Privacy Policy - ut.

1. Who we are

SJGD AS (org.nr 936662722, Norway) runs the Ut. app and is the data controller for the personal data described here. "We" and "us" in this policy mean SJGD AS.

This policy explains what data Ut. collects, why, who else handles it, and what you can do about it. It applies to the Ut. app for iOS and Android.

2. Information we collect

Account details. Your email address and password (stored hashed), or your Apple ID token if you sign in with Apple. If you choose Apple's "Hide My Email", we only receive a relay address.

Profile. Your name, username and date of birth. We use your date of birth to confirm you are 18 or older.

Your preferences. The music genres, venue types, atmosphere, drinks and times of week you pick during onboarding.

Social activity. Your friends and friend requests, the people you block, the events you like and the venues you save. When you report a user or message, we store the reason you pick and any details you write.

Messages. The direct and group chat messages you send, including events you share into a chat.

Last seen. While the app is open, we record the time you were last active, about once a minute. We record the time only, not where you are.

Location. With your permission, the app reads your device's location while you are using it, at roughly 100 m accuracy. It is used on your phone to show venues and events near you and their distance. We do not store your location on our servers, and the app never reads it in the background.

Notification token. If you allow notifications, we store a push token for your device so we can tell you about new messages and friend requests.

Usage and diagnostics. When you use the app, we record a small set of events, such as opening the app, finishing onboarding, viewing a venue or event, opening a chat or liking an event. We also collect crash reports, error details and performance data. This comes with your device model and operating system version, and is linked to your internal account ID, not your name or email.

We do not collect your contacts, photos, microphone, camera or payment details.

3. How we use it and our legal bases

Under the GDPR, every use of personal data needs a legal basis. Ours are below.

• Running your account and the app's features (chat, friends, likes, saved venues). Uses your account, profile, social activity and messages. Legal basis: contract, because we need it to provide the service you signed up for.

• Checking you are 18 or older. Uses your date of birth. Legal basis: contract, because our Terms only allow users aged 18 and over.

• Showing venues and events near you. Uses your location, on your device only. Legal basis: consent, through the location permission you give. You can withdraw it in your phone's settings.

• Personalising which events and venues you see first. Uses your preferences, likes and saved venues. Legal basis: contract.

• Sending notifications about messages and friend requests. Uses your push token, the sender's name and a message preview. Legal basis: consent, through the notification permission you give.

• Showing friends when you were last active. Uses your last seen time. Legal basis: legitimate interest in a working social feature. Only your friends can see it.

• Keeping the app safe (blocking, reports, removing content, banning accounts). Uses reports, messages and social activity. Legal basis: legitimate interest in a safe community, and enforcing our Terms of Service.

• Fixing crashes and understanding which features are used. Uses usage and diagnostics data. Legal basis: legitimate interest in a stable app that improves.

• Answering support and data-rights requests. Uses whatever you send us, plus your account. Legal basis: legal obligation and legitimate interest.

We do not sell your personal data, use it for advertising, or let third parties track you across other apps.

Where we rely on legitimate interest, you can object at any time (see Section 8).

4. What other users can see

Anyone signed in to Ut. Your name and username so they can find you and send a friend request. You can turn off friend requests in Privacy settings.

Your friends. Additionally when you were last active. Removing or blocking someone stops this straight away.

People in your chats. The messages you send in that chat, with your name. If you leave a group, what you already sent stays visible to the others.

Nobody. Your email, date of birth, preferences, likes, saved venues, reports and blocks are never shown to other users. Your location is never shared with other users.

When you block someone, any friendship between you ends, they can no longer message you or send you friend requests, and you stop seeing each other's messages.

5. Service providers and international transfers

We use the providers below to run Ut. They may only use your data to provide their service to us.

• Supabase (EU, Stockholm): database, sign-in and server functions. Handles all account, profile, social and message data.

• Sentry (EU, Germany): crash and error reporting. Handles diagnostics, device model, OS version and account ID.

• PostHog (EU): product analytics. Handles usage events, device model, OS version and account ID.

• Expo (650 Industries) (USA): delivers push notifications and app updates. Handles push tokens, sender names and message previews, plus device details and IP address when the app checks for updates.

• Apple (USA and worldwide): Sign in with Apple, notifications on iPhones, and the location lookup that gives the city name shown in the app. Handles your Apple ID token, notification content and approximate coordinates.

• Google (USA and worldwide): the map on Android, notifications on Android phones, and the location lookup for the city name. Handles the map area you view, notification content, approximate coordinates and IP address.

Apple and Google also process data under their own privacy policies when you use their operating systems, maps and sign-in.

Transfers outside the EEA. Expo, Apple and Google may process data in the USA. These transfers rely on the EU–US Data Privacy Framework where the company is certified, or on the EU Commission's Standard Contractual Clauses.

IP addresses. Sentry and PostHog are set up so that they do not store your IP address, and they never receive your name or email.

We may also share data if the law requires it, to protect people's safety, or as part of a merger or sale of SJGD AS. In a sale, this policy would continue to apply to your data.

6. How long we keep data

• Account, profile, preferences, friends, likes and messages: until you delete your account, or delete the item.

• Last seen time: overwritten each minute you are active, and deleted with your account.

• Push token: until you sign out on that device or delete your account.

• Reports you file: until you delete your account.

• Reports about you, and moderation decisions: up to 12 months after the case is closed, to deal with repeat abuse and ban evasion.

• Crash and error reports (Sentry): 90 days.

• Usage events (PostHog): 12 months.

If the law requires us to keep something longer, for example for accounting, we keep only what is required.

7. Deleting your account

You can delete your account in the app under Profile → Delete account. Deletion is immediate and permanent.

It removes your account, profile, preferences, friends, friend requests, likes, saved venues, blocks, reports you filed, push tokens and every message you sent, including in group chats. Group chats you created stay available to the other members, without you.

Crash and usage data linked to your account ID expires on the schedule in Section 6. You can also ask us by email to delete it sooner.

8. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and get a copy

• Correct data that is wrong. Email us and we'll fix it.

• Delete your data, in the app or by asking us

• Restrict how we use your data while a complaint is being looked into

• Object to uses based on our legitimate interest, such as analytics

• Portability: get the data you gave us in a machine-readable format

• Withdraw consent at any time. Location and notifications can be turned off in your phone's settings

Email sander@sjgd.no to use any of these rights. We answer within one month.

If you think we handle your data unlawfully, you can complain to Datatilsynet, the Norwegian Data Protection Authority, at datatilsynet.no. We would appreciate the chance to sort it out with you first.

9. Security

Data is encrypted in transit and stored with our providers in encrypted form. Access is limited by row-level security rules, so each user can only reach their own data and what others have chosen to share with them. Only a small number of SJGD AS staff can access the database, and only to run and support the service.

No system is perfectly secure. If a breach puts your data at risk, we will tell you and Datatilsynet as the law requires.

10. Age limit

Ut. is only for people aged 18 and over. We ask for your date of birth at sign-up and do not let anyone younger create an account. If we learn that someone under 18 has an account, we delete it. If you think a minor is using Ut., tell us at sander@sjgd.no.

11. Changes to this policy

We update this policy when the app or the law changes. The date at the bottom shows the latest version. For important changes, we tell you in the app or by email before they take effect.

Contact: sander@sjgd.no

Last updated: October 8, 2026 Operator: SJGD AS, Org.nr 936662722, Norway