Owner and Data Controller

Owner contact email: usama.khan@bromio.com

Type of Data we collect

The categories of Personal Data confirmed in the current Bromio Flutter app are described in the dedicated sections below.

Complete details on each type of Personal Data collected are provided in the dedicated sections of this privacy policy or by specific explanation texts displayed prior to the Data collection.

Personal Data may be freely provided by the User, or, in case of Usage Data, collected automatically when using this Application.

Unless specified otherwise, all Data requested by this Application is mandatory and failure to provide this Data may make it impossible for this Application to provide its services. In cases where this Application specifically states that some Data is not mandatory, Users are free not to communicate this Data without consequences to the availability or the functioning of the Service.

Users who are uncertain about which Personal Data is mandatory are welcome to contact the Owner.

Any use of Cookies – or of other tracking tools — by this Application or by the owners of third-party services used by this Application serves the purpose of providing the Service required by the User, in addition to any other purposes described in the present document and in the Cookie Policy.

Users are responsible for any third-party Personal Data obtained, published or shared through this Application.

Current Bromio Flutter app scope

The following app-specific sections describe data practices confirmed in the current Bromio Flutter app.

Further details about payments, shipping, checkout, website cookies and backend infrastructure will be expanded after separate audits. This version does not assign unconfirmed practices from those systems to the Flutter app.

Bromio Shop

When users access the Bromio Shop, Bromio may process account information, product searches, cart contents, purchase identifiers, purchased items, quantities, prices and total amounts in order to provide Shop functionality, checkout and purchase confirmation. The Shop may also use first-party cookies and browser storage for authentication, session restoration, cart management and checkout confirmation. Shipping information entered during checkout may be temporarily processed in the browser; its permanent storage and transmission are subject to the final checkout implementation. The current audited Shop does not confirm that Bromio receives full card details, bank credentials or PayPal passwords. Shop data linked to an account is covered by Bromio’s 30-day deletion process, except where retention is required for legal, tax, accounting, security or fraud-prevention purposes.

Account and authentication data

Bromio processes:

• first name
• optional last name
• email address
• password and password-recovery credentials
• date of birth
• optional pronouns
• optional current position
• optional country
• profile name
• optional profile headline
• Bromio user ID
• access token
• refresh token
• session-expiry information

This information is used for:

• creating and managing accounts
• authentication
• session restoration
• password recovery
• providing the initial public Profile
• securing access to Bromio services

Passwords are transmitted for authentication but are not persistently stored by the Flutter app.

Device and installation information

Bromio processes:

• a randomly generated installation UUID
• device type, such as Android or iOS
• device name and model information
• notification permission status
• app and operating-system information where collected automatically by Firebase services

The installation UUID is generated for the app installation and is not described as a hardware identifier.

This information is used for:

• account and device registration
• security
• session management
• push-notification delivery
• diagnosing crashes and technical problems

Profiles

Users may create Profiles containing:

• Profile name
• Profile type
• headline
• image
• public or hidden status
• ordered Profile elements
• associated Content
• associated collections

Profiles are user-generated and may be shared with other Bromio users through Encounters or public Profile links.

Content and uploaded images

Users may create Content containing:

• labels
• descriptions
• privacy settings
• text
• dates
• email addresses
• phone numbers
• links
• manually entered locations
• images
• Bromicon references
• Profile and collection associations

Image uploads may be selected from the device camera or photo library and may be cropped or compressed before upload.

Bromio does not currently collect arbitrary documents or video uploads through the Flutter app.

Encounters and sharing

Bromio processes:

• Encounter IDs
• connection relationships
• other users’ visible Profile information
• shared Profiles
• timestamps
• unread status
• collection membership
• pinned, muted or blocked settings
• last-message previews and related metadata

Encounters allow users to connect and exchange selected Profile information.

The effect of deleting an Encounter on the other participant’s data requires backend confirmation.

Chat and communications

Bromio processes:

• message text
• image messages and captions
• sender and recipient identifiers
• Encounter ID
• message ID
• reply references
• timestamps
• delivery, read, edit and deletion metadata
• temporary client identifiers
• active-room or presence information

No client-side end-to-end encryption implementation was found.

This policy does not make claims about server-side encryption or permanent message deletion; those matters require backend confirmation.

Bromicons

Bromio processes:

• owned Bromicon identifiers
• quantities
• acquisition dates
• names, types and formats
• ownership and transfer information
• recipients and transferred quantities

This information is used to display, manage and transfer Bromicons.

Collections and search activity

Bromio processes:

• user-created collection or folder names
• associations between collections and Profiles, Content, Encounters or Bromicons
• search terms
• filter choices
• sort choices
• pagination parameters

This information is used to organize and retrieve user data.

Push notifications

For push notifications, Bromio processes:

• Firebase Cloud Messaging registration token
• APNs-related notification identifiers through Firebase on iOS
• notification permission status
• notification preferences
• notification title, body, image URL and routing identifiers where included in the payload
• notification read or open state where applicable

Push delivery uses Google Firebase Cloud Messaging and Apple Push Notification Service. Payload content depends on the notification type and backend configuration; not every push payload contains message text.

Analytics, crash reporting and diagnostics

The app uses:

• Firebase Crashlytics
• Firebase Sessions
• Firebase Installations
• Google Analytics for Firebase on Android, subject to current configuration

These services may process:

• crash reports
• stack traces
• app version
• operating-system version
• device model and architecture
• Firebase installation identifiers
• session metadata
• app interaction and device metadata where Analytics is enabled

Actual platform configuration may differ and is subject to verification. This policy does not state that Analytics is disabled globally on iOS.

Google Fonts and technical requests

The app uses Google Fonts and may download font files at runtime.

Google may receive standard network request information such as:

• IP address
• user agent
• request metadata

This does not imply that the request is linked to a Google account.

Local storage and caching

The app stores or caches:

• authentication tokens in secure storage
• installation UUID
• theme and language preferences
• notification settings
• image caches
• temporary image files
• font caches
• WebView authentication cookies
• short-lived Shop authentication information

Some local data is cleared on logout or account deletion, while general preferences and some caches may remain on the device.

QR codes and sharing

Bromio processes:

• public Profile URLs
• scanned QR values
• generated QR images

Users may save or share QR codes through operating-system features and selected third-party apps.

Camera frames used for QR scanning are not sent to Bromio by the Flutter code.

Permissions

The app may request:

• Camera — for QR scanning and optional image capture
• Photos/media — for selecting Profile, Content and Chat images and saving QR codes
• Notifications — for push notifications

No microphone, contacts, calendar, health, SMS, call-log or device-location permission was found in the current Flutter app.

Service providers confirmed in the Flutter app

The current Flutter app uses the following confirmed services and infrastructure:

• Google Firebase Cloud Messaging
• Firebase Crashlytics
• Firebase Sessions
• Firebase Installations
• Google Analytics for Firebase on Android
• Apple Push Notification Service
• Google Fonts
• Google ML Kit barcode components
• Bromio’s own API, socket and Shop infrastructure

Provider processing, including any international processing, is subject to the relevant provider configuration and terms. Specific international transfer mechanisms are not stated here because they require separate confirmation.

App retention and deletion controls

Retention

Data is retained as long as necessary for the relevant service and legal obligations. The confirmed 30-day recovery rules for account deletion and recycle-bin items are described below.

Crash, analytics and service-provider retention may be governed by the provider’s settings and terms.

Account deletion and recovery

When a user requests deletion of their Bromio account, the account enters a 30-day recovery period. During this period, the account is scheduled for deletion, is not yet permanently deleted and normal access may be restricted.

If the user attempts to log in during the recovery period, Bromio displays an account-restoration screen. The user may choose to restore the account and regain access to the account and its recoverable data. If the user declines restoration, the account remains scheduled for deletion.

Restoration is optional. No further action is required from the user after requesting deletion. If the user makes no restoration attempt, or does not restore the account, the account is automatically permanently deleted after the 30-day recovery period expires.

Account deletion includes the user’s associated account data, Profiles, Content, Encounters, Chat data, notifications and notification records, authentication and push tokens, Bromicons and related account ownership records, Shop data and purchase records. This does not include information that Bromio must retain for tax or accounting obligations, regulatory requirements, fraud prevention, security, dispute handling, or the establishment, exercise or defence of legal claims.

Account deletion includes the deleting user’s Chat data after the 30-day account-recovery period. It does not necessarily remove copies already delivered to another participant, screenshots, exported information or notification content already displayed on another device.

Profiles, Content, Encounters and Bromicons

When a user deletes a Profile, Content item, Encounter or Bromicon record, the item is moved to the applicable recycle bin and remains recoverable for 30 days.

During this period, the user may restore the item. If the item is not restored, it is automatically permanently deleted after the 30-day recovery period.

Deleting an Encounter does not necessarily delete another participant’s independent copy, received data, Chat history or information already shared with or retained by that participant.

Local data and sessions

When account deletion is requested, the app may clear local authentication data and end the current session. If the account is restored, the user may need to authenticate again.

General device preferences and operating-system-managed caches may remain until cleared by the user, the app or the operating system.

Remaining retention questions

Backup rotation and deletion remain subject to confirmation. Third-party service-provider retention may be governed by the provider’s settings and terms. Information independently shared, received, exported or retained by another person is not necessarily removed when the user’s account or an item is deleted.

Mode and place of processing the Data

Methods of processing

The Owner takes appropriate security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Data.

The Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to the Owner, in some cases, the Data may be accessible to certain types of persons in charge, involved with the operation of this Application (administration, sales, marketing, legal, system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by the Owner. The updated list of these parties may be requested from the Owner at any time.

Place

The Data is processed at the Owner's operating offices and in any other places where the parties involved in the processing are located.

Depending on the User's location, data transfers may involve transferring the User's Data to a country other than their own. To find out more about the place of processing of such transferred Data, Users can check the section containing details about the processing of Personal Data.

Retention time

Unless specified otherwise in this document, Personal Data shall be processed and stored for as long as required by the purpose they have been collected for and may be retained for longer due to applicable legal obligation or based on the Users’ consent.

Cookie Policy

This Application uses Trackers. To learn more, Users may consult the Cookie Policy.

Further Information for Users in the European Union

Legal basis of processing

The Owner may process Personal Data relating to Users if one of the following applies:

• Users have given their consent for one or more specific purposes.
• provision of Data is necessary for the performance of an agreement with the User and/or for any pre-contractual obligations thereof;
• processing is necessary for compliance with a legal obligation to which the Owner is subject;
• processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Owner;
• processing is necessary for the purposes of the legitimate interests pursued by the Owner or by a third party.

For the current Flutter app, the applicable legal basis may include:

• performance of the contract for account, Profile, Content, Encounter, Chat and Bromicon functionality;
• consent where required for optional permissions and certain processing;
• legitimate interests for security, fraud prevention, diagnostics and service improvement;
• legal obligations where applicable.

The exact legal basis may depend on the specific processing activity.

In any case, the Owner will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

Further information about retention time

Unless specified otherwise in this document, Personal Data shall be processed and stored for as long as required by the purpose they have been collected for and may be retained for longer due to applicable legal obligation or based on the Users’ consent.

Therefore:

• Personal Data collected for purposes related to the performance of a contract between the Owner and the User shall be retained until such contract has been fully performed.
• Personal Data collected for the purposes of the Owner’s legitimate interests shall be retained as long as needed to fulfill such purposes. Users may find specific information regarding the legitimate interests pursued by the Owner within the relevant sections of this document or by contacting the Owner.

The Owner may be allowed to retain Personal Data for a longer period whenever the User has given consent to such processing, as long as such consent is not withdrawn. Furthermore, the Owner may be obliged to retain Personal Data for a longer period whenever required to fulfil a legal obligation or upon order of an authority.

Once the retention period expires, Personal Data shall be deleted. Therefore, the right of access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after expiration of the retention period.

The confirmed 30-day account-recovery and recycle-bin rules are described in the App retention and deletion controls section above. Backup retention, third-party service-provider retention and the effect of deletion on information independently retained by other users remain subject to confirmation. Bromio does not promise deletion of information it is legally required to retain.

The rights of Users based on the General Data Protection Regulation (GDPR)

Users may exercise certain rights regarding their Data processed by the Owner.

In particular, Users have the right to do the following, to the extent permitted by law:

• Withdraw their consent at any time. Users have the right to withdraw consent where they have previously given their consent to the processing of their Personal Data.
• Object to processing of their Data. Users have the right to object to the processing of their Data if the processing is carried out on a legal basis other than consent.
• Access their Data. Users have the right to learn if Data is being processed by the Owner, obtain disclosure regarding certain aspects of the processing and obtain a copy of the Data undergoing processing.
• Verify and seek rectification. Users have the right to verify the accuracy of their Data and ask for it to be updated or corrected.
• Restrict the processing of their Data. Users have the right to restrict the processing of their Data. In this case, the Owner will not process their Data for any purpose other than storing it.
• Have their Personal Data deleted or otherwise removed. Users have the right to obtain the erasure of their Data from the Owner.
• Receive their Data and have it transferred to another controller. Users have the right to receive their Data in a structured, commonly used and machine readable format and, if technically feasible, to have it transmitted to another controller without any hindrance.
• Lodge a complaint. Users have the right to bring a claim before their competent data protection authority.

Users are also entitled to learn about the legal basis for Data transfers abroad including to any international organization governed by public international law or set up by two or more countries, such as the UN, and about the security measures taken by the Owner to safeguard their Data.

Details about the right to object to processing

Where Personal Data is processed for a public interest, in the exercise of an official authority vested in the Owner or for the purposes of the legitimate interests pursued by the Owner, Users may object to such processing by providing a ground related to their particular situation to justify the objection.

Users must know that, however, should their Personal Data be processed for direct marketing purposes, they can object to that processing at any time, free of charge and without providing any justification. Where the User objects to processing for direct marketing purposes, the Personal Data will no longer be processed for such purposes. To learn whether the Owner is processing Personal Data for direct marketing purposes, Users may refer to the relevant sections of this document.

How to exercise these rights

Any requests to exercise User rights can be directed to the Owner through the contact details provided in this document. Such requests are free of charge and will be answered by the Owner as early as possible and always within one month, providing Users with the information required by law. Any rectification or erasure of Personal Data or restriction of processing will be communicated by the Owner to each recipient, if any, to whom the Personal Data has been disclosed unless this proves impossible or involves disproportionate effort. At the Users’ request, the Owner will inform them about those recipients.

Additional information about Data collection and processing

Legal action

The User's Personal Data may be used for legal purposes by the Owner in Court or in the stages leading to possible legal action arising from improper use of this Application or the related Services.

The User declares to be aware that the Owner may be required to reveal personal data upon request of public authorities.

Additional information about User's Personal Data

In addition to the information contained in this privacy policy, this Application may provide the User with additional and contextual information concerning particular Services or the collection and processing of Personal Data upon request.

System logs and maintenance

For operation and maintenance purposes, this Application and any third-party services may collect files that record interaction with this Application (System logs) or use other Personal Data (such as the IP Address) for this purpose.

Information not contained in this policy

More details concerning the collection or processing of Personal Data may be requested from the Owner at any time. Please see the contact information at the beginning of this document.

Changes to this privacy policy

The Owner reserves the right to make changes to this privacy policy at any time by notifying its Users on this page and possibly within this Application and/or - as far as technically and legally feasible - sending a notice to Users via any contact information available to the Owner. It is strongly recommended to check this page often, referring to the date of the last modification listed at the bottom.

Should the changes affect processing activities performed on the basis of the User’s consent, the Owner shall collect new consent from the User, where required.

Definitions and legal references

How can we help?

What you can do

Your data

• Ask us to know and access the information we hold on you
• Ask us to correct information we hold on you
• Ask us to be forgotten (delete the information we hold on you)
• Ask to port your data to another service

In case of issues

While we strive to create a positive user experience, we understand that issues may occasionally arise between us and our users.

If this is the case, please feel free to contact us.

Contact us

Footer

Bromio

Owner contact email: usama.khan@bromio.com