How Galomira handles your data

Galomira is operated by Aegeon Studios ("Galomira," "we," "us"). This policy explains what personal data we collect across our iOS, Android, and web apps, why we collect it, who we share it with, the countries you may be using Galomira from, and the choices and rights you have. Last updated 7 August 2026.

Data we collect

Account & profile

Email address and password (or Apple/Google sign-in identifier), used for authentication
Display name, username, bio, profile photo, and any Instagram/Snapchat/Facebook handles you choose to add
The neighborhood(s) you belong to, and your membership status and role

Residency verification

A single device location reading (latitude/longitude, accuracy in meters, a flag indicating whether the location was detected as mock/spoofed, and the time it was captured), taken once when you request to join a neighborhood
An address derived from that reading (street/district/city/country) generated for the reviewing moderator, using OpenStreetMap's Nominatim service
This data is visible only to the moderators/administrators reviewing your request — never to other residents

Content you create

Posts, comments, and reactions, and any photos/videos you attach to them
Direct messages you send to other residents
Marketplace and service listings, including any pickup address you choose to add for a listing
Events you create or RSVP to
Reports you file about other content or accounts

Payments (advertisers only)

If you purchase a neighborhood ad campaign, payment is handled entirely by Stripe — Galomira never receives or stores your card details

Device & technical data

Standard server logs (IP address, request timestamps, device/browser type) generated by our hosting providers as part of normal operation
On mobile, the app version, OS and OS version, and device model your requests come from, so we can keep the app working correctly across devices
We do not use any third-party analytics, advertising, or tracking SDKs in the app — we only see what's needed to run the service

Why we process it, and on what basis

Operating the service

Creating your account, showing you your neighborhood's feed, letting you post, message, and use the marketplace/services/events features.

Legal basis: Necessary to perform our contract with you (our Terms).

Verifying neighborhood residency

Confirming that a membership request comes from someone who genuinely lives near the neighborhood being requested, so admission decisions are fair to existing residents.

Legal basis: Your explicit action of granting the device location permission, and our legitimate interest in the integrity of neighborhood membership.

Trust & safety

Reviewing reports, moderating content, detecting abuse, and where required by law, reporting confirmed child sexual abuse material (CSAM) to the relevant authorities — see our Child Safety Standards.

Legal basis: Legitimate interest in keeping the platform safe, and legal obligation where applicable.

Communicating with you

Sending notification emails (for example, when someone replies to your comment) and responding to support requests.

Legal basis: Necessary to perform our contract with you, or your consent for optional notifications.

Advertising (advertisers only)

Processing payment for and displaying neighborhood ad campaigns.

Legal basis: Necessary to perform our contract with the advertiser.

Keeping our own records straight

Staff with database access (for example, to fix a bug or investigate a safety report) may be able to technically view content such as messages. We limit who has this access, log administrative access to production data, and only use it for a specific operational, safety, or legal purpose — never to read content out of curiosity.

Legal basis: Legitimate interest in operating and securing the platform.

Automated decisions

We don't use fully automated decision-making that produces legal or similarly significant effects about you. Your feed is ordered by simple, transparent rules (like recency and your neighborhood selection), and every membership decision is made by a human moderator — we don't auto-approve or auto-reject residency requests by algorithm.

Cookies & similar technologies

Strictly necessary — session cookies

When you sign in on galomira.com, our authentication provider (Supabase) sets a first-party cookie that keeps you signed in between page loads. Without it, the web app cannot function, so it is not switched off by a cookie banner.

No advertising or analytics cookies

We do not run any analytics, advertising, or cross-site tracking scripts on galomira.com or in the mobile apps, so there is nothing else to opt out of today. If that changes, we'll update this section and, where required, ask for your consent first.

Who we share data with

We do not sell your personal data, and we do not share it with advertisers or other residents beyond what you choose to post publicly. We use the following service providers to operate Galomira, each acting under our instructions:

Supabase

Database, authentication, and file storage. Hosted in the EU (Frankfurt, Germany).

Vercel

Hosting for the galomira.com web application.

Resend

Delivery of transactional emails (e.g. reply notifications).

Stripe

Payment processing for ad campaign purchases.

OpenStreetMap (Nominatim)

Converts coordinates into neighborhood boundaries and, for moderators reviewing a residency request, into a readable address.

Apple / Google

If you choose "Sign in with Apple" or "Continue with Google," these platforms authenticate you and share your name/email with us as authorized by you.

We may also disclose personal data where we have a good-faith belief it's required to comply with a valid legal request (such as a court order), to enforce our Terms of Service, or to protect the rights, property, or safety of Galomira, our residents, or the public — for example, reporting confirmed CSAM as described in our Child Safety Standards. If Galomira is ever involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction, subject to the protections in this policy.

International data transfers

Our database is hosted in the EU (Frankfurt, Germany) via Supabase. Galomira is available in 38 countries, so for most residents, using Galomira means your data stays within the EU/EEA where it's processed. For residents located outside the EEA — including Türkiye, the UK, and Switzerland — this means your personal data is transferred to and processed in the EU. Where applicable, we rely on the legal transfer mechanisms recognized under your local law (such as the EU Standard Contractual Clauses, the UK's International Data Transfer Addendum, or your explicit consent) to cover these transfers. See Jurisdiction-specific information below for what this means depending on where you are.

How long we keep it

We keep your account and content for as long as your account is active. Residency verification evidence (your location reading and derived address) is kept only for as long as needed to review your membership request and to handle any follow-up dispute about that decision — it is not used for any other purpose. When you delete your account (immediately, or on your scheduled date), we anonymize your profile, remove your uploaded media, and soft-delete your posts and comments. Direct messages you sent remain in the recipient's inbox but are no longer linked to your identity — see our Account Deletion page for full detail.

Your rights

Access the personal data we hold about you
Correct inaccurate data (most of this you can do yourself from your profile)
Delete your account and associated data — see our Account Deletion page
Object to or restrict certain processing, including processing based on legitimate interest
Request a copy of your data in a portable format
Withdraw consent at any time where processing is based on consent (e.g. by not granting the location permission — note that this means you won't be able to complete residency verification)
Lodge a complaint with your local data protection authority

To exercise any of these rights, email us at the address below. We may need to verify your identity before acting on your request. We aim to respond within one month, as required under GDPR — where local law sets a different deadline (for example, 30 days under Turkish KVKK), we follow that instead.

Jurisdiction-specific information

Galomira is available across many countries, and the rules that apply to your data can vary a little depending on where you live. The baseline protections above apply to everyone; the notes below add anything specific to your region.

European Economic Area & United Kingdom

If you're in the EEA or the UK, the EU GDPR (and, for the UK, the UK GDPR) gives you the rights listed above, plus the right to lodge a complaint with your national supervisory authority (for example, the Datainspektionen/IMY in Sweden, or the ICO in the UK) at any time.

Switzerland

If you're in Switzerland, your personal data is protected under the Federal Act on Data Protection (FADP). You have broadly the same access, correction, deletion, and objection rights described above, and you can contact the Federal Data Protection and Information Commissioner (FDPIC) with concerns.

Türkiye

If you're in Türkiye, the Personal Data Protection Law No. 6698 (KVKK) applies. Under Article 11 KVKK you have the right to learn whether we process your data, request access and correction, request deletion, object to results produced by automated analysis alone, and seek compensation for damage from unlawful processing. Because our database is hosted in the EU, using Galomira from Türkiye involves a cross-border transfer of your data outside Türkiye; by creating an account you consent to this transfer, which you can withdraw at any time by deleting your account. You may apply to us directly first (see Contact, below); if you're not satisfied with our response, you may complain to the Kişisel Verileri Koruma Kurumu (Turkish Personal Data Protection Authority).

Other countries

Galomira operates in several additional countries whose local data protection laws are generally modeled on the frameworks above. Wherever you are, the rights described in "Your rights" apply to you as a baseline, and you're welcome to contact us with any question about how local law affects your data.

Children

Galomira is not directed at children, and residents must be at least 16 years old to create an account. See our Child Safety Standards for more.

Security

We encrypt data in transit (HTTPS/TLS) and restrict access to your data using row-level database security, so that only the right people (you, or moderators reviewing a specific request) can see it. Internal access to production data is limited to a small number of people and used only for legitimate operational, safety, or legal purposes. No system is completely secure, but we take reasonable technical and organizational measures to protect your information.

Who is responsible for your data

Aegeon Studios is the data controller responsible for your personal data under this policy. [Registered company address and country to be added here — if Galomira has no establishment in the EU/UK, an EU/UK representative under GDPR Art. 27 / UK GDPR may also need to be appointed and listed here.] We have not appointed a formal Data Protection Officer at this stage of the company; direct any privacy question or request to the contact below and it will reach the person responsible for handling it.

Changes to this policy

If we make material changes to this policy, we'll update the date above and, where appropriate, notify you in the app before the change takes effect.

Questions about this policy, or a request about your data? Email support@galomira.com