to invisible straight away. You have a cooling-off period of fourteen days, during which you put it back in the app with a single button. After that we delete it for good: your account and your profile (including your phone number) go, along with your goals, check-ins, reactions and friendships. Within thirty days of your request at the latest, your photos, videos and invitations have been cleared out too. Your conversations with others disappear on both sides in the process, so at the other person's end as well.

One thing stays on purpose: if we have ever stepped in against you, we keep that measure in the admin log, with the username you had at that moment. Without that trail there is no way to tell afterwards whether we ourselves acted carefully. Beyond that, at most data is left behind that can no longer be linked to you.

Do you think we are not handling your data properly? We would like to hear it ourselves first, but you also always have the right to lodge a complaint with the Autoriteit Persoonsgegevens (the Dutch data protection authority).

9. If this policy changes

GroepsDruk is under development, so this policy grows with it. This page always carries the current version, with a date, and at the bottom it says what changed in each version. If something substantial changes, for instance a new processor or a different retention policy, we will say so in the app.

10. Version history

If anything about this text changes, a line is added below: which version it is, when it is from, and what is different. We keep the full text of every version, so it can always be looked up what someone agreed to.

Version 1 · 2 September 2026 - first published version.