Hiero privacy policy
Last updated: 28 October 2026
Short version
- Hiero is an app for doing something spontaneous with people in your city. You must be 18 or older.
- We collect as little as possible: your email address, your profile, your quests and your chat messages.
- We never store your live location. Before you are accepted, others only see a rough area of a quest, accurate to about 150 metres. Only accepted people see the exact spot.
- We delete chat messages 48 hours after the quest has ended.
- No ads, no trackers and no analytics services in the app. We only count ourselves on which days people use the app. On our website we count visitors ourselves, without cookies and without keeping your IP address or browser details (see section 2). We never sell your data.
- Our database is in the EU. For push notifications we use Expo, Google and Apple. They also operate outside the EU. That is why a push notification only says what kind of notification it is, never who or what.
- You can download your data and delete your account in the app.
- Questions? Email mark@markmaaktmedia.nl.
1. Who we are
Hiero is made by two people in the Netherlands: Mark Mossing Holsteijn and Teun Slokker. We do not have a company yet. We decide together what happens with your data. That makes us jointly responsible for it. The law calls this “joint controllers” (Article 26 GDPR).
- Email: mark@markmaaktmedia.nl
- Postal address: we do not have one yet. If you need one, email us.
We do not have a data protection officer.
What we agreed between us. We have written down who does what. The essence:
- For all questions and requests about privacy, email one address: mark@markmaaktmedia.nl. We make sure it reaches the right person.
- You can use your rights with either of us. You do not need to find out which of us does what.
- We are both responsible for security, for reporting data breaches and for the agreements with the companies that work for us.
2. What data we use
| Data | What exactly | Required? |
|---|---|---|
| Account | Email address, login codes (valid for 10 minutes), an account ID, when you accepted the terms | Yes |
| Profile | First name, username (like @mila4821), profile photo, short bio, languages you speak, your interests and the neighbourhood you choose | First name and username yes (if you don’t choose a username, we make one from your first name and a few digits). The rest no |
| Date of birth | To check that you are 18 or older. Others see your age in years, never your date of birth | Yes |
| Gender | Only needed for women-only quests. Never visible to others | No |
| Quests you post | Title, type, description, time, duration, maximum number of people, cost per person (if you fill it in), languages, settings, up to 4 photos, the exact spot and the rough area | Only if you post a quest |
| Joining | Your requests, whether you were accepted, cancellations, a +1, whether you want a notification when a spot opens up, and your place on the waiting list of a full quest | Only if you join |
| Chat | Messages in the group chat of a quest. The chat opens 1 hour before the start and closes 1 hour after the end, after that you can only read it. Updates from the host about time, place or cancellation | Only if you chat |
| Check-in | Who scanned whom, at which quest, and when. Not your location | Only if you check in |
| Counters and passport | How many quests you did and hosted, how often you showed up after being accepted, and your stamps and achievements in the quest passport (kinds of quests, neighbourhoods, how many people you met). Never with whom. Only you see your passport | Created automatically |
| After a quest | A rating from 1 to 5 with a short note, only for us. And who you would like to see again: the other person only sees that if you both choose each other | No |
| Access to the app | Whether you are on the app’s waiting list or in, and since when. Invite codes you make or use: who made the code and who used it. We do not keep the code itself on our server, only a keyed hash and the last 2 characters, so you can tell your codes apart. The full code is stored encrypted on the phone of the person who made it | Created automatically |
| Active days | On which days you used the app, only the date. To count how many people use Hiero | Created automatically |
| Notifications | Your phone’s push token, whether it is an Android phone or an iPhone, your phone’s language and your notification settings. If you use UnifiedPush: the address your notification app gives and the keys to encrypt messages. If you turn on notifications about new quests nearby: an area you choose yourself, rounded to about 1 km | No |
| Reports and blocks | Who you block. Reports you make or that are about you: the reason (for example child safety or someone seems under 18), your explanation and the content they are about. Whether we may email you about a report you made (only if you turn on “Send my details along”) | Only if it happens |
| Suspensions | If we suspend your account: until when, the reason and which of us decided. If a suspended account is deleted: only a code that we make from its email address with a secret key and that cannot be turned back into the address (a keyed hash) | Only if it happens |
| Technical data | IP address, time and type of request, in security logs | Yes, this happens with every request |
| Contact | Emails you send us | Only if you email us |
People without an account. If you open a quest share link in your browser, your IP address ends up in the logs of our web server. If you report something by email (see our Report page), we keep your name, your email address and your report.
The waiting list on our website. If you put your email address on the list (“Count me in”), we keep your address, the language and the date. We send you one confirmation with your personal code (through Brevo). If you later make an account with the same address, the app sees that you were already on the list and gives you that date as your place on the app’s waiting list. When it is your turn, we send you one email saying you are in (also through Brevo), with the links to the app. If you then sign in to the app with the same address, you skip the app’s waiting list; if you already had an account when we let you in, you are in right away. We keep when you got access and whether that email was sent. Apart from that, we only email you when Hiero opens.
Ideas and feedback. If you send us an idea, feedback or a bug through our website, we keep your message, the kind and your email address, so that we can answer you. If you delete your account, we take your email address and your account off your message; the message itself stays until the retention period is over.
Visitor statistics on our website. On our website and on the public quest page (the share link) we count ourselves how many people come and what they do, without a third-party service and without cookies. Nothing is stored in your browser (no cookie, no localStorage, no ID). For each page view and each event (you tap a download button for Google Play, the App Store or the APK, you join the waiting list, or you switch language) we send a small message to our own server in the EU. It contains only: the page (without anything after a question mark, and a share link counts as /q/*, so we do not take over the code in the link), the name of the website you came from (never the full link), your browser language, whether you use a phone, tablet or computer, and the country if our server can work it out from your connection. We do not keep your IP address or your browser details (user agent) for this. We only use them at the moment of the message to make a short abbreviation (a keyed hash) with a secret key, so that we do not count someone twice on one day. That key is random, exists for one day only and is thrown away at the end of that day, together with all the abbreviations of that day. So nobody, not even us, can recognise someone from one day on another day, and we follow nobody across visits. We keep only counts per day: how often each page, referring website, country, language and kind of device occurs, each counted separately (we do not keep the combination). There are no names, email addresses, quests or other data about people in it. If your browser has Do Not Track or Global Privacy Control switched on, we do not count you. We do not count robots and link previews (such as WhatsApp’s) either. If too many messages come from one network address we refuse them; for that we keep a keyed abbreviation of the address for at most two hours, never the address itself. See also the legal basis in section 3 and the retention period in section 9.
Businesses that apply. If you apply with your business through “For businesses” on our website, we keep the details of the business (name, address, kind, website or Instagram, your proposal for the deal and why it fits) and of the contact person: name, email address and, if you fill it in, phone number. The team adds notes. See also the partner terms.
What we do not collect. Your contacts, your live location, your location in the background, an advertising ID, what you tap or look at in the app, and audio. The app uses no analytics services and no tracking SDKs. We only keep on which days you used the app (see the table). On the website we only use the own, anonymous counter above.
Sensitive topics. Some quests are about something sensitive, such as religion, health or an LGBTQ+ meetup. If you join such a quest, you reveal something about yourself to the host and the other participants. Think about that before you post or join such a quest. We do not use this information for anything else.
3. Why we use your data, and on what legal basis
The GDPR lists several legal bases. We use four:
- Contract (Article 6(1)(b) GDPR): we need the data to make Hiero work, as agreed in the terms.
- Legitimate interest (Article 6(1)(f) GDPR): we have a good reason that outweighs your privacy interest, and we keep it as small as possible.
- Legal obligation (Article 6(1)(c) GDPR): the law requires it.
- Consent (Article 6(1)(a) GDPR): you choose it yourself, and you can always withdraw it.
| Purpose | Data | Legal basis |
|---|---|---|
| Creating an account and logging in | Email address, login codes, account ID | Contract |
| Checking that you are 18 or older | Date of birth | Contract |
| Showing your profile and your passport | First name, username, photo, bio, languages, interests, neighbourhood, age, counters. The passport only to you | Contract |
| Showing who someone is and stopping people from pretending to be someone else | Your username, when you changed it and your previous username. You can change it once a week. We hold your previous username for you for 14 days (or until your next change), so nobody else can take it and pretend to be you | Legitimate interest (a safe app) |
| Women-only quests | Gender | Contract (you choose whether to fill it in) |
| Posting, showing and finding quests nearby | Quest data, photos, rough area and exact spot, your rounded position (not stored) | Contract |
| Joining and chatting | Requests, participation, waiting list of a full quest, messages | Contract |
| Rating a quest afterwards and choosing who you would like to see again | Rating, note, your choices and mutual choices | Contract (you choose whether to do it) |
| The app’s waiting list and invite codes | Your place on the list, when you got in, who invited you | Legitimate interest (letting Hiero grow calmly and preventing abuse) |
| Counting how many people use Hiero | Active days, only the date | Legitimate interest (knowing whether Hiero is used, without an analytics service) |
| The waiting list on the website, the confirmation email and the email saying you are in | Email address, language, date, your code, when you got access and whether the email was sent | Contract (you ask for it yourself, before you have an account) |
| Reading and answering ideas and feedback | Your message and your email address | Legitimate interest (making Hiero better) |
| Checking in with a QR code | Check-in token, your location at that moment (not stored), the result | Contract |
| Sending push notifications | Push token, notification settings | Contract. You can always turn notifications off |
| Share link and public quest page | Public quest data, IP address of visitors in logs | Contract (for the host). Legitimate interest (visitor logs) |
| Reporting, blocking and moderation | Reports, the reported content, account data | Legitimate interest (a safe app). Legal obligation (Digital Services Act) |
| Emailing you about a report you made, if you turn on “Send my details along” | Your email address, with that one report | Consent. You can always withdraw it |
| Keeping reports after an account is deleted | Reports and what we did about them | Legitimate interest (preventing repeated abuse, being able to account for our decisions) |
| Making sure nobody gets around a suspension with another account, for example by deleting their account and signing up again | A keyed hash of the email address of a deleted, suspended account. When someone makes a profile or changes their email address, we check in the same way whether it is the address of a suspended account, deleted or not (also when written a little differently, for example with a +tag). If it is, the suspension applies to that account too, until the same end. When we suspend an account, we look in the same way for other accounts that already have its address, and the suspension applies to them too | Legitimate interest (a safe app) |
| Counting how many people visit our website and share links and tap a download button | Only counts per day: page, referring website, country, language, kind of device. A short abbreviation with a secret key that changes every day, kept for one day, only to avoid counting anyone twice. No IP address, no browser details, no cookie | Legitimate interest (knowing whether the website and the share link work and which pages help people, without following anyone) |
| Security and preventing abuse | Security logs with IP address, limits on the number of actions | Legitimate interest (protecting the app and your data) |
| Police and other authorities | What is needed for the report or the order | Legal obligation |
| Handling your privacy rights | Email address, your request | Legal obligation |
| Answering your questions | Email address, your message | Legitimate interest |
| Reviewing applications from businesses (Hiero places) and working together | Details of the business, name, email address and phone number of the contact person, the proposal, notes of the team | Legitimate interest (working with great places). For a sole trader also: preparing a contract |
| A photo or logo of a business on the Partners page | The photo or logo | Consent of the business, which can always be withdrawn |
| Emailing you about important changes, such as new terms | Email address | Contract |
Legitimate interest. Where we rely on legitimate interest, we have weighed whether that is fair to you. We will send you that assessment on request. You can always object (see section 11).
Consent. We ask users for consent for one thing only. When you report something in the app, you can turn on “Send my details along” (it is off by default). We may then email you about that report, for example with a question or to tell you what we did. Only the admins with the highest rights (now Mark and Teun) see your email address, and only with that report. Our team sees your name with every report, also without this switch. We do not put it in the report or in the email we get about the report: we read it from your account, for as long as that exists. Apart from that we do not ask users for consent, because we do no marketing and only use our own anonymous visitor counter (no cookies, nothing stored on your device). For a photo or logo of a business on the Partners page we ask the business for consent. You can always withdraw consent: email us and we turn it off. What we did before stays valid.
No decisions by a computer alone. We do not make decisions about you that are made only by a computer and that have a major effect on you. A word filter can hold back a text. A human always decides about restricting, suspending or deleting an account. If a suspension carries over to another account with the same email address, that follows from the decision a human made about the first account.
4. How location works
Location is the most sensitive part of Hiero. This is how we handle it:
- Explanation first. After you sign up, the app explains once what a quest is, how to meet safely and how we use location. Only then does your phone ask for permission.
- The map. If you give permission, the app uses your approximate location while the app is open. Your phone rounds your position to 2 decimals (about 1 km) before the app asks the server which quests are nearby. We do not store that position. Without permission you see the centre of Amsterdam and the app still works.
- Posting a quest. You pick a spot on the map. When you post, we move that spot once at random, within about 150 metres. That is the rough area others see. We always calculate distances from the rough area. That way nobody can work out the real spot.
- The exact spot is only visible to the host and to people who were accepted.
- Checking in. Only when you scan a QR code does the app ask for your precise location. Your phone sends it once. The server checks whether you are within 200 metres of the quest. We only store whether it worked, not where you were.
- Notifications about quests nearby. We do not store a live location for these. You choose an area yourself (rounded to about 1 km), or your phone decides by itself whether a quest is close.
- What does not exist. No live location, no background location, and no feature that shows where someone is now or who is nearby.
- No location in push notifications or logs.
- Map tiles. The map comes from OpenFreeMap. That service sees your IP address and which part of the map you load, not who you are: we send no account, ID or cookie with it. The map is made with OpenStreetMap data.
- Address search. If you search for an address while creating a quest, only the text you type goes to Photon by komoot, never your location.
5. Photos
- You can add up to 4 photos to a quest and one profile photo.
- Before a photo is uploaded, the app re-encodes it. This removes the hidden data (EXIF), such as the GPS position where the photo was taken.
- All logged-in users can see quest photos while the quest is visible. Pick a photo that does not give away the exact spot, and without people who did not agree to it.
- The app does not ask for access to your whole photo library. You pick photos with your phone’s photo picker. The app only uses the camera to scan QR codes.
6. Push notifications
- You only get push notifications if you allow them. You can turn them off per type in the app, or completely in your phone settings. The app also works without them.
- A notification travels like this: our server sends it to Expo’s push service, Expo sends it to Google (Firebase Cloud Messaging, for Android) or Apple (Apple Push Notification service, for iPhone), and they deliver it to your phone. These parties see your push token and the text of the notification.
- That is why the text of a notification is always the same for each kind, for example “Someone wants to join your quest”. It never contains a quest title, a name, chat text or a place. You only see the details when you open the app.
- UnifiedPush. If you have an Android phone without Google, you can get notifications through a notification app you choose yourself (such as ntfy), in Settings under Advanced. The notification then goes encrypted to that app’s server. That server sees that a message arrives and when, never what is in it.
- We delete your push token (or your UnifiedPush address) when you log out or when it stops working.
7. Who sees your data
Other users
- Logged-in users can see your profile (first name, username, photo, bio, languages, interests, neighbourhood, age, since when you are a member and the counters), except people you blocked or who blocked you. Your username shows under your name at a quest and on your card. Nobody else sees when you changed it or your previous username.
- Logged-in users can see a quest until it is over. Only women can see a women-only quest.
- The host and the other accepted participants see who joins a quest. Others only see how many people are joining.
- Only the host and accepted participants can see the group chat. The chat is deliberately small: it opens 1 hour before the start and closes 1 hour after the end. Hiero is about actually meeting.
- Updates from the host about time, place or cancellation are also shown on the quest page. Only accepted people see a new exact spot.
- If you are on the waiting list of a full quest, the host only sees how many people are waiting, not who.
- Only our team sees your rating and note after a quest, not the host. If you choose someone you would like to see again, that person never hears about it, unless they choose you too. Then you see each other in your profile.
Anyone with a share link
- A share link opens a web page with public information only: title, type, time, neighbourhood and number of spots. Never the exact spot, names or photos of people. Search engines do not index this page.
Anyone on our website
- The Partners page shows approved Hiero places with what the business wants to make public: name, kind, neighbourhood, address, the deal, opening hours and website or Instagram. A photo or logo only if the business gave permission. Never the contact person or their details.
- Businesses never get personal data of users from us.
Companies that work for us (processors) These parties only process data on our instructions, under their data processing terms (a data processing agreement).
| Party | What for | Where |
|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore) | Database, login, photo storage, server functions, live chat | Data in the EU region (Frankfurt, Germany). Supabase and some of its subcontractors can access the data from outside the EU, for example for support |
| Expo (650 Industries, Inc., United States) | Forwarding push notifications | United States |
| Google (Firebase Cloud Messaging) | Push notifications on Android | EU and United States |
| Apple (Apple Push Notification service) | Push notifications on iPhone | EU and United States |
| Brevo (Sendinblue SAS, France) | Sending login codes, the waiting list confirmation, the email saying you are in and important emails | France (EU) |
| Bunny.net (BunnyWay d.o.o., Slovenia) | The website, the share page, this privacy policy and the Report page | Slovenia (EU). Bunny has servers all over the world. You are usually served by a server near you |
| Proton (Proton AG, Switzerland) | Our mailbox: the emails you send us | Switzerland. The EU recognises Switzerland as a country that protects data well enough |
Services with their own privacy policy The app uses these services directly. They get no account, ID or cookie from us, and follow their own privacy policy.
| Service | What for | Where |
|---|---|---|
| OpenFreeMap (Hyperknot Software Kft., Hungary) | Map tiles. Sees your IP address and which part of the map you load | Hungary (EU). According to OpenFreeMap, Cloudflare may be used as a CDN |
| Photon by komoot (komoot GmbH, Germany) | Address search when you create a quest. Only the text you type is sent, never your location | Germany (EU) |
| Your notification app, if you use UnifiedPush | Passing on notifications. Only sees that an encrypted message arrives and when | Wherever the server you choose is |
Authorities We only give data to the police or another authority when the law requires it, or when someone’s life or safety is at risk.
Google Play and the App Store If you download Hiero from Google Play or the App Store, Google and Apple process data under their own privacy policies. We have no control over that.
We do not sell your data and do not give it to advertisers.
8. Data outside the EU
Our database is in the EU. Data can still leave the EU:
- Supabase is a company from Singapore. Supabase staff and subcontractors can in some cases access the data from outside the EU. The European Commission’s Standard Contractual Clauses (SCCs) apply to this.
- Expo, Google and Apple are American companies or part of one. With push notifications, your push token and the text of the notification can end up in the United States. Expo and Google take part in the EU-US Data Privacy Framework. Apple uses the Standard Contractual Clauses, and so does Google.
- Cloudflare may be used as a CDN for the map tiles, according to OpenFreeMap. Your IP address can then also reach Cloudflare, an American company.
The Data Privacy Framework is under pressure. That is why we keep notifications generic and free of sensitive data, and choose European parties where we can. For a copy of the safeguards, email mark@markmaaktmedia.nl.
9. How long we keep data
| Data | How long |
|---|---|
| Chat messages and host updates | 48 hours after the quest has ended |
| Exact spot of a quest | 48 hours after the quest has ended, together with the chat. If the quest is deleted earlier, the exact spot goes with it |
| Quests, quest photos, participation and check-ins | 90 days after the quest has ended. Then we delete them or make them anonymous. Only the counters stay on your profile |
| Your position on the map and at check-in | Not stored |
| Profile and account | As long as your account exists |
| Your previous username | 14 days after the change, or until your next change. If you delete your account, your username and your previous username are gone at once and free for others again. If your profile was reported, the username you had then is still in the copy kept with that report (see Reports below) |
| Blocks | As long as your account exists |
| Reports and what we did about them | As long as the account exists, and up to 12 months after the report is closed. If you report a profile, quest, message or photo, we keep a copy of it with the report. For a profile that is the first name, the username, the bio and a reference to the profile photo at that moment. That copy is kept as long as the report, also when that person later changes the name or deletes the account. Whether we may email you about a report is kept with that report and goes with it; your email address is not in it and can no longer be seen once your account is gone |
| Suspensions | Up to 12 months after the suspension has ended. A suspension for good: as long as the account exists |
| Keyed hash of the email address of a deleted, suspended account | As long as the suspension runs. For a suspension for good: until we lift it. You can ask us to |
| Push tokens and UnifiedPush addresses | Until you log out or it stops working |
| Waiting list of a full quest | Until the quest is over or called off |
| Rating and note after a quest | 12 months after the quest has ended |
| Who you would like to see again | If the other person does not choose you: 31 days after the quest has ended. If you both choose each other: 12 months after the end |
| Passport: stamps and achievements | As long as your account exists. After 90 days only counts, neighbourhood names, the date of your first quest and your highest scores remain, never with whom |
| Active days | 13 months |
| Your place on the app’s waiting list | As long as your account exists |
| Invite codes | A used code as long as the account of the person who made it exists. If the person who used it deletes their account, we take them off the code. An unused code 60 days after it expired or was revoked. Wrong tries 2 days |
| Waiting list on the website | Until Hiero opens and we have emailed you, then we delete the list. Want to be taken off earlier? Email us |
| Ideas and feedback | 12 months after you sent it |
| Security logs | At most 7 days |
| Website visitor statistics: the daily key and the visitor abbreviations | Until the end of the day (UTC), deleted within an hour after that. A keyed abbreviation of the network address for the limit: at most 2 hours |
| Website visitor statistics: counts per day | 400 days (about 13 months), to compare with the same month last year. They are no longer personal data |
| Which actions you took, for the limits on the number of actions | 2 days |
| Sent push notifications (type of notification, quest, time) | 7 days |
| Emails with questions and privacy requests | Up to 12 months after we handled your question |
| Applications from businesses | Turned down: 6 months after the last change. While we are talking or working together: as long as needed. When we stop working together, we delete the contact person’s details straight away on request, and otherwise after 12 months |
| Deleted account | Permanently deleted within 30 days. Backups are overwritten within 7 days |
If the police or a court asks us to keep data longer, we only do so for as long as needed.
10. 18+ only
Hiero is only for people aged 18 and older. When you sign up we ask for your date of birth, and the database checks it as well. If we find out someone is under 18, we delete the account. Does someone look under 18? Report it in the app.
11. Your rights
You have these rights:
- Access: you can find out what data we have about you.
- Correction: you can have incorrect data corrected. You can change a lot yourself in your profile.
- Deletion: you can have your data deleted.
- Restriction: you can ask us to stop using your data for a while, for example while we look into a complaint.
- Portability: you can get your data in a file that a computer can read.
- Objection: you can object when we use your data based on legitimate interest. We then stop, unless we have a compelling reason, which we will explain to you.
- Withdrawing consent: you can always withdraw a consent, such as letting us email you about a report. Email us and we turn it off.
How to use your rights
- Download your data: in the app under Profile, Settings, Download my data. You get a JSON file.
- Delete your account: in the app under Profile, Settings, Delete account.
- Without the app: follow the steps at https://hiero.app/en/delete-account, or email us.
- All other requests: email mark@markmaaktmedia.nl. Email from your account’s email address, so we know it is your account. Sometimes we ask you to confirm a code that we send to that address.
We reply within one month. If your request is complicated, it can take two months longer. We will tell you within the first month. It is free.
12. Complaints
Not happy with how we handle your data? Tell us first at mark@markmaaktmedia.nl and we will look for a solution together. You can always file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): https://autoriteitpersoonsgegevens.nl. If you live in another EU country, you can also go to the data protection authority of that country.
13. Security
- All connections are encrypted (HTTPS).
- Every table in the database has rules that decide who can see which row (Row Level Security). The server never trusts the app and checks everything itself.
- Your session is stored in your phone’s encrypted storage. When you log out, we wipe everything on your phone.
- Only the two of us can access the admin environments. Two-factor authentication is on there.
- If something goes wrong with your data (a data breach), we report it to the Autoriteit Persoonsgegevens within 72 hours when required. If the risk to you is high, we tell you as well.
14. Changes
When Hiero changes, we update this policy. The date of the latest version is at the top. For important changes we let you know in advance in the app or by email.