Privacy Policy

Effective date: 16 July 2026

This Privacy Policy explains how The Corner Factory SA (Up4it, we, us, or our) processes personal data when you use our websites, applications, Help Center, and related services (together, the Platform) or otherwise interact with us.

The Platform supports private and public real-world social coordination. This Policy covers the features you use, including guest access and Communities where available. Roadmap descriptions do not mean that a feature or its associated data processing is already available.

1. Controller and Contact

The controller responsible for the processing described in this Policy is:

The Corner Factory SA, Rue de St-Guérin 6, 1950 Sion, Switzerland. UID: CHE-271.016.257. Email: support@the-corner.io.

2. Personal Data We Process

The data we process depends on the features you use and the choices you make.

2.1 Data you provide

Account and contact data: email address, login information, account identifiers, guest display names, and account preferences. Ordinary registration does not ask for a date of birth. Age or authority information may be requested when needed to assess eligibility, a safety concern, or a rights request.
Profile data: display name, profile photo, biography, language, and other optional profile fields.
Mood and Moment data: titles, descriptions, images, dates, times, approximate or precise locations, requirements, invitations, participation responses, and Organizer instructions.
Social and audience data: friend connections, Circle and Community membership, roles, membership requests, invitations, blocks, and audience choices for shared Content.
Communications: messages and other information you send through communication features that are available in your version of the Platform.
Support, safety, and legal data: correspondence, reports, appeals, evidence you choose to provide, and information needed to investigate abuse, protect safety, or respond to legal requests.

Do not include sensitive personal data in a Mood, Moment, profile, or message unless it is necessary and appropriate for the selected audience.

2.2 Data collected when you use the Platform

Device and network data: IP address, device and app type, operating system, language, time zone, and identifiers needed for authentication, security, or reliable delivery.
Usage and log data: access times, pages or screens viewed, feature interactions, invitations and responses, error logs, crash data, and security events.
Location data: approximate location derived from an IP address and, only where the feature requires it and device permission is granted, location from your device. You can control device location through operating-system settings, but some location-based features may then be unavailable.
Cookies and local technologies: data described in our Cookie Policy.

2.3 Data from other sources

Sign-in providers: if you choose a third-party sign-in method, we receive the identifiers and profile fields shown during that sign-in flow.
Other Members and reporters: another person may invite you, include information about you in Content, or submit a report concerning an interaction.
Public authorities and security sources: where lawful and necessary to protect the Platform, comply with law, or investigate abuse.

Up4it does not currently operate a payment service or collect payment-card or bank-account credentials to execute payments or payouts. Do not enter those credentials into Content or expense records.

Where expense tracking is available, we store the amounts, descriptions, named payers and recipients, shares owed, and settlement entries that Members submit to coordinate shared costs. These are Member-entered records and do not confirm that money changed hands. We process them to provide the requested coordination feature, on the basis of our contract where a legal basis is required, and retain them with the associated Moment subject to Section 6.

3. Why We Process Personal Data

Where the GDPR or another law requires a legal basis, we rely on the bases below as applicable. Swiss data-protection principles, including transparency, proportionality, purpose limitation, and security, apply independently.

We do not require health, biometric, religious, political, sexual-orientation, or other legally sensitive data as a standard account condition. If a released feature asks for sensitive data, we will identify the purpose and use explicit consent where required, or rely on another specific basis permitted by law, such as protecting vital interests or establishing legal claims. An Organizer who independently requests or uses sensitive data has separate responsibilities under the Participant Privacy Standards.

Purpose	Typical data	Legal basis where required
Create and secure an account; provide requested features	Account, profile, social, Mood, Moment, communication, device data	Performance of our contract with you
Show Content to the audience you select and coordinate participation	Profile, social, location, Mood, Moment, communication data	Performance of our contract with you
Authenticate users, prevent fraud, debug, and maintain service security	Account, device, usage, report data	Contract; legitimate interests in a secure and reliable service; legal obligations
Enforce policies, review reports and appeals, and protect Members	Content, communications where relevant to a report, account, usage, and report data	Legitimate interests in safety and enforcement; contract; legal obligations; vital interests in an emergency
Respond to support and data-rights requests	Account, contact, support, verification data	Contract; legal obligations; legitimate interests in handling requests correctly
Send service notices and requested notifications	Contact, preference, Mood, and Moment data	Contract; legitimate interests for essential service notices
Send optional marketing	Contact and preference data	Consent where required, or another basis permitted by applicable law; you may opt out at any time
Improve the Platform using aggregated or limited usage information	Usage, device, and feedback data	Legitimate interests in improving the service; consent where required for optional analytics technologies
Establish, exercise, or defend legal claims and comply with valid requests	Account, Content, usage, support, report, and legal-request data	Legal obligations; legitimate interests; establishment or defence of legal claims

We do not use Content from private Moods, Moments, or communications for advertising. We do not make decisions that produce legal or similarly significant effects based solely on automated processing. If that changes, we will provide the legally required information and review rights before the processing begins.

4. How Information Is Shared

We may share personal data with the following recipients only for the stated purposes:

People involved in shared activities: profile and coordination information is shared through the audience, invitation, participation, and Community features you use. Within a Community, members can see membership information and Circle assignments; managers can access member email addresses for administration. Review who belongs to a Community before sharing with it, as membership and roles can change.
Service providers: companies that provide hosting, authentication, communications delivery, security, error monitoring, support, or other infrastructure under contractual restrictions.
Professional advisers and insurers: where reasonably necessary for legal advice, audits, claims, security, or risk management.
Authorities and affected persons: where required or permitted by law, valid legal process, or a good-faith response to an emergency or serious threat. See Law Enforcement Requests.
A successor organization: as part of a merger, financing, reorganization, insolvency, or transfer of all or part of the Platform, subject to confidentiality and applicable notice requirements.

We do not sell personal data. We do not share personal data with third parties for cross-context behavioural advertising.

Members who receive another person’s information must follow the Participant Privacy Standards.

Public Content: a public Moment or enabled Community website can be viewed by people outside your contacts, including visitors without an account. Details you publish there, including a location, may be copied or shared elsewhere. A private Community does not by itself make every Moment hosted by it private. Check each Moment’s audience and obtain any permission needed before publishing information about another person.

Current integrations include Resend for email delivery, Firebase for push notifications, and Apple or Google when you choose their sign-in methods. The web application also requests fonts from Google Fonts, which involves a connection from your browser to that provider. Hosting and file-storage services support the Platform. These providers receive the data needed for the integration you use; third-party sign-in and public web resources also have their own privacy notices.

5. International Disclosures

The Platform is operated from Switzerland. Service providers may process personal data in Switzerland, the European Economic Area, the United States, or another country identified in the relevant feature or consent notice.

Before disclosing personal data to a country without legally recognized adequate protection, we use an available safeguard, such as approved standard contractual clauses with any required Swiss or European supplements, or a specific legal exception. You may request information about the applicable destination and safeguard by contacting us.

Information you choose to share with a Member may be accessed from the country where that Member is located.

6. Retention and Ephemeral Features

We retain personal data only for as long as reasonably necessary for the purpose described, taking account of legal obligations, safety, security, disputes, and technical backup cycles.

Account and profile data: retained while the account is active, then deleted or anonymized after a valid deletion request unless continued retention is necessary.
Moods and Moments: expiry or the end of an activity does not immediately remove all access. The current Mood cleanup schedule allows a period after expiry equal to half the Mood’s original duration, followed by hourly cleanup. Past Moments can remain accessible to their permitted audience in recent history; daily cleanup selects them once they are at least seven days past their end, or start if no end is set. Files and other copies can require separate cleanup. These schedules describe normal operation, not guaranteed erasure times for every system. Necessary backup, safety, security, rights-request, or legal records remain subject to the limits in this section.
Social and participation data: retained while needed to operate Friends, Circles, invitations, blocks, and participation history, or until the account or relevant relationship is deleted, subject to safety and legal exceptions.
Support, report, and appeal records: retained for the time needed to resolve the matter, prevent repeated abuse, demonstrate fair enforcement, comply with law, and establish or defend claims.
Technical and security logs: retained for a limited period based on security, reliability, and incident-investigation needs, then deleted or aggregated unless an incident requires longer preservation.
Legal records: retained for the period required by law or reasonably necessary for a legal claim or valid preservation request.

Where an exact period cannot be stated in advance, retention is limited by the purpose, sensitivity, risk, and applicable limitation or retention periods. Technical delays do not create a right to keep personal data indefinitely. You may request deletion or information about retained data through the rights process below.

7. Security

The Platform uses authentication, access controls, and time-limited links for stored media to help protect personal data. No service can guarantee absolute security. Up4it remains responsible for the technical and organizational measures required by applicable law.

If a personal-data breach occurs, we will assess it and notify the competent authority and affected people where applicable law requires.

8. Your Choices and Rights

Depending on applicable law, you may have rights to:

ask whether we process your personal data and obtain access to it;
correct inaccurate or incomplete data;
request deletion, restriction, or cessation of processing;
object to processing based on legitimate interests or for direct marketing;
receive certain data in a portable format;
withdraw consent at any time, without affecting earlier lawful processing;
express your view and request human review of an automated individual decision, if we introduce one; and
complain to a competent data-protection authority.

These rights may be subject to lawful exceptions, including the rights and safety of others, legal privilege, security, and record-retention duties. Instructions are available in How to Exercise Your Data Subject Rights.

9. Children and Young People

The Platform is intended for Members aged 13 and older. People under 13 may not create or use an independent account. If we learn that an under-13 account was created, we will restrict or close it and delete or limit the associated data, subject to child-safety, security, rights-request, and legal-preservation duties.

Members aged 13 to 17 are Young Members. They use the available account, audience, and reporting controls described in the Young Members Policy. The current service does not automatically identify every Young Member or apply separate settings based on a verified age. We do not use a Young Member’s personal data for profiling-based advertising.

Where the GDPR applies and we rely on consent to process a child’s personal data in connection with an online service offered directly to the child, a parent or guardian must authorize that consent if the child is below the age set by the child’s EU or EEA country. That age varies by country between 13 and 16. This rule concerns consent-based data processing; other legal bases and national rules may apply to other processing. We will make reasonable and proportionate efforts to verify parental authorization where it is required.

Creating an account does not establish that age or parental permission has been verified. Where an eligibility, safety, or rights request requires a check, we may request proportionate information and must limit it to what is necessary. A parent or guardian may contact us about a child’s data. We may verify the requester’s identity and authority while respecting the Young Member’s privacy, safety, and applicable rights.

10. Third-Party Services

Third-party sites and services have their own privacy practices. Review the information shown before linking an account, enabling a device permission, or following an external link. Up4it’s Policy does not govern a third party’s independent processing.

11. Complaints

You may contact us first so we can address a privacy concern. You also have the right to contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, the data-protection authority in the country where you live, work, or believe an infringement occurred.

12. Changes to This Policy

We may update this Policy to reflect changes in law, technology, or the Platform. We will update the lastUpdate date and provide reasonable notice of material changes. If a new purpose requires consent, we will request it before using data for that purpose.

13. Contact

For privacy questions, complaints, or rights requests, email support@the-corner.io with the subject Privacy request, or write to the controller address in Section 1.