Privacy Policy

Rumour is operated jointly by Mihika Bhawkar and Jonah Kittelmann, Ostender Straße 2A, 13353 Berlin, Germany. We are joint controllers for the processing of your personal data and have agreed in writing how we share our duties under data protection law. You can reach both of us at info@rumour-app.com. You may exercise your rights against either of us, and we will answer together.

To use Rumour we need your email address and your confirmation that you are 18 or older. Without them we cannot create an account for you. Everything else is optional — your moods and no-gos, your saved places, your plans, your Circle, your Live spots, your location and our feedback emails — and the app works without it.

• Account and sign-in. We process your email address together with either a password or your Google account, so that we can run your account. Legal basis: Art. 6(1)(b) GDPR.
• Age. We store your confirmation that you are 18 or older, together with the date and time at which you gave it. This allows us to run your account and serves our legitimate interest in limiting the app to adults. Legal basis: Art. 6(1)(b) and (f) GDPR.
• Preferences. We process the moods, no-gos and places you choose, so that our recommendations suit you. Legal basis: Art. 6(1)(b) GDPR.
• Chat and recommendations. We process what you type and the answers we give you, so that the conversation holds together. Legal basis: Art. 6(1)(b) GDPR. After twelve months these records are anonymised, and we keep them in that form in order to check and improve our recommendations. Legal basis: Art. 6(1)(f) GDPR.
• Saved places. We store the places you save, so that you can find them again. Legal basis: Art. 6(1)(b) GDPR.
• Plans and share links. We process a plan together with the venue, the time, the people taking part and their answers, as well as a dietary note if you write one. Anyone holding a share link can see the plan it points to. Legal basis: Art. 6(1)(b) GDPR.
• Circle. We process the connections you make and the invite codes you use; invite codes expire. If you scan someone's code in the app, your camera is used only to read that code on your phone. No picture or video is stored or sent anywhere, and the camera turns off as soon as the code is read or you leave the screen. Only the invite code itself is sent to us, as when you open an invite link. Legal basis for the invite code: Art. 6(1)(b) GDPR; camera access happens only when you ask for it and is strictly necessary for that function (§ 25(2) no. 2 TDDDG).
• Live map and location. When you post a Live spot, we process the venue, the time, the audience you choose and the people who join. Your device location is used only if you switch it on and your browser allows it: your coordinates are sent to us, we determine whether you are inside our service area, and the coordinates are discarded as soon as we have the answer. We never store them. Legal basis: Art. 6(1)(a) GDPR for your location and Art. 6(1)(b) GDPR for the Live spot.
• Notifications. If you turn them on, we send you notifications about your plans and about activity in your circle — for example when someone joins a plan you host, or when someone connects with you. To do this we store a push subscription for your device. You can turn notifications off at any time in the app or in your device settings.
• Feedback emails. If you have given your consent, we send you one short email after a plan and process the answers you give us. You can stop these emails at any time. Legal basis: Art. 6(1)(a) GDPR.
• Service emails. We send account emails such as sign-up confirmations and password resets. Legal basis: Art. 6(1)(b) GDPR.
• Operating the app safely. We briefly count the requests coming from your IP address on our public links, so that nobody can flood them, and we log technical error details on our side. This serves our legitimate interest in keeping the app secure and available. Legal basis: Art. 6(1)(f) GDPR.

The answers in the chat are generated by an AI model provided by Mistral AI and called through its European endpoint. They are written from our own venue data. Mistral stores inputs and outputs for 30 days in order to detect abuse and deletes them afterwards. We have objected to the use of our data for model training, and the chat offers no rating function that could feed data into training. Every AI-written reply is marked in the app as written by AI.

We do not take automated decisions that produce legal effects concerning you or that similarly significantly affect you. Our recommendations are personalised suggestions and nothing more.

Other people using Rumour see some of your data as well: your Circle sees your display name and the Live spots you share with them, the people on a plan see that plan and who is taking part, and anyone holding a share link can see the shared plan until the link expires.

We do not use Google Places in the app at present. If that changes, we will update this page first.

Our deletion routines run every night.

• Your account, your preferences, your saved places and your Circle connections are kept until you delete your account.
• Chats and the messages they contain are deleted after 90 days.
• Plans are deleted six months after the date they were made for, and a dietary note is deleted 30 days after that date.
• Live spots are deleted 30 days after they end.
• Share links, invite codes and feedback links are removed once they expire: a feedback link after 30 days, an unsubscribe link after 90 days and an invite code after 90 days.
• Password reset records and the short-lived counters for IP addresses are deleted after 24 hours.
• After twelve months, the recommendations you were shown, the places you opened and the feedback you left are anonymised: the link to your account is removed and anything you typed is erased. We keep these records in anonymised form in order to see which venues work well and to improve our recommendations.

Anonymised records no longer relate to you, so they remain when you delete your account. Everything still linked to you is deleted.

You have the right to access your data, to receive a copy of it, to have it corrected or deleted, to have its processing restricted, to receive it in a portable form, and to withdraw your consent at any time, without affecting anything done before the withdrawal. In Settings you can download your data in a single file and delete your account. For anything else, please write to info@rumour-app.com. You also have the right to lodge a complaint with a supervisory authority; the authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

We use no analytics, no tracking and no advertising. We store only what the app needs in order to work: your sign-in session, whether you have dismissed the installation prompt, when you last opened the Live map (so we can mark new spots), the page to return to after signing in, which is kept on your device for up to an hour and removed as soon as it has been used, and a few entries that last only for the duration of a visit, such as an unfinished set-up, your consent answers until your account exists, the chat you just had, whether the opening animation has already played and a one-off reload guard. Two cookies are set on your device: __dpl, set by our host for 24 hours so that the right version of the app is delivered, and __cf_bm, set by Cloudflare for 30 minutes in order to tell people and bots apart. All of this is strictly necessary within the meaning of § 25(2) TDDDG, which is why we do not ask for your consent.

Rumour is intended for people aged 18 and older.

We update this policy whenever the app changes. The date at the top shows when it was last updated.