Privacy policy

Version 2026-10-03 · Takes effect on October 3, 2026

Draft — the operator's details marked [ ] are not filled in yet. Have this text reviewed by a lawyer before launch.

This privacy policy explains which personal data recappin processes, why, on what legal basis, who can see it, how long we keep it and which rights you have. It applies to everyone who uses recappin, including visitors who are not signed in. We have tried to write it in plain language, also for younger users. If anything is unclear, contact us at [privacy email address].

1. Who we are

Recappin is operated by recappin, [street and number, postal code, city, country], registered under [trade register and number, e.g. Chamber of Commerce (KvK) number] ("we", "us"). We are the controller of your personal data within the meaning of the General Data Protection Regulation (GDPR).

For any question about privacy or to exercise your rights, write to [privacy email address]. For anything else, write to [contact email address].

2. The short version

• We use your data to run your account and the features you choose to use. We do not sell your data, we show no advertising and we do not track you across other websites.
• You decide who sees each part of your profile. Sensitive fields are private by default, and the defaults for minors are never less strict than for adults.
• Health measurements are only recorded with explicit consent, and dating is switched off until you give explicit consent. You can withdraw consent at any time.
• Your data, including our backups, is stored in the European Union and encrypted. We use as few outside services as possible; they are listed in section 9.
• You can download a copy of your data and have your account erased at any time (section 13).
• Some things are visible to others in ways you should know about: people can see that you visited their profile or saw their posts (section 6), a supervising guardian can read a minor's private messages (section 7), and administrators with a special permission can read private messages (section 8).

3. Which data we process

Account data. When you register: your username, email address, first and last name, gender, date of birth, country and password. We store your password only as a one-way, salted hash (Argon2id); nobody, including us, can read it. When you choose a password (at registration, when you change it or when you reset it), we check it against Have I Been Pwned's list of passwords exposed in data breaches. Only the first five characters of the password's SHA-1 hash are sent to its Pwned Passwords service (a method called k-anonymity); the password itself never leaves our servers, and the service cannot tell which password, or whose, was checked. A password on that list is refused. We keep a history of the email addresses linked to your account. We also record which version of the terms you accepted and which version of this policy you confirmed you read, and when.

Profile data you choose to add. For example a display name, profile photo and background image, bio, headline, a self-described gender, how much of your date of birth is shown, your time zone, relationship status and partner (with the dates of your relationship stages, such as since when you are engaged or married), sexual orientation, interests and sports, contact details (address, phone numbers, contact email addresses, websites and social links), work experience, education and skills. All of this is optional.

Content you create. Posts, replies, reactions, poll votes, shares, mentions, #tags, linked videos, photo albums, agenda items and your responses, invitations, co-hosting and attendance for them, organizations and their pages, the audience groups you create, the pages and organizations you follow, and the terms you suggest for the interest and sports catalog. We keep the earlier versions of a post you edit.

Messages. The content of your private, group and organization conversations (including formatting, #tags and linked videos), the images you send, your messaging preferences, and technical details such as when a message was sent, edited and read.

Social connections. Your friends, friend requests, followers and the people you follow, family and professional connections, the people you blocked or muted, and your organization memberships, roles and divisions.

Health and training data. Your training log: training sessions with their sport, date, duration, distance, elevation, speed, power, calories and private notes, plus your goals and training zones. Health data is only recorded with explicit consent: body and physiological measurements (weight, height, body fat percentage, resting and maximum heart rate, functional threshold power, threshold speed) and the heart rate and perceived exertion of a training session.

Dating data (only if you switch it on). Your dating card (gender, who you want to see, countries, age range, bio, photos), the people you are interested in or passed on, and your matches.

Usage data. For every account we measure online time per day: active time, number of visits, the longest visit and the first and last time you were active. For supervised minors we also record screen time and requests for extra time. For every session we also record the approximate country of the internet address you signed in from, looked up in our own copy of the regional internet registries' public data: your address is never sent to anyone to be looked up. If you sign in from a country that is new to your account, we let you know.

Insights data. When you are signed in and view another user's profile or an organization's page, or a post appears on your screen, we record that visit or view (see section 6).

Notifications. The notifications we show you and your notification preferences.

Security and technical data. IP address, browser and device type (user agent), session times, login attempts, one-time login codes and trusted browsers. Every request to our servers is logged with the route, the result, the time it took, your user ID, IP address and user agent, but never the content you send. Our web server also logs the address of each page requested (which can include search terms), the page you came from and your browser type. Important actions on your account (such as logging in, changing your password or changing privacy settings) are recorded in an activity log, together with the IP address and user agent.

Guardian data. If you are a minor, the username of your guardian, and the guardian's decisions. If you are a guardian, the links to the children you supervise (kept, marked as ended, if you withdraw your consent) and the settings you choose for them.

Moderation data. Reports you file or that are filed about you, the evidence attached, requests for more information and your answers, notes by our moderators, the decisions taken, and appeals. If you administer an organization: reports about it, the measures we took against it and objections filed on its behalf. If a photo you uploaded matched known child sexual abuse material: a record of that match (where and when, a checksum of the file and the reference of the check), never the photo itself or its PhotoDNA fingerprint.

Data requests and consents. Your requests to access, export or erase your data, and each consent you gave or withdrew, with the version of the text you consented to.

We receive most of this data from you. Some comes from other users: for example when someone mentions you, adds you to a group conversation, invites you to an event or organization, reports you or an organization you administer, or, as your guardian, approves your registration.

Every photo you upload is stripped of hidden metadata, such as the location where it was taken, before it is stored: JPEG and PNG photos are decoded and saved again, and GIF and WebP images have their metadata removed. We never keep the original file. Before that, every file you upload is checked automatically, while you wait, and only stored if it passes: for malicious software, by a scanner (ClamAV) that runs on our own servers, so the file is not sent anywhere for it; and, once we switch that check on, for photos also against the lists of known child sexual abuse material, using Microsoft's PhotoDNA technology (see section 9). Until that check is switched on, photos are checked for malicious software only and nothing is sent to Microsoft. When it is on, the photo is converted on our own servers into a digital fingerprint (hash); only that fingerprint, not the photo, your name or account details, is sent to Microsoft, which compares it with the fingerprints of material that is already known and tells us only whether it matches. The photo itself never leaves our servers for this check, and PhotoDNA does not judge your photos in any other way. A file that fails either check is refused and not stored. If a photo matches known child sexual abuse material, we refuse it without storing it, suspend the account straight away, and a member of our staff reviews the case; we keep a record of the match (not the photo) and may report it to the competent authorities as the law requires. If a check cannot be completed, the upload is refused and you can try again later.

4. Why we process your data and on what legal basis

To provide the service you signed up for (performance of a contract, Article 6(1)(b) GDPR): creating and running your account, showing your profile and content to the audiences you choose, connections, messaging, organizations, the agenda, your training log, notifications, the insights pages, data export, and the emails we send you to log in, verify your email address and reset your password.

To keep the platform safe and to prevent abuse (legitimate interest, Article 6(1)(f) GDPR): protecting accounts against break-ins, rate limits, request and activity logs, backups, handling reports and appeals, investigating abuse, enforcing these rules and preventing banned users from returning. Our interest is a safe and reliable service for all users; we keep this data to the minimum needed and limit who can access it. This includes checking every upload for malicious software and, once that check is switched on, for known child sexual abuse material (section 3): there our interest is also the protection of children, and where the law obliges us to detect or report such material, we rely on that legal obligation (Article 6(1)(c) GDPR).

Online-time measurement (legitimate interest, Article 6(1)(f) GDPR): to show you your own usage, to let a guardian supervise a minor, and to detect misuse. Nobody except you, a supervising guardian and authorised staff can see it.

Profile visitors and post views (legitimate interest, Article 6(1)(f) GDPR): to show users and organizations who visited their page or saw their posts. Minors are never named in these lists, and the detailed records are deleted after 90 days.

Special categories of data — only with your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR):

• Health data: we ask for your explicit consent the first time you open the performance section. Without it, no health measurements are stored, but you can still keep your training log. For a supervised minor, the guardian's permission takes the place of the minor's own consent while supervision lasts.
• Dating: we ask for your explicit consent before your dating card is switched on, because using dating reveals which genders you are interested in, which can say something about your sexual orientation.
• Sexual orientation on your profile: this field is optional and set to "not specified" and "only me" by default. If you fill it in, you consent to us storing it, showing it to the audience you choose and, if you use dating, using it as the starting point for who you want to see. You withdraw this consent by removing it, which you can do at any time.

Marketing emails (consent, Article 6(1)(a) GDPR): only if you opt in. We currently send none.

Legal obligations (Article 6(1)(c) GDPR): keeping records of consents and terms acceptances, handling data requests, responding to orders from authorities, and our duties under the EU Digital Services Act.

Legal claims (legitimate interest, Article 6(1)(f) and Article 9(2)(f) GDPR): keeping moderation records and evidence when this is necessary to establish, exercise or defend legal claims.

Where we rely on our legitimate interest, you have the right to object (section 13). Where we rely on consent, you can withdraw it at any time with effect for the future; this does not make the earlier processing unlawful.

Apart from the one case described here, which applies only once the check against known child sexual abuse material in section 3 is switched on, we do not use automated decision-making that has legal or similarly significant effects on you within the meaning of Article 22 GDPR. If a photo you upload matches known child sexual abuse material (section 3), your account is suspended automatically and at once, to protect children; a member of our staff then reviews that decision, you can give your point of view and appeal it, and the suspension is lifted if the match turns out to be wrong. All other moderation decisions are made by people; when a moderator decides, related reports about the same content, account or organization are closed along with that decision, and their reporters are told so. Matching on the dating feature only follows the preferences you and other users set.

5. Who can see your data

Other users. For each part of your profile and for your content, you choose the audience: everyone, friends, family, professional connections, only you, or groups you create yourself. Your username can always be seen. Blocking someone hides you from them completely. Until you change them, the following defaults apply:

• Adults: name, photo, bio, headline, interests, sports, skills, work and education, organization memberships, posts, albums and training sessions are public; gender, birthday, relationship status, the town you live in, websites and social links, your friend, follower and following lists, your agenda and agenda items are visible to friends; your list of professional connections is visible to your professional connections; sexual orientation, address, phone numbers and contact email addresses are only visible to you.
• Minors: nothing is public by default. Name, photo, bio, headline, interests, sports, skills, organization memberships, posts, albums, training sessions, agenda items and all connection lists are visible to friends; gender, birthday, relationship status, address and town, phone numbers, contact email addresses, websites and social links, work, education, sexual orientation and the agenda as a whole are only visible to you.
• Health measurements, goals and zones are always only visible to you; this cannot be changed. Training sessions have their own visibility setting, but others never see their heart rate, perceived exertion or private notes.

Organizations. Administrators of an organization you join can see your membership, the role and divisions you have in it, and what you share in the organization. They cannot see your health data or your private messages. By default, the members of an organization can see its member list. Members of a division can read its conversation, including messages sent before they joined; division leads and members with the right permission can delete messages in it, which is recorded in the organization's activity history. Reports about an organization, and who filed them, are never shown to its members or administrators. If we take a measure against an organization, its administrators receive the statement of reasons and can object on its behalf; our staff can see which administrator filed the objection.

Agenda items. Hosts of an agenda item can see who responded and who attended. Unless the host limits it, anyone who can see the item can also see who is going or might go, and your friends may see that you are going to an event they can see.

Message participants. In direct and group conversations, the people in it see your messages and when you last read the conversation. In an organization's division conversation, they see your messages and only how many people have read a message, not who.

6. Profile visitors and post views

When you are signed in and open another user's profile or an organization's page, the owner (and, for an organization, members with the right permission) can see that you visited: your name, photo, username and the time. When one of their posts appears on your screen, they can see that you viewed it. There is currently no way to visit or view anonymously while signed in. Minors always appear as "Someone", also after they come of age, and users you blocked or who blocked you and accounts that are no longer active never appear. Visits to an organization's page by people who are not signed in are only counted, never named. The detailed records are deleted 90 days after the visit or the last view; only anonymous counts per hour are kept.

The owner also sees a map of where visitors come from, as counts only: the approximate country of each visit, and the city in your address if you share it with anyone but yourself. Minors only ever count toward a country. A country or city is only named once at least five new visitors came from it in the chosen period; smaller groups are folded together. The map never shows who came from where, but on a page with very few visitors the owner might work it out by comparing days. Set the city in your address to "Only me" to keep it off these maps.

7. Minors and guardians

You must be at least 13 years old to use recappin. If you are younger than 16 (or the age set by the law of your country), a guardian of at least 18 years old with their own recappin account must approve your registration within 7 days; otherwise the registration lapses.

While supervision is active, your guardian can:

• see the activity history on your account, your online time and your screen time;
• read your private conversations, including pending message requests (read-only), and is told when someone you are not connected with sends you a message request. You and the people you chat with are told that a guardian can read along;
• choose who may message you, set your daily screen time and decide on your requests for extra time;
• allow or stop the recording of your health measurements, without being able to see them;
• consent to you being added to a division of an organization;
• receive copies of important notices about your account (safety and security, moderation, and invitations to agenda items).

Supervision ends automatically when you reach the age at which no guardian consent is needed. Your guardian can withdraw their consent at any time, without giving a reason. If you still need a guardian's consent, your account is then suspended — not deleted — and you are signed out everywhere. You cannot use it until another guardian you name approves it, or until you reach the age at which no consent is needed, whichever comes first. Everything your guardian could see or set ends at that moment. The withdrawal is recorded in your activity history and you are notified. When your guardian opens your activity history or reads one of your conversations, this is recorded in your own activity history. Dating is only available from 18.

8. Access by our staff

Moderators and administrators only have the permissions they need for their task. Reading private messages and opening a user's full content is always logged.

• Moderators handling a report see the evidence attached to that report, such as the reported profile, post or organization page, or up to 20 messages selected by the person reporting. Every reported message they open is logged. They have no general access to your messages.
• Administrators with a separate, specific permission can see all of a user's content, read-only: including private messages and pending message requests, posts that were hidden or removed, and earlier profile photos. We use this to investigate abuse, including content nobody has reported, and to answer lawful requests. Each part of your content and each conversation they open is logged; you are not notified of individual reads.
• Administrators who manage accounts can see your account and profile details regardless of your visibility settings, your sessions (with IP address and browser), your online time, and your moderation and data-request history. Administrators with the right permission can also see the activity log and the request log.
• Staff cannot log in as you, and they cannot see your password. They only see the people you expressed interest in on the dating feature when that is part of reported content.

Your messages are encrypted in transit and stored encrypted, but they are not end-to-end encrypted: our systems can decrypt them to show them to the participants and for the access described above.

9. Service providers and other recipients

We do not sell or rent your data and we do not share it with advertisers. We share it only with:

• [name of the hosting provider], which hosts our servers in [data centre location, e.g. Amsterdam, the Netherlands]. Our database and all photos are stored there.
• [name of the offsite backup storage provider], which stores our backups in [backup storage location, must be in the EEA, e.g. Falkenstein, Germany]. Backups are encrypted before they leave our servers, so the provider cannot read them.
• [name of the email delivery (SMTP) provider], which delivers our emails (your login code, and the links to verify your email address, reset your password or, while your registration awaits a guardian's approval, cancel it).
• Microsoft Corporation, once our check against known child sexual abuse material is switched on (section 3): its PhotoDNA Cloud Service then checks every photo you upload. Until then, nothing is sent to Microsoft. The photo is converted on our own servers into a digital fingerprint (hash) using Microsoft's PhotoDNA technology; only that fingerprint, not the photo, your name or account details, is sent to Microsoft, which tells us only whether it matches known material. We use it to protect children, based on our legitimate interest and, where the law requires it, our legal obligations (section 4). Microsoft may process the fingerprint in the United States (section 10).
• YouTube (Google), Vimeo and Spotify, if you play a video or audio clip embedded in a post, message or agenda item. The player only loads after you click play; from that moment the provider receives your IP address and can set its own cookies under its own privacy policy. YouTube videos are played in privacy-enhanced mode (youtube-nocookie.com) and Vimeo with "do not track". Before that, our server fetches the title and preview image on your behalf, so the provider does not learn who you are.
• Authorities, courts or other parties when we are legally required to, or when it is necessary to protect the rights, safety or property of our users or others.
• A buyer or successor, if recappin is transferred to another company; you will be informed beforehand.

Our service providers process data only on our instructions under a data processing agreement (Article 28 GDPR).

10. Transfers outside the European Economic Area

We store your data, including backups, in the European Economic Area. A transfer outside it only happens when you play an embedded YouTube, Vimeo or Spotify item, and, once that check is switched on, when Microsoft's PhotoDNA service checks the fingerprint of a photo you upload (section 9; the photo itself stays on our servers); these providers may process data in the United States. Where they are certified under the EU-U.S. Data Privacy Framework, the transfer relies on the European Commission's adequacy decision; otherwise it relies on the standard contractual clauses these providers use.

11. How long we keep your data

• Account and profile data: as long as your account exists. Deactivating your account hides it but deletes nothing; erasure is described in section 13.
• Posts, messages and other content: until you delete them or your account is erased. A deleted post or message is no longer shown; its content is purged when your account is erased. A conversation that nobody can open any more, because everyone in it has left or declined or their accounts have been erased, is deleted 90 days after the last person left.
• Health data, training log and dating data: until you delete it or your account is erased.
• Sessions: up to 30 days after they expire. One-time login codes: up to one hour after they expire. Trusted browsers: 30 days.
• Request logs with IP address and user agent: 30 days. Web server error and access logs: 30 days.
• The IP address you registered from: 90 days. A registration that is never completed, or that a guardian does not approve, expires; 90 days later its personal data is deleted.
• Online time and screen time: 90 days. Requests for extra screen time: until your account is erased.
• Named profile visits and post views: 90 days; anonymous hourly counts are kept without a time limit, because they cannot be linked to anyone.
• Notifications: 90 days after you read them, or one year if you never do.
• Activity log: 2 years; entries about moderation: 5 years. If your account is erased sooner, the entries stay until then, linked to an anonymous number instead of your profile. They keep the IP address, user agent and details recorded at the time; for entries not about moderation, the personal values that were changed are removed.
• Moderation records (reports, evidence, information requests, notes, decisions and appeals): 5 years after the last step in the case, which is the period in which a legal claim can be brought under Dutch law. Never shorter while a report or appeal in that case is still open, or while a suspension or ban from it is still in force. They are kept through an erasure.
• Your username and email address after erasure: kept internally for 5 years, and for as long as a moderation case about the account is kept, so they cannot be confused with past records and banned users cannot return under them; never shown. After that they are deleted and may be used again.
• Consent records, terms acceptances and data requests: as long as your account exists, and 5 years after it is erased, as proof that we complied with the law.
• Data exports: never stored; the download link expires after 7 days.
• Backups: 35 days. Data that was deleted or erased stays in the backups until they expire, and is not used in the meantime. Each backup also keeps a short list of recent erasures (account number and dates only), so that if we ever have to restore a backup, we can repeat those erasures before recappin reopens.
• The approximate country of a session: as long as the session record (until 30 days after it ends). Visit counts by country and city name nobody and are kept until the page's owner erases their account.

12. Security

We protect your data with technical and organizational measures, including encrypted connections (TLS) for all traffic; encryption of all stored data, with additional encryption of messages, health data, contact details, date of birth, sexual orientation, moderation records and all uploaded photos; encrypted backups; password hashing with Argon2id; refusing passwords known from data breaches, checked without the password leaving our servers; scanning every uploaded file for malicious software, on our own servers, before it is stored; a one-time code sent by email when you log in from a browser you have not trusted; protection against repeated login attempts; strict access permissions for staff, with logging of access to private messages and to a user's full content; rate limits; removal of metadata from photos; and a strict content security policy in the browser. No system is perfectly secure. If a data breach is likely to put your rights at risk, we will notify the supervisory authority within 72 hours and inform you without undue delay where the law requires it.

13. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy (Article 15);
• correct inaccurate data (Article 16). You can edit most data yourself; your date of birth can only be corrected by us, with proof;
• have your data erased (Article 17);
• restrict processing (Article 18);
• data portability: receive your data in a structured, machine-readable format (Article 20);
• object to processing based on our legitimate interest (Article 21);
• withdraw any consent at any time, with effect for the future (Article 7(3)).

You can download your data and request erasure in your account settings, or on the data request page, which also works if your account is suspended or banned, or if you have not accepted new terms. For security we ask you to confirm your password first. The download contains all the personal data we hold about you, except security material such as your password hash, login codes and tokens, our technical request logs, and records we may not disclose because that would affect other people's rights or the investigation of crimes (for example reports others filed about you). For all other requests, such as correction, restriction or objection, write to [privacy email address].

How erasure works: we first prepare an export of your data for you. Thirty days after you open it, your account is erased; until then you can cancel. After erasure, your profile is gone and your posts and messages are replaced by a notice that the content has been removed. Only the records listed in section 11 are kept, for the periods stated there; they are linked to an anonymous number instead of your profile, but some of them, such as your username and email address, consent records and moderation cases, can still be traced back to you. Erased data disappears from our backups when they expire, within 35 days. If you only want to take a break, you can deactivate your account instead; logging in again reactivates it.

We respond within one month. If a request is complex, we may extend this by two more months; we will tell you within the first month. Exercising your rights is free.

You also have the right to lodge a complaint with a data protection authority, in particular in the EU country where you live or work or where the alleged infringement took place. Our lead authority is [lead data protection authority, e.g. Autoriteit Persoonsgegevens]. We would appreciate the chance to resolve your concern first.

14. Cookies and local storage

Recappin uses only cookies that are necessary for the service or that remember choices you made yourself. We use no advertising, analytics or tracking cookies, so we do not ask for cookie consent.

• access_token and refresh_token: keep you signed in (10 minutes and up to 24 hours).
• login_challenge: links your login to the code we emailed you (10 minutes).
• trusted_device: remembers that you chose to trust this browser, so you are not asked for a login code for 30 days. It remains after you log out.
• XSRF-TOKEN: protects against cross-site request forgery (up to 24 hours).
• NEXT_LOCALE, theme and sidebar_collapsed: remember your language, light or dark theme and sidebar preference (one year).

We also keep one setting in your browser's local storage, which remembers that you dismissed the suggestion to follow people. Fonts and emoji are served from our own servers, so loading a page does not contact Google or any other third party.

15. Changes to this policy

When we change this policy, we publish the new version with a new version number, and you will be asked to read the new version before you can continue using recappin. Earlier confirmations remain on record.