WildCrewPrivacy policy
Last updated: 2 October 2026
Draft. This text is a draft for the controller to review. It is not legal advice and is not final until that review is done.
This policy explains what personal data the WildCrew app collects, why, who can see it and what your rights are. WildCrew is an app for finding and joining action-sports activities in Greece. It is for people aged 18 and over only.
1. Who is responsible
The controller of your data is:
Meletios Peppas, trading as WildCrew
Geranion 28, Magoula, 19018, Greece
Email: support@wildcrew.eu
Write to this address for any question or request about your data.
2. What we collect
Account and sign-in
- Your email address and password, or, if you use Google sign-in, the name, email address and profile photo Google gives us. The Google photo is copied in as your WildCrew photo; you can replace or remove it.
- Your phone number, which you verify with a code sent by SMS.
Your profile
- Display name, gender, date of birth (to check you are 18 or over), bio, languages, Instagram username (optional), profile photo (optional) and interests.
- Your discovery area: a place name, its coordinates and a radius, which the app uses to show activities near you. If you tap "Use my current location", the coordinates come from your phone's location at city-level accuracy.
What you do in the app
- Activities you create: title, type, date and time, start and end places with coordinates, number of places, costs and notes.
- Your join requests and which activities you take part in.
- Messages you send in activity group chats, and which messages you have read.
- Your crew: crew requests and connections with other users.
- Safety: people you block, and reports you file (reason and details). If a message is deleted, a copy of its text is kept so a moderator can review a report about it.
Notifications
- If you allow notifications: a push token for your phone, its platform and device name, and a record of which notifications were sent.
From your phone, only with your permission
- Location, while the app is open, to show where you are on the map and to fill in your discovery area. We don't track your location in the background.
- Contacts, only when you use "Find friends". The app reads the phone numbers in your contacts (not names), turns each into a hash (a scrambled fingerprint) on your phone and uploads the hashes. We use them to tell you which of your contacts already use WildCrew.
- Photos, only the one picture you pick as your profile photo.
- Notifications, to alert you to chat messages and updates.
Our database provider and the services listed in section 6 also see technical data such as your IP address when your phone connects to them.
3. Who can see what
| Data | Who can see it |
|---|---|
| Display name, profile photo, bio, languages, gender, birth year (shown as an age), Instagram username, crew counts, join date | Every signed-in WildCrew user. The photo file is stored in a public bucket, so anyone who has its link can open it without signing in. |
| Activities: title, type, time, exact start and end places, notes, host | Every signed-in WildCrew user, including activities in the past. This is how discovery works. |
| Chat messages | The members of that activity's chat, and the host. |
| Crew requests and connections | The people involved. |
| Email, phone number, exact date of birth, discovery area, uploaded contact hashes, push tokens, blocks, reports you filed | You, and us as the controller. Not other users. |
4. Contact matching: what you should know
When you use "Find friends", hashes of the phone numbers in your contacts are stored on our server, linked to your account, until you delete your account or ask us to remove them. We compare them with the hashed phone numbers of WildCrew users.
A hash of a phone number is not anonymous. Phone numbers come from a small set of possible values, so a hash can be reversed by trying them all. Treat these hashes as personal data. They include numbers of people who are not WildCrew users and don't know about this. We plan to stop storing them and match transiently instead; this policy will be updated when that is done.
5. Why we use your data, and the legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, profile, activities, join requests and chats; sign-in and phone verification | Contract (Art. 6(1)(b)) |
| Check that you are 18 or over; keep the service safe: blocks, reports, bans, limits on abuse and spam | Our legitimate interest in a safe service and protecting users (Art. 6(1)(f)); legal obligations where they apply (Art. 6(1)(c)) |
| Show activities near you and your position on the map | Contract; your consent to location access (Art. 6(1)(a)), which you can withdraw in your phone settings |
| Find friends from your contacts | Your consent, given by allowing contacts access and tapping "Find friends" (Art. 6(1)(a)) |
| Push notifications | Your consent to notifications (Art. 6(1)(a)); contract for the messages you asked to receive |
| Answer your requests; handle legal claims | Legal obligation and our legitimate interest (Art. 6(1)(c), (f)) |
We don't use your data for advertising, we don't sell it, and nobody makes decisions about you by automated means that have legal or similarly significant effects. Bans are decided by a person.
6. Who receives your data
Other users see what section 3 says. We use these providers (processors) to run the app:
- Supabase: our database, sign-in, file storage and server functions. Our project runs in the EU (Frankfurt, Germany).
- Twilio: sends the SMS verification code, through Supabase. It receives your phone number and the code.
- Google: Google Sign-In if you use it (name, email, photo); Google Maps in the app (it receives technical data such as your IP address when maps load); Google Places for place search (it receives the text you type into place fields); Android's location services may use Google to turn your coordinates into a place name; Firebase Cloud Messaging to deliver push notifications.
- Expo: its push notification service, which relays notifications to Google's Firebase Cloud Messaging. It receives the push token and the notification content, which can include the sender's name and the start of a message.
We don't use analytics, crash reporting or advertising services. We may also disclose data to public authorities when the law requires it.
7. Transfers outside the EU
Google, Expo and Twilio are US companies, and Supabase is too, so some of your data can be processed in the United States. We rely on the safeguards the GDPR allows for such transfers, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, depending on the provider.
8. How long we keep it
- Account, profile, activities, join requests, messages, crew links, contact hashes, blocks and push tokens: while your account exists. When you ask us to delete the account, we delete them within 30 days (see how to delete your account).
- Reports, deleted-message copies and ban records: up to 12 months after the case is closed, then deleted, even if your account is deleted before that.
- Backups at our database provider roll off shortly after deletion.
- Emails you send us: as long as needed to handle your request, and for legal claims.
9. Your rights
You have the right to access your data, correct it, delete it, restrict or object to its use, receive it in a portable format, and withdraw consent at any time (without affecting what was done before). Email support@wildcrew.eu; we reply within one month. Some of this you can do yourself in the app, such as editing your profile and removing your photo.
You can complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα): dpa.gr. We would appreciate the chance to fix the problem first.
10. Age
WildCrew is for people aged 18 and over. We don't knowingly collect data from anyone younger. If we find that an account belongs to someone under 18, we delete it.
11. Security
Data travels over encrypted connections, and the database restricts who can read what. No system is completely secure, and we can't promise otherwise.
12. This website
This website sets no cookies, uses no analytics and loads nothing from other companies.
13. Changes
We will update this page when the app changes how it handles data, and change the date at the top. For significant changes we will also tell you in the app.