Privacy Policy
Who we are
Unspace ("the app", "we", "us") is published by Zintex OÜ, a company registered in Estonia. Under the EU General Data Protection Regulation (GDPR), Zintex OÜ is the data controller for personal data processed through the app.
Privacy questions: unspaceapp@gmail.com.
What we collect
All of the data below is linked to your account.
- Account data — email address, username, display name, date of birth, password (stored hashed, never in plain text)
- Profile data — avatar, bio, themes, fonts, stickers, profile music, widgets, badges, follows and followers
- Content you publish — posts, Diary entries, comments, wall messages, photos, videos, voice notes and reactions
- Messages — direct and group messages you send, their attachments and read state
- Push token — the device token Apple or Google issues if you allow notifications
- Subscription data — an anonymised subscriber ID and purchase history for Unspace Premium
- Technical data — IP address, device model, OS and app version, and server request logs
- Safety data — reports you file, accounts you block, and moderation actions on your account
- Advertising and attribution identifiers — your device advertising identifier and install information, used to show ads and to measure which campaign brought you to Unspace (see below)
We do not collect precise location, health data, your phone contacts, or your browsing outside the app. We do not ask you for payment card details — purchases are handled entirely by Apple on iOS and by Google Play on Android.
Why we process it, and on what legal basis
- To create and run your account, show your profile and deliver your posts and messages — performance of our contract with you (GDPR Art. 6(1)(b))
- To send push notifications about activity involving you — your consent (Art. 6(1)(a)), which you can withdraw at any time in your device settings
- To process Unspace Premium — performance of contract (Art. 6(1)(b))
- To detect and act on abuse, spam, ban evasion and illegal content — our legitimate interest in keeping the platform safe (Art. 6(1)(f))
- To fix crashes and keep the service working — legitimate interest (Art. 6(1)(f))
- To answer legal requests and takedown notices — legal obligation (Art. 6(1)(c))
- To show advertising in the free version and to measure where new users come from — your consent where it is required, otherwise our legitimate interest in funding a free service (see “Advertising and attribution” below)
Who else processes your data
We use the following providers, each acting as our processor under GDPR Art. 28:
- Supabase — authentication, database and file storage. Data is hosted in the European Union.
- Cloudflare R2 — storage and delivery of photos, videos and other media you upload.
- RevenueCat — management of Unspace Premium subscriptions (United States).
- Apple — app distribution, In-App Purchase and push notification delivery on iOS.
- Google Play — app distribution and, through Google Play Billing, payment processing on Android.
- Firebase Cloud Messaging (Google) — push notification delivery on Android.
- Google (AdMob) — serving advertisements in the free version of the app.
- AppsFlyer — measuring which campaign or link brought a new user to Unspace.
- OpenAI — automated safety screening of images before they are stored (United States).
We do not sell your personal data, and we do not share it with data brokers. Where a provider processes data outside the EU/EEA, the transfer is covered by the European Commission’s Standard Contractual Clauses.
Automated safety screening of images
Every image uploaded to Unspace — profile picture, cover, post photo, image sent in a chat, custom sticker — is checked automatically before it is stored. To do that the image is sent to OpenAI’s moderation service, which returns a machine assessment of whether it contains sexual, violent or otherwise prohibited material. Sexual content involving minors is refused at the lowest threshold available to us.
Only the image itself is sent. Your name, username, email address and the text around the image are not. OpenAI processes the image to produce that assessment and does not use it to train its models. See OpenAI’s privacy policy.
This screening is how we keep the app usable for the people on it, and for a service open to teenagers it is not optional. The legal basis is our legitimate interest in the safety of our users and in complying with the obligations that platforms carry for user-generated content (GDPR Art. 6(1)(f)), and, for the child-safety part of it, compliance with legal obligation (Art. 6(1)(c)). An image that is refused is not stored; a decision can be disputed by writing to unspaceapp@gmail.com, and a person will look at it.
Advertising and attribution
Unspace is free to use, and the free version is partly paid for by advertising. Two services are involved, and both work with device-level identifiers rather than with your posts, messages or profile:
- Google AdMob shows the ads. To do that it may process your advertising identifier, IP address, device and app information, and how you interacted with an ad. See Google’s privacy information for partners.
- AppsFlyer tells us which campaign, link or referral an install came from, so that we know where to spend and where not to. It processes device and install information and a pseudonymous identifier. See AppsFlyer’s privacy policy.
Your choice. On iOS, tracking across apps and websites only happens if you allow it when the app asks. You can change your answer at any time in iOS Settings → Privacy & Security → Tracking. On Android, you control this through Settings → Privacy → Ads, where you can delete or reset your advertising ID. If you say no, Unspace still works and you will still see ads — they are simply less relevant, and are not linked to you across other apps.
Unspace Premium removes advertising. While a subscription is active, no ads are shown to you.
Advertising and attribution rest on your consent where consent is required (GDPR Art. 6(1)(a) and Apple’s App Tracking Transparency on iOS, and the Android advertising ID controls on Android), and otherwise on our legitimate interest in funding and growing a free service (Art. 6(1)(f)). We never use the content of your posts, Diary entries or messages to target advertising.
How long we keep it
- Account, profile, posts and messages — until you delete your account.
- Server logs — up to 30 days, then deleted.
- Reports and moderation records — at least one year after the account is closed, so that repeat abuse can be recognised.
- Banned accounts — kept in a deactivated state to prevent the same person from immediately returning.
- Purchase records — for the period Estonian accounting law requires (7 years).
When you delete your account we remove or anonymise your personal data within 30 days, except anything we are legally required to keep.
Security
- All traffic between the app and our servers uses HTTPS with TLS 1.2 or higher.
- Passwords are hashed; we never see or store them in readable form.
- Sign-in tokens are stored in the iOS Keychain, and in the Android Keystore on Android.
- Access to production data is limited to the people who need it, behind strong authentication.
- Database access rules restrict every account to the data it is allowed to see.
No system is completely secure. If a breach affects your personal data, we will notify you and the Estonian Data Protection Inspectorate where the GDPR requires it.
Your rights
Under the GDPR you can ask us to:
- give you a copy of the data we hold about you (access and portability)
- correct data that is wrong or incomplete
- delete your data — you can do this yourself in the app under Settings → Delete account
- restrict or object to processing we base on legitimate interests
- withdraw consent you have given, such as for push notifications
Write to unspaceapp@gmail.com and we will respond within one month. You also have the right to complain to your national data protection authority, or to ours: Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia — aki.ee.
Age
Unspace is rated for users aged 13 and over on the App Store and on Google Play, and is intended for that audience. We ask for your date of birth at sign-up and refuse accounts below that age. If we learn that a younger child has created an account, we remove it and the data with it. See also our child safety standards.
Changes
We may update this policy. Material changes will be announced in the app or by email, and the date at the top of this page always shows the current version.