Privacy Policy — Wasssup
Last updated: October 9, 2026
1. Who we are
Wasssup is a mobile application that displays a map of public events happening in Montreal (and, eventually, other cities), aggregated from publicly available data sources. You can reach us about anything in this policy at [email protected] — see Contact at the end for who is responsible.
2. What this policy covers
This policy explains what data Wasssup collects, why we collect it, who we share it with, and what choices you have. It applies to anyone who uses the app or visits our website.
3. Data we collect
3a. Data you give us directly (v1)
- None required. Wasssup v1 does not require account creation. You can browse the map and save events without giving us any personal information.
- Saved events ("Going" list): Stored locally on your device. If you reinstall, we cannot restore this list.
- Reports & suggestions you send us: You can send us a comment (e.g. wrong info, a scam, a cancelled event, or a suggestion) and optionally attach one or more photos. Reports are anonymous — we do not ask for your name or email. Before any photo leaves your device it is automatically compressed and its location/EXIF metadata is removed. Reports are emailed to the developer, reviewed by us, used only to fix and improve the app, never shown to other users, and deleted on request.
- Launch list (website only): If you type your email on wasssup.app and tick the consent box, we store that address (with the date, your language, your country and the consent wording you accepted) only to send you a short thank-you email right away, and then ONE email from B&B Multimedia when the app is released, to confirm the launch. There is no marketing. The address is stored with Cloudflare and both emails are sent through Resend; they say who we are and how to unsubscribe. You can withdraw your consent or ask us to delete your address at any time: [email protected].
- Beta-test list (website only, when open): If you enter your email to join the beta-test list, we store it (with the date, your language and your country) only to send you the test link. It is stored with Cloudflare. To be removed, email [email protected].
- Protection of the sign-up form: to stop bots, we keep a scrambled copy (hash) of your IP address for up to 1 hour, only to limit repeated sign-ups. It is deleted automatically.
3b. Data we collect automatically
- Website visits: wasssup.app uses Cloudflare Web Analytics to count visits in aggregate (pages viewed, approximate country, browser and device type). We do not use it for advertising or to identify you, and we do not link it to your email address.
- Location data — only if you grant location permission. Used to:
- Determine your current city.
- Show events near you.
- Power the "near me" filter.
Your location is processed on your device to centre the map and sort events by distance. It is not sent to our servers and we do not store it.
- Event reminders — if you grant notification permission, reminders for events you save are scheduled locally on your device. We do not collect a push token and do not send notifications from our servers in v1.
Wasssup v1 contains no analytics or tracking SDKs — we do not collect usage analytics, advertising identifiers, or a device identifier.
3c. Data we do NOT collect (v1)
- We do not collect your name, email, phone number, or photo unless you submit a report with a photo or join our launch or beta list on the website.
- We do not have user accounts, logins, or social profiles in v1.
- We do not access your contacts or microphone. We access your calendar only when you tap "add to calendar" on an event, and your camera or photo library only when you choose to take or attach a photo for a report — in those cases the data stays between your device and the app/your calendar.
4. Why we collect it
| Purpose | Data used |
|---|
| Show you nearby events | Location (on-device only) |
| Remind you about saved events | Saved events list (on-device) + local notifications |
| Read and respond to your reports | Report comment + any photo you choose to attach |
We do not use your data for advertising, profiling, or sale to third parties.
5. Who we share data with
- Service providers we use to operate the app:
- Cloudflare — hosts our backend (event data) and proxies the app's requests.
- Google (Google Maps SDK) — renders the map. Your IP address and request metadata are visible to Google when map tiles are requested.
- Open-Meteo — provides the weather forecast shown on weather-sensitive events; it receives the event's coordinates (never your device location).
- Resend and Google (Gmail) — deliver and receive the reports you choose to send us, so we can read and act on them. Resend also delivers our thank-you email and the one launch email to people who joined the launch list.
- Apple and Google Play — distribute the app and provide basic crash reporting through their standard developer tools.
- Public authorities — if required by law (court order, subpoena, etc.) we will comply, and we will inform you when legally permitted.
We do not sell your data. We do not share data with advertisers. Wasssup contains no third-party advertising SDKs in v1.
6. Where your data lives
Our event data is served from Cloudflare's global network. Reports you send us, and our thank-you and launch emails, are delivered by Resend and stored in our email inbox (Google), which may process them in the United States. When data crosses borders, we rely on providers that offer recognised contractual protections (such as Standard Contractual Clauses).
If you are located in Quebec, we make reasonable efforts to keep your personal data within Canada whenever feasible. The website's launch and beta lists are stored on Cloudflare's global network, so they may be processed outside Canada, including in the United States.
7. How long we keep data
- Saved events — on your device until you remove the app or unsave the event.
- Reports — automatically deleted within 3 months (sooner once resolved), and on request at any time (see §8).
- Launch list — kept until we send the one launch email, then deleted within 30 days (or earlier if you ask).
- Beta-test list — kept until the beta ends, then deleted within 30 days.
8. Your rights
Depending on where you live, you may have the right to:
- Access — request a copy of the personal data we hold about you.
- Correct — ask us to correct inaccurate data.
- Delete — ask us to delete your data. (For v1, this applies to reports you've submitted and to your email address on our launch or beta list; most other data is anonymous.)
- Portability — request data in a transferable format.
To exercise these rights, email [email protected] with the subject line "Data Request". We respond within 30 days.
For Quebec residents, you also have the right to know how an automated decision affecting you was made, and to request human review. Wasssup v1 does not make automated decisions about individual users — all moderation actions are reviewed by humans.
9. Children
Wasssup is not intended for children under 13 (or 14 for Quebec residents). We do not knowingly collect data from children. If you believe a child has used the app, contact [email protected] and we will remove their data.
10. Security
We use industry-standard security measures: HTTPS for all traffic, encrypted databases, access controls, and regular security review. No system is perfectly secure — if a data breach affects you, we will notify you and the relevant authorities as required by law (within 72 hours where applicable).
11. Changes to this policy
We may update this policy. Material changes will be announced in the app and on wasssup.app/privacy. The "Last updated" date at the top reflects the most recent change. Continued use of the app after changes means you accept the updated policy.
12. Contact
Wasssup is operated by B&B Multimedia (Montréal, Québec). For matters covered by Quebec's Act respecting the protection of personal information in the private sector (Law 25), the person responsible for the protection of personal information is the owner of B&B Multimedia, reachable at the address below.
Appendix: App Store Privacy Disclosures
This appendix maps our practices to the disclosures required by Apple's App Privacy labels and Google Play's Data Safety form.
Apple App Privacy labels
- Data linked to user: None (no accounts in v1).
- Data not linked to user:
- User Content — photos and the text of reports you choose to send us (optional)
- Data used to track you: None.
- Data collected for third-party advertising: None.
- Your location is used only on your device and is not collected.
Google Play Data Safety
- Data collected (optional):
- Photos — images you choose to attach to a report
- Other user-generated content — the text of your report
- Location: used on-device only; not collected.
- Data shared with third parties: None for advertising; reports are handled only by the service providers in §5 to deliver them to us.
- Data is encrypted in transit: Yes.
- Users can request data deletion: Yes, by emailing [email protected].
Privacy Manifest (Apple PrivacyInfo.xcprivacy summary)
NSPrivacyAccessedAPITypes — declarations for each protected API used (file timestamps, system boot time, disk space, user defaults — populated at implementation time).NSPrivacyTracking — false (no tracking SDKs).NSPrivacyCollectedDataTypes — match the Apple App Privacy disclosures above.