Privacy Policy
This Privacy Policy explains how Pfalzer Dániel egyéni vállalkozó (registered seat: 2049, Diósd Zöldfa utca 23., company reg. no.: 50850264, tax no.: HU67848973, "we", "us") processes personal data when you use the BitRaver mobile application, our website at bitraver.com, and related services (together, the "Service").
We are the data controller within the meaning of Regulation (EU) 2016/679 ("GDPR"). Contact for privacy matters: hello@bitraver.com.
1. What BitRaver does
BitRaver is a gamified step counter for electronic music events: while you are at a participating event and start a LIVE session, the app counts your steps, verifies you are inside the event area, and awards points you can spend on cosmetic avatar items and event coupons.
2. Data we collect
Account data — email address, password (stored only as a cryptographic hash by our authentication provider), username, optional display name, language preference.
Date of birth — collected at registration to verify you are at least 18. We store the date so the check can be re-applied server-side; we do not use it for anything else.
Profile & avatar — your avatar configuration (chosen base body and layers/items), optional profile photo you upload, points balance, lifetime points and lifetime steps, accessibility preferences.
Activity & fitness data — step counts measured by your phone's built-in pedometer only during LIVE sessions you start, session timestamps, awarded points. Step data comes from the operating system's motion sensor (on iOS, Core Motion). We do not read or write Apple HealthKit / Google Fit data.
Location data — precise location only while the app is in the foreground, and only: (a) when you start and run a LIVE session, to verify you are inside the event's geofence; (b) if you use the optional distance filter or distance sorting on the events list; and (c) for organizers using the venue test tool. We never track location in the background. Location fixes sent during LIVE sessions (coordinates, accuracy, timestamp) are stored server-side for anti-cheat validation.
Approximate area — if you leave the "new event near you" notification enabled, the app stores a coarse position rounded to roughly one kilometre, refreshed at most once a day and only while the app is open. It is used solely to decide which new events are within 50 km of you, and which events belong in your newsletter. It is deliberately too imprecise to identify an address, and it is deleted when you turn that notification off.
Content you create ("UGC") — chat messages (direct and crew messages), event message-board posts (organizers), reports you file about other users' content, uploaded images (profile photo; organizers: event banners).
Social data — friendships, crew memberships, event RSVPs (including the optional "looking for a crew" flag, which is visible to other users), invitations, referral relationships (who invited whom), users you have blocked.
Transactions in points — a ledger of points earned and spent (sessions, purchases of avatar items, coupon redemptions, referral bonuses, administrative adjustments). Points are a virtual reward with no monetary value; we process no payment card or bank data.
Communication preferences — your per-type push notification settings, and whether you have subscribed to the newsletter, together with the time that consent was given.
Device & technical data — push notification token (if you enable notifications), app language, timestamps and technical logs generated by our hosting provider (IP address in server logs), device model and OS version as transmitted by standard network requests.
Support data — messages you send to hello@bitraver.com.
We do not collect advertising identifiers, we show no ads, we use no third-party analytics or tracking SDKs, and we do not sell personal data.
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Providing the Service (account, sessions, points, coupons) | account, activity, transactions | (b) contract |
| Verifying the 18+ age requirement | date of birth | (c) legal obligation; (b) contract |
| Geofence verification & anti-cheat | location during LIVE, activity | (b) contract; (f) legitimate interest in preventing fraud |
| Social features (friends, crews, chat, leaderboards) | profile, social, UGC | (b) contract |
| Moderation & safety (reports, blocks, enforcement) | UGC, reports, account | (f) legitimate interest; legal obligation where applicable |
| Push notifications | push token, preferences | (a) consent (OS permission plus per-type settings; revocable any time) |
| "New event near you" notifications | approximate area, push token | (a) consent |
| Newsletter | email, approximate area, subscription record | (a) consent (separate opt-in; withdrawable any time) |
| Event reminders & organizer announcements | account, RSVPs, push token | (b) contract / (a) consent for push |
| Referral programme | referral relationships | (b) contract |
| Security, abuse prevention, rate limiting | technical data | (f) legitimate interest |
| Legal compliance | any of the above | (c) legal obligation |
4. Who can see what (in-app visibility)
Your username, display name, avatar and lifetime points are visible to other signed-in users (leaderboards, crew lists, profiles). Your profile photo is shown only where you choose it. Your "looking for a crew" RSVP is visible on the given event. Event organizers see aggregate statistics about their event (counts, totals, hourly attendance) — not your identity in those aggregates. Chat messages are visible only to their participants. Your date of birth and your approximate area are never shown to other users.
5. Processors and recipients
We use the following processors under data processing agreements:
- Supabase (database, authentication, storage, serverless functions) — hosting region: EU. Infrastructure provided by Amazon Web Services.
- Resend — delivery of account emails (registration, password reset) and the newsletter. Sending region: Ireland (EU).
- Expo (Expo Application Services) — delivery of push notifications.
- Apple Inc. — app distribution and OS-level push delivery (APNs).
- Tárhely.Eu Kft. +36 1 789-2-789 1097 Budapest, Könyves Kálmán körút 12-14. tarhely.eu — hosting of this website.
Organizer-entered venue addresses (not end-user personal data) are sent to Google Geocoding API or OpenStreetMap Nominatim to place the event pin. If an organizer imports a public Facebook event page, our server fetches that public page. We disclose personal data to authorities only where legally required.
6. International transfers
We host data in the EU. Where a processor transfers data outside the EEA (for example push delivery), the transfer is protected by the European Commission's Standard Contractual Clauses and/or an adequacy decision (such as the EU–US Data Privacy Framework where the recipient is certified).
7. Retention
- Account, profile, avatar, social data: for the life of your account.
- Date of birth: for the life of your account, as the record of the age check.
- Approximate area: until you turn off the nearby-event notification, when it is deleted.
- Newsletter subscription and its consent timestamp: until you unsubscribe, plus [e.g. 1 year] afterwards as proof that consent was given and withdrawn.
- Chat messages and message-board posts: until deleted by the author or moderation, or until account deletion.
- LIVE session records and points ledger: for the life of your account (needed for balance integrity and anti-cheat).
- Raw location heartbeats: up to [e.g. 90] days, then deleted or aggregated.
- Server logs: up to [e.g. 30] days.
- Reports and moderation records: up to [e.g. 1 year] after resolution, to enforce repeated-violation policies.
When you delete your account, personal data is deleted or irreversibly anonymised without undue delay, except where retention is required by law.
8. Your rights
Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time — push notifications and the newsletter each have their own switch in Profile → Push notifications, and every newsletter carries an unsubscribe link that works without signing in.
You can also export your data from inside the app: Profile → Privacy → Export my data.
Exercise your rights at hello@bitraver.com. We respond within one month.
You may lodge a complaint with your supervisory authority; in Hungary: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) — naih.hu, 1055 Budapest, Falk Miksa utca 9–11.
9. Deleting your account
You can delete your account inside the app: Profile → Delete account (password confirmation required). This removes your profile, avatar, social connections, messages and personal records as described in Section 7.
10. Children
The Service is intended for adults and is rated accordingly. You must be at least 18 years old to use BitRaver, and registration asks for your date of birth to enforce this. We do not knowingly process data of children; if you believe a child uses the Service, contact hello@bitraver.com and we will delete the account.
11. Security
Data is encrypted in transit (TLS). Access to production data is restricted; sensitive operations (points, purchases, moderation) run only on trusted server-side functions with row-level security enforced in the database. No method of storage is 100% secure; we notify affected users and authorities of breaches as required by GDPR Articles 33–34.
12. Automated decision-making
Anti-cheat rules automatically validate step and location data (for example rejecting impossible step rates or out-of-area sessions). This affects only in-app points, has no legal or similarly significant effect, and you may contest any outcome at hello@bitraver.com.
13. Changes
We will notify you of material changes in the app or by email before they take effect. The current version is always available at bitraver.com/privacy.
14. Contact
Pfalzer Dániel egyéni vállalkozó · Hungary, 2049 Diósd Zöldfa utca 23. · hello@bitraver.com