Privacy Policy

barrio.social is an invite-only community app. We collect only what we need to make it work, and we never sell your data to anyone.

1. Who we are

barrio.social is operated as an independent app. If you have any questions about this policy, contact us at hello@barrio.social.

2. What we collect

When you use barrio.social, we collect the following:

Email address — used to sign you in via one-time code. We do not send marketing emails.
Profile photo — the picture you upload during onboarding. Visible to all other authenticated barrio members within the app. Not shared publicly outside the app, not embedded in any web page that does not require authentication, and not provided to any third party beyond our storage provider (Supabase, listed in section 5).
Handle and 5 words — your public identity in the app, visible to all other authenticated barrio members.
Connection data — who you are connected to and the stories you write about how you met. Stories are only visible to the two people in the connection.
Events — events you create or RSVP to.
Invite codes — codes you generate and send to others.
Push notification token — if you grant permission, your device token is stored to send you notifications about connection requests, acceptances, and events.

We do not collect your location, contacts, browsing history, or any data beyond what is listed above.

3. How we use your data

To provide and operate the app
To connect you with other users in your barrio
To send push notifications (only if you grant permission)
To enforce community safety (block and report features)

We do not use your data for advertising, profiling, or any purpose other than operating the app.

4. Lawful basis for processing (EU/UK users)

Under the GDPR and UK GDPR, we process your personal data on the following lawful bases:

Consent — for your profile photo, handle, and 5 words. Consent is given when you complete onboarding, and you can withdraw it at any time by deleting your account (Profile → Delete account).
Performance of a contract — for your email address, connection data, events, and invite codes, which are necessary to provide the app's core functionality.
Legitimate interests — for push notification tokens (only after you grant permission) and for safety features such as block and report, which we use to keep the community safe. You can object to processing on this basis at any time.

Withdrawing consent for your profile photo, handle, or 5 words means you can no longer use barrio.social, because these are the elements other members use to recognize you. Deleting your account is the way to withdraw this consent.

5. Who we share data with

We use the following third-party services to run barrio.social:

Supabase (supabase.com) — our database, authentication, and file storage provider. Your data is stored on Supabase servers. See their privacy policy.
Expo (expo.dev) — our mobile app infrastructure and push notification delivery service. See their privacy policy.

We do not sell, rent, or share your personal data with any other third parties.

6. Data storage and security

All data is stored on Supabase infrastructure with row-level security enabled. This means your data is only accessible to you and the people you choose to connect with. Profile photos are stored in a secured storage bucket.

We use magic link authentication — we never store your password because we never ask for one.

7. Your rights

You have the right to:

Access your data — everything you've added is visible in the app.
Correct your data — edit your handle, words, and photo in the Profile screen at any time.
Delete your data (right to erasure — GDPR Art. 17) — go to Profile → "Delete account," or visit barrio.social/delete. This permanently removes your profile, connections, events, and all associated data. It cannot be undone.
Export your data — go to Profile → "Export my data." We will email you a JSON file containing everything we hold about your account.
Withdraw consent — to withdraw consent for your profile photo, handle, or 5 words, delete your account in Profile → "Delete account" or at barrio.social/delete. To withdraw push notification consent only, revoke permission in your device settings at any time.

If you are in the European Union, you also have rights under the GDPR including the right to data portability and the right to lodge a complaint with a supervisory authority. Contact us at hello@barrio.social for any data requests.

8. Data retention

We keep your data for as long as your account is active. When you delete your account, all your data is permanently deleted from our systems within 30 days. Backup copies may persist for up to 30 days before being purged.

9. Children's privacy

barrio.social is not intended for anyone under the age of 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal information, contact us at hello@barrio.social.

10. Changes to this policy

We may update this policy from time to time. We will update the "Last updated" date at the top. Continued use of the app after changes constitutes acceptance of the new policy.

11. Contact

Questions, requests, or concerns about your privacy: hello@barrio.social