# ГоГулять Privacy Policy > DRAFT 2026-11-08-draft. LEGAL REVIEW REQUIRED. Based on the product specification; confirm implementation, legal bases, retention and providers before publication. Effective date: {{EFFECTIVE_DATE}}. ## 1. Data controller Controller: {{OPERATOR_FULL_NAME}}, an individual, country: {{OPERATOR_COUNTRY}}, address: {{OPERATOR_ADDRESS}}. Data requests and consent withdrawal: {{PRIVACY_EMAIL}}. Support: {{SUPPORT_EMAIL}}. This policy covers the ГоГулять app, web service and support requests. The initial release is intended for Russia. ## 2. Data and purposes | Category | Source and purpose | | --------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Nickname, catalogue avatar, colour and participant birth year | Participant or representative; profile, age restrictions and safety settings | | Adult or independent participant email and password hash | User; login, email confirmation and recovery. Managed children have no email or password | | Adult and representative-authority confirmation and child relationship | Representative and verification process; creating and managing accounts. An adult's registration birth year is not retained | | Language, time zone, preferences and parental controls | User, representative and device; interface, quiet hours and access control | | Sessions, in-service account and device identifiers, platform, app version, device name, push token or browser subscription | Connecting devices: authentication and access revocation. Push tokens/subscriptions are stored only after the user or guardian separately grants `push` before the system permission request | | Friendship, requests, blocks, walks, participation, reactions and statuses | User and representative actions; arrangements and access restrictions | | Place names, icons, map-cell centres and radii | Manual selection by a participant or representative; approximate meeting places | | Reports, optional report text, moderation outcomes and support messages | Reporter and moderation; safety, responses and investigations | | Document versions, acceptance and withdrawal records | User or representative actions; evidence of authorised purposes and rights handling | | Daily activity, platform and app version | Our server, only with separate consent for `analytics`; off by default, with a guardian deciding for a child | | IP address and connection details in proxy logs | Network requests; request delivery, security and diagnosis. Administrator access logs also contain their technical identifiers | Exact device location is used locally for map convenience and is not sent to our API. There is no background location tracking, photo/audio/video upload, address-book access, IDFA/AAID collection or third-party advertising tracking. Approximate places, nicknames, walk history, IP addresses and technical identifiers may still be personal data. Grid snapping and pseudonyms do not make them anonymous. Map requests may reveal IP and the viewed area to the map server, including an area around the position used to centre the map. Device location permission is optional; places can be selected manually. Nicknames and place names are checked for prohibited language, contacts (phone numbers, links and `@`) and reserved words. Rejected text is not stored. ## 3. Legal bases Necessary account operations support entering into and performing the agreement with the user or, where law permits, providing the agreed service for a child as beneficiary. Processing that requires consent uses a separate consent from the person or verified legal representative. Statutory duties and lawful authority requests rely on law. A separate lawful basis for security or protecting rights is used only where available, necessary and compatible with children's rights. The relevant consent specifies the data and purposes relying on it. This policy is a notice, not blanket consent. Daily statistics, advertising and other operations unnecessary for an account are not automatically contractual necessities. Their actual basis and necessity must be established before activation. ## 4. Access to information Profile and walk information are available within current friendships and the authorised audience. Other participants do not receive email addresses, birth years or passwords. Representatives access managed-child information according to role and control settings; other children's representatives receive only friend information permitted by parent mode. A participant unknown to a viewer may appear only in a count under visibility rules. A child's current guardian can view someone else's walk only if the child is in its authorised audience, has responded "going" or "maybe", has the "Parent can view walk history" setting enabled and can currently view that walk themselves. Access is limited to the time, duration, activities and walk creator. A place is shown only as a preset type (such as a yard or park), without its name or map point; a saved map place is shown as unavailable. Other participants, counts, reactions and the audience are not shown. The guardian cannot react or change participation in the walk. A private place is visible to its owner and representatives. Selecting it for an open walk gives that audience access within the walk. After closure, this access does not continue without another permission to the place. Screenshots cannot be recalled. Owner deletion of a place does not delete copies saved by others; moderator hiding of a place also hides its copies. Contact the controller about a saved copy containing your personal data. Moderators and technical providers have task-limited access. Official requests are checked, and necessary information is disclosed on a lawful basis. There is no public user directory. Permission for disclosure to defined recipients is not permission to publish information to an unlimited audience. ## 5. Providers and countries Depending on platform, Apple APNs, Google FCM or a browser push service receives a token/subscription and notification. Detailed display text can contain a friend's nickname, place name, time and activity. Technical push data contains no coordinates. Details can be disabled. SMTP receives an adult's or independent participant's email and service-message content. Hosting and backup providers process service data. Map servers receive map requests. Build providers must not receive the user database; any app requests to update services must be assessed separately. A push token is stored and used only while the separately granted `push` purpose is active. Withdrawal deletes tokens and prevents queued notifications from being sent. Device permission does not replace this consent. Actual providers, legal entities, countries, data categories and purposes: {{PROVIDERS_TABLE}} Collection of Russian citizens' data uses databases in Russia in accordance with localisation requirements. Foreign push, email, maps, support and storage are assessed separately: a Russian main server does not eliminate cross-border disclosures. Applicable legal bases, recipient assessment and Roskomnadzor notification requirements must be satisfied before transfers. User consent does not override statutory restrictions. Data is not sold or disclosed for cross-service behavioural advertising. Advertising is off at launch. If campaigns are enabled after a separate review, they will use language, platform and age category and may use a temporary per-account frequency counter. Aggregate impressions and clicks must not contain user profiles. Connecting advertising networks requires prior assessment and revised notices. ## 6. Retention and deletion The following are ordinary retention limits; a lawful earlier-deletion requirement takes priority. Data is also deleted when it is no longer needed. | Data | Ordinary period | | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | Profile, settings, relationships, places, blocks and consent records | Until account or relevant object deletion; current purpose states and the consent event journal are deleted with the account | | Domain event queue (`outbox_events`) | Identifiers and codes only; 7 days after processing, 30 days after failure; removed on user deletion | | Consent event journal (`consent_events`) and current purpose states | Actor, subject, action, version, purposes, language, method and time; no IP or text content. Deleted with the account | | Walks and participation | 30 days after completion or cancellation | | Inbox notifications | 30 days from creation | | Closed friendship requests | 90 days after resolution | | Expired or revoked sessions | Up to 30 days after expiry/revocation; live sessions until they end | | Previously used refresh-token hashes | Until original token expiry or session deletion; raw tokens are not retained | | Used/expired email tokens and expired representative invitations | Up to 7 days after use or expiry, as applicable | | Owner-role transfer requests between representatives | 90 days after closure, or earlier deletion of a party or the child | | Service markers for renewed-consent reminders | Until acceptance or deletion; 30 days after the series closes, or earlier end of the relevant representation | | Closed reports | Up to 1 year after closure; identifying profile information is cleared under account deletion rules | | Account-linked daily activity | Only with `analytics`, up to 13 months; withdrawal immediately stops recording and deletes the records; account deletion also removes them | | Administrator audit, including object-linked events | Up to 2 years; event identifiers are not automatically anonymous | | Application and proxy logs | Up to 14 days | | Temporary friendship/pairing codes and counters | Friendship QR up to 90 seconds; child device code up to 15 minutes; daily-activity and campaign-frequency counters up to 26 hours | | Backups | Rotation within 14 days of creating a copy | An ordinary deletion request immediately hides the account and revokes sessions. Permanent deletion from the live database follows a 7-day cancellation period. After a backup restore, deletions must be reapplied before normal service resumes. Earlier legally required cessation or destruction takes precedence over this waiting period and backup rotation. Support messages are retained until the issue is resolved. Any further restricted retention requires a specific lawful basis and a period explained to the requester. Legal obligations or a specific dispute may require limited retention; the response identifies the category, basis and duration. Data is not kept indefinitely just in case. Only irreversibly anonymous statistics may remain indefinitely; small groups and linkable identifiers are not automatically anonymous. ## 7. Your rights You may request processing and recipient information, access and a copy, correction, restriction/blocking or destruction where justified, withdraw consent and challenge processing. Representatives act for children with verified authority. Children's age and independent rights are considered; account pairing alone does not justify disclosure to someone without authority. Nickname and avatar can be corrected in the app. A guardian corrects a child’s birth year; an independent teen can change it only by deleting the account and registering again. Withdraw `push` and `analytics` in settings, or in “Child consents” for a child: processing for that purpose stops immediately and its data is deleted. Contact the controller without login if you cannot sign in. Contact {{PRIVACY_EMAIL}} or the controller's postal address. Do not send passwords, codes, a full passport copy or others' data. Account access and minimal checks are used first; extra verification is requested only where needed and permitted. Child JSON export is provided through parent mode; adults and independent participants can request their own information through support. [Deletion instructions](delete-account.md) are available without login. In Russia, processing information and access are provided on approach or within 10 working days of a request; a reasoned extension of up to 5 working days is permitted. Correction, cessation and destruction have their own statutory deadlines. Withdrawal ends consent-based processing, while another lawful basis may justify necessary retention. If necessary processing ends and an account can no longer operate, we explain why. You may complain to Roskomnadzor or a court. Where GDPR applies, its conditional rights, including restriction, objection, portability and complaint to a competent supervisory authority, remain available. Applicable US state rights also remain available. This preservation of rights does not announce a launch in those markets or replace required local notices. ## 8. Protection and changes We use role-based access, protected connections, password hashing, session revocation and administrator accountability. Measures reduce risk without guaranteeing absolute security. Authorities and affected persons are notified of incidents where and within the periods required by law. The current version is published at {{LEGAL_BASE_URL}}. New consent is obtained before changed purposes, data or recipients are used where required. Updating this policy does not itself create consent.