Dawzr Privacy Policy
Last updated: 31 August 2026
Version: 2.0
Controller: Atane BV, Meiweg 8, 9870 Zulte, Belgium
Contact: privacy@dawzr.com
Dawzr helps you remember where you have been, discover places that match the mood you are in, and share both with the people you choose.
Your location is used to find places near you and to rank what we show you. It is read only while the app is open, never in the background, and we do not build a movement history.
You decide who sees what, item by item. Every visit, note, photo, video, place and list carries its own visibility setting: only me, friends, followers, or public. A note and the photo next to it can sit at different settings on the same visit.
We do not sell your data, and we run no advertising.
Deleting your account deletes your data. Not hidden, not archived. The delete runs immediately and removes your places, visits, lists, notes, reactions and media.
Most of what we use is hosted in Europe. The exceptions are named in section 8, with the transfer safeguard for each.
The rest of this page is the detail behind those five lines.
Who we are
Atane BV ("Dawzr", "we", "us") is the controller of the personal data described in this policy. That means we decide why and how it is processed.
Registered name
Atane BV
Registered office
Meiweg 8, 9870 Zulte, Belgium
Enterprise number
BE 1001.810.357
Contact for privacy questions
privacy@dawzr.com
General support
support@dawzr.com
We have not appointed a Data Protection Officer. Our processing does not currently meet the threshold in Article 37 GDPR that would require one, and we will appoint one and publish the contact details here if that changes. Write to privacy@dawzr.com for anything in this policy.
What this policy covers
The Dawzr mobile app for iOS and Android, the website at dawzr.com, share links, and the support we provide by email. Viewing content on Dawzr, including content someone shared with you by link, requires a Dawzr account. If that changes and some content becomes viewable without signing in, we will update this policy before it does.
Places on Dawzr may link out to third-party sites and services. Once you leave Dawzr, the privacy policy of whoever you land on applies instead of this one.
The data we hold, and where it comes from
Account: email address, a password (which we store only as a one-way hash, so we never hold it in readable form and cannot recover it), and a username. Email is verified with a code we send you.
Profile: a first name, a username and your date of birth are required, and you cannot save a profile without them. The date of birth is what we check against the minimum age in section 14, and it stays on your profile. A last name, a profile photo, a short free-text bio, your pronoun and your gender are all optional, and leaving them empty costs you nothing in the app; if you do fill them in, they appear on your profile.
Content you create: places you save, visits you record, lists you build, notes and text you write, and photos and videos you upload. A video you record inside Dawzr carries its audio, so the microphone is used for the length of that recording and for nothing else.
The words you attach to a place: the vibes you pick for a visit, the tags you add, and the emoji reactions you leave. Dawzr may suggest vibes, but the ones stored against your visit are the ones you chose. This is how you describe a place in your own terms, and it is what makes searching by mood work.
Video links you paste: if you paste a link to a video so Dawzr can work out which place it shows, we fetch that video and analyse its imagery to recognise the location. Part of that analysis runs on an outside image-recognition service, so images from the video are sent there; the link itself, your account and everything else stay with us. Section 8 names the service.
Two things are worth knowing about what this can and cannot do. It looks for buildings, not people — the only question we ask of the imagery is which landmark is in it, so no face recognition, no object labelling and no reading of text takes place. And it answers only in narrow circumstances: the video has to show the outside of a building, and that building has to be a public place recognisable in its own right. Footage shot indoors, or of an ordinary building with nothing distinctive about it, returns nothing at all. When we do get a match, the place is what we keep.
Support correspondence: whatever you write to us, and our replies.
Location: your device coordinates and their accuracy, read from the operating system after you grant permission.
Read only while the Dawzr app is open on screen. The app stops the location stream the moment it goes to the background, and it does not request background location permission at all.
Sent to our servers as a coordinate pair when you search nearby or open a feed, where it is used to rank results by distance. We do not store that coordinate pair as a location history.
The last known position is cached on your own device so the map has somewhere to start.
What we do keep is the place you chose to save and when you saved it. That is your content, under your visibility settings, and you can delete it at any time.
Device and app data: an app installation identifier, device platform (iOS or Android), app version, and a Firebase Cloud Messaging token if you have turned on notifications.
Usage data: which screens you open, when you open and close the app, and which features you use. This is product analytics: no session recording, no tap-by-tap capture, and no advertising identifiers. Section 8 names the provider and where it runs.
Diagnostics: when something crashes or errors, we receive a technical report with the device model, OS version, app version, a stack trace, your Dawzr user identifier and your IP address. Section 8 describes who receives it and where they run.
Connection data: IP address and standard request metadata, which every server necessarily receives and which we use for security and abuse prevention.
Share link views: when you open someone's share link, we record one entry per distinct viewer: who viewed, what they viewed, who shared it, and when. The person who shared sees how many distinct people opened their link. Opening your own link is not counted.
A place's vibe profile: distinct from the vibes you pick, which are yours and stay yours, Dawzr also builds a mood picture of a place itself. That one is an aggregate: it draws on the place's category, on the vibes many people have chosen for it, on what people save and revisit, and on the emoji reactions people leave, which we read as an emotional signal. No single person's choices are visible in it.
Recommendations: your explore feed is ranked from the places you have saved, the vibes you gravitate to, your current location, and what is popular nearby.
Profile embedding: if you write a free-text bio, we send that text, and nothing else from your account, to an outside language-model service, which turns it into a numeric representation of what it is about. That is what lets us match you to people and places with related interests. Section 8 names the service and where it runs.
This is profiling in the sense of Article 4(4) GDPR. It changes what Dawzr shows you. It produces no legal or similarly significant effect: no decision about you is made automatically, and you can ignore every suggestion. Section 12 has more.
When someone shares with you: if another person adds you to a list, invites you to collaborate, follows you or shares content with you, we receive their content and the fact of the connection.
When you open a share link: opening a link someone sent you records the view described in 3.2 and gives us the content they shared with you.
App stores: Apple and Google tell us aggregate installation and crash statistics. These reach us without identifying you.
Why we use it, and on what legal basis
Purpose
Data used
Legal basis
Create and run your account, sign you in, keep you signed in
Account, device, session tokens
Contract, Art. 6(1)(b)
Verify your email and let you reset a forgotten password
Email, one-time code
Contract, Art. 6(1)(b)
Save your places, visits, lists, notes, reactions and media, and sync them across your devices
Content, account
Contract, Art. 6(1)(b)
Show you places near you and rank a feed by distance
Location
Consent, Art. 6(1)(a), given through the OS location permission
Read your camera roll or camera so you can attach a photo or video
Photos, camera
Consent, Art. 6(1)(a), given through the OS permission
Share what you choose with the people you choose, and run share links
Content, social graph, share-view records
Contract, Art. 6(1)(b)
Identify the place shown in a video you paste
Video frames, the link you gave us
Contract, Art. 6(1)(b)
Derive vibes and personalise your feed
Content, reactions, location, profile bio embedding
Legitimate interests, Art. 6(1)(f): giving you a feed that is worth opening is the core of the product
Send you notifications about activity that involves you
Push token, account
Consent, Art. 6(1)(a), given through the notification permission
Send you a reminder when you have been away
Push token, last-active date
Consent, Art. 6(1)(a)
Understand which features are used, so we know what to build
Usage data, opaque user id
Consent, Art. 6(1)(a)
Diagnose crashes and errors
Diagnostics, IP, user id
Legitimate interests, Art. 6(1)(f): an app that crashes serves nobody
Keep the service secure, prevent abuse, enforce our terms
Connection data, account, and anything brought to our attention at support@dawzr.com
Legitimate interests, Art. 6(1)(f): protecting users and the service
Check that you meet the minimum age
Date of birth
Legitimate interests, Art. 6(1)(f): keeping the service to the age it is meant for
Answer your support requests
Correspondence, account
Contract, Art. 6(1)(b)
Meet legal obligations and respond to lawful requests
Whatever the obligation covers
Legal obligation, Art. 6(1)(c)
Establish, exercise or defend legal claims
As relevant
Legitimate interests, Art. 6(1)(f)
Where the basis is consent, you can withdraw it at any time and Dawzr keeps working with that feature switched off. Revoke location, camera or notification permission in your device settings; switch analytics off in Dawzr under Settings. Withdrawing consent does not undo processing that already happened while consent was in place.
Where the basis is legitimate interests, you can object under Article 21. Write to privacy@dawzr.com and we stop unless we can show compelling grounds that override your interests. We have weighed each of the four cases above against the impact on you and documented the outcome; ask and we will share the assessment.
Giving us your data: an email address, a password, a first name, a username and your date of birth are required to have an account, and we cannot create one without them. Everything else is optional: without location Dawzr still works, with search in place of nearby; without photos you keep text notes; without a last name, bio, pronoun or gender your profile simply shows less; without analytics or notifications nothing about the app changes for you.
Location, specifically
Location is the sensitive part, so here is the whole position in one place.
Foreground only. Dawzr does not ask either operating system for background location permission, and switches its location updates off when the app leaves the screen. When Dawzr is not the app you are looking at, it is not reading your location. This is checkable rather than promised: the permissions an app declares are published with it, and Dawzr declares no background location permission on Android or iOS.
Accuracy scales to the task. Coarse accuracy for a city-level feed, fine accuracy only when a screen genuinely needs to know which side of the street you are on.
No trajectory. We do not record where you went, in what order, or how long you stayed. The coordinate you send with a nearby search is used to compute distances for that request.
What persists is your choice. A saved place or a recorded visit exists because you saved it. It carries the visibility you set, and deleting it removes it.
Turning it off is a supported state. Deny or revoke location permission and Dawzr falls back to search. Nothing is withheld from you as a penalty for saying no.
Who can see what you share
Visibility is a choice you make per item. Every visit, every note, every photo and video, every saved place and every list carries its own setting, which you choose when you create it and can change afterwards. Two photos on the same visit can sit at different settings, and so can a note and the visit it belongs to.
The four settings are:
Only me: nobody else, whatever anyone else can see of the place it belongs to.
Friends: people whose friend request you accepted, or who accepted yours.
Followers: people who follow you.
Public: any Dawzr user.
Reaching specific named people works through two separate mechanisms rather than through the setting above. You can add or invite named accounts to a list, which gives those people access to that list and to what you contributed to it. And you can send a share link, which gives whoever holds it access to the one thing you shared.
Three more things worth knowing:
A share link can go to anyone, and your settings still decide what opens. A share link is an unguessable web address, and opening it requires a Dawzr account. Two things have to hold for the person who opens it to see anything: the content is still there, and your settings allow that person to see it. Where either one fails, they get a message saying the content is not available. The same applies inside a shared list, where each contributor's own visits, notes and photos stay under their own settings. Anyone you send a link to can pass it on, so treat it the way you would treat a link to an unlisted video. You can see how many distinct people opened it.
A shared list does not open up everything on it. When several people build a list together, everyone sees the places. Each contributor's own visits, notes and photos still follow that contributor's own settings and their relationship to whoever is looking. Being on a list with someone grants no blanket access to their content.
Your profile has its own visibility setting, separate from the visibility of your content.
You can block another account at any time. A block works both ways: they lose access to your content and theirs stops appearing to you, across feeds, lists and suggestions alike. Blocking applies to an account rather than to a single post.
To flag content rather than an account, write to support@dawzr.com and we will look at it. An in-app way to report a specific item is on the way; until it ships, email is the route.
What we do not do
We do not sell your personal data, and we do not share it for anyone else's marketing.
We do not run advertising in Dawzr, and we do not build advertising profiles.
We do not track you across other apps and websites, and we use no advertising identifiers.
We do not read your location while the app is in the background.
We do not read your contacts, your calendar, or health data.
We do not use your content to train third-party AI models.
Who else processes your data
Everyone below works on our instructions under a written data processing agreement, on the data needed for the stated job and no more.
Recipient
What they do for us
What they receive
Where
A cloud infrastructure provider
Servers and media storage
All application data and uploaded media
Amsterdam, Netherlands
Cloudflare
TLS termination, CDN, protection against attack
Connection data, IP, requests in transit
Global network, EU entity, SCCs
A maps and geocoding provider
Maps, geocoding, place search, address suggestions
The coordinates or search text of a request
Netherlands, EU
Google Maps Platform
Place details and photos
Place identifiers and search terms
Google Ireland, EU-US DPF for any US transfer
Google Cloud Vision
Recognising the place shown in a video you pasted
Images from that video
Google Ireland, EU-US DPF for any US transfer
Firebase Cloud Messaging (Google)
Delivering push notifications
Device push token, notification content
Google Ireland, EU-US DPF for any US transfer
OpenAI
Turning your free-text bio into a numeric representation
The bio text only
United States, EU-US DPF and SCCs
PostHog
Product analytics
Usage events, opaque user id, device platform
PostHog EU Cloud, Frankfurt, Germany
An error-reporting provider
Crash and error reporting
Stack traces, device and app version, user id, IP
EU region, Germany
An email delivery provider
Sending transactional email
Your email address and the message
Belgium
Apple, Google
Distributing the app, in-app purchases
Whatever their own policies describe
Their own terms apply
We also disclose data outside that list in three situations: when the law requires it and the request is valid and proportionate; when it is needed to establish, exercise or defend a legal claim; and if Dawzr is ever merged with or acquired by another company, in which case we will tell you before your data moves and you will be able to delete your account first.
Where your data lives, and transers outside the EEA
The database, the media store and the application servers are in the European Union. Email is sent from Belgium. Analytics and crash reporting run on European instances of the providers named in section 8.
Three recipients can involve a transfer outside the EEA:
OpenAI, for the profile bio embedding. Covered by the EU-US Data Privacy Framework and by Standard Contractual Clauses.
Google, for Maps, Cloud Vision and push messaging. Contracted through Google Ireland; any onward transfer to the United States is covered by the EU-US Data Privacy Framework.
Cloudflare, whose network is global by design and may route a request through a node outside the EEA. Covered by Standard Contractual Clauses.
For each of these we have carried out a transfer assessment and rely on the safeguards named. Ask at privacy@dawzr.com for a copy of the clauses.
How long we keep your data
Data
Kept for
Account and profile
Until you delete your account
Places, visits, lists, notes, reactions, media
Until you delete them, or until you delete your account
Email verification code
Until used, or 30 minutes
Password reset code
30 minutes, and 10 minutes more once verified
Session refresh token
30 days, or until you sign out
Push notification token
Until you turn notifications off, sign out, or delete your account
Share link view records
Until the shared content or the account is deleted
Online-presence records
Cleared nightly once stale
Place photos nobody references
Cleared nightly
Product analytics
12 months
Crash and error reports
90 days
Server logs
30 days
Backups
30 days, rolling
Support correspondence
2 years after the conversation closes
Records we must keep by law, or need for a legal claim
For as long as the obligation or the claim runs
Inactive accounts: if you have not opened Dawzr for 24 months we will email you. If you do not come back within 12 months of that email, we delete the account.
Deletion is real. When you delete your account, the deletion runs immediately as a single transaction across every place your data is held: your places, visits, lists, notes, reactions, social connections, share records and account are removed, and your uploaded media is deleted from storage. It is not a flag, not an archive, and not a 30-day grace period, so we cannot undo it.
What you put on other people's lists goes with it: a place you added to a list belonging to someone else is removed from that list when your account goes. The one exception is a list you own together with somebody: that list survives because another owner remains, and the places you added to it stay on the list with your name no longer attached to them. Everything else you made stays yours to the end, so your visits, notes, photos and videos are deleted wherever they appeared.
Backups age out on the cycle in the table above.
You can delete your account from Settings in the app, or at dawzr.com/support/account/delete.
Your rights
Under the GDPR you have the right to:
Access the personal data we hold about you, and get a copy.
Rectify anything inaccurate or incomplete. Most of it you can edit in the app directly.
Erase your data. Deleting your account does this in full and immediately.
Restrict processing while a dispute about accuracy or legitimacy is resolved.
Object to processing based on legitimate interests, including the profiling in section 3.3.
Portability: receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible.
Withdraw consent at any time, for anything we do on the basis of consent.
Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We make no such decisions.
Write to privacy@dawzr.com. We answer within one month, and will tell you if we need to extend that by up to two more months because the request is complex. There is no charge. We may ask you to confirm your identity if the request comes from an address we cannot tie to the account, and we will ask for no more than we need to be sure.
If you are unhappy with how we handled it, you can lodge a complaint with the Belgian data protection authority, or with the authority where you live or work:
Gegevensbeschermingsautoriteit / Autorité de protection des données Drukpersstraat 35, 1000 Brussel, Belgium +32 (0)2 274 48 00 · contact@apd-gba.be · www.gegevensbeschermingsautoriteit.be
We would rather you came to us first, and we read every message that arrives at privacy@dawzr.com.
Personalisation and automated processing
Dawzr ranks what it shows you rather than showing everything in the order it arrived. The inputs are described in section 3.3: places you saved, vibes you gravitate to, where you are, and what is popular nearby. The output is the order of a feed and a set of suggestions.
Nothing about this decides anything about you. It has no legal effect, it changes no price, it grants and withholds no access. It changes, for example, which restaurant appears third instead of ninth.
You can object to it under Article 21 by writing to privacy@dawzr.com, and you can reduce it yourself by turning location off, which removes the strongest personalisation signal.
Storage on your device, cookies and similar technologies
In the app, Dawzr stores on your device: your session tokens (in the operating system's secure storage), your last known position, your preferences, and a local copy of your content that keeps parts of the app working offline. All of it is necessary for the app to function, and all of it goes when you sign out or uninstall.
The analytics described in section 3.2 also write an identifier to your device. That happens only if you have agreed to analytics, and you can withdraw at any time in Settings.
On dawzr.com, we use cookies that are necessary to serve and secure the site. We set no advertising cookies and no cross-site tracking cookies. Where the law requires consent for a cookie, we ask before setting it.
Age
Dawzr is for people aged 16 and over. You agree to that when you accept the Terms of Service, and the date of birth on your profile is checked against it. We do not knowingly collect data from anyone younger. If you believe a child has an account, write to privacy@dawzr.com and we will delete it.
Sixteen is our own floor rather than a legal minimum. The age at which someone can agree to a service like this on their own varies across the EU, from 13 in Belgium to 16 in several other member states. Setting ours at 16 means the answer is the same wherever you live.
How we protect your data
Your password is never stored in readable form. We keep only a salted one-way hash produced by an algorithm built for password storage and deliberately slow to compute, which means we cannot recover your password and neither can anyone who obtains the stored value. We review that choice against current practice and will change it when better becomes standard.
Traffic between the app and our servers is encrypted in transit, and the leg from our public edge to our own servers runs through a separate encrypted tunnel rather than the open internet. Signing in gives your device a short-lived access credential and a separate longer-lived one used only to renew it, both held in the operating system's secure storage rather than in ordinary app storage. Access to production data is limited to the people who need it to run the service.
Deleting your account is all-or-nothing by design: it either removes everything or leaves your data untouched so the deletion can be retried. There is no state in which you are left half deleted.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Belgian data protection authority within 72 hours, and we will tell you directly if the risk to you is high.
Changes to this policy
We update this policy when what we do changes. The date at the top always shows the current version. For a change that materially affects you, we will tell you in the app or by email before it takes effect, and where the change needs your consent we will ask for it rather than assume it.
Contact
Privacy questions and rights requests
privacy@dawzr.com
Everything else
support@dawzr.com
Post
Atane BV, Meiweg 8, 9870 Zulte, Belgium
