Privacy Policy

Last updated 23 August 2026

Brosky fills one empty seat in something you already do every week. It needs very little about you to do that, so this policy is largely a list of things we deliberately do not hold. There is no advertising, no advertising identifier, no location tracking, and nothing is sold.

1. Who we are (controller)

OVDEVEL LLC ("Brosky", "we", "us") is the controller of the personal data described below. It is a limited liability company registered in the Republic of Georgia.

Privacy contact: privacy@brosky.app. General help: support@brosky.app. Safety: safety@brosky.app.

2. Information we collect

Account information. Your email address; your date of birth, used to check you are 18 or over; and how you sign in. If you use a password we store only a cryptographic hash of it, never the password itself. If you use Sign in with Apple or Google we receive an identifier from them and an email address - which may be Apple's private relay address if you chose to hide yours.

Profile information. Your first name; your city and country; the activities you pick; the times of week that suit you; one line of context; your photo; and whether your account is verified.

Approximate location - only if you ask for it, and only the city name. A city is optional. If you tap Use my location, and only then, your device asks your permission and the app takes a single coarse reading. That reading is turned into a city name on your own phone and the coordinates are discarded immediately: they are never sent to us, never stored, and never logged. Only the resulting city and country are saved. If you refuse, you can skip the step and the Board still works without a city; you can retry or update the city from your location later. There is no background location, no continuous tracking, no radius, no distance and no map anywhere in Brosky, and nothing in the app shows you men “near you”.

What you post and send. Sessions you create, including the day, time, cadence and place label you write. Claims on other men's seats and the 140-character note attached. Messages in your crew threads. Shouts and the replies to them. Handovers and the hand-offs they travel through. Your daily Rope answers. Standing orders. Reactions.

Reliability information. Whether you said you were in, and whether you and the other man both confirmed a session happened. Your sessions kept and your streak are derived from these.

Safety information. Reports you make, reports made about you, who you have blocked, and the outcome of moderation decisions - including the automated screening results on photos and written content.

Technical information. Device type, operating system and app version; a push notification token if you enable notifications; your IP address, used for rate limiting and abuse prevention; and diagnostic data about errors and crashes.

Usage information. Aggregate events about which features are used. These are held separately and are not joined back to your account.

Purchases. Brosky does not currently sell anything, so there is no purchase data. If that changes, the transaction itself will be handled by Apple or Google - we would receive confirmation that an entitlement exists, never your card details.

Verification. Brosky is for men, and the check is a live selfie taken during sign-up. The photo is sent to Google's Vertex AI, which returns a judgement about whether the face presents as male; we keep that judgement, a confidence score, the model's scores, and a one-way fingerprint of the image so the same photo cannot be reused across accounts. We do not keep the photo. It exists in memory for the length of a single request and is discarded once the decision is written. We create no face template, no embedding and no biometric identifier, and at no point is the photo used to work out who you are - only whether a face presents as male. That is what separates this from facial recognition. The photo leaves our systems only as that one request to Google, which acts as our processor and does not use it to improve its models; Google already screens your profile photos for us. The decision is automated: where the check is confident the face does not present as male, the account is refused without a person looking at it, and that refusal is final. Where it is not confident, the attempt is held for a retry and a reviewer may look at the result. You can contact us at support@brosky.app about a decision, and you can delete your account and your data at any time.

What we do not collect. Your coordinates - see above: the one optional location reading never leaves your device, and we hold no latitude, longitude, radius, distance or movement history for you at all. We also do not collect your contacts, your surname, your photo library beyond what you choose to upload, or anything about you from other apps and websites. We never ask you to state your gender and we store no gender field - see Verification above for the one check we do run, and what survives it.

3. How we use your information

• To run the service - create and maintain your account, show the board, let you post sessions and claim seats, form crews, carry messages, run the confirm, and roll a session forward to next week.
• To send the few notifications Brosky sends - principally the reminder the day before a session, plus claims, accepted claims, messages, the post-session confirm, matched standing orders, and your daily Rope ask.
• To keep people safe - screen photos and written content before they are shown, act on reports and blocks, detect fake accounts, spam, scams and abuse, and enforce our Terms of Use.
• To check eligibility - confirm you are 18 or over.
• To keep the service working - diagnose errors and crashes, prevent fraud and technical abuse, and understand in aggregate which features are used.
• To answer you - when you write to support, privacy or safety.
• To meet our legal obligations - including mandatory child-safety reporting and responding to lawful requests.

We do not use your personal data for advertising, we do not profile you for advertising, and we do not take decisions with legal or similarly significant effects about you by automated means alone. Photo and text screening is automated, but borderline cases are held for a human to review before anything is published, and any removal can be appealed to a human.

4. Legal bases (EEA and UK)

• Performance of a contract (Art. 6(1)(b)) - your account, profile, sessions, claims, crews, messages, and the notifications attached to a session. Without these there is no service.
• Legitimate interests (Art. 6(1)(f)) - safety and moderation, preventing fraud, spam and abuse, securing the service, diagnosing faults, and understanding aggregate usage. Our interest is running a service where men meet strangers in the real world without being harmed. We have weighed it against your rights, and you can object at any time (see §7).
• Legal obligation (Art. 6(1)(c)) - child-safety reporting, responding to lawful requests, and keeping records we are required to keep.
• Consent (Art. 6(1)(a)) - push notifications, and the optional location reading used to fill in your city; in both cases your device asks you first, and refusing does not restrict the service, so the consent is freely given. You can withdraw either permission in your device settings at any time and ask us to correct or remove a saved city.
• Vital interests (Art. 6(1)(d)) - rarely, where there is a risk to someone's life.

Information that may reveal health. A few of the activities you can pick - quit-smoking accountability, sober social, physio and rehab - and anything you choose to write in a Shout or as a Rope goal can say something about your health. We never ask for it, never infer it, and nothing in the service requires it. Where you choose to provide it, we process it on the basis of your explicit consent (Art. 9(2)(a)), which you can withdraw by removing the activity or deleting the content. Rope answers are visible only to the one man you are tied to, and Shouts are delivered privately and deleted after 10 days.

5. How we share information

With other users. Only what the app shows: your first name, photo, city if you set one, activities, sessions kept, streak and verification status - plus whatever you write in a session, a claim note, or a message. Your email address, your date of birth and your surname are never shown to another user. In a Shout your identity is hidden from the men who receive it unless you both choose to take it further. In a Handover your identity crosses a hop only at the moment a thread is created.

With service providers who process data on our instructions, under contract, and only for the purposes above:

• Cloud hosting, database and media storage - runs the service and stores your data and photos.
• Image and text moderation - screens uploads and written content before they are shown.
• Transactional email - sign-in codes, password resets and safety notices.
• Push notification delivery and app build services - gets notifications to your device.
• Error and crash monitoring - diagnostic data, which can include an IP address or an account identifier in the error context.
• Caching and rate limiting - short-lived counters derived from IP addresses.
• Apple and Google - where you use their sign-in, and for any future purchase.

For safety and legal reasons. We may disclose information where we believe in good faith it is necessary to comply with a law or a lawful request; to enforce our Terms; to detect or address fraud, security or technical problems; to protect the rights, property or safety of a user, of us, or of the public; or to report child sexual abuse and exploitation to the relevant authorities, which we are required to do.

In a business transfer. If OVDEVEL LLC is involved in a merger, acquisition or sale of assets, your information may transfer with it. We will tell you before it becomes subject to a materially different privacy policy.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

6. Location data

We store no coordinates. The app asks for the location permission only from the Use my location action on a screen where you set or update your city, and only if you tap it. When you do, your device takes a single coarse reading, your phone turns that reading into a city name locally, and the coordinates are thrown away in the same breath. They are not transmitted to us, not written to any database, and not written to any log. Only the resulting city and country reach our servers.

Everything else stays true: no background location, no continuous tracking, no location history, no radius, no distance on any profile, no map, and no “men near you”. The permission is when in use only, and on Android it is the approximate permission - we do not request precise location at all. You may skip the city and use the Board without one. You can revoke the permission in device settings at any time, retry or update the city from your location later, and ask us to correct or remove the saved city.

7. Your choices and rights

Wherever you live, you can:

• Access what we hold about you, and ask for a copy.
• Correct anything wrong - most of it directly in Settings.
• Delete your account and its data: Settings › Delete Account. See Delete Account & Data.
• Port your data - receive it in a structured, commonly used, machine-readable format.
• Restrict or object to processing we base on legitimate interests.
• Withdraw consent at any time, without affecting anything done before you withdrew it.
• Turn off notifications in your device settings.

To use any of these, email privacy@brosky.app - from the address on your account where you can. We respond within one month and will tell you if we need longer. We may need to confirm who you are, and we will not ask for more than the request requires. Nobody is treated differently for exercising a right.

If you are unhappy with how we handled a request, you can complain to a data protection authority. Because we are established in Georgia, that is the Personal Data Protection Service of Georgia (personaldata.ge), which supervises us under the Law of Georgia on Personal Data Protection. If you live in the EEA or the UK you may instead complain to the authority in your own country - you do not have to bring it to Georgia.

8. Data retention

We keep personal data only as long as it is needed for the purpose it was collected for, then delete it. Deletion is automated rather than manual: background sweepers remove expired data on a schedule, and deleting an account cascades to every related record and to the stored photo files themselves, not merely to the database rows.

9. Security

Traffic between the app and our servers is encrypted in transit. Passwords are stored as salted hashes and are never recoverable by anyone, including us. Sign-in codes and reset tokens are stored hashed, work once, and expire in 30 minutes. Access to production data is limited to the people who need it. Uploaded photos are screened before anyone sees them. Rate limiting protects sign-in and other sensitive endpoints against brute force and abuse.

No service can promise perfect security. If a breach affects your personal data and is likely to result in a high risk to your rights, we will notify you and the relevant authority as the law requires.

10. Children

Brosky is for adults aged 18 and over. Everyone gives a date of birth at sign-up and the check is enforced on our servers, not only in the app. We do not knowingly collect personal data from anyone under 18. If we learn an account belongs to someone under 18 we remove it and delete the data, subject to any legal hold.

If you believe a minor is using Brosky, report the account in the app or email safety@brosky.app. See our Child Safety Standards.

11. International transfers

Brosky is available worldwide and our service providers operate in more than one country, so your personal data may be processed outside the country you live in - including outside the EEA and the UK.

We are established in Georgia, which is not currently covered by a European Commission adequacy decision. Personal data belonging to users in the EEA and the UK therefore reaches a third country, and we say so plainly rather than leaving you to work it out.

Where data leaves the EEA or the UK for a country without an adequacy decision - including to us in Georgia - we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum or the UK International Data Transfer Agreement where relevant, together with the additional safeguards our providers offer. Ask us for details at privacy@brosky.app.

12. Region-specific disclosures

Georgia. We are established in Georgia and process personal data under the Law of Georgia on Personal Data Protection. It gives you rights to information, access, correction, updating, blocking, erasure and destruction of your data, and to withdraw consent at any time. Exercise them at privacy@brosky.app, or complain to the Personal Data Protection Service of Georgia.

EEA and UK. Because we offer Brosky to people in the EEA and the UK, the GDPR and UK GDPR apply to us as well, and the rights in §7 are your rights under them. You may complain to your national supervisory authority; in the UK that is the Information Commissioner's Office.

California. You have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing; and not to be discriminated against for exercising those rights. We do not sell or share personal information as the CCPA defines those terms, and have not done so in the preceding twelve months. We do not knowingly collect personal information from anyone under 16 - Brosky is 18+. The categories we collect, and why, are in §2 and §3. Requests go to privacy@brosky.app.

Elsewhere. If your local law gives you rights beyond those in §7, write to privacy@brosky.app and we will honour them.

13. Changes

We update this policy when the service changes, and the date at the top always reflects the current version. If a change is material - a new purpose, a new category of data, or a new kind of sharing - we will tell you in the app or by email before it takes effect, and will ask for your consent where the law requires it.

14. Contact

OVDEVEL LLC - privacy@brosky.app - Support.