Privacy Policy

Last updated: 3 November 2026 · version 78

This notice is published in thirteen languages. If the versions differ, the Italian version prevails, without prejudice to the mandatory rules protecting consumers.

The service is operated from Italy under European Union law. If you use it from another country, you do so on your own initiative and local laws may apply to you.

Each section starts with the essentials. Where needed, the details are under «Details»: they are part of this notice like everything else.

1. Who processes your data

The data controller is Daniele Cattaneo. For any question or request: info@wefocusbuddy.com.

There is no Data Protection Officer: for a service like this one is not required (art. 37 GDPR).

2. What data we process

(a) Account. The email you sign in with: with a code we send you by email, or with a Google or Microsoft account (personal, work or university). If you use Google or Microsoft, they send us your email and some basic profile identifiers. We use the email to sign you in. The name on your Google or Microsoft profile, if there is one, appears in the daily summary of sign-ups that we receive by email; nobody else sees it. The sign-in system (Supabase) also saves, for each device you sign in with, the IP address and the browser, to keep the session open: they stay while the session is open and are deleted when you sign out or delete the account.

(b) What you write in the app. Study or work sessions, focus ratings, exams, grades, goals and settings. If you wish, also the name you display and your profile photo. With the Agenda on: the topic of a session, the note you write and the score from 0 to 10 you give it. Settings (sounds, theme, language, alerts, Agenda) are saved on your account, so you find them on every device.

(c) Coworking. The times you book and how each session went, the name you show others, your favourite companions, the people you block and reports.

Details on coworking data

Bookings: the time slot and the session status (queued, matched, completed, cancelled).
Weekly schedule: if you use it, the sessions you plan for your week (day, time, length), the time zone they are read in, how long it lasts and whether it is paused. They let us book the sessions of the next 8 days for you, which are then bookings like any other. They are deleted with your account or when you delete them.
Who you met: for each completed session with another person, the name that person showed and the booked length, so the calendar can show you who you worked with.
Your display name: the name or nickname you show other participants, required for coworking. Other signed-in users who look at a time you booked in the calendar also see it, never together with your email.
Favourite companions: the people you add in a call with «Favourite companion» or, when matching with priorities is on, with «Meet … again», together with the name they showed in that session, so you can recognise them in the list. Only you see them. The other person finds out only if you propose a time to them. Whoever runs the service counts only the total. They stay until you remove them, until you block that person or until one of the two accounts is deleted. If someone adds you, you do not see it and we do not tell you, until they propose a time to you. If you turn on «My favourites first» in «You» (off by default), when you book we try to match you with your favourite companions first.
Companion changes: if your companion for one of your bookings changes up to 10 minutes before the start, we keep the name of the new companion (or the fact that there isn't one yet) and whether you have seen the notice. Until you have seen it, we also keep the identifier of the previous companion, so we don't notify you if the same person comes back.
Blocks: the people you block, with the name they showed in the session or in the proposal. We no longer pair you with each other, in either direction. If someone blocks you, you do not see it and we do not tell you.
Reports sent or received (section 5).
Early exits: when you leave, with confirmation, a session in progress with another real person: the time slot, the minutes completed and the identifier of the other person.
Joining and absences: the moment you join a booked session (with «Join», including the waiting room), to know whether you were there; whether a session counts as missed; which notices about a missed session you have already seen, so as not to show them again.
Removed bookings: a reduced copy of every booking you cancel or leave: the time, the length, the status, whether you already had a companion (yes or no, not who), when you booked, when you joined and when you removed it. Cancelling removes the booking from the calendar, but we need to know that it existed and how long you waited before leaving.

2-bis. If you don't give us the data

Without an email no account can be created, so we cannot provide you with the service. The display name is needed only for coworking: without it, the timer and the rest of the app stay available. All other data is entered by you whenever you want, and not entering it has no consequences.

2-ter. Your profile photo

It is optional. If you upload it in «You», the large photo stays private on your account. A square thumbnail of 128 pixels is seen by people looking at the calendar where you appear and by the person you are paired with. In the past quarter-hours of the calendar it may appear, without your name, together with those of other people who had a spot at that time (point 2-duodecies).

Purpose: to show a face to the person you are matched with.
Legal basis: your consent (art. 6(1)(a) GDPR), which you give by uploading it after reading the sentence next to the «Upload» button. You can withdraw it whenever you like with «Remove»: the thumbnail is deleted from the server at once, without affecting what has already happened. Together with the thumbnail we keep the date and time of upload and the version of the legal documents in force.
No face analysis: we do not compare, recognise or extract characteristics from the photo, and no software analyses it automatically. If it needs to be checked because it was reported, a person looks at it, also with the help of the assistant described in section 6.
If someone reports it, a person reviews it and may remove it or prevent others from being shown. We keep a record of every decision (what, when, why) to check compliance with the Terms and for legal obligations (art. 6(1)(f) and 6(1)(c) GDPR). We do not tell the reported person who reported them. If your photo is removed, you see this in «You».
How long it stays: the thumbnail until you remove it or delete your account; the record of decisions for as long as your account exists. Everything is deleted together with the account.
Who receives it: the people who see it in the calendar or paired with you, and Supabase as processor (section 6).

2-quater. Record of acceptance

When you sign up or sign in, or press «Got it» on the notice about updated documents, you accept the Terms and this notice, and with them you declare that you are at least 18. To be able to show this, we store four items: your account identifier, the version of the documents accepted, whether you accepted it from the sign-in screen or from the notice, and the date and time, calculated by our server. Nothing else, neither the IP address nor the device. Legal basis: our legitimate interest in documenting acceptance and the age declaration (Art. 6(1)(f) GDPR). They are kept as long as the account exists and are deleted with it.

2-quinquies. The leaderboard

Since 31 October 2026 the leaderboard no longer exists, and neither does the streak of days in a row: we no longer calculate ranks, categories, percentages or streaks, we no longer send the evening streak reminder, and we have deleted the counts already calculated and the dates of the reminders. What remains, for as long as the account exists and deleted with it, is any "Show only my initial" choice made before that date, which no longer has any effect, and the record of decisions on reported names, which we show to no one.

2-sexies. The connected calendar (optional)

If you want, you can connect your Google Calendar from «Tu» (You): the sessions you book appear in your calendar on their own and update if you move or cancel them. It is off until you turn it on.

How it works: press «Connect Google Calendar», choose your Google account and grant permission. We ask Google for a single permission: to create a dedicated calendar called «WeFocusBuddy» and to write events on that calendar. We do not see or touch any of your other calendars or other data in your Google account (we do not read your email, your name or your contacts).
What we send to Google: for each booked session, the start time, the length, a title («Coworking session, 25 min») and the app link. We do not send the other person's name, their photo or anything else about the pairing.
What we keep: the code Google gives us to write on the calendar (encrypted), the ID of the dedicated calendar, the app language at the time of connecting and, for each event, which booking it matches with its time and length, so we know what to update. We do not keep your Google address.
Purpose and legal basis: showing your sessions in your calendar, at your request. Your consent (art. 6.1.a GDPR), which you give by connecting the calendar and withdraw whenever you like.
Withdrawal: with «Disconnect» in «Tu» we revoke the permission at Google and delete the dedicated calendar with its events, the code and the connection data. You can also remove the permission in your Google account settings: the connection then stops working and we tell you in «Tu».
How long it stays: until you disconnect or delete your account; it is deleted with it. Future events are removed or moved on their own if you cancel or move the booking; past ones stay in the calendar until you disconnect.
Who receives it: Google, which handles your calendar as an independent controller under its own privacy rules, and Supabase as processor (point 6). Anyone with access to your calendar, for example if you share it, sees the events.
Timing: events update about every minute; there may be a short delay.
Use of data received from Google: the use and transfer of information received from Google APIs comply with the Google API Services User Data Policy, including the Limited Use requirements.

2-septies. The security trace when you delete your account

When you delete your account we erase your data as described in section 8. We do, however, keep a reduced trace for 24 months and, for a shorter time, your email address and the name you showed in coworking (30 days, or 24 months only if there is a security reason: see below). It protects the other people who use the service, for example to recognise someone who, after being reported several times, deletes their account and signs up again with the same email to start from scratch, and to let people who worked with you report behaviour even after you have deleted your account.

What we keep: the identifier your account had; the dates it was created and deleted; whether you deleted it or it was deleted in another way; how many sessions you did, how many reports you received and made, and how many blocks you received; for each report received, the category, the outcome, the date and the text written by the person who reported, including reports that arrive after the deletion from people who had worked with you (section 2-octies); whether you were suspended and until when; the fingerprint of your email; and, for the time stated below, your email address and the name you showed in coworking.
The email fingerprint: it is not the address. It is a code produced by a one-way calculation with a secret key only we have: it does not let anyone work back to the address, but if someone signs up again with the same email it gives the same code, and that is how we recognise it (even if they change the dots or add a «+» in a Gmail address).
What we do not keep: your photo, anything you wrote in the app, the people you worked with, the times of your sessions. Your email address, your name and the text of reports do not stay beyond the times stated below.
Purpose and legal basis: the security of the service and the prevention of abuse, in our interest and in that of the other people who use it (art. 6(1)(f) GDPR). The email address and the name let a person who runs the service understand who the reported person was and recognise someone who signs up again.
Balancing: the impact on you is limited: the trace is mostly numbers; the email address, the name and the text of reports normally stay only 30 days and are deleted automatically if in that time there are no reports, blocks or restrictions; only the people who run the service see it, it is not given to anyone, and it triggers no automatic measure. If the same email signs up again, nothing happens by itself: a person looks at the trace and, only if there are reports or restrictions, assesses the case as for any report (section 5).
Your right to object (art. 21 GDPR): you can ask us to delete it, at once and in full, by writing to info@wefocusbuddy.com. If there are no reports or restrictions against you, we delete it with the email and the name; if there are, we keep only what is needed if the security reasons outweigh yours, and we explain why.
How long it stays: the trace, 24 months from the deletion of the account. The email address, the name and the text of reports, 30 days; they move to 24 months only if there are reports against you (even if they arrive within those 30 days or later), blocks received or a restriction on the account. Then they are deleted automatically.
Who receives it: nobody. It sits in our database on Supabase, as processor (section 6).

2-octies. The people you worked with in a session

For every session done with a real person, the server remembers who was really on the call: the name they showed, when they appeared and, if they left before the end, when. It lets you find again the people you met, even if they left halfway or later deleted their account.

What you do with this data: by tapping a past session in the calendar you see the people of that session and can add or remove the heart, invite them to a new session, block them or report them. Only the people who did that session can see it.
Reporting after the call: you can report up to 30 days after the session, even if the person left halfway or later deleted their account. A report is accepted only if it shows that you were really on a call together.
Purpose and legal basis: giving you the functions above (art. 6(1)(b) GDPR, performance of the contract) and the security of the service (art. 6(1)(f)).
How long it stays: as long as your account exists; it is deleted with the account. If the other person deletes theirs, the row about them stays 30 days (24 months if there are security reasons, section 2-septies), only so that you can report them.
Who receives it: nobody. It sits in our database on Supabase, as processor (section 6); if you report, the person who handles reports reads it.

2-nonies. The country you sign up from

When you create your account, we work out from your IP address the country you are connecting from and save only its two-letter code (for example IT or DE) next to your account. We do not save the IP address. It is only an approximation: with a VPN or a company network it may not match where you are.

How we work it out: Cloudflare, the provider that hosts the site (section 6), calculates it at the edge of its network; we receive only the code. We do not use any third-party geolocation service.
Purpose and legal basis: to understand which countries the people who sign up come from (Art. 6.1.f GDPR, legitimate interest; you can object, section 9-bis). We do not use it to decide anything about you and it does not change how the app works for you. Other users do not see it linked to you: on the home page we only show, in aggregate form, the list of countries where at least one person is present and how many there are (a globe), never who you are or how many people there are per country.
Once only: it is recorded when you sign up; we do not track your movements. People who signed up earlier do not have this data.
How long it stays: as long as your account exists; it is deleted with the account.
Who sees it: only the people who run the service, in the internal panel. It is kept in our database at Supabase, as processor (section 6).

2-decies. Donations (optional)

From “You” → “Support WeFocusBuddy” you can make a free donation by card or with your phone's wallet. It is optional, it does not unlock anything and it does not change how you use the app. If you wish, you can choose what to fund (for example the fee to publish the app on Google Play) and appear with your name among the supporters. This point covers one-off donations: the monthly support is described in point 2-undecies.

How it works: you choose an amount and the payment fields appear on the same page. Stripe handles the payment: you type your card details directly into its fields and we never see or store them.
What we record: for each donation, the amount, the currency (euro), the outcome, a payment identifier at Stripe, the date and the items you chose to fund. Together with the donation we do not record your name, your email or your account, except as described below if you choose to appear. To stop people trying cards in bulk, for one day we remember that a payment was requested from your account (at most 6 per hour): this data deletes itself and is deleted with your account.
If you choose to appear among the supporters: it is your choice, never pre-selected. We save the name you write (at most 40 characters) together with your account, only so that you can remove it. People signed up to the app who open the page can see it, in the list and next to the item you funded, only once the payment has succeeded (never for test payments). With the monthly support the name is saved with the subscription, appears after the first successful payment and stays in the list even if you cancel later, until you remove it or delete your account. You can remove it whenever you like with “Remove my name” on the same page: the donation stays, without a name. It is also deleted with your account. The legal basis is your consent (Art. 6.1.a GDPR), which you can withdraw at any time.
What Stripe sees: the card details and the technical device data needed to complete the payment and prevent fraud, under its own privacy policy. We do not send Stripe your name, your email, your account or the items chosen.
When Stripe loads: Stripe's library is downloaded from its server only when you press “Continue” on the donation page, not before. To prevent fraud it may store or read information on your device: we consider this necessary for the payment you asked for. If you do not press “Continue”, Stripe is not contacted.
Where: Stripe may process data outside the European Union, with the safeguards it describes in its own privacy policy.
Purpose and legal basis: receiving the donation you decide to make and keeping its accounts (Art. 6.1.b and 6.1.c GDPR, for accounting and tax obligations); for the name in the list, your consent (above).
How long: the donation row (amount, outcome, date, items) is kept as long as accounting and legal obligations require. It contains no data about you and is not linked to your account, so it is not deleted with the account. The name in the list stays until you remove it or delete your account. Stripe keeps its own data under its own rules.

2-undecies. Monthly support (optional)

From “You” → “Support WeFocusBuddy” you can choose, instead of a one-off donation, monthly support: a recurring donation of an amount you choose (from 3 to 500 euros) that renews every month until you cancel it. You can cancel at any time from the same page. It is optional, it gives no benefits or features and it does not change how you use the app. The items to fund apply only to one-off donations; you can also choose to appear among the supporters with the monthly support (point 2-decies).

How it works: you choose the monthly amount and the payment fields appear on the same page. Stripe handles the payment, by card or with your phone's wallet: you enter the card details directly in its fields and we neither see nor store them.
What we record: unlike one-off donations, for monthly support we keep the link between your account and the subscription: the customer identifier and the subscription identifier at Stripe, the amount, the status (for example active or cancelled) and the date of the next renewal. We need it to show you your monthly support on the page and to let you cancel it. We do not record your card. If you choose to appear among the supporters, we also keep the name you write together with the subscription (see point 2-decies).
What Stripe sees: the card details and the technical device data needed to complete the payment and prevent fraud, under its own privacy policy. Stripe creates a “customer” for the subscription, but it receives neither your name nor your email from us.
When Stripe loads: as with one-off donations, Stripe's library is downloaded only when you press “Continue”; if you do not press it, Stripe is not contacted.
Where: Stripe may process data outside the European Union, with the safeguards it describes in its own privacy policy.
Purpose and legal basis: to start, renew and cancel the monthly support you asked for and to keep the accounts (art. 6(1)(b) and 6(1)(c) GDPR, for accounting and tax obligations).
How long: the link between your account and the subscription is kept while the subscription is active and disappears with the account: when you delete the account, we cancel the subscription and there will be no further charges. Charges already made remain in Stripe's records and in our accounts for the period required by law and by Stripe's rules.

2-duodecies. The calendar's past: who had a spot

In quarter-hours that have already passed, the calendar may show people who are signed in how many people had a spot at that time and, for some of them, the profile photo. We do not show names, durations or who was with whom. If this feature is not active, nothing appears.

What is shown: for each quarter-hour, a number («+N») and up to three thumbnails picked at random among the people who have a visible photo (point 2-ter). A person counts once per time, even with two bookings. For people without a visible photo, only the initial of their chosen name appears in its place, on a colour (never the full name).
Who is counted: people who at that time had a booking (paired or not) or a booking later cancelled or abandoned (point 2(c), «Removed bookings»), or were inside a completed session, alone or in a pair: whoever completed a session counts in every quarter-hour they were inside (25 or 50 minutes). We create no new data: the number is calculated on the spot from this data. People who had the app open in the foreground in that quarter-hour (point 2(m)) also count, even without a booking: they count in the number and, if they have a visible photo, may also appear with the photo.
The day's total: under the date of each day that has already begun we show how many people, on that day, opened the app or had a spot, and up to three thumbnails picked among those who had a spot. To know who opened the app we use the «one row per person and per day» record in point 2(m): we never show at what time. Someone who only opened the app counts in the number and, if they have a visible photo, may also appear with the photo.
Who sees it: people who are signed in. They do not see your photo if you blocked them or they blocked you; you are still in the number. Without a photo, however, only the initial of your name appears; if you do not want to appear even that way, write to the same address.
How to remove yourself: with «Remove» in «You» your photo no longer appears, but you stay in the number. If you do not want to be counted even in the number, write to info@wefocusbuddy.com (point 9-bis).
Purpose and legal basis: showing when the community is active, to help you choose a time (legitimate interest, art. 6.1.f GDPR); for the photo, your consent under point 2-ter applies. You may object at any time (point 9-bis).
How long: the number and the thumbnails are not stored anywhere: they are calculated each time. The data they are calculated from is kept as in points 2(c) and 8 and is deleted with the account.

2-terdecies. Who opened the app recently: the list next to friends

On the screen where you invite your friends, below them, a list of the last 10 people who had the app open may appear. You can propose a session to them as you would to a friend, and they can do the same with you. If this feature is not active, nothing appears.

What others see about you: the name you chose and, if you added and shared one, the thumbnail of your photo (point 2-ter). We do not show when you opened the app, nor your email, country, time zone, sessions or anything else. The list is made of the last 10 people in order of when they opened the app: you appear only while you are among the last 10.
How it is worked out: from the «last time with the app open» mark in point 2(m), which already exists: we keep no history and save nothing new about who saw or looked for you. These people never appear: those blocked in either direction, people who have not finished their profile (name, 18+, time zone) and people who have not opened the app for more than seven days.
Who sees it: people who are logged in and have not turned the feature off.
How to remove yourself: by default you appear. You can turn it off at any time in «You» (How you are matched): you stop appearing and you stop seeing others. We save only this choice (one row with your identifier, deleted with your account).
If someone proposes a session: it arrives like a friend's proposal (point 2(c)), with a notification if you turned them on; you can say no without the sender seeing a refusal, and you can block them. We set limits: at most 5 people per invite, 15 different people per day for the person inviting, and 3 open proposals from non-friends for the person receiving them.
Purpose and legal basis: helping people who look for a study or work companion find each other (legitimate interest, art. 6.1.f GDPR; for the photo, your consent in point 2-ter applies). You can object at any time by turning the feature off or by writing to us (point 9-bis).

3. Why we process it and on what basis

To provide the service (art. 6(1)(b) GDPR, performance of a contract):

authenticating you and syncing your data across your devices;
matching you and running the coworking sessions you request, including matching with priorities (favourite companions and, if the question is on, the answer to «I study at university»), notices when your companion changes, invites and proposals to favourite companions;
showing you the people you worked with in a past session and letting you find, invite, block or report them again (section 2-octies);
understand which countries the people who sign up come from, using the country code worked out from the IP address (section 2-nonies);
recording when you join a booked session, applying the pause described below and remembering the notices you have already seen, so that the person you are paired with is not left waiting;
answering support requests;
writing to you, at the email you sign in with, about the service: an outage that stopped you from using it, a change to the Terms or to this notice, the security of your account and a summary of your activity (your sessions, your friends' pending requests and your upcoming sessions), on by default, at most once a day and only if there is something new to tell you. You turn it off whenever you like from You → Sounds and notifications or from the link at the bottom of the email. The summary contains no advertising or promotional invitations. Community invitations, that is, regular meetups for studying and working together, are part of how the community, and therefore the app, works: they are on by default for everyone who signs up, at most one email a day (in total, together with the summary), and you turn them off whenever you like from You → Sounds and notifications or from the link at the bottom of every email, without the app ceasing to work.

For our legitimate interest (art. 6(1)(f) GDPR; you can object, section 9-bis):

security of the service, prevention of abuse and handling of reports between users (our interest and that of other users in a safe environment), including the limit of one waiting proposal per person and the 30-day pause, which protect people who receive proposals from pressure;
the anti-abuse code for the form, against spam;
the aggregated visit statistics in section 2(f), with the lowest possible impact on your privacy;
automatic collection of the app's technical errors (what broke, on which screen, with which browser; never what you wrote), in order to fix faults;
reading and replying to messages with ideas and problems;
notifying you, at the email you sign in with, of news and initiatives of the service you are using, such as a new feature, a meetup for studying and working together with the other members, or a request for your opinion on the service: rarely, one email per initiative, only about WeFocusBuddy and never with third-party advertising or offers for other products; every email has a link at the bottom to stop receiving them, and you can also object by writing to info@wefocusbuddy.com (section 9-bis);
the technical logs of the video call server (section 4-bis), for security and to understand faults;
the record of acceptance of the documents (section 2-quater) and the record of decisions on reported photos (section 2-ter);
the leaderboard and the record of decisions on reported names (section 2-quinquies, which describes the balancing and how to object);
the security trace of deleted accounts (section 2-septies, which describes the balancing and how to object);
internal per-account statistics, aggregated usage trends and video call quality, described in the details below.

With your consent (art. 6(1)(a) GDPR): reminders on your device; the profile photo (section 2-ter).

For legal obligations (art. 6(1)(c) GDPR).

What we do not do: we do not sell your data, we do not use it for advertising, and we carry out no profiling for advertising or marketing purposes and no automated decisions producing legal effects on you.

Only one automatic measure, and it is temporary. If you have not joined 10 minutes after the start of a booked session (with «Join»), or if 25 minutes after the end no completed session is recorded for that time, your later bookings are not matched until you reopen the app and choose whether to keep or cancel them, and in any case for no longer than 14 days. A notice in the app tells you. It does not depend on other users' reports: the app only looks at whether you joined and whether the session took place.

Details on the automatic measure and internal statistics

Why the pause is not a decision within the meaning of art. 22 GDPR: it does not produce legal effects or similarly significantly affect you. It does not touch your account or your data, does not lock you out of the app, does not stop you from working with the virtual companion, lasts until you answer the notice (no longer than 14 days) and has no consequence outside the service. Regardless of this, you have the right to obtain human intervention, to express your point of view and to contest it: just write to info@wefocusbuddy.com. Closing an account or any lasting limitation of the account or of coworking is always decided by a person (section 5).
Earlier reports: whoever reviews a report also sees how many earlier reports concern the same person and with what outcome. It is context information: the decision is always taken by a person.
Internal per-account statistics: we look at how often you book, show up, send or receive conduct reports, leave early and how long you stay in sessions, to detect abuse and improve matching. They are calculated at the time of viewing from the data in section 2(c), including the log of removed bookings, with no separate archive, and only the people who run the service see them. Balancing: the impact on you is low, because they stay internal, appear in no public profile, are not seen by other users, are not used for advertising or commercial profiling, are not a score and on their own trigger no measure.
Aggregated usage trends, to understand whether the service works and to improve it: how many people sign up and use the service each week, how many do a first session within 7 days of signing up, how many come back after 1, 2 or 4 weeks, how many have been inactive for more than 14 days, how often sessions repeat, how many of the people who sign up each week book at least once, and at which hours and on which days sessions take place. These are overall counts calculated on the data in section 2(c), on the sign-up date and on the statistics in section 2(f). The view shows no lists, names or identifiers; we install no tracking on your device, use no cookies or additional identifiers and do not share this data with third parties. Balancing: the impact is low because these are overall numbers that do not concern any particular person.
Video call quality: the technical data in section 2(l) are used to understand whether the video service works and whether to change the infrastructure it runs on. Only the people who run the service read them, in a view with percentages and averages (successful calls and average connection time by device type, over the last 7 and 30 days): no lists, names or identifiers, no score per person, no measure taken against you. To understand a fault reported in a single call, the people who run the service may also read them for that one session, and for no other purpose. We do not use them for advertising or profiling, do not share them with third parties and install nothing on your device. Balancing: the impact is low because they are technical data about the connection, not the content of the call, reduced to a few categories, and they only say how many times and for how long, not what you did.
People active each day: the date in section 2(m) is used to understand how many different people use the app every day and whether the service is growing. Only the people who run the service see it, as a number per day (without internal accounts): no list, name or score, and no measure against you. We do not use it for advertising or profiling, we do not share it with third parties and we install nothing on your device. Balancing: the impact is low because it is a single date per day, with no time and no content; you can object as described in section 9-bis. The same applies to the time of the app's last sign of life (section 2(m)): it is used to count who is in the app right now, it has no history and only the people who run the service see it. The quarter-hours in which the app is open (point 2(m)) are used to count, in overall numbers, who was in the app in the past; the balance is the same and you may object as in point 9-bis. Time you use the app: the data in point 2(n) is used to understand how much and at what times the service is used and on what type of device, in order to improve it. Only the people who run the service see it; we do not use it for advertising or profiling, we do not share it with third parties and we install nothing on your device. Balancing: the impact is limited because it is only a few numbers per day, with no page or content; you can object as described in point 9-bis.

4. Video calls

We do not record audio or video. On our server recording is not a disabled feature: it does not exist. The session chat is not saved anywhere either. Recording the call is prohibited by the Terms.

Calls run on free video-conferencing software, on our server in Frankfurt (Germany, European Union). The machine is provided by Oracle (section 6); we run the software ourselves. No commercial video-conferencing platform is involved.

The other person sees your image and hears your voice while the call is running, and sees the name you chose to display and, under the name, how many sessions you have done in total (a single number). We never show them your email or your account name. We recommend not saying personal things on the call that you don't want known.

Sharing your screen. From a computer you can show the other person a tab, a window or your whole screen, only if you choose to: the browser asks you what to share and you can stop whenever you want. While you share, the other person sees everything that appears in that tab, window or screen, including notifications, messages and data about you or other people: check what you are showing before you share. The screen travels like audio and video (section 4-bis), including to someone outside the European Union; we do not record it or store it. Legal basis: performing the service you ask us for (Art. 6.1.b GDPR).

4-bis. How the call travels and your IP address

Audio and video always travel encrypted. When there are two of you, your devices first try to connect directly to each other: it is the shortest path, and without it the delay is enough for you to talk over each other.

Your IP address. To attempt the direct connection, the two devices exchange their network addresses, including the public IP address, as in any direct connection between two computers. This happens in every call between two people, even when the direct connection then fails. So the person you connect with can see your IP address if they use technical tools to look for it; the app does not show it to them. It is personal data; the legal basis is the performance of the service you asked us for (art. 6(1)(b) GDPR). There is no setting in the app to avoid this exchange. To discover the public address we use our own server in Frankfurt (STUN), not a third-party service.

Direct connection (the most frequent case): the call is encrypted from one device to the other and does not go through our server.
Through our server (when the direct connection fails, for example on some corporate or mobile networks): audio and video go through our Frankfurt server, encrypted between each device and the server. To forward them, the server decrypts them and encrypts them again, only in its memory and only while forwarding: it does not record them and does not store them.

The video server's technical logs. Like every server, our video call server automatically records in its technical logs the IP address of the devices that connect, with date and time. We use them only for the security of the service and to understand faults, for example when a call does not start (art. 6(1)(f) GDPR; you can object, section 9-bis). We do not use them for anything else, we pass them to no one except the authorities where the law requires it (section 6), and they are deleted automatically within 14 days.

If you do not want the other person to see your IP address, one option is to use a VPN set up to route all of your device's traffic: the other person then normally sees the VPN's address, not yours. We cannot guarantee it, because it depends on the VPN and the browser.

Outside the European Union. Our server is in the EU, but the call reaches the person you are talking to wherever they are, including outside the EU if that is where they live. That is what a video call is, and writing that no data leaves Europe would not be honest. The person you talk to, wherever they are, receives your image and your voice for the duration of the call and, as explained above, your IP address.

5. Reports and moderation

If you report the person you were matched with, the report is read by a person. No report, on its own, suspends an account, and the automatic measure in section 3 does not depend on reports: the app applies it on its own when you do not join a session you had booked, and you lift it yourself. After the review we may limit, suspend or close access to coworking or to the account.

What we process: the category you choose, any description you write, the session identifier, time and length, the names shown by the two people, the accounts involved and the number of earlier reports about the same person, with their outcome. The time, length, names shown and earlier reports are added by our server, not by you.
Limits: at most 5 reports a day, only one per person and per session.
If you are the one reporting: we do not show the reported person your email or your account name.
If you are the person reported: we process this data about you without having received it from you; here and in sections 3, 8 and 9 you find the information required by art. 14 GDPR. If you make an access request, we tell you whether there are reports concerning you, of what type and with what outcome. We do not tell you who reported, other people's data or the time of the session, to the extent that the law allows or requires us to protect them (art. 15(4) GDPR; art. 2-undecies of Italian Legislative Decree no. 196/2003); in that case we explain the reason.
If a measure is taken against you you can challenge it by writing to info@wefocusbuddy.com, and you will receive a reasoned reply.

5-bis. Special categories of data

Some fields are free text: messages with ideas and problems, the description of a report, the display name, the topic and note of a session in the Agenda and, in the site's calculators, the entries you type yourself (for example the description of a work item or the subject of an appointment). They are not meant to collect data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, or data concerning health, sex life or sexual orientation (art. 9 GDPR): please do not write it there. If you do so anyway, that data is processed only for the security and support purposes in section 3, with the same safeguards as other data, and you can ask us to delete it at any time at info@wefocusbuddy.com. In reports we ask you to describe the facts, not to attribute criminal offences.

6. Who receives the data

We do not sell your data and we do not give it to anyone for marketing.

Providers that process it on our behalf (processors under art. 28 GDPR):

Supabase: database, authentication, server functions;
Cloudflare: site hosting and email routing;
Resend: delivery of your sign-in emails, of withdrawal acknowledgements, of your activity summary, of the community invitations and of the internal alerts through which we receive sign-ups, reports and messages;
Google (Gmail): the mailbox that receives the emails written to info@wefocusbuddy.com and the service's internal alerts, with the names of sign-ups;
Anthropic: the artificial intelligence assistant (Claude) we use to manage the database and reports; it sees the data only during the operations we ask it to carry out, which may include messages, reports and thumbnails of reported photos;
Oracle: the Frankfurt machine our video call server runs on. It provides the infrastructure, not the video call service.

Those who process it on their own account (independent controllers): Google and Microsoft, only if you sign in with their account and only for authentication; Google also for the calendar, only if you connect it (point 2-sexies). If you turn on reminders, the message passes through the notification service of your browser's maker, which receives the delivery address and the encrypted message but cannot read it.

Payments: if you make a donation, Stripe processes the payment data under its own privacy policy (point 2-decies and 2-undecies).

There are no other recipients: apart from the payment library described in point 2-decies and 2-undecies (only if you make a donation), the app loads no scripts, fonts, maps or images from third-party servers, uses no external content delivery networks and uses no third-party analytics tools. We may disclose data to judicial or other competent authorities where the law requires it. Messages and reports are read only by whoever runs WeFocusBuddy or by a person authorised by us and bound by confidentiality.

7. Where the data is kept

The database and authentication are on Supabase, in the Frankfurt region (Germany, EU). The video call server is also in Frankfurt. From the browser, each account can directly read and write only its own data (row-level security); what others see of you, such as your name and thumbnail, goes through server functions that show only those fields.

For Supabase, Cloudflare, Oracle, Resend, Google (Gmail) and Anthropic, some technical traffic or support activity may involve infrastructure outside the EU (for Resend and Anthropic, in the United States). In those cases the transfer relies, depending on the provider, on the European Commission's adequacy decision of 10 July 2023 for certified companies or on the Commission's standard contractual clauses, set out in the respective data processing agreements. You can request a copy at info@wefocusbuddy.com. Google, Microsoft and the browser's notification service, as independent controllers, may process data outside the EU under their own safeguards.

Until 7 September 2026 the video call ran on a third-party provider's United States infrastructure: we said so openly and asked for specific consent (art. 49(1)(a) GDPR). Since it runs on our server in the EU that transfer no longer happens, and the consent has been removed because it no longer has anything to authorise.

8. How long we keep it

The rule: account and app data are kept as long as the account is active. If you delete it, we erase them without undue delay; copies in the providers' technical backups disappear with the normal backup cycles, as a rule within 30 days. The only exception is the reduced security trace in section 2-septies, which we keep for 24 months (the email address and the name, as a rule, only 30 days).

Item by item:

Coworking sessions: for as long as needed to show you your history and to handle any reports. The name the other person showed stays in your history as long as your account exists; if that person deletes theirs, the name is removed from your sessions.
Joining sessions: kept with the booking it refers to, as long as the account exists; if you cancel or leave the booking, it moves to the log of removed bookings.
Removed bookings (section 2(c)): as long as the account exists; deleted with it.
Missed sessions: after 14 days they no longer cause any pause, but stay recorded with the booking. The record that you have already seen the notice stays as long as the account exists.
Early exits: for as long as the account exists; they are deleted with it.
Companion-change notices: within one day of the end of the session, or earlier if you cancel the booking.
Favourite companions: until you remove them, until you block that person or until one of the two accounts is deleted.
Blocked people: until you unblock them or until one of the two accounts is deleted.
Answer to «I study at university»: until you change it or delete the account.
Choice «My favourites first»: until you change it or delete the account.
Reports and the outcome of the review: for as long as the accounts of the reported person and of the person who reported exist, to assess repeated behaviour and defend against claims; they are deleted when either account is deleted. For someone who deletes their account, the reduced trace and the reports received remain, as described in section 2-septies.
Messages with ideas and problems: with no time limit, because they help us understand what to improve. If you left your email we can find your message and delete it on request; anonymous ones are not linked to you, so we cannot find or delete yours.
Technical errors collected automatically: with no time limit; they contain only a code, a number and the app version, and are not linked to you.
Anti-abuse code: 2 days at most.
Technical logs of the video call server (section 4-bis): 14 days at most.
Technical and security logs of the hosting providers and of the server functions (section 2(e)): for the periods set by the providers in their data processing agreements.
Invite links (with requests and proposals): for as long as the account of the person who created the link exists; they are deleted with it.
Reminder delivery address: while notifications are on. It is deleted when you turn them off in the app, when you sign out, when the notification service tells us it no longer exists, after 5 failed deliveries or when the account is deleted.
Video call technical data (section 2(l)): for as long as the session they refer to exists; they are deleted with it or with the account.
Day you open the app (section 2(m)): for as long as your account exists; it is deleted with the account. Also the time of the app's last sign of life: a single row per person, overwritten every minute, with no history; it is deleted with the account. The quarter-hours in which the app is open: 30 days, then they delete themselves; they are also deleted with the account. The time you use the app (point 2(n)): as long as your account exists; it is deleted with the account.
Aggregated visit statistics: with no time limit, because they are only numbers and do not refer to any person. Aggregated usage trends are calculated when viewed and are not stored separately.
Leaderboard (section 2-quinquies): your choice, the counts and the positions for as long as the account exists, and they are deleted with it; the record of decisions on reported names for as long as the account exists, and it is deleted with it.
Security trace of deleted accounts (section 2-septies): 24 months from the deletion of the account, then it is deleted automatically; the email address, the name and the text of reports 30 days (24 months if there are reports, blocks or restrictions).
People met in a session (section 2-octies): as long as your account exists; if the other person deletes theirs, 30 days (24 months if there are security reasons).
Country of sign-up (section 2-nonies): as long as your account exists; it is deleted with the account.
Profile photo and record of acceptance: see sections 2-ter and 2-quater.

9. Your rights

You have the right of access, rectification, erasure, restriction, objection and data portability (arts. 15–22 GDPR).

Export: from You → Your data you download by yourself the data you entered that is saved on your account. It does not include calendar bookings (with the joining time and missed sessions), the history of coworking sessions, invites, requests and proposals, early exits, removed bookings, the record of acceptance or reports: to get them, write to info@wefocusbuddy.com (for reports see also section 5). Nor does it include leaderboard data (section 2-quinquies): for those too, write to info@wefocusbuddy.com.
Delete: from You → Your data you delete your account and data. Only the reduced security trace in section 2-septies remains, for 24 months, and your email address and name for 30 days (24 months if there are reports, blocks or restrictions).
Everything else: write to info@wefocusbuddy.com, we reply within one month. You can also ask at any time for a person to intervene, express your point of view and contest the automatic measure in section 3.
Complaint: you can turn to the supervisory authority of your country; in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

9-bis. Right to object

You can object at any time, on grounds relating to your particular situation, to the processing based on legitimate interest (section 3): security and handling of reports, messages with ideas and problems, notices of news and initiatives of the service, the anti-abuse code, aggregated visit statistics, internal per-account statistics on coworking, aggregated usage trends, automatic collection of technical errors, video call quality, technical logs of the video call server, record of acceptance of the documents, record of decisions on reported photos, the leaderboard and the record of decisions on reported names (section 2-quinquies, where you can also read what happens in practice if you object). The same goes for the security trace of deleted accounts (section 2-septies). Just write to info@wefocusbuddy.com. We tell you here, separately from the rest, because art. 21 GDPR requires this right to be presented to you explicitly and separately.

10. Cookies and data saved on your device

The app uses no cookies, neither strictly necessary nor profiling cookies, and there are no advertising cookies, third-party analytics tools or tracking pixels. That is why you see no consent banner. The only exception is the payment library, which loads only if you press “Continue” to make a donation (point 2-decies and 2-undecies).

The app only uses the browser's storage (both the kind that stays and the kind that is cleared when the tab is closed) and its own cache (a copy of its files, saved after you sign in so it opens faster), needed to run it. They hold: the local copy of your data, the session token, preferences such as language and theme, the last virtual companion shown, the companion-change notices already shown and:

if you arrive from the page for university students, a marker valid for at most two hours and deleted the first time the app opens;
if you press “Support” on the home page before signing in, a mark with the amount you chose, which lasts two hours and is deleted the first time the app opens;
if you prepare an invite on a page of the site before signing in, the days and times you chose, valid for at most one day and deleted the first time the app opens;
if you tap a time on a page of the site before signing in, that time, valid for two hours;
your «Not now» choice on notifications, valid for 14 days, and which notices, requests and document versions you have already seen, so as not to show them to you again;
the last leaderboard tier you saw, to show you a «New» mark when you move up.

Why no consent is needed: cookie law requires consent to store or read information on your device, except where this is strictly necessary to provide the service you asked for. The local storage described here falls under that exception; the visit statistics (section 2(f)) store nothing on your device; the browser creates the reminder delivery address only if you give it permission.

11. Security

We use technical and organisational measures appropriate to the risk: encrypted transmission (HTTPS), per-account data access through row-level security, authentication with no passwords stored by us. No system is absolutely secure: if a data breach involves a high risk to your rights, we will inform you (art. 34 GDPR).

12. Minors

The service is reserved for people aged 18 or over. We do not knowingly collect data from minors. If you think a minor has created an account, write to info@wefocusbuddy.com and we will delete it. If a report indicates that a person may be under 18, we may suspend their access to coworking until the situation is clarified.

13. Changes

We may update this notice. We announce material changes in the app with a notice you confirm; when a change reduces your rights, with reasonable notice. The date at the top changes. If you do not agree you can close your account at any time from You → Your data, at no cost. Changes do not apply to processing that has already taken place.