Privacy Policy
Last updated 18 August 2026
Brosky fills one empty seat in something you already do every week. It needs very little about you to do that, so this policy is largely a list of things we deliberately do not hold. There is no advertising, no advertising identifier, no location tracking, and nothing is sold.
1. Who we are (controller)
OVDEVEL LLC ("Brosky", "we", "us") is the controller of the personal data described below. It is a limited liability company registered in Georgia (the country, not the US state of the same name). Registered address: TODO(brosky): street address as it appears on the Georgian business registry entry.
Privacy contact: privacy@brosky.app. General help: support@brosky.app. Safety: safety@brosky.app.
2. Information we collect
Account information. Your email address; your date of birth, used to check you are 18 or over; and how you sign in. If you use a password we store only a cryptographic hash of it, never the password itself. If you use Sign in with Apple or Google we receive an identifier from them and an email address — which may be Apple's private relay address if you chose to hide yours.
Profile information. Your first name; your city and country, if you type them; the activities you pick; the times of week that suit you; one line of context; your photo; and whether your account is verified.
What you post and send. Sessions you create, including the day, time, cadence and place label you write. Claims on other men's seats and the 140-character note attached. Messages in your crew threads. Shouts and the replies to them. Handovers and the hand-offs they travel through. Your daily Rope answers. Standing orders. Reactions.
Reliability information. Whether you said you were in, and whether you and the other man both confirmed a session happened. Your sessions kept and your streak are derived from these.
Safety information. Reports you make, reports made about you, who you have blocked, and the outcome of moderation decisions — including the automated screening results on photos and written content.
Technical information. Device type, operating system and app version; a push notification token if you enable notifications; your IP address, used for rate limiting and abuse prevention; and diagnostic data about errors and crashes.
Usage information. Aggregate events about which features are used. These are held separately and are not joined back to your account.
Purchases. Brosky does not currently sell anything, so there is no purchase data. If that changes, the transaction itself will be handled by Apple or Google — we would receive confirmation that an entitlement exists, never your card details.
What we do not collect. Your location. The app never requests the location permission: there is no GPS, no coordinates, no radius and no distance anywhere in Brosky. We also do not collect your contacts, your surname, your gender, your photo library beyond what you choose to upload, or anything about you from other apps and websites.
3. How we use your information
- To run the service — create and maintain your account, show the board, let you post sessions and claim seats, form crews, carry messages, run the confirm, and roll a session forward to next week.
- To send the few notifications Brosky sends — principally the reminder the day before a session, plus claims, accepted claims, messages, the post-session confirm, matched standing orders, and your daily Rope ask.
- To keep people safe — screen photos and written content before they are shown, act on reports and blocks, detect fake accounts, spam, scams and abuse, and enforce our Terms of Use.
- To check eligibility — confirm you are 18 or over.
- To keep the service working — diagnose errors and crashes, prevent fraud and technical abuse, and understand in aggregate which features are used.
- To answer you — when you write to support, privacy or safety.
- To meet our legal obligations — including mandatory child-safety reporting and responding to lawful requests.
We do not use your personal data for advertising, we do not profile you for advertising, and we do not take decisions with legal or similarly significant effects about you by automated means alone. Photo and text screening is automated, but borderline cases are held for a human to review before anything is published, and any removal can be appealed to a human.
4. Legal bases (EEA and UK)
- Performance of a contract (Art. 6(1)(b)) — your account, profile, sessions, claims, crews, messages, and the notifications attached to a session. Without these there is no service.
- Legitimate interests (Art. 6(1)(f)) — safety and moderation, preventing fraud, spam and abuse, securing the service, diagnosing faults, and understanding aggregate usage. Our interest is running a service where men meet strangers in the real world without being harmed. We have weighed it against your rights, and you can object at any time (see §7).
- Legal obligation (Art. 6(1)(c)) — child-safety reporting, responding to lawful requests, and keeping records we are required to keep.
- Consent (Art. 6(1)(a)) — push notifications, where your device asks you first. You can withdraw it in your device settings at any time.
- Vital interests (Art. 6(1)(d)) — rarely, where there is a risk to someone's life.
Information that may reveal health. A few of the activities you can pick — quit-smoking accountability, sober social, physio and rehab — and anything you choose to write in a Shout or as a Rope goal can say something about your health. We never ask for it, never infer it, and nothing in the service requires it. Where you choose to provide it, we process it on the basis of your explicit consent (Art. 9(2)(a)), which you can withdraw by removing the activity or deleting the content. Rope answers are visible only to the one man you are tied to, and Shouts are delivered privately and deleted after 72 hours.
5. How we share information
With other users. Only what the app shows: your first name, photo, city if you set one, activities, sessions kept, streak and verification status — plus whatever you write in a session, a claim note, or a message. Your email address, your date of birth and your surname are never shown to another user. In a Shout your identity is hidden from the men who receive it unless you both choose to take it further. In a Handover your identity crosses a hop only at the moment a thread is created.
With service providers who process data on our instructions, under contract, and only for the purposes above:
- Cloud hosting, database and media storage — runs the service and stores your data and photos.
- Image and text moderation — screens uploads and written content before they are shown.
- Transactional email — sign-in codes, password resets and safety notices.
- Push notification delivery and app build services — gets notifications to your device.
- Error and crash monitoring — diagnostic data, which can include an IP address or an account identifier in the error context.
- Caching and rate limiting — short-lived counters derived from IP addresses.
- Apple and Google — where you use their sign-in, and for any future purchase.
For safety and legal reasons. We may disclose information where we believe in good faith it is necessary to comply with a law or a lawful request; to enforce our Terms; to detect or address fraud, security or technical problems; to protect the rights, property or safety of a user, of us, or of the public; or to report child sexual abuse and exploitation to the relevant authorities, which we are required to do.
In a business transfer. If OVDEVEL LLC is involved in a merger, acquisition or sale of assets, your information may transfer with it. We will tell you before it becomes subject to a materially different privacy policy.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
6. Location data
We do not collect it. Brosky never requests the location permission on iOS or Android, holds no coordinates, and shows no distance on any profile. The only geography in the service is a city you type in yourself and a place label a host writes for his session — both optional, both editable, and neither taken from your device.
7. Your choices and rights
Wherever you live, you can:
- Access what we hold about you, and ask for a copy.
- Correct anything wrong — most of it directly in Settings.
- Delete your account and its data: Settings › Delete Account. See Delete Account & Data.
- Port your data — receive it in a structured, commonly used, machine-readable format.
- Restrict or object to processing we base on legitimate interests.
- Withdraw consent at any time, without affecting anything done before you withdrew it.
- Turn off notifications in your device settings.
To use any of these, email privacy@brosky.app — from the address on your account where you can. We respond within one month and will tell you if we need longer. We may need to confirm who you are, and we will not ask for more than the request requires. Nobody is treated differently for exercising a right.
If you are unhappy with how we handled a request, you can complain to a data protection authority. Because we are established in Georgia, that is the Personal Data Protection Service of Georgia (personaldata.ge), which supervises us under the Law of Georgia on Personal Data Protection. If you live in the EEA or the UK you may instead complain to the authority in your own country — you do not have to bring it to Georgia.
8. Data retention
We keep personal data only as long as it is needed for the purpose it was collected for, then delete it. Deletion is automated rather than manual: background sweepers remove expired data on a schedule, and deleting an account cascades to every related record and to the stored photo files themselves, not merely to the database rows.
| What | How long we keep it |
|---|---|
| Your account and profile | While the account exists. After you delete it: deactivated immediately, permanently erased after 30 days — or immediately, if you choose that option. |
| Sessions, claims, crews and messages | While the account exists. Messages are not set to expire; they are removed when an account is deleted. If we ever switch on expiring messages, the exact duration will be stated here and shown in the app before it takes effect. |
| Shouts and replies | 72 hours, then permanently deleted. |
| Handovers and hand-offs | 7 days, then permanently deleted. |
| An unmatched Rope intent | 14 days, then it expires and stops being readable. |
| Rope answers | For the life of your account. The pair record survives while the other man is still here, carrying his own history and your first name only — so one man leaving does not erase another man's twelve weeks. |
| Safety reports | 3 years after closure. A report about you survives your account deletion with the link to you removed, so a pattern of abuse cannot be erased by deleting and re-registering. |
| Blocks | Kept even after an account is deleted, so a block is never quietly undone. |
| Child-safety evidence under legal hold | 1 year. A hold overrides deletion, including a deletion you request. |
| Usage analytics | 1 year. Not linked back to your account. |
| Sign-in codes and password reset links | 30 minutes, single use, stored hashed. |
| Server and error logs | A short rolling window set on the logging platform, then discarded. |
9. Security
Traffic between the app and our servers is encrypted in transit. Passwords are stored as salted hashes and are never recoverable by anyone, including us. Sign-in codes and reset tokens are stored hashed, work once, and expire in 30 minutes. Access to production data is limited to the people who need it. Uploaded photos are screened before anyone sees them. Rate limiting protects sign-in and other sensitive endpoints against brute force and abuse.
No service can promise perfect security. If a breach affects your personal data and is likely to result in a high risk to your rights, we will notify you and the relevant authority as the law requires.
10. Children
Brosky is for adults aged 18 and over. Everyone gives a date of birth at sign-up and the check is enforced on our servers, not only in the app. We do not knowingly collect personal data from anyone under 18. If we learn an account belongs to someone under 18 we remove it and delete the data, subject to any legal hold.
If you believe a minor is using Brosky, report the account in the app or email safety@brosky.app. See our Child Safety Standards.
11. International transfers
Brosky is available worldwide and our service providers operate in more than one country, so your personal data may be processed outside the country you live in — including outside the EEA and the UK.
We are established in Georgia, which is not currently covered by a European Commission adequacy decision. Personal data belonging to users in the EEA and the UK therefore reaches a third country, and we say so plainly rather than leaving you to work it out.
Where data leaves the EEA or the UK for a country without an adequacy decision — including to us in Georgia — we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum or the UK International Data Transfer Agreement where relevant, together with the additional safeguards our providers offer. Ask us for details at privacy@brosky.app.
12. Region-specific disclosures
Georgia. We are established in Georgia and process personal data under the Law of Georgia on Personal Data Protection. It gives you rights to information, access, correction, updating, blocking, erasure and destruction of your data, and to withdraw consent at any time. Exercise them at privacy@brosky.app, or complain to the Personal Data Protection Service of Georgia.
EEA and UK. Because we offer Brosky to people in the EEA and the UK, the GDPR and UK GDPR apply to us as well, and the rights in §7 are your rights under them. You may complain to your national supervisory authority; in the UK that is the Information Commissioner's Office. TODO(brosky): OVDEVEL LLC is established outside the EU, so GDPR Article 27 requires a named EU representative unless the Article 27(2) exemption applies — decide this with counsel and either name the representative here or record why the exemption is relied on. See docs/DATA_PROCESSORS.md.
California. You have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing; and not to be discriminated against for exercising those rights. We do not sell or share personal information as the CCPA defines those terms, and have not done so in the preceding twelve months. We do not knowingly collect personal information from anyone under 16 — Brosky is 18+. The categories we collect, and why, are in §2 and §3. Requests go to privacy@brosky.app.
Elsewhere. If your local law gives you rights beyond those in §7, write to privacy@brosky.app and we will honour them.
13. Changes
We update this policy when the service changes, and the date at the top always reflects the current version. If a change is material — a new purpose, a new category of data, or a new kind of sharing — we will tell you in the app or by email before it takes effect, and will ask for your consent where the law requires it.
14. Contact
OVDEVEL LLC — privacy@brosky.app — Support.